4 Commits

Include renames

Author	SHA1	Message	Date
Jens	80a2d1654d	fix(platform): govern geospatial analysis and raster handoffs	2026-08-30 06:00:15 +02:00
JensandClaude Opus 5	e2f586c029	consume only artifacts the runtime produced ... tile_manifest_path arrives in the detection and segmentation request and was read straight off disk, and a manifest entry may name an absolute tile path. That makes an API field an unbounded reference to the host filesystem, and it contradicts the rule the persistence model rests on: only a governed, runtime-produced artifact may be consumed, and a file outside the storage root is not one. Both the manifest and every tile it names now resolve under STORAGE_ROOT. Resolution happens before the comparison, so ".." cannot climb out and a sibling that merely shares a name prefix does not pass. GEOINTEL_ALLOW_EXTERNAL_ARTIFACT_PATHS opts out for provisioning workflows that stage tiles before ingest. The check honours the Settings the caller is operating under rather than the process-wide ones, because every analysis path already threads its own. The affected tests write manifests into tmp_path, so they now declare tmp_path as the storage root — which is what a deployment does, and makes the fixtures more honest than they were. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-22 16:16:25 +02:00
Codex	4b0c016df9	feat: provision regional Kempen buildings	2026-07-14 19:01:49 +02:00
Codex	6ea3586a3e	Initial GeoIntel V1 foundation	2026-06-16 23:36:32 +02:00