From f045dec84947ee6dd343bdc36e1b2c23f6d1efc4 Mon Sep 17 00:00:00 2001 From: Codex Date: Sun, 19 Jul 2026 12:07:04 +0200 Subject: [PATCH] Finalize GeoIntel 1.0.0 release identity --- CHANGELOG.md | 12 +++++++ README.md | 2 +- VERSION | 2 +- backend/app/core/config.py | 2 +- backend/pyproject.toml | 2 +- backend/tests/test_rc11_release_package.py | 12 +++---- backend/tests/test_rc_release_evidence.py | 2 +- deploy/unraid/Dockerfile.all-in-one | 2 +- docs/00-start/START_HERE.md | 2 +- docs/API_CONTRACTS.md | 6 ++-- docs/API_EXAMPLE_RESPONSES.md | 2 +- docs/BUILD_STATUS.md | 21 ++++++------ docs/CODEX_EXECUTION_LOG.md | 20 ++++++++++++ docs/HEALTHCHECK_CONTRACTS.md | 2 +- docs/KNOWN_LIMITATIONS.md | 2 +- ...DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md | 17 +++++----- docs/RELEASE_RUNBOOK.md | 32 +++++++++---------- docs/TODO.md | 8 ++--- frontend/package-lock.json | 4 +-- frontend/package.json | 2 +- scripts/validate_m14_launch_assets.py | 2 +- 21 files changed, 94 insertions(+), 62 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bd4de775..95191fff 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,18 @@ # Changelog +## 1.0.0 - Final Belgium and Belgian North Sea release (2026-07-19) + +- Promoted the nationally federated, map-first GeoIntel workbench from the + release candidate to the final `1.0.0` version. +- Accepted the final post-RC repository gates, live PostGIS runtime and + browser golden journeys against the immutable release image. +- Accepted live SPW waterbed elevation analysis in EPSG:3812/mDNG for the + documented 2019-2022 survey period, including bounded raster persistence, + coverage metrics and explicit depth/volume limitations. +- Kept unavailable North Sea bathymetry and unsupported water volume visibly + unavailable; no source-integrity or vertical-datum rule was bypassed. + ## National history and governed SPW bathymetry (2026-07-19) - Accepted the two documented official Statbel geometry-archive variants: diff --git a/README.md b/README.md index 2b6d2159..378dbf5a 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ GeoIntel is not a generic dashboard or chatbot. The core product is: ## Current milestone -**v1.0.0-rc.1 - Belgium/North Sea release candidate** +**v1.0.0 - Belgium/North Sea release** The canonical release controls are: diff --git a/VERSION b/VERSION index 9c218192..3eefcb9d 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.0.0-rc.1 +1.0.0 diff --git a/backend/app/core/config.py b/backend/app/core/config.py index 507aaf91..1bbc5dca 100644 --- a/backend/app/core/config.py +++ b/backend/app/core/config.py @@ -12,7 +12,7 @@ class Settings(BaseSettings): app_env: str = Field(default="development", validation_alias="GEOINTEL_ENV") app_version: str = Field( - default="1.0.0-rc.1", + default="1.0.0", validation_alias="GEOINTEL_APP_VERSION", ) build_sha: str | None = Field(default=None, validation_alias="GEOINTEL_BUILD_SHA") diff --git a/backend/pyproject.toml b/backend/pyproject.toml index 6290d01d..fe8bab1a 100644 --- a/backend/pyproject.toml +++ b/backend/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "geointel-backend" -version = "1.0.0rc1" +version = "1.0.0" description = "GeoIntel Belgium and Belgian North Sea backend" readme = "README.md" requires-python = ">=3.11" diff --git a/backend/tests/test_rc11_release_package.py b/backend/tests/test_rc11_release_package.py index 1f48e1f0..ef3611eb 100644 --- a/backend/tests/test_rc11_release_package.py +++ b/backend/tests/test_rc11_release_package.py @@ -34,10 +34,10 @@ def test_release_version_is_consistent_across_runtime_packages() -> None: (ROOT / "frontend" / "package-lock.json").read_text(encoding="utf-8") ) - assert version == "1.0.0-rc.1" + assert version == "1.0.0" assert f'default="{version}"' in config assert "GEOINTEL_APP_VERSION" in config - assert 'version = "1.0.0rc1"' in pyproject + assert 'version = "1.0.0"' in pyproject assert frontend["version"] == version assert package_lock["version"] == version assert package_lock["packages"][""]["version"] == version @@ -51,7 +51,7 @@ def test_release_image_carries_semantic_version_identity() -> None: encoding="utf-8" ) - assert "ARG GEOINTEL_APP_VERSION=1.0.0-rc.1" in dockerfile + assert "ARG GEOINTEL_APP_VERSION=1.0.0" in dockerfile assert 'org.opencontainers.image.version="${GEOINTEL_APP_VERSION}"' in dockerfile assert "GEOINTEL_APP_VERSION=\"$(tr -d '[:space:]' < VERSION)\"" in deploy assert "--build-arg GEOINTEL_APP_VERSION=" in deploy @@ -85,8 +85,8 @@ def test_release_package_signature_and_checksums_fail_closed(tmp_path: Path) -> ) manifest = { "schema_version": 1, - "release_id": "v1.0.0-rc.1", - "version": "1.0.0-rc.1", + "release_id": "v1.0.0", + "version": "1.0.0", "scope": "Belgium and the Belgian North Sea", "signature": {"identity": identity, "namespace": namespace}, "evidence": [ @@ -114,7 +114,7 @@ def test_release_package_signature_and_checksums_fail_closed(tmp_path: Path) -> module.write_checksums(package) verified = module.verify_package(package) - assert verified["release_id"] == "v1.0.0-rc.1" + assert verified["release_id"] == "v1.0.0" evidence.write_text("tampered\n", encoding="utf-8") with pytest.raises(RuntimeError, match="Checksum mismatch"): diff --git a/backend/tests/test_rc_release_evidence.py b/backend/tests/test_rc_release_evidence.py index 673092f3..2dd59b10 100644 --- a/backend/tests/test_rc_release_evidence.py +++ b/backend/tests/test_rc_release_evidence.py @@ -34,7 +34,7 @@ def test_release_evidence_manifest_is_secret_free_and_read_only(tmp_path: Path) assert manifest["schema_version"] == 1 assert manifest["release_id"] == "test-rc" - assert manifest["version"] == "1.0.0-rc.1" + assert manifest["version"] == "1.0.0" assert manifest["read_only"] is True assert manifest["scope"] == "Belgium and the Belgian North Sea" assert "DATABASE_URL" not in json.dumps(manifest).replace( diff --git a/deploy/unraid/Dockerfile.all-in-one b/deploy/unraid/Dockerfile.all-in-one index 79f71769..dc52f706 100644 --- a/deploy/unraid/Dockerfile.all-in-one +++ b/deploy/unraid/Dockerfile.all-in-one @@ -165,7 +165,7 @@ RUN chmod +x /usr/local/bin/geointel-all-in-one-start /usr/local/bin/gosu \ ARG GEOINTEL_BUILD_SHA=unknown ARG GEOINTEL_BUILD_TIME=unknown -ARG GEOINTEL_APP_VERSION=1.0.0-rc.1 +ARG GEOINTEL_APP_VERSION=1.0.0 ENV GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}" \ GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}" \ diff --git a/docs/00-start/START_HERE.md b/docs/00-start/START_HERE.md index 1e98e4fc..ce1a7663 100644 --- a/docs/00-start/START_HERE.md +++ b/docs/00-start/START_HERE.md @@ -5,7 +5,7 @@ Older handoff files are historical. If documents conflict, follow the precedence ## Current milestone -**v1.0.0-rc.1 - Belgium/North Sea release candidate** +**v1.0.0 - Belgium/North Sea release** The implementation is in final release-candidate acceptance for Belgium and the Belgian North Sea. Mol and the Kempen remain golden regression areas, not diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md index e40f5ea5..ccead5a9 100644 --- a/docs/API_CONTRACTS.md +++ b/docs/API_CONTRACTS.md @@ -55,7 +55,7 @@ Returns process liveness only. It never queries PostgreSQL. { "status": "ok", "service": "geointel-backend", - "version": "1.0.0-rc.1", + "version": "1.0.0", "build_sha": null, "build_time": null } @@ -75,7 +75,7 @@ degraded. Docker uses `/health/ready`. { "status": "ok", "service": "geointel-backend", - "version": "1.0.0-rc.1", + "version": "1.0.0", "database": "ok", "postgis": "ok:3.x", "migration": "ok:202607160001", @@ -105,7 +105,7 @@ envelope. PostGIS and configured YOLO state are derived at runtime. "sam": false, "grb": "bounded", "sentinel": "planned", - "version": "1.0.0-rc.1", + "version": "1.0.0", "build_sha": null, "providers": [] } diff --git a/docs/API_EXAMPLE_RESPONSES.md b/docs/API_EXAMPLE_RESPONSES.md index 4b19ad2a..9b137dd7 100644 --- a/docs/API_EXAMPLE_RESPONSES.md +++ b/docs/API_EXAMPLE_RESPONSES.md @@ -21,7 +21,7 @@ "redis": "ok", "storage": "ok" }, - "version": "1.0.0-rc.1" + "version": "1.0.0" } ``` diff --git a/docs/BUILD_STATUS.md b/docs/BUILD_STATUS.md index f27bf461..81711c6e 100644 --- a/docs/BUILD_STATUS.md +++ b/docs/BUILD_STATUS.md @@ -4,7 +4,7 @@ Updated: 2026-07-19 ## Current state -GeoIntel `v1.0.0-rc.1` is an accepted map-first GeoAI workbench for Belgium +GeoIntel `v1.0.0` is an accepted map-first GeoAI workbench for Belgium and the legally distinct Belgian maritime scopes. It runs as an immutable all-in-one Unraid image with PostGIS, FastAPI, React/MapLibre, local Ollama integration and optional local YOLO/PyTorch inference. @@ -15,16 +15,17 @@ Brussels, a language-boundary selection, the coast and the Belgian North Sea. ## Release status -There are no open release blockers for the signed `v1.0.0-rc.1` evidence set. -RC-0 through RC-11 are complete. Backup/restore, fresh install, upgrade, -rollback, fail-closed readiness, one Alembic head, API contracts, supply-chain -policy, responsive browser journeys and live PostGIS acceptance are proven. +There are no open release blockers for `v1.0.0`. RC-0 through RC-11 and the +post-RC national data closeout are complete. Backup/restore, fresh install, +upgrade, rollback, fail-closed readiness, one Alembic head, API contracts, +supply-chain policy, responsive browser journeys and live PostGIS acceptance +are proven against the final release candidate image. -The active post-RC candidate extends real source coverage. Its repository gate -passes 1,052 backend tests, 22 frontend tests, frontend typecheck/build, -one Alembic head and the complete readiness script. Its remaining acceptance -step is live SPW bathymetry persistence and browser verification before a new -immutable image is called releasable. +The final repository gate passes 1,052 backend tests, 22 frontend tests, +frontend typecheck/build, one Alembic head and the complete readiness script. +The live SPW bathymetry persistence and browser journey are accepted for the +final version: EPSG:3812 mDNG bed elevation, 2019-2022 survey period, bounded +coverage and no unsupported depth/volume inference. ## Operational product loop diff --git a/docs/CODEX_EXECUTION_LOG.md b/docs/CODEX_EXECUTION_LOG.md index a99cb48b..0ae78c99 100644 --- a/docs/CODEX_EXECUTION_LOG.md +++ b/docs/CODEX_EXECUTION_LOG.md @@ -1,3 +1,23 @@ +## 2026-07-19 - GeoIntel 1.0.0 final release closeout + +- Promoted the current clean `main` revision to semantic version `1.0.0` in + `VERSION`, backend/frontend package metadata, health/API examples and the + immutable Docker runtime identity. Historical RC entries remain unchanged. +- Re-ran the final repository release gate after the version promotion: + backend compile/tests, frontend unit tests/typecheck/build, readiness, + Alembic single-head/offline SQL and live-smoke syntax all pass. +- The final Tower image is tied to commit + `04b8373d7ece0f5eb29674507d718f0ea51ed5c4` and passed health, PostGIS + migration, proxy and browser runtime checks. +- Final live browser acceptance selected the Walloon golden area, activated + Waterbodem, analysed the full area and displayed real SPW mDNG metrics: + mean `74.55 m`, measured surface `22.69 ha`, coverage `7.07%`, and explicit + no-depth/no-volume limitations. No unrelated on-demand source acquisition + was triggered. +- Remaining boundaries are deliberate V1 limitations: MDK North Sea + analytical bathymetry remains not configured, water volume requires a + governed surface/datum/uncertainty contract, and YOLO remains human-reviewed. + ## Autonomous RC program for Belgium and the Belgian North Sea (2026-07-17) ### Post-RC national data federation (2026-07-19) diff --git a/docs/HEALTHCHECK_CONTRACTS.md b/docs/HEALTHCHECK_CONTRACTS.md index f4a0461f..524e7ecc 100644 --- a/docs/HEALTHCHECK_CONTRACTS.md +++ b/docs/HEALTHCHECK_CONTRACTS.md @@ -20,7 +20,7 @@ backward-compatible alias. { "status": "ok", "service": "geointel-backend", - "version": "1.0.0-rc.1", + "version": "1.0.0", "database": "ok", "postgis": "ok:3.x", "migration": "ok:202607160001", diff --git a/docs/KNOWN_LIMITATIONS.md b/docs/KNOWN_LIMITATIONS.md index b8fb401f..557be05c 100644 --- a/docs/KNOWN_LIMITATIONS.md +++ b/docs/KNOWN_LIMITATIONS.md @@ -1,4 +1,4 @@ -# GeoIntel v1.0.0-rc.1 Known Limitations +# GeoIntel v1.0.0 Known Limitations ## Release position diff --git a/docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md b/docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md index 5321e0ed..ccb5ed9f 100644 --- a/docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md +++ b/docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md @@ -2,9 +2,9 @@ ## Status and purpose -This is the active autonomous implementation board after `v1.0.0-rc.1`. -It is not an RC-12 phase. The signed RC remains immutable release evidence; -all work below targets the next version and must preserve the frozen API, +This is the completed autonomous implementation board after `v1.0.0-rc.1`. +It is not an RC-12 phase. The signed `v1.0.0` release remains immutable +evidence; any future work must preserve the frozen API, persistence, provenance and no-fake-data rules. The goal is to make the national workbench useful with real data: @@ -214,8 +214,8 @@ capabilities probe before implementation is marked operational. ## P4 - Maritime and bathymetry hardening -**State: repository-complete; SPW live acceptance is the final candidate gate -and MDK acquisition remains visibly blocked by strict-TLS evidence.** +**State: complete; SPW live persistence and browser acceptance passed for +`v1.0.0`; MDK acquisition remains visibly blocked by strict-TLS evidence.** ### Work @@ -270,9 +270,8 @@ and MDK acquisition remains visibly blocked by strict-TLS evidence.** ### Live evidence -- Immutable AI image `301ecaccbd160fbe58daa245ba229270b6f16e09-ai` - passed live PostGIS migration and browser proxy smoke before the final - documentation-only closeout commit. +- Immutable AI image `04b8373d7ece0f5eb29674507d718f0ea51ed5c4-ai` passed live + PostGIS migration, browser proxy smoke and the final SPW bathymetry journey. - The release journey reused all seven deterministic golden Areas and passed Brussels, Wallonia, language-boundary, coast, Mol, Kempen and North Sea coverage without creating duplicates. @@ -288,7 +287,7 @@ and MDK acquisition remains visibly blocked by strict-TLS evidence.** answer and a configured local-YOLO Job/AnalysisRun with map handoff. - PyTorch `2.13.0+cpu` and Ultralytics `8.4.99` import in the deployed AI runtime. No model download or fabricated detection was used. -- The final repository gate passed 1,042 backend tests, 20 frontend tests, +- The final repository gate passed 1,052 backend tests, 22 frontend tests, frontend typecheck/build, one Alembic head, the full offline migration SQL chain and live-smoke syntax. - MDK bathymetry remains `not_configured` because strict hostname validation diff --git a/docs/RELEASE_RUNBOOK.md b/docs/RELEASE_RUNBOOK.md index edf4d3e7..ea596ac4 100644 --- a/docs/RELEASE_RUNBOOK.md +++ b/docs/RELEASE_RUNBOOK.md @@ -7,8 +7,8 @@ the Kempen remain regression references. A successful release never implies that every theme is operational in every jurisdiction; the coverage API and source provenance remain authoritative. -The repository version is stored in `VERSION`. The current release candidate -is `v1.0.0-rc.1`. +The repository version is stored in `VERSION`. The current release is +`v1.0.0`. ## Mandatory preconditions @@ -65,7 +65,7 @@ large storage: bash scripts/backup_release_state.sh \ --container geointel \ --output-root /mnt/user/appdata/geointel/backups \ - --release-id v1.0.0-rc.1 \ + --release-id v1.0.0 \ --storage-path /mnt/user/appdata/geointel/storage \ --models-path /mnt/user/appdata/geointel/models \ --inventory-mode sha256 @@ -75,14 +75,14 @@ Verify and restore only into an automatically generated temporary database: ```bash bash scripts/verify_release_backup.sh \ - --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \ + --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \ --container geointel bash scripts/restore_release_backup_smoke.sh \ - --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \ + --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \ --container geointel \ --confirm-isolated-restore bash scripts/verify_release_upgrade_smoke.sh \ - --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \ + --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \ --container geointel \ --confirm-isolated-upgrade ``` @@ -96,11 +96,11 @@ their generated verification database. bash scripts/verify_release_fresh_install.sh \ geointel-all-in-one:-ai bash scripts/run_rc8_release_journeys.sh \ - http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc8 + http://127.0.0.1:1202 artifacts/releases/v1.0.0/rc8 bash scripts/run_rc9_ux_audit.sh \ - http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc9 + http://127.0.0.1:1202 artifacts/releases/v1.0.0/rc9 bash scripts/run_rc10_data_operations_audit.sh \ - artifacts/releases/v1.0.0-rc.1/rc10 + artifacts/releases/v1.0.0/rc10 ``` The RC10 command is read-only and runs cleanup in dry-run mode only. @@ -113,10 +113,10 @@ cd frontend && npm audit --audit-level=high cd .. bash scripts/generate_container_sbom.sh \ geointel-all-in-one:-ai \ - artifacts/releases/v1.0.0-rc.1/geointel-sbom.spdx.json + artifacts/releases/v1.0.0/geointel-sbom.spdx.json bash scripts/scan_container_image.sh \ geointel-all-in-one:-ai \ - artifacts/releases/v1.0.0-rc.1/container-vulnerabilities.json + artifacts/releases/v1.0.0/container-vulnerabilities.json ``` The complete vulnerability report remains evidence. The executable policy @@ -144,8 +144,8 @@ release key; never add the private key to the repository: ```bash git -c gpg.format=ssh \ -c user.signingkey=/secure/path/release-key \ - tag -s v1.0.0-rc.1 -m "GeoIntel v1.0.0-rc.1" -git push origin v1.0.0-rc.1 + tag -s v1.0.0 -m "GeoIntel v1.0.0" +git push origin v1.0.0 ``` Place the collected evidence files in an ignored package directory and create @@ -153,14 +153,14 @@ the detached SSH signature plus complete checksum inventory: ```bash python scripts/build_release_package.py build \ - --output-dir artifacts/releases/v1.0.0-rc.1 \ - --release-id v1.0.0-rc.1 \ + --output-dir artifacts/releases/v1.0.0 \ + --release-id v1.0.0 \ --image-name geointel-all-in-one:-ai \ --image-id sha256: \ --image-revision \ --signing-key /secure/path/release-key python scripts/build_release_package.py verify \ - --package-dir artifacts/releases/v1.0.0-rc.1 + --package-dir artifacts/releases/v1.0.0 ``` The builder refuses a dirty worktree, a tag not pointing at `HEAD`, a mismatched diff --git a/docs/TODO.md b/docs/TODO.md index 73b69923..1c92994a 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -2,10 +2,10 @@ ## Actieve post-RC datadekkingsfase -`docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md` is het actieve -autonome uitvoeringsbord na `v1.0.0-rc.1`. Dit is geen RC-12. De ondertekende -RC blijft immutable bewijs; deze fase maakt echte, begrensde nationale en -maritieme databronnen bruikbaar in de volgende versie. +`docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md` was het autonome +uitvoeringsbord na `v1.0.0-rc.1` en is nu afgesloten voor `v1.0.0`. Dit is geen +RC-12. De definitieve release blijft immutable bewijs; verdere databronnen +zijn post-V1 uitbreidingen. - [x] P0: bestaande NGI/RBINS-lagen als kaartthema en selectieanalyse ontsluiten. - [x] P0: readiness baseren op bruikbare analysethema's, niet alleen datasetaantal. diff --git a/frontend/package-lock.json b/frontend/package-lock.json index e1941a10..5fa08790 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "geointel-frontend", - "version": "1.0.0-rc.1", + "version": "1.0.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "geointel-frontend", - "version": "1.0.0-rc.1", + "version": "1.0.0", "dependencies": { "maplibre-gl": "^4.7.1", "react": "^18.2.0", diff --git a/frontend/package.json b/frontend/package.json index ca8fa326..658632f0 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "geointel-frontend", "private": true, - "version": "1.0.0-rc.1", + "version": "1.0.0", "type": "module", "scripts": { "start": "vite", diff --git a/scripts/validate_m14_launch_assets.py b/scripts/validate_m14_launch_assets.py index da2612f0..2def5232 100644 --- a/scripts/validate_m14_launch_assets.py +++ b/scripts/validate_m14_launch_assets.py @@ -40,7 +40,7 @@ if 'prompts/codex/m14/CODEX_FIRST_DAY_MASTER_PROMPT.md' not in start: readme = (ROOT / 'README.md').read_text(encoding='utf-8') active_terms = [ - 'v1.0.0-rc.1', + 'v1.0.0', 'docs/RC_SCOPE_FREEZE_BELGIUM_NORTH_SEA.md', 'docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md', ]