Jens
5f4f399abf
GeoIntel release gates / Compile, test, contracts and builds (pull_request) Canceled after 0s
GeoIntel release gates / Python and npm vulnerability policy (pull_request) Canceled after 0s
GeoIntel release gates / GIS image, SBOM and container scan (pull_request) Canceled after 0s
GeoIntel release gates / AI image, SBOM and container scan (pull_request) Canceled after 0s
GeoIntel release gates / Compile, test, contracts and builds (push) Failing after 1m6s
GeoIntel release gates / Python and npm vulnerability policy (push) Failing after 33s
GeoIntel release gates / GIS image, SBOM and container scan (push) Successful in 2m55s
GeoIntel release gates / AI image, SBOM and container scan (push) Skipped
91 lines
4.1 KiB
Markdown
91 lines
4.1 KiB
Markdown
# GeoIntel hardening — 2026-08-26
|
|
|
|
This change set converts the 2026-08-26 repository audit into executable
|
|
guardrails without widening any data-source or AI accuracy claim.
|
|
|
|
## Implemented controls
|
|
|
|
### Secure defaults
|
|
|
|
- Guest access is opt-in instead of enabled by default across Settings, Compose,
|
|
the Unraid environment template, DockerMan runtime script and Unraid GUI
|
|
template.
|
|
- Configured YOLO validation-scope enforcement is opt-out only in
|
|
non-production research/development contexts.
|
|
- Production YOLO uses CUDA. Configured inference remains bound to the existing
|
|
immutable validation-scope service; absent or invalid scope evidence keeps
|
|
YOLO unavailable without taking the GIS runtime offline.
|
|
- The Unraid runtime now passes both the validation-scope manifest path and its
|
|
expected SHA-256 into the container.
|
|
|
|
### Repository hygiene
|
|
|
|
- `.codex-input/` and `.codex-artifacts/` are forbidden tracked paths.
|
|
- Transient SQLite WAL/SHM files are forbidden.
|
|
- A tracked-file size budget prevents large local scratch artifacts from
|
|
silently returning; governed accuracy evidence and presentation assets have
|
|
explicit narrow allowlists.
|
|
- Cross-project DockDeck archives and Stitch imports, transient SQLite state,
|
|
generated contact sheets, calibration scratch and error-review scratch are
|
|
removed from the current repository tree.
|
|
|
|
Historical Git objects are intentionally not rewritten by this change. Purging
|
|
old blobs requires a coordinated destructive history rewrite and force-update
|
|
of every clone, so it is a separate operator decision.
|
|
|
|
### Engineering quality
|
|
|
|
- Repository architecture budgets turn the largest legacy modules into a
|
|
ratchet: they may shrink but may not grow.
|
|
- Critical Python static checks and frontend source-policy linting are release
|
|
gates alongside the existing full tests, typecheck and build.
|
|
- The source-policy gate forbids debugger statements, `@ts-ignore`, `eval()` and
|
|
dynamic `Function` construction without adding an unlocked npm dependency.
|
|
- A managed `.gitea/workflows/chatgpt-validation.yml` exposes the allowlisted
|
|
`test`, `lint`, `typecheck`, `build`, `security` and `full` profiles expected
|
|
by ITWorx Gitea Workspace once this bootstrap change reaches the default
|
|
branch.
|
|
|
|
A migration to ESLint 10 remains a dependency upgrade rather than being mixed
|
|
into this hardening pass. ESLint 9 reached upstream end-of-life in August 2026.
|
|
|
|
### Supply chain
|
|
|
|
- External Actions are pinned to full commit SHAs.
|
|
- External Docker base/runtime images are digest-pinned.
|
|
- TruffleHog, Syft and Trivy execute through digest-pinned container images.
|
|
- CI verifies those policies so mutable references cannot silently return.
|
|
- Both GIS and AI release images are built, SBOMed and scanned under the same
|
|
vulnerability policy.
|
|
- Nested Gitea/act runners no longer rely on checkout host-path binds for
|
|
secret scanning, SBOM generation or container scanning.
|
|
- The Unraid Torch index default is aligned with the retained CUDA 12.8 runtime
|
|
evidence instead of silently selecting a different CUDA wheel channel.
|
|
|
|
### Deployment gating
|
|
|
|
Tower autoredeploy is downstream of the successful `GeoIntel release gates`
|
|
workflow on `main` and deploys the workflow's exact validated head SHA. A direct
|
|
push can therefore no longer bypass release validation and immediately roll to
|
|
production.
|
|
|
|
## Explicit non-claims
|
|
|
|
This hardening does **not**:
|
|
|
|
- make the active building detector nationally validated;
|
|
- replace the required geographically independent protected test and human
|
|
review evidence;
|
|
- convert guest mode into tenant isolation;
|
|
- convert the PostgreSQL/in-process worker model into a distributed queue;
|
|
- purge historical Git objects;
|
|
- alter official source semantics or CRS contracts.
|
|
|
|
## External repository control
|
|
|
|
Gitea branch protection for `main` is still required. The connected workspace
|
|
can audit protection, create isolated branches, validate pull requests and merge
|
|
them safely, but its current capability catalog does not expose a write action
|
|
for branch-protection rules. Until an administrator enables protection, the
|
|
downstream validated deploy gate remains the compensating production control.
|