7 Commits

Include renames

Author	SHA1	Message	Date
JensandClaude Opus 5	e2f586c029	consume only artifacts the runtime produced ... tile_manifest_path arrives in the detection and segmentation request and was read straight off disk, and a manifest entry may name an absolute tile path. That makes an API field an unbounded reference to the host filesystem, and it contradicts the rule the persistence model rests on: only a governed, runtime-produced artifact may be consumed, and a file outside the storage root is not one. Both the manifest and every tile it names now resolve under STORAGE_ROOT. Resolution happens before the comparison, so ".." cannot climb out and a sibling that merely shares a name prefix does not pass. GEOINTEL_ALLOW_EXTERNAL_ARTIFACT_PATHS opts out for provisioning workflows that stage tiles before ingest. The check honours the Settings the caller is operating under rather than the process-wide ones, because every analysis path already threads its own. The affected tests write manifests into tmp_path, so they now declare tmp_path as the storage root — which is what a deployment does, and makes the fixtures more honest than they were. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-22 16:16:25 +02:00
Jens	5b3c17b494	feat(provenance): govern source snapshots and data inputs	2026-08-01 23:46:17 +02:00
Codex	f9493479c7	Honor YOLO preflight environment config	2026-07-09 02:28:29 +02:00
Codex	7aa9382c9e	Surface YOLO preflight in Detection Lab	2026-07-06 10:52:26 +02:00
Codex	7a29e7867d	Add YOLO preflight runtime diagnostics	2026-07-05 21:17:20 +02:00
Codex	3f1a686bef	Harden YOLO compatibility preflight	2026-06-17 01:59:00 +02:00
Codex	6ea3586a3e	Initial GeoIntel V1 foundation	2026-06-16 23:36:32 +02:00