State quality gate

Public state releases are never activated by a build. They move through acquisition, deep audit, immutable candidate build, public QA preview, ATAK and WinTAK attestation, and explicit operator promotion.

Automated checks

The state audit pins the Census TIGERweb boundary in the acquisition receipt and requires the source archive to match that receipt's SHA-256. Every boundary- intersecting one-degree cell must be present at DTED2 and no unrelated cell may be included.

Every DTED cell receives a complete streaming scan. The gate validates UHL, DSI, ACC, dimensions, one-arc-second spacing, data sentinels and counters, record checksums, signed-magnitude elevations, state-land voids, shared edges, and curated control points. The release publishes a compact quality-summary.json; per-cell details remain under the operator quality directory.

Schema-3 receipts additionally require an authoritative source ID and collection, immutable upstream asset records, a credential-free processing record, EGM96 output, a pinned processing-profile hash, and PROJ_NETWORK=off. The output archive must match both the receipt and manifest. Source-specific releases fail if a land void would require data from another source.

Schema-3 conversion receipts may declare only the bounded postprocessing used by the source-neutral converter: same-source repair of a land-boundary void from an adjacent valid land post, and canonicalization of duplicated shared posts whose independent rounding differs by no more than one meter. The audit rejects broader postprocessing declarations, then independently requires zero state-land voids and exact shared edges in the resulting archive. Interior voids, missing neighbors, larger edge differences, and any cross-source fill still fail.

Candidate workflow

For California, then North Carolina, then Texas:

make check-usgs-access STATE=CA
make acquire-state STATE=CA
make audit-state STATE=CA
make build-state STATE=CA
make preview-state STATE=CA RELEASE=release-id
make attest-state STATE=CA RELEASE=release-id CLIENT=atak VERSION=version PLUGIN_VERSION=version PLATFORM=device OS_VERSION=version EVIDENCE=screenshot.png OPERATOR=name NOTES="locations tested"
make attest-state STATE=CA RELEASE=release-id CLIENT=wintak VERSION=version PLUGIN_VERSION=version PLATFORM=workstation OS_VERSION=version EVIDENCE=client.log OPERATOR=name NOTES="locations tested"
make promote-state STATE=CA RELEASE=release-id OPERATOR=name
make smoke-state STATE=CA

Preview hosts use preview-STATE.dted.org and are public by default so field testers can use native TAK clients without coordinating a source CIDR. Preview staging derives its landing page, QR, preference, data package, and client JSON from the immutable candidate so every setup path uses the preview hostname. Promotion still serves the candidate's unchanged production-host assets. Preview responses carry X-Robots-Tag: noindex, nofollow, noarchive; this reduces indexing but is not an access-control boundary. Never stage sensitive or restricted data on a preview hostname.

An installation may opt into restricted QA by replacing the public entries in /etc/dted/qa_allowlist.conf with only trusted device networks. On such an installation, an operator can temporarily open exactly one staged preview for a bounded public test window:

sudo /srv/dted/tools/qa_preview_window.sh open CA 24
sudo /srv/dted/tools/qa_preview_window.sh status
sudo /srv/dted/tools/qa_preview_window.sh close

The helper preserves the restricted policy, validates and reloads Nginx, schedules automatic closure, and refuses to open while more than one candidate is staged. It is unnecessary on the public-by-default deployment.

By default, promotion refuses a candidate unless its public summary passes and both client attestations target the exact release ID. Each attestation requires passing package import, preference, index, DTED2, control-point, and DTED0-fallback checks plus a checksum-bound screenshot or log.

For baseline_policy: none, the fallback checklist item means that the operator verified source isolation: a request outside the published source coverage returns no tile rather than the canonical baseline. ATAK native streaming without Simple DTED Streamer is the primary acceptance path. SDS and zipped-DTED import are tested as additional compatibility paths.

California is the certification canary. Promotion of any other state or territory also requires an active promoted California release.

An operator-directed cohort rollout may explicitly waive the per-release client records after validating a representative candidate. Supply CLIENT_VALIDATION_OVERRIDE="reason" to make promote-state. This never bypasses receipt integrity or automated QA, and the resulting schema-3 promotion record stores the reason and empty attestation set instead of presenting the release as evidence-certified.

If the current authoritative source itself has a known automated failure, an operator may build and publish it only as a visibly disclosed evaluation release by supplying QUALITY_GATE_OVERRIDE="reason" to both make build-state and make promote-state. The release retains the failed public quality summary, and the schema-3 promotion record stores the failure list and override reason. This does not convert a failed audit into a passing or evidence-certified result.

Rollback accepts only a release that has a prior promotion record:

make rollback-state STATE=CA RELEASE=certified-release-id OPERATOR=name

Keep the active release and two prior releases. make prune removes only older candidates and abandoned staging directories according to the documented retention windows. Failed source summaries remain visible in the portal's state source-audit table even when no candidate can be built.