5 Commits

Include renames

Author	SHA1	Message	Date
Jens	80a2d1654d	fix(platform): govern geospatial analysis and raster handoffs	2026-08-30 06:00:15 +02:00
JensandClaude Opus 5	16dedeb670	claim analysis jobs atomically and keep acquisition on its official host ... Two defects of the same kind: work that is supposed to be bounded is not. The analysis worker selected queued jobs and then set them to running in a second statement. A restarted process overlapping the previous one, or a second replica, could both select the same row and both start tiled GPU inference on it — duplicate analysis runs and double the GPU load. The AOI worker beside it already claims with FOR UPDATE SKIP LOCKED; this uses a conditional update, which is the same guarantee in one statement. run_once now reports jobs it actually claimed rather than jobs it looked at. urlopen follows redirects, so although every acquisition URL is built from settings and cannot be steered by a request payload, a misconfigured or compromised upstream could send the runtime to the loopback interface, to another container on the compose network, or to a cloud metadata endpoint — and the bytes would then be persisted under an official provenance. That is exactly the substitution the product forbids. All eight fetch sites now open through a guard that refuses private, loopback and link-local destinations (resolving the host first, so a DNS name cannot hide one) and refuses a redirect that leaves the configured origin or downgrades from HTTPS. The guard is proven by calling the services' own fetch paths, not by grepping for the call: every existing acquisition test injects an opener, which bypasses it by design. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-22 15:59:01 +02:00
Codex	153cff06c0	Handle VMM WCS edge grid rounding	2026-07-16 13:45:58 +02:00
Codex	943ecfbc90	Respect VMM flood coverage size limit	2026-07-15 22:23:22 +02:00
Codex	501f824257	Add governed VMM flood hazard scenarios	2026-07-15 22:14:12 +02:00