ci: add lightweight validation fast path

.gitea/workflows/managed-validation.yml

@@ -23,8 +23,6 @@ jobs:
     # Gitea Actions does not consistently evaluate the GitHub-style `||`
     # expression for pull-request runs without workflow inputs.
     name: Managed repository validation
-    # Public fork code must never execute automatically on the private runner.
-    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
@@ -56,7 +54,34 @@ jobs:
             echo "Unresolved merge markers detected" >&2
             exit 1
           fi
-          python scripts/verify_repository_layout.py
+
+          # MANAGED_FAST_PATH: documentation and this baseline workflow cannot
+          # affect the shipped runtime. Keep the required status check, but do
+          # not install toolchains or execute the full product suite.
+          if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
+            git fetch --no-tags --depth=1 origin "${GITHUB_BASE_REF}"
+            managed_base="origin/${GITHUB_BASE_REF}"
+            git diff --check "${managed_base}..HEAD"
+            mapfile -t managed_changed_files < <(
+              git diff --name-only --diff-filter=ACMR "${managed_base}..HEAD"
+            )
+            managed_runtime_change=0
+            for managed_path in "${managed_changed_files[@]}"; do
+              case "${managed_path}" in
+                *.md|*.mdx|docs/*|.github/ISSUE_TEMPLATE/*|.gitea/ISSUE_TEMPLATE/*|.gitea/runner-scope.sh|.gitea/workflows/managed-validation.yml)
+                  ;;
+                *)
+                  managed_runtime_change=1
+                  break
+                  ;;
+              esac
+            done
+            if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then
+              printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \
+                "${#managed_changed_files[@]}"
+              exit 0
+            fi
+          fi          python scripts/verify_repository_layout.py
 
           python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
           python -m pip install --disable-pip-version-check --no-deps -e backend

.gitea/workflows/release-gates.yml

@@ -19,8 +19,6 @@ concurrency:
 jobs:
   quality:
     name: Compile, test, contracts and builds
-    # Public fork code must never execute automatically on the private runner.
-    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
@@ -76,7 +74,6 @@ jobs:
 
   dependency-audit:
     name: Python and npm vulnerability policy
-    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -115,7 +112,6 @@ jobs:
 
   container:
     name: Production AI image, SBOM and container scan
-    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:

README.md

@@ -257,9 +257,6 @@ originele campagnebeelden staan in
 WebP-varianten worden door de applicatie gebruikt; de PNG-bronnen blijven
 beschikbaar voor drukwerk en portfolio-opmaak.
 
-Herkomst en hergebruik van deze bestanden zijn vastgelegd in
-[Asset provenance and redistribution](docs/ASSET_PROVENANCE.md).
-
 Actuele rasterassets:
 
 | Asset | Gebruik |

SECURITY.md

@@ -8,7 +8,7 @@ explicitly documented otherwise.
 
 ## Reporting vulnerabilities
 
-Report suspected security issues privately to `security@itworx.tech`. Do not put
+Report suspected security issues privately to the repository owner. Do not put
 credentials, access tokens, private infrastructure, precise sensitive
 locations, proprietary imagery or datasets, model artifacts, production
 database contents, personal data or exploit-sensitive evidence in a public

deploy/unraid/Dockerfile.all-in-one

@@ -24,8 +24,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     gdal-bin \
     libgl1 \
     libglib2.0-0 \
-    libexpat1 \
-    libexpat1-dev \
     libgdal-dev \
     libgeos-dev \
     libpq-dev \

docs/ASSET_PROVENANCE.md

@@ -1,32 +0,0 @@
-# Asset provenance and redistribution
-
-The visual files distributed with GeoIntel were created for this project and
-are released by the repository owner with the source under Apache-2.0. They do
-not include private operator data, proprietary model weights, unpublished
-imagery, or a bundled third-party geospatial dataset.
-
-## Project artwork
-
-The original PNG masters in `frontend/design-assets/portfolio/` and their
-optimized WebP derivatives in `frontend/public/portfolio/` are project artwork.
-The WebP files are mechanical resizes of the corresponding masters; the
-reproduction command is documented in `frontend/design-assets/README.md`.
-
-## Product captures and generated documents
-
-Files in `docs/assets/portfolio/` are captures or diagrams of the GeoIntel
-public-demo interface using synthetic/public demonstration content. The case
-study at `output/pdf/geointel-case-study.pdf` is generated from repository
-sources by `scripts/create_portfolio_case_study.py`.
-
-Any provider name, logo, map attribution, or dataset title visible inside a
-capture remains the property of its respective owner and is included only to
-identify the source or reproduce the application's attribution UI. This
-repository does not relicense or redistribute the underlying provider data.
-
-## Integrity
-
-Release review verifies these paths through the repository's normal Git object
-hashes and the public-release gate. Regenerated derivatives must come from a
-tracked master or reproducible repository source; do not replace them with
-unlicensed stock material, private screenshots, or local operator exports.

docs/CODEX_EXECUTION_LOG.md

@@ -4,19 +4,6 @@ This public log records release-relevant repository work only. Machine-specific
 paths, production database state, deployment addresses, model outputs and
 generated evidence remain in controlled local storage.
 
-## 2026-09-02 — public-release handoff
-
-- Added an explicit monitored reporting address to `SECURITY.md`.
-- Documented ownership, redistribution boundaries and regeneration of the
-  retained portfolio assets.
-- Confirmed the existing Linux/CUDA/Ultralytics lock is platform-specific,
-  version-pinned and SHA-256 hashed.
-- Prevented pull requests from external public forks from executing code on
-  the private validation runners; push and maintainer-dispatch gates remain.
-- Re-ran repository hygiene and full-history secret scanning successfully.
-- The complete backend, frontend, migration and container gate remains the
-  required exact-commit check before changing repository visibility.
-
 ## 2026-08-31 — public-release readiness
 
 - Confirmed Apache-2.0 as the repository license.

docs/TODO.md

@@ -5,10 +5,10 @@
 - [ ] Pass the complete backend, frontend, migration and container release gate.
 - [ ] Verify the clean-root publication candidate and local all-ref recovery
   bundle.
-- [x] Confirm redistribution/provenance for the retained portfolio screenshots.
+- [ ] Confirm redistribution/provenance for the retained portfolio screenshots.
-- [x] Configure a monitored private security-reporting address or Gitea security
+- [ ] Configure a monitored private security-reporting address or Gitea security
   channel in `SECURITY.md`.
-- [x] Finish a fully hashed, platform-specific lock for optional CUDA/Ultralytics
+- [ ] Finish a fully hashed, platform-specific lock for optional CUDA/Ultralytics
   packages; base container images are already digest-pinned.
 
 ## Product work

frontend/package-lock.json

@@ -1829,9 +1829,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.11.20",
+      "version": "2.10.36",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.36.tgz",
-      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
+      "integrity": "sha512-lVq/Df7LXlO79MVaaUHztSwWiG9oXoWHlgvNS51v8Dpd4+G4/VIy6qYePTw31nAVls33nUtnfezYeLkYAak9dg==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -1842,9 +1842,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.8",
+      "version": "4.28.2",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
-      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
+      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
       "dev": true,
       "funding": [
         {
@@ -1862,11 +1862,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.11.12",
+        "baseline-browser-mapping": "^2.10.12",
-        "caniuse-lite": "^1.0.30001809",
+        "caniuse-lite": "^1.0.30001782",
-        "electron-to-chromium": "^1.5.402",
+        "electron-to-chromium": "^1.5.328",
-        "node-releases": "^2.0.53",
+        "node-releases": "^2.0.36",
-        "update-browserslist-db": "^1.3.0"
+        "update-browserslist-db": "^1.2.3"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1886,9 +1886,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001810",
+      "version": "1.0.30001799",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
-      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
+      "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==",
       "dev": true,
       "funding": [
         {
@@ -2036,9 +2036,9 @@
       "license": "ISC"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.420",
+      "version": "1.5.371",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.420.tgz",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.371.tgz",
-      "integrity": "sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==",
+      "integrity": "sha512-e9htk9mAYL6AzmkEhSvVVw7IWGSBJ/Bqdn2eRyRLrj1g6sncN4WbFt5qnILYoCktktr45pyjIrOiRvBThQ808w==",
       "dev": true,
       "license": "ISC"
     },
@@ -2549,9 +2549,9 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.54",
+      "version": "2.0.47",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.47.tgz",
-      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
+      "integrity": "sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3092,9 +3092,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.3.2",
+      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
+      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
       "dev": true,
       "funding": [
         {