Finalize GeoIntel 1.0.0 release identity

docs/00-start/START_HERE.md

@@ -5,7 +5,7 @@ Older handoff files are historical. If documents conflict, follow the precedence
 
 ## Current milestone
 
-**v1.0.0-rc.1 - Belgium/North Sea release candidate**
+**v1.0.0 - Belgium/North Sea release**
 
 The implementation is in final release-candidate acceptance for Belgium and
 the Belgian North Sea. Mol and the Kempen remain golden regression areas, not

docs/API_CONTRACTS.md

@@ -55,7 +55,7 @@ Returns process liveness only. It never queries PostgreSQL.
 {
   "status": "ok",
   "service": "geointel-backend",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0",
   "build_sha": null,
   "build_time": null
 }
@@ -75,7 +75,7 @@ degraded. Docker uses `/health/ready`.
 {
   "status": "ok",
   "service": "geointel-backend",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0",
   "database": "ok",
   "postgis": "ok:3.x",
   "migration": "ok:202607160001",
@@ -105,7 +105,7 @@ envelope. PostGIS and configured YOLO state are derived at runtime.
     "sam": false,
     "grb": "bounded",
     "sentinel": "planned",
-    "version": "1.0.0-rc.1",
+    "version": "1.0.0",
     "build_sha": null,
     "providers": []
   }

docs/API_EXAMPLE_RESPONSES.md

@@ -21,7 +21,7 @@
     "redis": "ok",
     "storage": "ok"
   },
-  "version": "1.0.0-rc.1"
+    "version": "1.0.0"
 }
 ```
 

docs/BUILD_STATUS.md

@@ -4,7 +4,7 @@ Updated: 2026-07-19
 
 ## Current state
 
-GeoIntel `v1.0.0-rc.1` is an accepted map-first GeoAI workbench for Belgium
+GeoIntel `v1.0.0` is an accepted map-first GeoAI workbench for Belgium
 and the legally distinct Belgian maritime scopes. It runs as an immutable
 all-in-one Unraid image with PostGIS, FastAPI, React/MapLibre, local Ollama
 integration and optional local YOLO/PyTorch inference.
@@ -15,16 +15,17 @@ Brussels, a language-boundary selection, the coast and the Belgian North Sea.
 
 ## Release status
 
-There are no open release blockers for the signed `v1.0.0-rc.1` evidence set.
-RC-0 through RC-11 are complete. Backup/restore, fresh install, upgrade,
-rollback, fail-closed readiness, one Alembic head, API contracts, supply-chain
-policy, responsive browser journeys and live PostGIS acceptance are proven.
+There are no open release blockers for `v1.0.0`. RC-0 through RC-11 and the
+post-RC national data closeout are complete. Backup/restore, fresh install,
+upgrade, rollback, fail-closed readiness, one Alembic head, API contracts,
+supply-chain policy, responsive browser journeys and live PostGIS acceptance
+are proven against the final release candidate image.
 
-The active post-RC candidate extends real source coverage. Its repository gate
-passes 1,052 backend tests, 22 frontend tests, frontend typecheck/build,
-one Alembic head and the complete readiness script. Its remaining acceptance
-step is live SPW bathymetry persistence and browser verification before a new
-immutable image is called releasable.
+The final repository gate passes 1,052 backend tests, 22 frontend tests,
+frontend typecheck/build, one Alembic head and the complete readiness script.
+The live SPW bathymetry persistence and browser journey are accepted for the
+final version: EPSG:3812 mDNG bed elevation, 2019-2022 survey period, bounded
+coverage and no unsupported depth/volume inference.
 
 ## Operational product loop
 

docs/CODEX_EXECUTION_LOG.md

@@ -1,3 +1,23 @@
+## 2026-07-19 - GeoIntel 1.0.0 final release closeout
+
+- Promoted the current clean `main` revision to semantic version `1.0.0` in
+  `VERSION`, backend/frontend package metadata, health/API examples and the
+  immutable Docker runtime identity. Historical RC entries remain unchanged.
+- Re-ran the final repository release gate after the version promotion:
+  backend compile/tests, frontend unit tests/typecheck/build, readiness,
+  Alembic single-head/offline SQL and live-smoke syntax all pass.
+- The final Tower image is tied to commit
+  `04b8373d7ece0f5eb29674507d718f0ea51ed5c4` and passed health, PostGIS
+  migration, proxy and browser runtime checks.
+- Final live browser acceptance selected the Walloon golden area, activated
+  Waterbodem, analysed the full area and displayed real SPW mDNG metrics:
+  mean `74.55 m`, measured surface `22.69 ha`, coverage `7.07%`, and explicit
+  no-depth/no-volume limitations. No unrelated on-demand source acquisition
+  was triggered.
+- Remaining boundaries are deliberate V1 limitations: MDK North Sea
+  analytical bathymetry remains not configured, water volume requires a
+  governed surface/datum/uncertainty contract, and YOLO remains human-reviewed.
+
 ## Autonomous RC program for Belgium and the Belgian North Sea (2026-07-17)
 
 ### Post-RC national data federation (2026-07-19)

docs/HEALTHCHECK_CONTRACTS.md

@@ -20,7 +20,7 @@ backward-compatible alias.
 {
   "status": "ok",
   "service": "geointel-backend",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0",
   "database": "ok",
   "postgis": "ok:3.x",
   "migration": "ok:202607160001",

docs/KNOWN_LIMITATIONS.md

@@ -1,4 +1,4 @@
-# GeoIntel v1.0.0-rc.1 Known Limitations
+# GeoIntel v1.0.0 Known Limitations
 
 ## Release position
 

docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md

@@ -2,9 +2,9 @@
 
 ## Status and purpose
 
-This is the active autonomous implementation board after `v1.0.0-rc.1`.
-It is not an RC-12 phase. The signed RC remains immutable release evidence;
-all work below targets the next version and must preserve the frozen API,
+This is the completed autonomous implementation board after `v1.0.0-rc.1`.
+It is not an RC-12 phase. The signed `v1.0.0` release remains immutable
+evidence; any future work must preserve the frozen API,
 persistence, provenance and no-fake-data rules.
 
 The goal is to make the national workbench useful with real data:
@@ -214,8 +214,8 @@ capabilities probe before implementation is marked operational.
 
 ## P4 - Maritime and bathymetry hardening
 
-**State: repository-complete; SPW live acceptance is the final candidate gate
-and MDK acquisition remains visibly blocked by strict-TLS evidence.**
+**State: complete; SPW live persistence and browser acceptance passed for
+`v1.0.0`; MDK acquisition remains visibly blocked by strict-TLS evidence.**
 
 ### Work
 
@@ -270,9 +270,8 @@ and MDK acquisition remains visibly blocked by strict-TLS evidence.**
 
 ### Live evidence
 
-- Immutable AI image `301ecaccbd160fbe58daa245ba229270b6f16e09-ai`
-  passed live PostGIS migration and browser proxy smoke before the final
-  documentation-only closeout commit.
+- Immutable AI image `04b8373d7ece0f5eb29674507d718f0ea51ed5c4-ai` passed live
+  PostGIS migration, browser proxy smoke and the final SPW bathymetry journey.
 - The release journey reused all seven deterministic golden Areas and passed
   Brussels, Wallonia, language-boundary, coast, Mol, Kempen and North Sea
   coverage without creating duplicates.
@@ -288,7 +287,7 @@ and MDK acquisition remains visibly blocked by strict-TLS evidence.**
   answer and a configured local-YOLO Job/AnalysisRun with map handoff.
 - PyTorch `2.13.0+cpu` and Ultralytics `8.4.99` import in the deployed AI
   runtime. No model download or fabricated detection was used.
-- The final repository gate passed 1,042 backend tests, 20 frontend tests,
+- The final repository gate passed 1,052 backend tests, 22 frontend tests,
   frontend typecheck/build, one Alembic head, the full offline migration SQL
   chain and live-smoke syntax.
 - MDK bathymetry remains `not_configured` because strict hostname validation

docs/RELEASE_RUNBOOK.md

@@ -7,8 +7,8 @@ the Kempen remain regression references. A successful release never implies
 that every theme is operational in every jurisdiction; the coverage API and
 source provenance remain authoritative.
 
-The repository version is stored in `VERSION`. The current release candidate
-is `v1.0.0-rc.1`.
+The repository version is stored in `VERSION`. The current release is
+`v1.0.0`.
 
 ## Mandatory preconditions
 
@@ -65,7 +65,7 @@ large storage:
 bash scripts/backup_release_state.sh \
   --container geointel \
   --output-root /mnt/user/appdata/geointel/backups \
-  --release-id v1.0.0-rc.1 \
+  --release-id v1.0.0 \
   --storage-path /mnt/user/appdata/geointel/storage \
   --models-path /mnt/user/appdata/geointel/models \
   --inventory-mode sha256
@@ -75,14 +75,14 @@ Verify and restore only into an automatically generated temporary database:
 
 ```bash
 bash scripts/verify_release_backup.sh \
-  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
+  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \
   --container geointel
 bash scripts/restore_release_backup_smoke.sh \
-  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
+  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \
   --container geointel \
   --confirm-isolated-restore
 bash scripts/verify_release_upgrade_smoke.sh \
-  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
+  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \
   --container geointel \
   --confirm-isolated-upgrade
 ```
@@ -96,11 +96,11 @@ their generated verification database.
 bash scripts/verify_release_fresh_install.sh \
   geointel-all-in-one:<release-commit>-ai
 bash scripts/run_rc8_release_journeys.sh \
-  http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc8
+  http://127.0.0.1:1202 artifacts/releases/v1.0.0/rc8
 bash scripts/run_rc9_ux_audit.sh \
-  http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc9
+  http://127.0.0.1:1202 artifacts/releases/v1.0.0/rc9
 bash scripts/run_rc10_data_operations_audit.sh \
-  artifacts/releases/v1.0.0-rc.1/rc10
+  artifacts/releases/v1.0.0/rc10
 ```
 
 The RC10 command is read-only and runs cleanup in dry-run mode only.
@@ -113,10 +113,10 @@ cd frontend && npm audit --audit-level=high
 cd ..
 bash scripts/generate_container_sbom.sh \
   geointel-all-in-one:<release-commit>-ai \
-  artifacts/releases/v1.0.0-rc.1/geointel-sbom.spdx.json
+  artifacts/releases/v1.0.0/geointel-sbom.spdx.json
 bash scripts/scan_container_image.sh \
   geointel-all-in-one:<release-commit>-ai \
-  artifacts/releases/v1.0.0-rc.1/container-vulnerabilities.json
+  artifacts/releases/v1.0.0/container-vulnerabilities.json
 ```
 
 The complete vulnerability report remains evidence. The executable policy
@@ -144,8 +144,8 @@ release key; never add the private key to the repository:
 ```bash
 git -c gpg.format=ssh \
   -c user.signingkey=/secure/path/release-key \
-  tag -s v1.0.0-rc.1 -m "GeoIntel v1.0.0-rc.1"
-git push origin v1.0.0-rc.1
+  tag -s v1.0.0 -m "GeoIntel v1.0.0"
+git push origin v1.0.0
 ```
 
 Place the collected evidence files in an ignored package directory and create
@@ -153,14 +153,14 @@ the detached SSH signature plus complete checksum inventory:
 
 ```bash
 python scripts/build_release_package.py build \
-  --output-dir artifacts/releases/v1.0.0-rc.1 \
-  --release-id v1.0.0-rc.1 \
+  --output-dir artifacts/releases/v1.0.0 \
+  --release-id v1.0.0 \
   --image-name geointel-all-in-one:<release-commit>-ai \
   --image-id sha256:<image-id> \
   --image-revision <release-commit> \
   --signing-key /secure/path/release-key
 python scripts/build_release_package.py verify \
-  --package-dir artifacts/releases/v1.0.0-rc.1
+  --package-dir artifacts/releases/v1.0.0
 ```
 
 The builder refuses a dirty worktree, a tag not pointing at `HEAD`, a mismatched

docs/TODO.md

@@ -2,10 +2,10 @@
 
 ## Actieve post-RC datadekkingsfase
 
-`docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md` is het actieve
-autonome uitvoeringsbord na `v1.0.0-rc.1`. Dit is geen RC-12. De ondertekende
-RC blijft immutable bewijs; deze fase maakt echte, begrensde nationale en
-maritieme databronnen bruikbaar in de volgende versie.
+`docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md` was het autonome
+uitvoeringsbord na `v1.0.0-rc.1` en is nu afgesloten voor `v1.0.0`. Dit is geen
+RC-12. De definitieve release blijft immutable bewijs; verdere databronnen
+zijn post-V1 uitbreidingen.
 
 - [x] P0: bestaande NGI/RBINS-lagen als kaartthema en selectieanalyse ontsluiten.
 - [x] P0: readiness baseren op bruikbare analysethema's, niet alleen datasetaantal.