chore(release): v1.0.7 - Security Hardening & Intelligence Accuracy

Author: d3mocide

CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [1.0.7] - 2026-04-18
+
+### Security
+
+- **SSRF Fix in News Article Extraction** — Hardened the `/api/news/article` reader endpoint against Server-Side Request Forgery; private/loopback addresses and non-HTTP schemes are now blocked before fetch.
+
+### Fixed
+
+- **AI Model Overload Advisory** — Domain agents (air, sea, orbital) now surface an amber `Model Overloaded` notice in the Analyst Panel when the LLM provider returns `503 / high demand` instead of silently showing heuristic fallback text.
+- **SatNOGS Timeout Resilience** — Added one retry for transient SatNOGS station fetch timeouts; timeout failures are now distinguished from broader network errors in the degraded-response metadata.
+- **News Feed Noise** — Removed DefenseNews from the default RSS feed set (intermittent `42` non-standard HTTP status); it remains configurable via env.
+- **Semantic Cache Warning Clarity** — Corrected the `redisvl` runtime-missing warning to avoid incorrectly instructing operators to edit `pyproject.toml`.
+- **HTTPS Reverse-Proxy WebSocket Fix** — Added a shared frontend URL resolver that promotes `ws://`/`http://` build-time endpoints to same-origin wss/https paths when served behind TLS, eliminating mixed-content WebSocket failures.
+- **WebSDR Mixed-Content Iframe** — WebSDR receiver iframes are now HTTPS-upgraded when discovered via an `http://` directory entry; the original URL is preserved as an external fallback link.
+- **FIRMS Poller Alias & Cooldown Loop** — Normalized the legacy `VIIRS_SNPP_NR` source alias to prevent repeated `400` errors; fixed the empty-cache cooldown-bypass guard to prevent tight re-poll loops when upstream returns no hotspots.
+- **FIRMS Test Stale Date** — Replaced the hardcoded `acq_date` fixture in the FIRMS router test with a dynamically computed value so the test never expires.
+- **Linkage Audit Form Accessibility** — Added explicit `htmlFor`/`id` attribute pairs to all `LinkageAuditView` form inputs.
+
+### Changed
+
+- **Active Conflict Zone Recalibration** — Recalibrated threat-score thresholds to match real-world GDELT distributions (CRITICAL ≤ −4.5, ELEVATED ≤ −2.0). Added a material-conflict volume shortcut: actors with >150 kinetic events promoted to CRITICAL; >50 promotes MONITORING to ELEVATED. The Intel Globe conflict zone panel now includes MONITORING-level actors with a WATCH badge.
+- **GDELT Conflict Filter & ReliefWeb Pulse Config** — `gdelt_pulse` now exposes configurable conflict-filter keywords and `ReliefWeb` appname via environment variables; GDELT event logging enhanced with structured metadata.
+- **Frontend Static Nginx Cache** — `frontend/nginx-spa.conf` no longer caches `index.html`, reducing stale-bundle issues behind CDNs and reverse proxies after deploys.
+- **Deck.gl Text Character Sets** — Explicit character sets added for label layers that render the middle-dot separator, eliminating missing-glyph console warnings.
+
 ## [1.0.6] - 2026-04-15
 
 ### Added

RELEASE_NOTES.md

@@ -1,47 +1,91 @@
-# Release - v1.0.6 - Thermal Watch
+# Release — v1.0.7 — Security Hardening & Intelligence Accuracy
+
+**Released:** 2026-04-18  
+**Type:** Patch  
+**Previous:** v1.0.6
+
+---
 
 ## Summary
 
-v1.0.6 delivers the FIRMS thermal intelligence layer and dark-vessel anomaly engine to operators, resolves the two hold items that blocked the v1.0.6 candidate, and closes out a sweep of backend ingestion reliability fixes. The ISS ground-track now updates live in the animation loop and renders cleanly after container restarts. Fire hotspot data is now sourced globally by design, while the thermal layer starts off by default to reduce initial map noise.
+v1.0.7 ships a high-priority security patch alongside a set of runtime stability fixes and a significant accuracy improvement to the Active Conflict Zone intelligence engine. Operators on HTTPS deployments will also see mixed-content WebSocket and WebSDR iframe errors resolved.
+
+---
+
+## Key Changes
+
+### 🛡️ Security
+
+- **SSRF Fix — News Article Reader** *(HIGH)*  
+  The `/api/news/article` reader endpoint now blocks requests to private/loopback addresses (`127.0.0.1`, `192.168.x.x`, `169.254.x.x`, etc.) and non-HTTP schemes before making any outbound connection. This closes a Server-Side Request Forgery vector that could have allowed authenticated operators to probe internal services.
+
+---
+
+### 🎯 Active Conflict Zone Accuracy
+
+The ACTIVE CONFLICT ZONES panel previously showed `[0]` almost always, even with active warzones (Ukraine, Israel, Sudan) appearing in the actor feed. Root cause: the old Goldstein thresholds were calibrated against an idealised model rather than real GDELT data distributions.
 
-## Key Features
+**What changed:**
+- CRITICAL threshold: `≤ −6.0` → **`≤ −4.5`** (Ukraine/Gaza cluster at −3 to −5)
+- ELEVATED threshold: `≤ −3.0` → **`≤ −2.0`**
+- New **material-conflict volume shortcut**: actors with >150 kinetic events → CRITICAL; >50 → at least ELEVATED (prevents dilution by high diplomatic-media volume)
+- **MONITORING-level actors** now appear in the conflict zone panel with a yellow `WATCH` badge, so operators see the full threat spectrum instead of just the top tier
 
-- **NRT NASA FIRMS Thermal Layer** — VIIRS/MODIS thermal infrared hotspots on the tactical map with FRP-scaled radii and confidence-coded colors.
-- **Dark Vessel Anomaly Detection** — Backend engine cross-references FIRMS heat signatures against AIS vessel positions. Vessel-scale hotspots with no AIS broadcast within 5nm/2h are surfaced as anomaly candidates.
-- **FIRMS Source Health Visibility** — Operations surfaces now show compact per-source FIRMS ingest summaries so NOAA-20, NOAA-21, and SNPP drift can be diagnosed without container log inspection.
-- **Live ISS Ground Track** — WebSocket-delivered positions now normalise Unix integer timestamps to ISO-8601 on arrival, keeping the orbital trail current in the animation loop.
-- **ISS Track Gap Detection** — Consecutive positions separated by >10 minutes start a new path segment, eliminating the distorted line artifact after container restarts.
+---
 
-## Bug Fixes
+### 🔧 Runtime Stability
 
-- FIRMS thermal visibility now defaults to `false`, while dark-vessel anomalies remain enabled and FIRMS coverage stays global.
-- FIRMS poller health now distinguishes healthy, empty, and failed upstream source responses instead of silently reporting partial upstream degradation as healthy.
-- ISS live-track timestamps normalised at the hook boundary (`useISSTracker`) so all sources (WebSocket, REST, DB) produce trail points that pass the `buildISSLayer` filter.
-- ISS track gap rendering fixed in `splitTrackAtAntimeridian`.
-- SatNOGS pagination loop indentation corrected; PeeringDB IXP coordinates recovered from facility centroids; IODA Nominatim geocoder restored.
+- **AI Model Overload Advisory** — Analyst Panel now shows an amber "Model Overloaded" notice instead of silently presenting heuristic fallback text when the LLM provider returns `503 / high demand`.
+- **SatNOGS Timeout Resilience** — One retry added for transient station fetch timeouts; timeout vs. network failures now distinguished in response metadata.
+- **HTTPS WebSocket Fix** — Shared URL resolver promotes `ws://`/`http://` build-time endpoints to same-origin secure paths when the app is served behind TLS. Eliminates mixed-content failures on HTTPS deployments.
+- **WebSDR HTTPS Iframe** — WebSDR receiver iframes are now HTTPS-upgraded on secure pages; original HTTP URL preserved as an external link fallback.
+- **FIRMS Poller** — Normalized legacy `VIIRS_SNPP_NR` alias; fixed empty-cache cooldown guard that caused tight re-poll loops.
+- **News Feed** — DefenseNews removed from the default feed set (intermittent non-standard HTTP status).
 
-## Technical Details
+---
 
-- TimescaleDB migration **V004** adds `firms_hotspots` hypertable and `dark_vessel_candidates` table.
-- `space_pulse` cadence policy: daily TLE refresh gated on UTC hour, FIRMS/space-weather cadence persisted in Redis across restarts.
-- FIRMS no longer supports a mission-vs-global ingest mode; the poller always uses the NASA world endpoint and `FIRMS_BBOX_MODE` is no longer part of the runtime configuration.
-- FIRMS source-cycle snapshots are now published to Redis under `firms:source_status` and surfaced through `/api/config/poller-health`.
-- No breaking API or schema changes, no new required environment variables.
+### ⚙️ Configuration
+
+- **GDELT Conflict Keywords** — Now configurable via `GDELT_CONFLICT_KEYWORDS` env var without a code change.
+- **ReliefWeb App Name** — Now configurable via `RELIEFWEB_APPNAME` env var.
+- **nginx-spa.conf** — `index.html` is no longer cached, reducing stale-bundle issues after deploys behind CDNs.
+
+---
+
+## Technical Notes
+
+- No database migrations — no schema changes in this release.
+- No new environment variables are mandatory; all new vars have sensible defaults matching previous behaviour.
+- The `sovereign-backend` container should be rebuilt to pick up AI overload handling, SatNOGS, and news changes.
+- The `sovereign-gdelt-pulse` container should be rebuilt to pick up the conflict-filter and ReliefWeb config changes.
+- The `sovereign-space-pulse` container should be rebuilt to pick up the FIRMS poller alias fix.
+- Frontend: no rebuild required for already-deployed prod builds if served via nginx (nginx-spa.conf change only affects cache headers, not functionality).
+
+---
 
 ## Verification
 
-- Frontend: `pnpm run lint` ✅ · `pnpm run typecheck` ✅ · `pnpm run test` ✅ (18/18 files, 268/268 tests)
-- Backend API: `uv tool run ruff check . && uv run python -m pytest tests/test_firms_router.py tests/test_system_router.py` ✅ (7 targeted tests)
-- Targeted poller verification: `space_pulse` lint ✅; host `space_pulse` pytest remains blocked by the known Windows/Python 3.14 `asyncpg==0.30.0` build issue.
+| Suite | Result |
+|-------|--------|
+| Frontend lint | ✅ Clean |
+| Frontend typecheck | ✅ Clean |
+| Frontend tests | ✅ 272/272 |
+| Backend API lint | ✅ Clean |
+| Backend API tests | ✅ 152/152 |
+| GDELT threshold tests | ✅ 11/11 (6 new) |
+
+---
 
 ## Upgrade Instructions
 
 ```bash
-git pull origin main
-docker compose pull
-docker compose up -d --build
-```
+git pull origin dev
 
-TimescaleDB migration V004 runs automatically on backend startup.
+# Rebuild affected services
+docker compose up -d --build sovereign-backend sovereign-gdelt-pulse sovereign-space-pulse
+
+# Frontend (if running prod static build)
+docker compose up -d --build sovereign-frontend
+```
 
-**SITREP Status: [GO]**
+No `docker compose down` required. No migrations to run.

agent_docs/tasks/2026-04-16-fix-ssrf-news-article-extraction.md

@@ -0,0 +1,32 @@
+# Fix: SSRF Vulnerability in News Article Extraction
+
+## Issue
+
+The `/api/news/article` reader endpoint made outbound HTTP requests to arbitrary URLs supplied by the frontend. An authenticated operator could craft a request URL pointing at internal services (e.g., `http://localhost/`, `http://169.254.169.254/` metadata endpoints, `http://redis:6379/`) and receive their content, constituting a Server-Side Request Forgery (SSRF) vulnerability rated HIGH.
+
+## Solution
+
+Added a blocklist validator that rejects requests before any socket connection is opened. The validator refuses:
+- Non-HTTP/HTTPS schemes (`file://`, `ftp://`, `gopher://`, etc.)
+- Loopback addresses (`127.0.0.0/8`, `::1`)
+- Link-local / metadata ranges (`169.254.0.0/16`, `fe80::/10`)
+- RFC-1918 private ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`)
+- Unspecified (`0.0.0.0`, `::`)
+
+## Changes
+
+| File | Change |
+|------|--------|
+| `backend/api/routers/news.py` | Added `_validate_url()` guard called before `httpx` fetch in the article reader route; returns `400 Bad Request` on blocked targets. |
+
+## Verification
+
+- `cd backend/api && uv tool run ruff check .` — passed (clean).
+- `cd backend/api && uv run python -m pytest tests/test_news_router.py` — passed.
+- Manual review: private IP and `file://` URLs return `400`; public URLs proceed normally.
+
+## Benefits
+
+- Eliminates SSRF attack surface in the news article extraction path.
+- Fails closed (400) rather than proxying the disallowed request.
+- Validator is a pure-Python stdlib function — no new dependencies.

agent_docs/tasks/2026-04-16-linkage-audit-a11y.md

@@ -0,0 +1,26 @@
+# Linkage Audit View Form Accessibility
+
+## Issue
+
+The `LinkageAuditView` form inputs lacked explicit `htmlFor` / `id` attribute pairs, failing accessibility linting rules (`jsx-a11y/label-has-associated-control`) and preventing screen readers from associating labels with their controls.
+
+## Solution
+
+Added matching `id` attributes to every controlled input and `htmlFor` attributes to their corresponding labels.
+
+## Changes
+
+| File | Change |
+|------|--------|
+| `frontend/src/components/views/LinkageAuditView.tsx` | Added `id` and `htmlFor` pairs to all form label/input elements. |
+
+## Verification
+
+- `cd frontend && pnpm run lint` — exit 0 (previously flagged `jsx-a11y` warnings).
+- `cd frontend && pnpm run typecheck` — passed.
+- `cd frontend && pnpm run test` — all tests passed.
+
+## Benefits
+
+- Screen readers can now correctly associate labels with form controls in the diagnostic view.
+- Satisfies `jsx-a11y/label-has-associated-control` for CI lint gate.

agent_docs/tasks/2026-04-17-gdelt-conflict-filter-config.md

@@ -0,0 +1,28 @@
+# GDELT Conflict Filter & ReliefWeb Pulse Configuration
+
+## Issue
+
+The `gdelt_pulse` service had hardcoded conflict-filter keywords and a hardcoded ReliefWeb `appname` query parameter, making it impossible to tune the filter without a code change and container rebuild. Additionally, GDELT event ingestion lacked structured metadata in its log output, making it harder to diagnose filter behavior in production.
+
+## Solution
+
+Exposed conflict-filter keyword list and ReliefWeb `appname` as environment variables (`GDELT_CONFLICT_KEYWORDS`, `RELIEFWEB_APPNAME`), defaulting to the previous hardcoded values so existing deployments are unaffected. Enhanced the event-logging path with structured per-event metadata for better observability.
+
+## Changes
+
+| File | Change |
+|------|--------|
+| `backend/ingestion/gdelt_pulse/service.py` | Read `GDELT_CONFLICT_KEYWORDS` and `RELIEFWEB_APPNAME` from env; pass to filter/fetch helpers; add structured logging fields per ingested event. |
+| `backend/api/routers/gdelt.py` | Minor logging enhancement to surface filter metadata in API layer logs. |
+| `.env.example` | Added `GDELT_CONFLICT_KEYWORDS` and `RELIEFWEB_APPNAME` documentation entries. |
+
+## Verification
+
+- Docker: `docker compose up -d --build sovereign-gdelt-pulse` — container starts, poll cycle logs structured events.
+- Ruff: `uv tool run ruff check backend/ingestion/gdelt_pulse/` — clean.
+
+## Benefits
+
+- Operators can tune GDELT conflict keyword granularity without a code change.
+- ReliefWeb `appname` is now a documented, overridable config value.
+- Structured logging enables per-event tracing in production log aggregation tools.

agent_docs/tasks/2026-04-18-fix-firms-test-stale-date.md

@@ -0,0 +1,46 @@
+# Fix: FIRMS Test Stale Hardcoded Date
+
+## Issue
+
+The CI PR run was failing with:
+
+```
+FAILED tests/test_firms_router.py::test_parse_firms_csv_to_rows_filters_and_normalizes_live_world_feed
+assert 0 == 1
+```
+
+`_parse_firms_csv_to_rows` filters rows by comparing `acq_dt` against
+`datetime.now(UTC) - timedelta(hours=hours_back)`.  The test fixture used a
+hardcoded `acq_date` of `2026-04-14`, which was written within the 72-hour
+window at the time of authoring but naturally expired as calendar time advanced
+past `2026-04-17` (72 h later).  Every row was silently dropped by the cutoff
+filter, returning an empty list and causing `assert len(rows) == 1` to fail.
+
+## Solution
+
+Replace the hardcoded `acq_date`/`acq_time` values in the CSV fixture with
+values derived from `datetime.now(UTC) - timedelta(hours=1)`.  This keeps the
+fixture data perpetually one hour old — always well inside any `hours_back`
+window the test might use — without requiring any changes to the production
+router code.
+
+## Changes
+
+| File | Change |
+|------|--------|
+| `backend/api/tests/test_firms_router.py` | Added `from datetime import UTC, datetime, timedelta` import; replaced hardcoded `2026-04-14` date/time strings with dynamically computed values 1 hour before test execution. |
+
+## Verification
+
+```
+cd backend/api && uv run python -m pytest tests/test_firms_router.py -v
+```
+
+All 5 tests in the file pass.  No router production code was changed.
+
+## Benefits
+
+- **Stability**: The test is now date-agnostic and will never fail due to the
+  fixture going stale.
+- **Correctness**: The fixture accurately models "recent" FIRMS data, which is
+  the scenario the test was always intended to cover.

agent_docs/tasks/2026-04-18-recalibrate-conflict-zone-detection.md

@@ -0,0 +1,45 @@
+# Recalibrate Active Conflict Zone Detection
+
+## Issue
+
+The ACTIVE CONFLICT ZONES panel consistently showed `[0]` even with ISR, RUS, IND, and UKR all active and carrying amber threat indicators. Three root causes:
+
+1. **CRITICAL threshold too conservative** — the old gate (`threat_score ≤ -6.0`) required both a severely negative Goldstein average *and* a high material-conflict ratio. Real-world active warzones (Ukraine, Gaza) typically cluster in the −3 to −5 Goldstein band under GDELT and would never trigger it.
+2. **No kinetic-volume bypass** — a country with 200 material conflict events over a quiet news cycle could still be classified as MONITORING if its average Goldstein was diluted by non-conflict articles.
+3. **Conflict zone panel excluded MONITORING actors** — the frontend filter only showed CRITICAL and ELEVATED actors, meaning even correctly-classified MONITORING conflict zones were invisible in that panel.
+
+## Solution
+
+Three coordinated changes:
+
+1. **Recalibrated Goldstein thresholds** to match observed GDELT distributions:
+   - CRITICAL: `threat_score ≤ -4.5` (was `-6.0`)
+   - ELEVATED: `threat_score ≤ -2.0` (was `-3.0`)
+
+2. **Added material-conflict volume shortcut** — bypasses the Goldstein average when a country shows high absolute kinetic event counts:
+   - `material_conflict > 150` → CRITICAL (regardless of Goldstein)
+   - `material_conflict > 50` and was MONITORING → promote to ELEVATED
+
+3. **Conflict zone panel now includes MONITORING** — shows all three negative threat levels (CRITICAL →red, ELEVATED →amber, MONITORING →yellow/WATCH badge). The zone counter now breaks out counts by level (`[2]+3+7`) instead of a single total.
+
+## Changes
+
+| File | Change |
+|------|--------|
+| `backend/api/routers/gdelt.py` | Lowered CRITICAL/ELEVATED thresholds; added material-conflict shortcut |
+| `frontend/src/components/layouts/IntelSidebar.tsx` | `conflictZones` filter includes MONITORING; header count is split by level; zone badge uses `conflictZoneBadgeLabel()` returning CRITICAL/ELEVATED/WATCH |
+| `frontend/src/components/widgets/ActiveConflictWidget.tsx` | Same filter expansion and WATCH badge; count display shows active/watch split |
+| `backend/api/tests/test_gdelt_router.py` | 6 new threshold/shortcut regression tests |
+
+## Verification
+
+- `cd backend/api && uv tool run ruff check .` — clean.
+- `cd backend/api && uv run python -m pytest tests/test_gdelt_router.py -v` — **11/11 passed**.
+- `cd frontend && pnpm run lint` — exit 0.
+- `cd frontend && pnpm run typecheck` — exit 0.
+
+## Benefits
+
+- ISR, UKR, RUS, and other active conflict zones will now correctly surface in the ACTIVE CONFLICT ZONES panel.
+- High-kinetic actors (Gaza, Sudan) are promoted even during subdued media cycles.
+- MONITORING actors are visible without polluting the CRITICAL/ELEVATED severity hierarchy — operators can see the full threat picture in one panel.