geointel/docs/AUDIT_REMEDIATION_ROADMAP.md

# Audit remediation roadmap

Status: active, 2026-07-26

## Release outcome

GeoIntel may accept every valid AOI inside the governed Belgium and Belgian
North Sea scope. It may only call a theme operational where bounded processing,
source coverage, provenance, resolution and validation evidence support that
claim. Production AI inference on the server uses its NVIDIA GPU and fails
closed when CUDA is unavailable; CPU fallback is not an accepted production
state.

## Wave 0 - Runtime truth and NVIDIA GPU (in progress)

- expose the NVIDIA device to the Unraid container;
- set `YOLO_DEVICE=cuda:0` and `YOLO_REQUIRE_CUDA=true` in the server runtime;
- make preflight and model loading reject missing CUDA instead of using CPU;
- report configured device, CUDA requirement and accelerator readiness;
- rebuild on Tower and capture `nvidia-smi`, CUDA-enabled PyTorch, preflight and
  one bounded inference smoke as release evidence.

Exit gate: the live container sees the NVIDIA GPU, `torch.cuda.is_available()`
is true, preflight is ready, and a persisted smoke run records the configured
CUDA device. A CPU-only image or unavailable device remains `not_configured` /
unavailable and cannot run production inference.

## Wave 1 - General AOI orchestration (in progress)

- [x] introduce one persisted parent operation with source-specific partitions;
- [x] derive partitions from provider side budgets supplied by the governed plan;
- [x] support queued execution, bounded retries, checkpoints and restart recovery;
- make partition application idempotent and retain exact request/checksum
  provenance;
- [x] reuse source-aware vector deduplication and raster mosaic contracts and
  aggregate their Dataset identities into one parent result;
- [x] expose one progress/result contract to the frontend system workspace.

Start with existing orthophoto, GRB and raster partition services; do not create
a second provider or persistence path. Keep per-source limits internal. A source
that cannot cover a partition returns explicit partial/not_configured evidence.

Exit gate: interrupted cross-region and coastal golden AOIs resume without
duplicate rows and finish as one inspectable result.

## Wave 2 - Zone x theme x source coverage truth (implemented; live gate pending)

- [x] materialize the resolver contract for land, regions and legal maritime zones;
- [x] evaluate partition-union spatial coverage and expose source edition,
  resolution, time, CRS, attribution, licence and checksum evidence;
- [x] derive only `operational`, `partial`, `not_configured` or `unsupported`;
- [x] show missing partitions and limitations in API and map states;
- [x] prohibit UI wording that implies complete national analysis from selection
  acceptance alone.

Exit gate: all frozen golden areas have checksum-bound coverage evidence and no
theme is promoted from file presence or a Mol-only success.

## Wave 3 - Source completion

- resolve North Sea bathymetry through a TLS-valid, authority-approved endpoint
  or reviewed bounded operator acquisition; never bypass TLS;
- close configured orthophoto/nature/soil gaps for Wallonia where authoritative
  machine access permits;
- close Brussels orthophoto gaps and retain unsupported statuses where no
  source-appropriate analytical contract exists;
- add explicit external-catalog review evidence for the six source families
  currently requiring review.

Exit gate: every required theme/zone cell has current evidence and honest status;
vertical datums remain separate and water volume remains unavailable without a
governed compatible model.

## Wave 4 - Model portfolio and validation (current active model gated)

- [x] inventory model assets without treating presence as configuration;
- [x] bind the current active model to persisted Mol/Kempen Area evidence;
- [x] retain building-only semantics for the current active detector;
- add segmentation only with a configured model, georeferencing tests and
  persisted polygon/mask evidence;
- [x] require a model/region pair to pass reproducible holdout, hard-negative and
  QA gates pass.

Exit gate: UI and API operational labels are derived from validation evidence,
not run counts; no claim that PyTorch itself is trained on themes.

## Wave 5 - Release proof

- run Mol/Kempen plus Walloon, Brussels, language-boundary, coastal and maritime
  golden workflows;
- test fresh install, upgrade, rollback, restart/resume and sustained runtime;
- audit OpenAPI envelopes, CRS/units, provenance, exports and frontend
  loading/empty/error states;
- publish exact checksums, source editions, model evidence and known limitations.

Exit gate: `docs/DEFINITION_OF_DONE.md` and the RC freeze are satisfied. The
product claim remains location-complete at source-native resolution, never
literal centimetre-resolution.

## Execution order

1. Finish Wave 0 and verify it live on Tower.
2. Implement the parent/partition state machine and one GRB/orthophoto vertical
   slice from Wave 1.
3. Generalize that slice across compatible raster/vector providers.
4. Deliver Wave 2 before promoting additional source cells.
5. Run Waves 3 and 4 in parallel only where their evidence is independent.
6. Close with Wave 5; do not advertise the audited guarantee before its gate.