5 Commits

Include renames

Author	SHA1	Message	Date
Jens	80a2d1654d	fix(platform): govern geospatial analysis and raster handoffs	2026-08-30 06:00:15 +02:00
JensandClaude Opus 5	e2f586c029	consume only artifacts the runtime produced ... tile_manifest_path arrives in the detection and segmentation request and was read straight off disk, and a manifest entry may name an absolute tile path. That makes an API field an unbounded reference to the host filesystem, and it contradicts the rule the persistence model rests on: only a governed, runtime-produced artifact may be consumed, and a file outside the storage root is not one. Both the manifest and every tile it names now resolve under STORAGE_ROOT. Resolution happens before the comparison, so ".." cannot climb out and a sibling that merely shares a name prefix does not pass. GEOINTEL_ALLOW_EXTERNAL_ARTIFACT_PATHS opts out for provisioning workflows that stage tiles before ingest. The check honours the Settings the caller is operating under rather than the process-wide ones, because every analysis path already threads its own. The affected tests write manifests into tmp_path, so they now declare tmp_path as the storage root — which is what a deployment does, and makes the fixtures more honest than they were. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-22 16:16:25 +02:00
JensandClaude Opus 5	08188005bd	correct the tiled inference chain and move runs off the request thread ... Tile handling produced results that were wrong before any model quality question arose: - orthophoto tiles reached the model through PIL convert("RGB"), which truncates the high byte of a 16-bit product and treats a 4-band RGB+NIR tile's infrared channel as colour. Tiles are now read with rasterio, the visible bands are chosen explicitly, and values are percentile-stretched across all three bands together so hue is preserved; - an object wider than the tile overlap was truncated by both tiles into two boxes that barely intersect, so IoU suppression kept both: two false positives and one missed footprint per seam building. Suppression now also compares overlap against the smaller box, and boxes cut by an interior tile edge are dropped in favour of the neighbouring tile's complete view; - georeferencing fell back to an assumed EPSG:4326 when a manifest carried no CRS, producing geometry that renders plausibly in the wrong place. QA already refused such a tile; inference now fails closed too. Segmentation QA scored candidates against every reference feature in the dataset, so every building outside the inferred tiles counted as a false negative. It now applies the same persisted tile coverage that detection QA has always used, including the indexed ST_Intersects prefilter. Duplicate suppression uses an STRtree instead of the O(n^2) scan, tiles are predicted in batches of YOLO_BATCH_SIZE (a setting that existed but was never read), and detection/segmentation runs can be queued through /run-async for a polling background worker rather than holding an HTTP worker thread for minutes of GPU work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-22 14:32:44 +02:00
Jens	5b3c17b494	feat(provenance): govern source snapshots and data inputs	2026-08-01 23:46:17 +02:00
Codex	0aff8e3b8c	feat(scope): make Belgium and North Sea operational default	2026-07-22 02:11:48 +02:00