hardening: record audit remediation boundaries

docs/HARDENING_2026-08-26.md

@@ -0,0 +1,76 @@
+# GeoIntel hardening — 2026-08-26
+
+This change set converts the 2026-08-26 repository audit into executable
+guardrails without widening any data-source or AI accuracy claim.
+
+## Implemented controls
+
+### Secure defaults
+
+- Guest access is opt-in instead of enabled by default.
+- Configured YOLO validation-scope enforcement is opt-out only in
+  non-production research/development contexts.
+- Production YOLO uses CUDA and an immutable validation-scope manifest; when
+  scope evidence is absent or invalid, inference fails closed rather than being
+  treated as validated.
+
+### Repository hygiene
+
+- `.codex-input/` and `.codex-artifacts/` are forbidden tracked paths.
+- Transient SQLite WAL/SHM files are forbidden.
+- A tracked-file size budget prevents large local scratch artifacts from
+  silently returning; governed accuracy evidence and presentation assets have
+  explicit narrow allowlists.
+- Cross-project DockDeck inputs and generated GeoIntel scratch artifacts are
+  removed from the current repository tree.
+
+Historical Git objects are intentionally not rewritten by this change. Purging
+old blobs requires a coordinated destructive history rewrite and force-update
+of every clone, so it is a separate operator decision.
+
+### Engineering quality
+
+- Repository architecture budgets turn the largest legacy modules into a
+  ratchet: they may shrink but may not grow.
+- Critical Python static checks and frontend source-policy linting are release
+  gates alongside the existing full tests, typecheck and build.
+- The source-policy gate forbids debugger statements, `@ts-ignore`, `eval()` and
+  dynamic `Function` construction without adding an unlocked npm dependency.
+
+A migration to ESLint 10 remains a dependency upgrade rather than being mixed
+into this hardening pass. ESLint 9 reached upstream end-of-life in August 2026.
+
+### Supply chain
+
+- External Actions are pinned to full commit SHAs.
+- External Docker base/runtime images are digest-pinned.
+- CI verifies those policies so mutable references cannot silently return.
+- Both GIS and AI release images are built, SBOMed and scanned under the same
+  vulnerability policy.
+
+### Deployment gating
+
+Tower autoredeploy is downstream of the successful `GeoIntel release gates`
+workflow on `main` and deploys the workflow's exact validated head SHA. A direct
+push can therefore no longer bypass release validation and immediately roll to
+production.
+
+## Explicit non-claims
+
+This hardening does **not**:
+
+- make the active building detector nationally validated;
+- replace the required geographically independent protected test and human
+  review evidence;
+- convert guest mode into tenant isolation;
+- convert the PostgreSQL/in-process worker model into a distributed queue;
+- purge historical Git objects;
+- alter official source semantics or CRS contracts.
+
+## External repository control
+
+Gitea branch protection for `main` is still required. The connected workspace
+can audit protection, create isolated branches, validate pull requests and merge
+them safely, but it does not expose a write operation for branch-protection
+rules. Until an administrator enables protection, the downstream validated
+deploy gate remains the compensating production control.