Current operations handoff¶
Last updated: July 26, 2026 at 04:18 UTC.
Executive status¶
DTED.org is deployed from application revision 372d887 with production portal
image
sha256:2c455f5c12a439f0ab6d46ca36f7aac7364e162d47eeb1b9539392826559ae44.
The portal and worker are healthy and run unprivileged with read-only root
filesystems, all capabilities dropped, no-new-privileges, PID limits, init,
and isolated temporary filesystems. Nginx is the only public listener; the
portal remains bound to loopback.
The public landing page, coverage API, documentation, active state hosts,
public QA previews, wildcard TLS, response headers, byte ranges, TAK client
assets, and offline state packages passed deployment checks. Both the root SDS
cell form and ATAK's /elevation/DTED/ prefixed cell form are served through
the same release-first lookup. Native ATAK use was previously observed in
California without Simple DTED Streamer; HTTP checks do not replace per-release
hardware attestations.
State terrain-source discovery¶
The July 26 application release adds source-aware navigation to every active
state and source-specific endpoint. The endpoint root identifies the selected
terrain source and links to the stable regional comparison at
https://dted.org/states/STATE/. The comparison describes the terrain model,
native posting, delivered DTED level, vertical reference, fallback policy,
quality result, exact source-only enhanced coverage, common users, use cases,
and limitations for each available source.
GET /api/v1/regions/STATE/terrain-sources provides the same selection data to
machine-readable consumers. Eligible public, QA-passed source previews are
included and explicitly labeled evaluation; they remain excluded from the
production-only GET /api/v1/products catalog. Production takes precedence
when the same source is both active and staged. Private, failed, malformed, or
canonical-refresh previews are not advertised.
The dynamic state root is intentionally limited to /. Nginx continues to
serve cells, SDS indexes, client profiles, mission packages, ZIPs, metadata,
and quality evidence as immutable static release artifacts. If the portal is
unavailable, each release's static landing page remains the state-root
fallback. Installations that restrict QA hosts must set
DTED_PUBLIC_QA_DISCOVERY=0; the production installer derives that default
from the installed QA allowlist.
Production verification passed for the canonical and source-specific state roots, the regional comparison page and API, QA no-index headers, the production-only product boundary, and both canonical CA and CA 3DEP TAK artifact smoke tests.
Active state releases¶
| State | Active release | Automated QA | Publication status |
|---|---|---|---|
| CA | a8f18033bbc9d188 |
Pass | Active maintenance successor |
| TN | c4e5e66d444cf3db |
Pass | Active maintenance successor |
| TX | ef25662ecc37fc3f |
Pass | Active maintenance successor |
| VA | 792175342e93b6a6 |
Pass | Active maintenance successor |
| NC | 8c3b612d64285226 |
Fail | Active disclosed evaluation successor |
| SC | 5bd9dc8cb81f2d3c |
Fail | Active disclosed evaluation successor |
North Carolina retains 3,888,096 void samples on state land. South Carolina retains 7,145,029. Those failures remain visible in their public quality summaries and must not be described as passing or evidence-certified. The current California, Tennessee, Texas, and Virginia source audits pass, but the active maintenance successors do not contain per-release ATAK and WinTAK attestations.
All six active hosts pass the expanded live smoke test. The checks require a valid 180×360 SDS index, range-capable hemisphere and offline ZIPs, root and ATAK-prefixed per-cell equality, correct client hostnames, and the recorded quality state.
California 3DEP candidate¶
Candidate 67a19f908494fd1e remains staged only at the public QA host
preview-ca-3dep.dted.org;
ca-3dep.dted.org remains inactive. It was built from 100 current TNM assets at
source version 2026-06-10.
- Archive SHA-256:
068bdd8274a32297c0834a0d34fd26853327c8f102f451bb1dbf3243cc5fdc75 - Processing profile:
411a17ef58bddd0e - Automated QA: 69/69 cells, zero state-land voids, exact seams, controls pass
- Baseline policy:
none - Live public-preview smoke: pass, including native ATAK-prefixed route and uncovered-cell isolation 404
Do not activate this source alternative until the exact candidate has representative ATAK and WinTAK evidence or an explicit, recorded cohort validation override. ATAK's native elevation tool is the primary path; Simple DTED Streamer and the offline state package are additional compatibility paths.
North Carolina and South Carolina refresh¶
Run 20260724T174514Z refreshed both canonical sources directly through the
approved USGS M2M account. The credential existed only as an owner-readable
file under /run, was not passed in a command or container environment, and was
deleted after the serialized acquisitions. Receipt and archive hashes were
independently checked.
The current upstream SRTM DTED products reproduce the existing defects:
| State | Source selection | Cells | Archive SHA-256 | State-land voids |
|---|---|---|---|---|
| NC | 27 SRTM v3 scenes/products | 27/27 | 63a061dde39716598a7b5ba40904b92cf8de9d76568da0930eca070cb9948ea9 |
3,888,096 |
| SC | 19 SRTM v3 scenes/products | 18/18 | 247037aca4090ff5fa489a699d678d73d7d5f6871da394ff1d6e02ca7ae7da13 |
7,145,029 |
Both canonical audits failed closed. No override was used, no release was built
from either failed refresh, and the active NC and SC releases listed above were
not changed. The prior canonical audit reports are archived under
quality/source-audit-history/{NC,SC}/20260724T174514Z.
Two explicitly source-specific USGS 3DEP candidates were then acquired and staged:
| Dataset | Candidate | Public QA preview | Source assets/version | Automated QA |
|---|---|---|---|---|
nc-3dep |
d32ac8e908350c85 |
preview-nc-3dep.dted.org |
38 assets; 2026-04-29 |
27/27 cells; zero land voids; exact seams |
sc-3dep |
710feea02560ac37 |
preview-sc-3dep.dted.org |
27 assets; 2026-04-17 |
18/18 cells; zero land voids; exact seams |
The NC archive SHA-256 is
deeae768fd4627c429ab54ab2e06edc72d56db969ca8edea344a241b529fa7b0
and its processing profile is 53e7849373c6d2b6. The SC archive SHA-256 is
98b969c88cec571c429ae368c99b13df9fb388c8548bad754e7036254f078758
and its processing profile is 3ff5a2acefabe9da. Both profiles use only the
pinned local datum grids, have PROJ networking disabled, and declare
baseline_policy: none.
Both public QA previews pass the release smoke test, including range requests,
root and ATAK-prefixed cells, state-only offline packages, quality evidence, and
an uncovered-cell isolation 404. They carry
X-Robots-Tag: noindex, nofollow, noarchive, which is not an access-control
boundary. Do not promote either candidate until the exact release has
representative ATAK and WinTAK evidence or an explicit, recorded cohort
validation override.
Security checkpoint¶
The July 24 security audit is published in the field guide. Its final results:
- Gitleaks found no current-tree or complete-history leaks.
- The value-safe metadata scanner found no credential-shaped fields in 160 repository and production JSON receipts/manifests.
- The stale root-only bootstrap-password file was deleted without reading. The later AndKit auth cutover removed DTED's password bootstrap and rotation tools entirely.
- Provider files are
root:root 0600, the TLS key is root-only, and the portal database is0640. Browser identities now come only from central AndKit OIDC through the signed proxy contract. - Bandit, pip consistency, pip-audit, and Trivy pass. The exact production image has zero fixed high/critical OS or Python findings.
- TLS 1.2 and 1.3 verify successfully. All tested HTTPS responses hide the Nginx version and carry the documented browser hardening headers.
The Basic Authentication risk recorded by the July 24 audit is superseded by central AndKit OIDC. Remaining accepted risks are no enforced Content Security Policy pending asset review, non-PyPI advisory matching for the two local packages, and compatible dependency ranges that require retaining and scanning each deployed image digest.
Next operations¶
- Capture ATAK and WinTAK evidence for the exact NC and SC 3DEP candidates, including native elevation, optional SDS, offline import, representative locations, and source-isolation behavior.
- Promote or explicitly defer
nc-3depandsc-3depbased on that evidence; do not replace the canonical hostnames silently. - Capture ATAK and WinTAK evidence for the exact California 3DEP candidate, including native elevation, optional SDS, offline import, representative control points, and source-isolation behavior.
- Promote or explicitly defer
ca-3depbased on that evidence. - After every source staging or promotion operation, verify the state root, regional comparison API, and the production-only product-catalog boundary.
- Add phishing-resistant operator authentication when the simplified deployment is ready for OIDC or another MFA-capable boundary.
- Review and pin a fully resolved application dependency set before a future reproducibility milestone.
Use the authoritative-source release runbook for source work and the security and secrets runbook for routine scans, rotation, backup, incident response, and recovery. No credential values or client IPs belong in this handoff.