7 Commits

Include renames

Author	SHA1	Message	Date
JensandClaude Opus 5	16dedeb670	claim analysis jobs atomically and keep acquisition on its official host ... Two defects of the same kind: work that is supposed to be bounded is not. The analysis worker selected queued jobs and then set them to running in a second statement. A restarted process overlapping the previous one, or a second replica, could both select the same row and both start tiled GPU inference on it — duplicate analysis runs and double the GPU load. The AOI worker beside it already claims with FOR UPDATE SKIP LOCKED; this uses a conditional update, which is the same guarantee in one statement. run_once now reports jobs it actually claimed rather than jobs it looked at. urlopen follows redirects, so although every acquisition URL is built from settings and cannot be steered by a request payload, a misconfigured or compromised upstream could send the runtime to the loopback interface, to another container on the compose network, or to a cloud metadata endpoint — and the bytes would then be persisted under an official provenance. That is exactly the substitution the product forbids. All eight fetch sites now open through a guard that refuses private, loopback and link-local destinations (resolving the host first, so a DNS name cannot hide one) and refuses a redirect that leaves the configured origin or downgrades from HTTPS. The guard is proven by calling the services' own fetch paths, not by grepping for the call: every existing acquisition test injects an opener, which bypasses it by design. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-22 15:59:01 +02:00
Codex	512e15f24b	Handle DHMV WCS edge grid rounding	2026-07-16 12:47:53 +02:00
Codex	d64f07ad9c	Normalize DHMV tile mosaic resolution	2026-07-15 19:01:11 +02:00
Codex	69ce385e2f	Rate-limit official DHMV tile acquisition	2026-07-15 18:57:48 +02:00
Codex	705dfad4f1	Harden DHMV WCS request headers	2026-07-15 18:54:31 +02:00
Codex	daf9cef01b	Tile large DHMV coverage requests	2026-07-15 18:50:03 +02:00
Codex	5d8b46ed60	Add governed DHMV terrain analysis	2026-07-15 18:13:05 +02:00