chore: prepare repository for public release

2026-08-31 07:23:03 +02:00
parent 03df2db8b6
commit e43d7aca68
164 changed files with 694 additions and 29691 deletions
@@ -142,14 +142,14 @@ exists without docs or when docs claim an endpoint that is not implemented.
 Verify the browser-facing Docker/LAN runtime:

 ```bash
-bash scripts/verify_browser_runtime.sh http://192.168.10.150:1202
-bash scripts/verify_gis_runtime.sh http://192.168.10.150:1202
+bash scripts/verify_browser_runtime.sh http://192.0.2.10:1202
+bash scripts/verify_gis_runtime.sh http://192.0.2.10:1202
 ```

 Verify the explicit demo workflow plus export artifact path:

 ```bash
-bash scripts/verify_demo_export_workflow.sh http://192.168.10.150:1202
+bash scripts/verify_demo_export_workflow.sh http://192.0.2.10:1202
 ```

 The demo/export smoke is intentionally mutating and idempotent: it seeds the
@@ -164,7 +164,7 @@ counts cannot drift silently.
 Verify the explicit demo raster workflow:

 ```bash
-bash scripts/verify_demo_raster_workflow.sh http://192.168.10.150:1202
+bash scripts/verify_demo_raster_workflow.sh http://192.0.2.10:1202
 ```

 The raster smoke is intentionally mutating and idempotent enough for local
@@ -177,7 +177,7 @@ Verify that the browser-facing workbench can populate the default demo start
 state through the frontend proxy:

 ```bash
-bash scripts/verify_workbench_default_state.sh http://192.168.10.150:1202
+bash scripts/verify_workbench_default_state.sh http://192.0.2.10:1202
 ```

 This smoke is dependency-light and intentionally idempotent: it seeds the
@@ -190,7 +190,7 @@ screenshot pass when checking visual layout or overflow.
 Verify the backing state for the core workbench interactions:

 ```bash
-bash scripts/verify_workbench_interactions.sh http://192.168.10.150:1202
+bash scripts/verify_workbench_interactions.sh http://192.0.2.10:1202
 ```

 This smoke validates the state behind project switching, AOI/map selection,
@@ -202,7 +202,7 @@ Verify the browser click handoff from raster tiling into Detection and
 Segmentation Lab:

 ```bash
-bash scripts/verify_ai_handoff_interactions.sh http://192.168.10.150:1202
+bash scripts/verify_ai_handoff_interactions.sh http://192.0.2.10:1202
 ```

 The AI handoff smoke seeds the explicit offline demo workflow, generates a
@@ -216,8 +216,8 @@ default. The main readiness gate checks this script's syntax only.
 Capture visual regression handoff screenshots for the workbench:

 ```bash
-bash scripts/capture_workbench_screenshots.sh http://192.168.10.150:1202
-CAPTURE_MOBILE=0 bash scripts/capture_workbench_screenshots.sh http://192.168.10.150:1202 /tmp/geointel-screens
+bash scripts/capture_workbench_screenshots.sh http://192.0.2.10:1202
+CAPTURE_MOBILE=0 bash scripts/capture_workbench_screenshots.sh http://192.0.2.10:1202 /tmp/geointel-screens
 ```

 The capture script seeds the explicit offline demo workflow, opens each main
@@ -262,7 +262,7 @@ weights or run prediction.
 Verify the full configured-YOLO model asset workflow against a running runtime:

 ```bash
-bash scripts/verify_model_asset_detection_workflow.sh http://192.168.10.150:1202
+bash scripts/verify_model_asset_detection_workflow.sh http://192.0.2.10:1202
 ```

 This smoke is intentionally mutating and requires a real AI-enabled runtime with
@@ -280,7 +280,7 @@ Verify the full operator-provided raster/reference detection and QA path:
 ```bash
 REAL_RASTER_PATH=/mnt/user/appdata/geointel/data/orthophoto.tif \
 REAL_REFERENCE_VECTOR_PATH=/mnt/user/appdata/geointel/data/reference-buildings.geojson \
-bash scripts/verify_real_data_detection_qa_workflow.sh http://192.168.10.150:1202
+bash scripts/verify_real_data_detection_qa_workflow.sh http://192.0.2.10:1202
 ```

 The current Tower operator sample is available at:
@@ -288,7 +288,7 @@ The current Tower operator sample is available at:
 ```bash
 REAL_RASTER_PATH=/mnt/user/appdata/geointel/storage/operator-data/geel_orthophoto_wms_512.tif \
 REAL_REFERENCE_VECTOR_PATH=/mnt/user/appdata/geointel/storage/operator-data/geel_grb_gbg_buildings.geojson \
-bash scripts/verify_real_data_detection_qa_workflow.sh http://192.168.10.150:1202
+bash scripts/verify_real_data_detection_qa_workflow.sh http://192.0.2.10:1202
 ```

 Reuse the definitive Mol municipality project for a bounded Mol-Centrum
@@ -303,7 +303,7 @@ REAL_AREA_BBOX='5.113116,51.189653,5.120284,51.194147' \
 REAL_DATASET_NAME_PREFIX='mol_center_ai_500m' \
 REAL_RASTER_PATH=/mnt/user/appdata/geointel/storage/operator-data/mol_orthophoto_wms_512.tif \
 REAL_REFERENCE_VECTOR_PATH=/mnt/user/appdata/geointel/storage/operator-data/mol_grb_gbg_buildings.geojson \
-bash scripts/verify_real_data_detection_qa_workflow.sh http://192.168.10.150:1202
+bash scripts/verify_real_data_detection_qa_workflow.sh http://192.0.2.10:1202
 ```

 `REAL_PROJECT_ID` is validated through the canonical project endpoint; it does
@@ -447,7 +447,7 @@ Run a confidence-threshold calibration sweep against the same real-data path:
 REAL_RASTER_PATH=/mnt/user/appdata/geointel/storage/operator-data/geel_orthophoto_wms_512.tif \
 REAL_REFERENCE_VECTOR_PATH=/mnt/user/appdata/geointel/storage/operator-data/geel_grb_gbg_buildings.geojson \
 CALIBRATION_THRESHOLDS="0.50 0.35 0.25 0.15" \
-bash scripts/run_detection_calibration_sweep.sh http://192.168.10.150:1202
+bash scripts/run_detection_calibration_sweep.sh http://192.0.2.10:1202
 ```

 The sweep reuses `verify_real_data_detection_qa_workflow.sh` once per
@@ -472,7 +472,7 @@ QUALITY_MODEL_ASSET_IDS="yolov8n-building-segmentation-pt yolov8n-pt" \
 QUALITY_TILE_SIZES="512 640" \
 QUALITY_TILE_OVERLAPS="64" \
 QUALITY_THRESHOLDS="0.50 0.15" \
-bash scripts/run_detection_quality_matrix.sh http://192.168.10.150:1202
+bash scripts/run_detection_quality_matrix.sh http://192.0.2.10:1202
 ```

 The quality matrix repeats the same real-data upload, tiling, configured-YOLO,
@@ -495,7 +495,7 @@ QUALITY_MODEL_ASSET_IDS="yolov8n-building-segmentation-pt yolov8n-pt" \
 QUALITY_TILE_SIZES="512 640" \
 QUALITY_TILE_OVERLAPS="64" \
 QUALITY_THRESHOLDS="0.50 0.15" \
-bash scripts/run_multi_sample_detection_quality_matrix.sh http://192.168.10.150:1202
+bash scripts/run_multi_sample_detection_quality_matrix.sh http://192.0.2.10:1202
 ```

 The multi-sample wrapper writes one per-sample `quality_matrix_summary.json`
@@ -841,7 +841,7 @@ QUALITY_TILE_SIZES="640" \
 QUALITY_TILE_OVERLAPS="64" \
 QUALITY_THRESHOLDS="0.25 0.15 0.05" \
 MULTI_SAMPLE_OUTPUT_DIR=artifacts/detection-quality-matrix/multi-sample/expanded160e50-live \
-bash scripts/run_multi_sample_detection_quality_matrix.sh http://192.168.10.150:1202
+bash scripts/run_multi_sample_detection_quality_matrix.sh http://192.0.2.10:1202
 ```

 The expanded 50-epoch candidate improved dense Geel/Mol/Turnhout/Retie scores,
@@ -859,7 +859,7 @@ QUALITY_TILE_SIZES="512" \
 QUALITY_TILE_OVERLAPS="64" \
 QUALITY_THRESHOLDS="0.35 0.15" \
 BACKGROUND_SPLIT_OUTPUT_DIR=artifacts/detection-hard-negatives/aoi1024bg512r3e50-split \
-bash scripts/run_background_corpus_split_matrix.sh http://192.168.10.150:1202
+bash scripts/run_background_corpus_split_matrix.sh http://192.0.2.10:1202
 ```

 The split runner executes the strict `pure_empty_negative` matrix and the
@@ -880,7 +880,7 @@ QUALITY_TILE_SIZES="640" \
 QUALITY_TILE_OVERLAPS="64" \
 QUALITY_THRESHOLDS="0.25 0.15 0.05" \
 HARD_NEGATIVE_OUTPUT_DIR=artifacts/detection-hard-negatives/expanded160e50-live \
-bash scripts/run_operator_hard_negative_detection_matrix.sh http://192.168.10.150:1202
+bash scripts/run_operator_hard_negative_detection_matrix.sh http://192.0.2.10:1202
 ```

 The hard-negative matrix uploads only the background raster, generates tiles,
@@ -927,13 +927,13 @@ Export calibration QA evidence for visual review:

 ```bash
 CALIBRATION_SUMMARY_PATH=/mnt/user/appdata/geointel/artifacts/detection-calibration/20260707T002103Z/calibration_summary.json \
-bash scripts/export_detection_calibration_evidence.sh http://192.168.10.150:1202
+bash scripts/export_detection_calibration_evidence.sh http://192.0.2.10:1202
 ```

 Browser Detection Lab calibration summary exports are supported too:

 ```bash
-bash scripts/export_detection_calibration_evidence.sh http://192.168.10.150:1202 ./detection-calibration-summary.json
+bash scripts/export_detection_calibration_evidence.sh http://192.0.2.10:1202 ./detection-calibration-summary.json
 ```

 Run the local browser-summary evidence bundle smoke without touching live
@@ -953,7 +953,7 @@ Assemble multiple AOI evidence bundles into one model-review portfolio:

 ```bash
 bash scripts/assemble_detection_calibration_evidence_portfolio.sh \
-  http://192.168.10.150:1202 \
+  http://192.0.2.10:1202 \
  ./calibration-evidence-portfolio-manifest.json
 ```

@@ -1256,7 +1256,7 @@ QUALITY_TILE_OVERLAPS="64" \
 QUALITY_THRESHOLDS="0.35 0.15" \
 BACKGROUND_SPLIT_OUTPUT_DIR=artifacts/detection-hard-negatives/aoi1024bg512r3e50-split \
 PROMOTION_OUTPUT_DIR=artifacts/detection-model-promotion/aoi1024bg512r3e50-split-aware \
-bash scripts/run_split_background_promotion_workflow.sh http://192.168.10.150:1202
+bash scripts/run_split_background_promotion_workflow.sh http://192.0.2.10:1202
 ```

 The wrapper first calls `run_background_corpus_split_matrix.sh`, then feeds the
@@ -1278,7 +1278,7 @@ background samples with references are treated as `sparse_building_context`.
 ```bash
 PROMOTION_POSITIVE_PORTFOLIO_PATH=/mnt/user/appdata/geointel/artifacts/detection-quality-matrix/multi-sample/aoi1024bg512r3e50-positive/multi_sample_quality_summary.json \
 OPERATOR_SAMPLE_MANIFEST_PATH=storage/operator-data/operator_samples_manifest.json \
-bash scripts/run_split_background_promotion_workflow.sh --preflight-only http://192.168.10.150:1202
+bash scripts/run_split_background_promotion_workflow.sh --preflight-only http://192.0.2.10:1202
 ```

 If a legacy positive evidence portfolio records `model_asset_id` at portfolio
@@ -2023,10 +2023,10 @@ DEPLOY_BOOTSTRAP=1 bash scripts/deploy_tower.sh
 Useful overrides:

 ```bash
-REMOTE_HOST=root@192.168.10.150
+REMOTE_HOST=root@192.0.2.10
 REMOTE_PATH=/mnt/user/appdata/geointel
 REMOTE_REPO=gitea-widefrog:NuklearRabbit/geointel.git
-FRONTEND_URL=http://192.168.10.150:1202
+FRONTEND_URL=http://192.0.2.10:1202
 ```

 ## Regional BWK/Natura 2000 state 2025
@@ -2220,7 +2220,7 @@ Preview the seven release areas without mutating GeoIntel:

 ```bash
 python scripts/provision_release_golden_areas.py \
-  --base-url http://192.168.10.150:1202 \
+  --base-url http://192.0.2.10:1202 \
  --output artifacts/rc8-golden-areas.json
 ```

@@ -2229,7 +2229,7 @@ journey:

 ```bash
 bash scripts/run_rc8_release_journeys.sh \
-  http://192.168.10.150:1202 \
+  http://192.0.2.10:1202 \
  artifacts/rc8-release-journeys \
  artifacts/rc8-golden-areas.json
 ```
@@ -2253,7 +2253,7 @@ Run the non-mutating frontend audit against a deployed runtime:

 ```bash
 bash scripts/run_rc9_ux_audit.sh \
-  http://192.168.10.150:1202 \
+  http://192.0.2.10:1202 \
  artifacts/rc9-ux-audit
 ```

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Fail when publication-only repository boundaries are violated."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+BLOCKED_PATHS = {".mcp.json"}
+BLOCKED_PREFIXES = (".codex-input/", ".codex-artifacts/", ".playwright-mcp/", "data/")
+BLOCKED_SUFFIXES = (".db", ".db-shm", ".db-wal")
+BLOCKED_CONTENT = (
+    b"192.168." + b"10.150",
+    b"geointel." + b"itworx.tech",
+    b"itworx_" + b"unraid_deploy",
+    b"/mnt/user/appdata/" + b"dockdeck",
+    b"tower" + b".local",
+)
+LARGE_FILE_LIMIT = 20 * 1024 * 1024
+LARGE_FILE_ALLOWLIST_PREFIXES = (
+    "artifacts/evidence/accuracy/",
+    "docs/assets/",
+    "frontend/public/portfolio/",
+    "output/pdf/",
+)
+
+
+def tracked_files() -> list[str]:
+    result = subprocess.run(
+        ["git", "ls-files", "-z"],
+        cwd=ROOT,
+        check=True,
+        capture_output=True,
+    )
+    return [item for item in result.stdout.decode("utf-8").split("\0") if item]
+
+
+def main() -> int:
+    violations: list[str] = []
+    for relative in tracked_files():
+        normalized = relative.replace("\\", "/")
+        if normalized in BLOCKED_PATHS or normalized.startswith(BLOCKED_PREFIXES):
+            violations.append(
+                f"{normalized}: local or cross-project state must not be tracked"
+            )
+            continue
+        if normalized.endswith(BLOCKED_SUFFIXES):
+            violations.append(
+                f"{normalized}: database runtime state must not be tracked"
+            )
+            continue
+
+        path = ROOT / relative
+        if not path.is_file():
+            continue
+        size = path.stat().st_size
+        if size > LARGE_FILE_LIMIT and not normalized.startswith(
+            LARGE_FILE_ALLOWLIST_PREFIXES
+        ):
+            violations.append(
+                f"{normalized}: {size} bytes exceeds the {LARGE_FILE_LIMIT}-byte tracked-file budget"
+            )
+        content = path.read_bytes()
+        for marker in BLOCKED_CONTENT:
+            if marker in content:
+                violations.append(
+                    f"{normalized}: contains private publication marker {marker.decode('ascii')}"
+                )
+
+    if violations:
+        print("Repository hygiene violations:", file=sys.stderr)
+        for violation in violations:
+            print(f" - {violation}", file=sys.stderr)
+        return 1
+
+    print("Repository hygiene check passed.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -1,10 +1,10 @@
 param(
-    [string]$RemoteHost = "root@192.168.10.150",
+    [string]$RemoteHost = "root@192.0.2.10",
    [string]$RemotePath = "/mnt/user/appdata/geointel",
    [string]$RemoteBranch = "main",
    [string]$RemoteRepo = "gitea-widefrog:Jens/geointel.git",
-    [string]$SshKey = "$HOME/.ssh/itworx_unraid_deploy",
-    [string]$FrontendUrl = "http://192.168.10.150:1202",
+    [string]$SshKey = "$HOME/.ssh/geointel_unraid_deploy",
+    [string]$FrontendUrl = "http://192.0.2.10:1202",
    [string]$InstallAi = $(if ($env:GEOINTEL_INSTALL_AI) { $env:GEOINTEL_INSTALL_AI } else { "" }),
    [switch]$Bootstrap
 )
@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
 set -euo pipefail

-REMOTE_HOST="${REMOTE_HOST:-root@192.168.10.150}"
+REMOTE_HOST="${REMOTE_HOST:-root@192.0.2.10}"
 REMOTE_PATH="${REMOTE_PATH:-/mnt/user/appdata/geointel}"
 REMOTE_BRANCH="${REMOTE_BRANCH:-main}"
 REMOTE_REPO="${REMOTE_REPO:-gitea-widefrog:Jens/geointel.git}"
-SSH_KEY="${SSH_KEY:-$HOME/.ssh/itworx_unraid_deploy}"
-FRONTEND_URL="${FRONTEND_URL:-http://192.168.10.150:1202}"
+SSH_KEY="${SSH_KEY:-$HOME/.ssh/geointel_unraid_deploy}"
+FRONTEND_URL="${FRONTEND_URL:-http://192.0.2.10:1202}"
 BOOTSTRAP="${DEPLOY_BOOTSTRAP:-0}"
 DEPLOY_GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-}"

@@ -13,7 +13,8 @@ def main() -> int:
    parser.add_argument("checkpoint", type=Path)
    args = parser.parse_args()
    import torch
-    checkpoint = torch.load(args.checkpoint, map_location="cpu", weights_only=False)
+
+    checkpoint = torch.load(args.checkpoint, map_location="cpu", weights_only=True)
    payload = {
        key: checkpoint.get(key)
        for key in ("date", "version", "license", "docs", "train_args")
@@ -45,6 +45,8 @@ echo "== GeoIntel run readiness check =="
 "$PYTHON_BIN" scripts/verify_python_lock.py
 "$PYTHON_BIN" -m py_compile scripts/verify_repository_layout.py
 "$PYTHON_BIN" scripts/verify_repository_layout.py
+"$PYTHON_BIN" -m py_compile scripts/check_repository_hygiene.py
+"$PYTHON_BIN" scripts/check_repository_hygiene.py
 "$PYTHON_BIN" -m py_compile scripts/verify_security_exceptions.py
 "$PYTHON_BIN" scripts/verify_security_exceptions.py
 bash -n scripts/backup_release_state.sh