5 Commits

Include renames

Author	SHA1	Message	Date
JensandClaude Opus 5	16dedeb670	claim analysis jobs atomically and keep acquisition on its official host ... Two defects of the same kind: work that is supposed to be bounded is not. The analysis worker selected queued jobs and then set them to running in a second statement. A restarted process overlapping the previous one, or a second replica, could both select the same row and both start tiled GPU inference on it — duplicate analysis runs and double the GPU load. The AOI worker beside it already claims with FOR UPDATE SKIP LOCKED; this uses a conditional update, which is the same guarantee in one statement. run_once now reports jobs it actually claimed rather than jobs it looked at. urlopen follows redirects, so although every acquisition URL is built from settings and cannot be steered by a request payload, a misconfigured or compromised upstream could send the runtime to the loopback interface, to another container on the compose network, or to a cloud metadata endpoint — and the bytes would then be persisted under an official provenance. That is exactly the substitution the product forbids. All eight fetch sites now open through a guard that refuses private, loopback and link-local destinations (resolving the host first, so a DNS name cannot hide one) and refuses a redirect that leaves the configured origin or downgrades from HTTPS. The guard is proven by calling the services' own fetch paths, not by grepping for the call: every existing acquisition test injects an opener, which bypasses it by design. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-22 15:59:01 +02:00
Codex	06d05f03a6	Add governed orthophoto release promotion	2026-07-17 02:17:04 +02:00
Codex	da2371d662	Add governed Statbel edition probe	2026-07-16 22:14:48 +02:00
Codex	0a23e3484c	Add governed ALZ edition probe	2026-07-16 20:27:07 +02:00
Codex	595967f892	Add official source edition probes	2026-07-16 17:33:40 +02:00