geointel/docs/AUDIT_REMEDIATION_ROADMAP.md

Audit remediation roadmap

Status: active, 2026-07-26

Release outcome

GeoIntel may accept every valid AOI inside the governed Belgium and Belgian North Sea scope. It may only call a theme operational where bounded processing, source coverage, provenance, resolution and validation evidence support that claim. Production AI inference on the server uses its NVIDIA GPU and fails closed when CUDA is unavailable; CPU fallback is not an accepted production state.

Wave 0 - Runtime truth and NVIDIA GPU (in progress)

• expose the NVIDIA device to the Unraid container;
• set YOLO_DEVICE=cuda:0 and YOLO_REQUIRE_CUDA=true in the server runtime;
• make preflight and model loading reject missing CUDA instead of using CPU;
• report configured device, CUDA requirement and accelerator readiness;
• rebuild on Tower and capture nvidia-smi, CUDA-enabled PyTorch, preflight and one bounded inference smoke as release evidence.

Exit gate: the live container sees the NVIDIA GPU, torch.cuda.is_available() is true, preflight is ready, and a persisted smoke run records the configured CUDA device. A CPU-only image or unavailable device remains not_configured / unavailable and cannot run production inference.

Wave 1 - General AOI orchestration (in progress)

• introduce one persisted parent operation with source-specific partitions;
• derive partitions from provider side budgets supplied by the governed plan;
• support queued execution, bounded retries, checkpoints and restart recovery;
• make partition application idempotent and retain exact request/checksum provenance;
• reuse source-aware vector deduplication and raster mosaic contracts and aggregate their Dataset identities into one parent result;
• expose one progress/result contract to the frontend system workspace.

Start with existing orthophoto, GRB and raster partition services; do not create a second provider or persistence path. Keep per-source limits internal. A source that cannot cover a partition returns explicit partial/not_configured evidence.

Exit gate: interrupted cross-region and coastal golden AOIs resume without duplicate rows and finish as one inspectable result.

Wave 2 - Zone x theme x source coverage truth (implemented; live gate pending)

• materialize the resolver contract for land, regions and legal maritime zones;
• evaluate partition-union spatial coverage and expose source edition, resolution, time, CRS, attribution, licence and checksum evidence;
• derive only operational, partial, not_configured or unsupported;
• show missing partitions and limitations in API and map states;
• prohibit UI wording that implies complete national analysis from selection acceptance alone.

Exit gate: all frozen golden areas have checksum-bound coverage evidence and no theme is promoted from file presence or a Mol-only success.

Wave 3 - Source completion

• resolve North Sea bathymetry through a TLS-valid, authority-approved endpoint or reviewed bounded operator acquisition; never bypass TLS;
• close configured orthophoto/nature/soil gaps for Wallonia where authoritative machine access permits;
• close Brussels orthophoto gaps and retain unsupported statuses where no source-appropriate analytical contract exists;
• add explicit external-catalog review evidence for the six source families currently requiring review.

Exit gate: every required theme/zone cell has current evidence and honest status; vertical datums remain separate and water volume remains unavailable without a governed compatible model.

Wave 4 - Model portfolio and validation (current active model gated)

• inventory model assets without treating presence as configuration;
• bind the current active model to persisted Mol/Kempen Area evidence;
• retain building-only semantics for the current active detector;
• add segmentation only with a configured model, georeferencing tests and persisted polygon/mask evidence;
• require a model/region pair to pass reproducible holdout, hard-negative and QA gates pass.

Exit gate: UI and API operational labels are derived from validation evidence, not run counts; no claim that PyTorch itself is trained on themes.

Wave 5 - Release proof

• run Mol/Kempen plus Walloon, Brussels, language-boundary, coastal and maritime golden workflows;
• test fresh install, upgrade, rollback, restart/resume and sustained runtime;
• audit OpenAPI envelopes, CRS/units, provenance, exports and frontend loading/empty/error states;
• publish exact checksums, source editions, model evidence and known limitations.

Exit gate: docs/DEFINITION_OF_DONE.md and the RC freeze are satisfied. The product claim remains location-complete at source-native resolution, never literal centimetre-resolution.

Execution order

1. Finish Wave 0 and verify it live on Tower.
2. Implement the parent/partition state machine and one GRB/orthophoto vertical slice from Wave 1.
3. Generalize that slice across compatible raster/vector providers.
4. Deliver Wave 2 before promoting additional source cells.
5. Run Waves 3 and 4 in parallel only where their evidence is independent.
6. Close with Wave 5; do not advertise the audited guarantee before its gate.