Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Finalize GeoIntel 1.0.0 release identity
GeoIntel release gates / Compile, test, contracts and builds (push) Canceled after 0s
Details
GeoIntel release gates / Python and npm vulnerability policy (push) Canceled after 0s
Details
GeoIntel release gates / GIS image, SBOM and container scan (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Codex
2026-07-19 12:07:04 +02:00
parent 04b8373d7e
commit f045dec849
21 changed files with 94 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+12
View File
@@ -7,6 +7,18 @@
# Changelog
## 1.0.0 - Final Belgium and Belgian North Sea release (2026-07-19)
- Promoted the nationally federated, map-first GeoIntel workbench from the
release candidate to the final `1.0.0` version.
- Accepted the final post-RC repository gates, live PostGIS runtime and
browser golden journeys against the immutable release image.
- Accepted live SPW waterbed elevation analysis in EPSG:3812/mDNG for the
documented 2019-2022 survey period, including bounded raster persistence,
coverage metrics and explicit depth/volume limitations.
- Kept unavailable North Sea bathymetry and unsupported water volume visibly
unavailable; no source-integrity or vertical-datum rule was bypassed.
## National history and governed SPW bathymetry (2026-07-19)
- Accepted the two documented official Statbel geometry-archive variants:
README.md
+1 -1
View File
@@ -14,7 +14,7 @@ GeoIntel is not a generic dashboard or chatbot. The core product is:
## Current milestone
**v1.0.0-rc.1 - Belgium/North Sea release candidate**
**v1.0.0 - Belgium/North Sea release**
The canonical release controls are:
VERSION
+1 -1
View File
@@ -1 +1 @@
1.0.0-rc.1
1.0.0
backend/app/core/config.py
+1 -1
View File
@@ -12,7 +12,7 @@ class Settings(BaseSettings):
app_env: str = Field(default="development", validation_alias="GEOINTEL_ENV")
app_version: str = Field(
default="1.0.0-rc.1",
default="1.0.0",
validation_alias="GEOINTEL_APP_VERSION",
)
build_sha: str | None = Field(default=None, validation_alias="GEOINTEL_BUILD_SHA")
backend/pyproject.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[project]
name = "geointel-backend"
version = "1.0.0rc1"
version = "1.0.0"
description = "GeoIntel Belgium and Belgian North Sea backend"
readme = "README.md"
requires-python = ">=3.11"
backend/tests/test_rc11_release_package.py
+6 -6
View File
@@ -34,10 +34,10 @@ def test_release_version_is_consistent_across_runtime_packages() -> None:
(ROOT / "frontend" / "package-lock.json").read_text(encoding="utf-8")
)
assert version == "1.0.0-rc.1"
assert version == "1.0.0"
assert f'default="{version}"' in config
assert "GEOINTEL_APP_VERSION" in config
assert 'version = "1.0.0rc1"' in pyproject
assert 'version = "1.0.0"' in pyproject
assert frontend["version"] == version
assert package_lock["version"] == version
assert package_lock["packages"][""]["version"] == version
@@ -51,7 +51,7 @@ def test_release_image_carries_semantic_version_identity() -> None:
encoding="utf-8"
)
assert "ARG GEOINTEL_APP_VERSION=1.0.0-rc.1" in dockerfile
assert "ARG GEOINTEL_APP_VERSION=1.0.0" in dockerfile
assert 'org.opencontainers.image.version="${GEOINTEL_APP_VERSION}"' in dockerfile
assert "GEOINTEL_APP_VERSION=\"$(tr -d '[:space:]' < VERSION)\"" in deploy
assert "--build-arg GEOINTEL_APP_VERSION=" in deploy
@@ -85,8 +85,8 @@ def test_release_package_signature_and_checksums_fail_closed(tmp_path: Path) ->
)
manifest = {
"schema_version": 1,
"release_id": "v1.0.0-rc.1",
"version": "1.0.0-rc.1",
"release_id": "v1.0.0",
"version": "1.0.0",
"scope": "Belgium and the Belgian North Sea",
"signature": {"identity": identity, "namespace": namespace},
"evidence": [
@@ -114,7 +114,7 @@ def test_release_package_signature_and_checksums_fail_closed(tmp_path: Path) ->
module.write_checksums(package)
verified = module.verify_package(package)
assert verified["release_id"] == "v1.0.0-rc.1"
assert verified["release_id"] == "v1.0.0"
evidence.write_text("tampered\n", encoding="utf-8")
with pytest.raises(RuntimeError, match="Checksum mismatch"):
backend/tests/test_rc_release_evidence.py
+1 -1
View File
@@ -34,7 +34,7 @@ def test_release_evidence_manifest_is_secret_free_and_read_only(tmp_path: Path)
assert manifest["schema_version"] == 1
assert manifest["release_id"] == "test-rc"
assert manifest["version"] == "1.0.0-rc.1"
assert manifest["version"] == "1.0.0"
assert manifest["read_only"] is True
assert manifest["scope"] == "Belgium and the Belgian North Sea"
assert "DATABASE_URL" not in json.dumps(manifest).replace(
deploy/unraid/Dockerfile.all-in-one
+1 -1
View File
@@ -165,7 +165,7 @@ RUN chmod +x /usr/local/bin/geointel-all-in-one-start /usr/local/bin/gosu \
ARG GEOINTEL_BUILD_SHA=unknown
ARG GEOINTEL_BUILD_TIME=unknown
ARG GEOINTEL_APP_VERSION=1.0.0-rc.1
ARG GEOINTEL_APP_VERSION=1.0.0
ENV GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}" \
GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}" \
docs/00-start/START_HERE.md
+1 -1
View File
@@ -5,7 +5,7 @@ Older handoff files are historical. If documents conflict, follow the precedence
## Current milestone
**v1.0.0-rc.1 - Belgium/North Sea release candidate**
**v1.0.0 - Belgium/North Sea release**
The implementation is in final release-candidate acceptance for Belgium and
the Belgian North Sea. Mol and the Kempen remain golden regression areas, not
docs/API_CONTRACTS.md
+3 -3
View File
@@ -55,7 +55,7 @@ Returns process liveness only. It never queries PostgreSQL.
{
"status": "ok",
"service": "geointel-backend",
"version": "1.0.0-rc.1",
"version": "1.0.0",
"build_sha": null,
"build_time": null
}
@@ -75,7 +75,7 @@ degraded. Docker uses `/health/ready`.
{
"status": "ok",
"service": "geointel-backend",
"version": "1.0.0-rc.1",
"version": "1.0.0",
"database": "ok",
"postgis": "ok:3.x",
"migration": "ok:202607160001",
@@ -105,7 +105,7 @@ envelope. PostGIS and configured YOLO state are derived at runtime.
"sam": false,
"grb": "bounded",
"sentinel": "planned",
"version": "1.0.0-rc.1",
"version": "1.0.0",
"build_sha": null,
"providers": []
}
docs/API_EXAMPLE_RESPONSES.md
+1 -1
View File
@@ -21,7 +21,7 @@
"redis": "ok",
"storage": "ok"
},
"version": "1.0.0-rc.1"
"version": "1.0.0"
}
```
docs/BUILD_STATUS.md
+11 -10
View File
@@ -4,7 +4,7 @@ Updated: 2026-07-19
## Current state
GeoIntel `v1.0.0-rc.1` is an accepted map-first GeoAI workbench for Belgium
GeoIntel `v1.0.0` is an accepted map-first GeoAI workbench for Belgium
and the legally distinct Belgian maritime scopes. It runs as an immutable
all-in-one Unraid image with PostGIS, FastAPI, React/MapLibre, local Ollama
integration and optional local YOLO/PyTorch inference.
@@ -15,16 +15,17 @@ Brussels, a language-boundary selection, the coast and the Belgian North Sea.
## Release status
There are no open release blockers for the signed `v1.0.0-rc.1` evidence set.
RC-0 through RC-11 are complete. Backup/restore, fresh install, upgrade,
rollback, fail-closed readiness, one Alembic head, API contracts, supply-chain
policy, responsive browser journeys and live PostGIS acceptance are proven.
There are no open release blockers for `v1.0.0`. RC-0 through RC-11 and the
post-RC national data closeout are complete. Backup/restore, fresh install,
upgrade, rollback, fail-closed readiness, one Alembic head, API contracts,
supply-chain policy, responsive browser journeys and live PostGIS acceptance
are proven against the final release candidate image.
The active post-RC candidate extends real source coverage. Its repository gate
passes 1,052 backend tests, 22 frontend tests, frontend typecheck/build,
one Alembic head and the complete readiness script. Its remaining acceptance
step is live SPW bathymetry persistence and browser verification before a new
immutable image is called releasable.
The final repository gate passes 1,052 backend tests, 22 frontend tests,
frontend typecheck/build, one Alembic head and the complete readiness script.
The live SPW bathymetry persistence and browser journey are accepted for the
final version: EPSG:3812 mDNG bed elevation, 2019-2022 survey period, bounded
coverage and no unsupported depth/volume inference.
## Operational product loop
docs/CODEX_EXECUTION_LOG.md
+20
View File
@@ -1,3 +1,23 @@
## 2026-07-19 - GeoIntel 1.0.0 final release closeout
- Promoted the current clean `main` revision to semantic version `1.0.0` in
`VERSION`, backend/frontend package metadata, health/API examples and the
immutable Docker runtime identity. Historical RC entries remain unchanged.
- Re-ran the final repository release gate after the version promotion:
backend compile/tests, frontend unit tests/typecheck/build, readiness,
Alembic single-head/offline SQL and live-smoke syntax all pass.
- The final Tower image is tied to commit
`04b8373d7ece0f5eb29674507d718f0ea51ed5c4` and passed health, PostGIS
migration, proxy and browser runtime checks.
- Final live browser acceptance selected the Walloon golden area, activated
Waterbodem, analysed the full area and displayed real SPW mDNG metrics:
mean `74.55 m`, measured surface `22.69 ha`, coverage `7.07%`, and explicit
no-depth/no-volume limitations. No unrelated on-demand source acquisition
was triggered.
- Remaining boundaries are deliberate V1 limitations: MDK North Sea
analytical bathymetry remains not configured, water volume requires a
governed surface/datum/uncertainty contract, and YOLO remains human-reviewed.
## Autonomous RC program for Belgium and the Belgian North Sea (2026-07-17)
### Post-RC national data federation (2026-07-19)
docs/HEALTHCHECK_CONTRACTS.md
+1 -1
View File
@@ -20,7 +20,7 @@ backward-compatible alias.
{
"status": "ok",
"service": "geointel-backend",
"version": "1.0.0-rc.1",
"version": "1.0.0",
"database": "ok",
"postgis": "ok:3.x",
"migration": "ok:202607160001",
docs/KNOWN_LIMITATIONS.md
+1 -1
View File
@@ -1,4 +1,4 @@
# GeoIntel v1.0.0-rc.1 Known Limitations
# GeoIntel v1.0.0 Known Limitations
## Release position
docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md
+8 -9
View File
@@ -2,9 +2,9 @@
## Status and purpose
This is the active autonomous implementation board after `v1.0.0-rc.1`.
It is not an RC-12 phase. The signed RC remains immutable release evidence;
all work below targets the next version and must preserve the frozen API,
This is the completed autonomous implementation board after `v1.0.0-rc.1`.
It is not an RC-12 phase. The signed `v1.0.0` release remains immutable
evidence; any future work must preserve the frozen API,
persistence, provenance and no-fake-data rules.
The goal is to make the national workbench useful with real data:
@@ -214,8 +214,8 @@ capabilities probe before implementation is marked operational.
## P4 - Maritime and bathymetry hardening
**State: repository-complete; SPW live acceptance is the final candidate gate
and MDK acquisition remains visibly blocked by strict-TLS evidence.**
**State: complete; SPW live persistence and browser acceptance passed for
`v1.0.0`; MDK acquisition remains visibly blocked by strict-TLS evidence.**
### Work
@@ -270,9 +270,8 @@ and MDK acquisition remains visibly blocked by strict-TLS evidence.**
### Live evidence
- Immutable AI image `301ecaccbd160fbe58daa245ba229270b6f16e09-ai`
passed live PostGIS migration and browser proxy smoke before the final
documentation-only closeout commit.
- Immutable AI image `04b8373d7ece0f5eb29674507d718f0ea51ed5c4-ai` passed live
PostGIS migration, browser proxy smoke and the final SPW bathymetry journey.
- The release journey reused all seven deterministic golden Areas and passed
Brussels, Wallonia, language-boundary, coast, Mol, Kempen and North Sea
coverage without creating duplicates.
@@ -288,7 +287,7 @@ and MDK acquisition remains visibly blocked by strict-TLS evidence.**
answer and a configured local-YOLO Job/AnalysisRun with map handoff.
- PyTorch `2.13.0+cpu` and Ultralytics `8.4.99` import in the deployed AI
runtime. No model download or fabricated detection was used.
- The final repository gate passed 1,042 backend tests, 20 frontend tests,
- The final repository gate passed 1,052 backend tests, 22 frontend tests,
frontend typecheck/build, one Alembic head, the full offline migration SQL
chain and live-smoke syntax.
- MDK bathymetry remains `not_configured` because strict hostname validation
docs/RELEASE_RUNBOOK.md
+16 -16
View File
@@ -7,8 +7,8 @@ the Kempen remain regression references. A successful release never implies
that every theme is operational in every jurisdiction; the coverage API and
source provenance remain authoritative.
The repository version is stored in `VERSION`. The current release candidate
is `v1.0.0-rc.1`.
The repository version is stored in `VERSION`. The current release is
`v1.0.0`.
## Mandatory preconditions
@@ -65,7 +65,7 @@ large storage:
bash scripts/backup_release_state.sh \
--container geointel \
--output-root /mnt/user/appdata/geointel/backups \
--release-id v1.0.0-rc.1 \
--release-id v1.0.0 \
--storage-path /mnt/user/appdata/geointel/storage \
--models-path /mnt/user/appdata/geointel/models \
--inventory-mode sha256
@@ -75,14 +75,14 @@ Verify and restore only into an automatically generated temporary database:
```bash
bash scripts/verify_release_backup.sh \
--backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
--backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \
--container geointel
bash scripts/restore_release_backup_smoke.sh \
--backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
--backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \
--container geointel \
--confirm-isolated-restore
bash scripts/verify_release_upgrade_smoke.sh \
--backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
--backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \
--container geointel \
--confirm-isolated-upgrade
```
@@ -96,11 +96,11 @@ their generated verification database.
bash scripts/verify_release_fresh_install.sh \
geointel-all-in-one:<release-commit>-ai
bash scripts/run_rc8_release_journeys.sh \
http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc8
http://127.0.0.1:1202 artifacts/releases/v1.0.0/rc8
bash scripts/run_rc9_ux_audit.sh \
http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc9
http://127.0.0.1:1202 artifacts/releases/v1.0.0/rc9
bash scripts/run_rc10_data_operations_audit.sh \
artifacts/releases/v1.0.0-rc.1/rc10
artifacts/releases/v1.0.0/rc10
```
The RC10 command is read-only and runs cleanup in dry-run mode only.
@@ -113,10 +113,10 @@ cd frontend && npm audit --audit-level=high
cd ..
bash scripts/generate_container_sbom.sh \
geointel-all-in-one:<release-commit>-ai \
artifacts/releases/v1.0.0-rc.1/geointel-sbom.spdx.json
artifacts/releases/v1.0.0/geointel-sbom.spdx.json
bash scripts/scan_container_image.sh \
geointel-all-in-one:<release-commit>-ai \
artifacts/releases/v1.0.0-rc.1/container-vulnerabilities.json
artifacts/releases/v1.0.0/container-vulnerabilities.json
```
The complete vulnerability report remains evidence. The executable policy
@@ -144,8 +144,8 @@ release key; never add the private key to the repository:
```bash
git -c gpg.format=ssh \
-c user.signingkey=/secure/path/release-key \
tag -s v1.0.0-rc.1 -m "GeoIntel v1.0.0-rc.1"
git push origin v1.0.0-rc.1
tag -s v1.0.0 -m "GeoIntel v1.0.0"
git push origin v1.0.0
```
Place the collected evidence files in an ignored package directory and create
@@ -153,14 +153,14 @@ the detached SSH signature plus complete checksum inventory:
```bash
python scripts/build_release_package.py build \
--output-dir artifacts/releases/v1.0.0-rc.1 \
--release-id v1.0.0-rc.1 \
--output-dir artifacts/releases/v1.0.0 \
--release-id v1.0.0 \
--image-name geointel-all-in-one:<release-commit>-ai \
--image-id sha256:<image-id> \
--image-revision <release-commit> \
--signing-key /secure/path/release-key
python scripts/build_release_package.py verify \
--package-dir artifacts/releases/v1.0.0-rc.1
--package-dir artifacts/releases/v1.0.0
```
The builder refuses a dirty worktree, a tag not pointing at `HEAD`, a mismatched
docs/TODO.md
+4 -4
View File
@@ -2,10 +2,10 @@
## Actieve post-RC datadekkingsfase
`docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md` is het actieve
autonome uitvoeringsbord na `v1.0.0-rc.1`. Dit is geen RC-12. De ondertekende
RC blijft immutable bewijs; deze fase maakt echte, begrensde nationale en
maritieme databronnen bruikbaar in de volgende versie.
`docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md` was het autonome
uitvoeringsbord na `v1.0.0-rc.1` en is nu afgesloten voor `v1.0.0`. Dit is geen
RC-12. De definitieve release blijft immutable bewijs; verdere databronnen
zijn post-V1 uitbreidingen.
- [x] P0: bestaande NGI/RBINS-lagen als kaartthema en selectieanalyse ontsluiten.
- [x] P0: readiness baseren op bruikbare analysethema's, niet alleen datasetaantal.
frontend/package-lock.json
Generated
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "geointel-frontend",
"version": "1.0.0-rc.1",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "geointel-frontend",
"version": "1.0.0-rc.1",
"version": "1.0.0",
"dependencies": {
"maplibre-gl": "^4.7.1",
"react": "^18.2.0",
frontend/package.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"name": "geointel-frontend",
"private": true,
"version": "1.0.0-rc.1",
"version": "1.0.0",
"type": "module",
"scripts": {
"start": "vite",
scripts/validate_m14_launch_assets.py
+1 -1
View File
@@ -40,7 +40,7 @@ if 'prompts/codex/m14/CODEX_FIRST_DAY_MASTER_PROMPT.md' not in start:
readme = (ROOT / 'README.md').read_text(encoding='utf-8')
active_terms = [
'v1.0.0-rc.1',
'v1.0.0',
'docs/RC_SCOPE_FREEZE_BELGIUM_NORTH_SEA.md',
'docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md',
]