consume only artifacts the runtime produced

tile_manifest_path arrives in the detection and segmentation request and was
read straight off disk, and a manifest entry may name an absolute tile path.
That makes an API field an unbounded reference to the host filesystem, and it
contradicts the rule the persistence model rests on: only a governed,
runtime-produced artifact may be consumed, and a file outside the storage root
is not one.

Both the manifest and every tile it names now resolve under STORAGE_ROOT.
Resolution happens before the comparison, so ".." cannot climb out and a
sibling that merely shares a name prefix does not pass.
GEOINTEL_ALLOW_EXTERNAL_ARTIFACT_PATHS opts out for provisioning workflows that
stage tiles before ingest.

The check honours the Settings the caller is operating under rather than the
process-wide ones, because every analysis path already threads its own.

The affected tests write manifests into tmp_path, so they now declare tmp_path
as the storage root — which is what a deployment does, and makes the fixtures
more honest than they were.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/app/services/detection_service.py

@@ -29,6 +29,7 @@ from app.services.model_asset_catalog_service import ModelAssetCatalogService
 from app.services.model_registry_service import ModelRegistryService
 from app.services.model_validation_scope_service import ModelValidationScopeService
 from app.services.qa_service import QaService
+from app.services.storage_service import StorageService
 from app.services.quality_service import QualityService
 from app.services.runtime_model_provenance_service import RuntimeModelProvenance, RuntimeModelProvenanceService
 from app.services.temporal_compatibility_service import TemporalCompatibilityService
@@ -450,7 +451,7 @@ class DetectionService:
 
         coverage = None
         if manifest_path:
-            manifest = DetectionService._load_tile_manifest(manifest_path, resolved_settings.yolo_max_tiles)
+            manifest = DetectionService._load_tile_manifest(manifest_path, resolved_settings.yolo_max_tiles, resolved_settings)
             coverage = DetectionQaService.build_tile_coverage(
                 manifest,
                 manifest_path=manifest_path,
@@ -942,7 +943,7 @@ class DetectionService:
         settings: Settings,
         yolo_adapter_class: Type[YoloDetectionAdapter],
     ) -> tuple[list[Detection], dict[str, Any]]:
-        manifest = DetectionService._load_tile_manifest(tile_manifest_path, settings.yolo_max_tiles)
+        manifest = DetectionService._load_tile_manifest(tile_manifest_path, settings.yolo_max_tiles, settings)
         model_path = Path(settings.yolo_model_path or "").expanduser()
         runtime_model_provenance = RuntimeModelProvenanceService.validate_for_production_runtime(
             db=db,
@@ -965,7 +966,7 @@ class DetectionService:
         raster_bounds = DetectionService._bounds_to_epsg4326(manifest.get("bounds"), manifest_crs)
         tiles = list(manifest["tiles"])
         tile_paths = [
-            DetectionService._resolve_tile_path(tile, Path(tile_manifest_path or "").expanduser()) for tile in tiles
+            DetectionService._resolve_tile_path(tile, Path(tile_manifest_path or "").expanduser(), settings) for tile in tiles
         ]
         # Batched so the GPU is not idle between tiles; each tile keeps its own
         # transform for georeferencing, so results stay per tile and in order.
@@ -1248,14 +1249,18 @@ class DetectionService:
         return 1.5 * max((right - left) / width, (top - bottom) / height)
 
     @staticmethod
-    def _load_tile_manifest(tile_manifest_path: str | None, max_tiles: int) -> dict[str, Any]:
+    def _load_tile_manifest(tile_manifest_path: str | None, max_tiles: int, settings: Settings | None = None) -> dict[str, Any]:
         if not tile_manifest_path:
             raise AppError(
                 code="DETECTION_TILE_MANIFEST_REQUIRED",
                 message="Configured YOLO inference requires an existing raster tile manifest path",
                 status_code=400,
             )
-        manifest_path = Path(tile_manifest_path).expanduser()
+        # The path arrives in the request, so it must name a governed artifact
+        # rather than an arbitrary file on the host.
+        manifest_path = StorageService.assert_within_storage_root(
+            tile_manifest_path, label="tile manifest", settings=settings
+        )
         if not manifest_path.exists() or not manifest_path.is_file():
             raise AppError(
                 code="DETECTION_TILE_MANIFEST_NOT_FOUND",
@@ -1280,13 +1285,16 @@ class DetectionService:
         return manifest
 
     @staticmethod
-    def _resolve_tile_path(tile: dict[str, Any], manifest_path: Path) -> Path:
+    def _resolve_tile_path(tile: dict[str, Any], manifest_path: Path, settings: Settings | None = None) -> Path:
         raw_path = tile.get("path")
         if not isinstance(raw_path, str) or not raw_path:
             raise AppError(code="DETECTION_TILE_MANIFEST_INVALID", message="Tile manifest entries require a path", status_code=422)
         tile_path = Path(raw_path).expanduser()
         if not tile_path.is_absolute():
             tile_path = manifest_path.parent / tile_path
+        # A manifest entry may name an absolute path; it is still only allowed
+        # to point at a tile the runtime itself produced.
+        tile_path = StorageService.assert_within_storage_root(tile_path, label="raster tile", settings=settings)
         if not tile_path.exists() or not tile_path.is_file():
             raise AppError(
                 code="DETECTION_TILE_NOT_FOUND",