mapsmith 0.2.1__tar.gz → 0.2.2__tar.gz

mapsmith-0.2.2/.dockerignore

@@ -0,0 +1,35 @@
+# The build only needs pyproject/README/LICENSE/src, but everything else in the
+# directory is still sent to the daemon without this file — including a local
+# .venv, built wheels and any .env sitting next to them. CI builds from a clean
+# checkout, so nothing private has ever reached a published layer; this is here
+# so a `docker build .` on a working machine cannot be the first time.
+.git/
+.github/
+.venv/
+venv/
+env/
+dist/
+build/
+*.egg-info/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.ipynb_checkpoints/
+
+# secrets and local configuration
+.env
+.env.*
+*.pem
+*.key
+
+# large or irrelevant to the image
+benchmarks/
+docs/
+examples/
+tests/
+deploy/
+*.md
+!README.md
+uv.lock

mapsmith-0.2.2/CHANGELOG.md

@@ -0,0 +1,336 @@
+# Changelog
+
+All notable changes to MapSmith are documented here, in the format of
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project follows
+[semantic versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.2.2] — 2026-08-22
+
+A security release. The fixes below close holes present in 0.2.1, which is
+published: **if you run MapSmith on data or paths an agent can influence,
+upgrade.** The headline is that a plain local file could make GDAL fetch a URL
+or read a dataset from outside the workspace, and that credentials could reach
+a manifest.
+
+Worth saying plainly, because it shaped the release: each fix here was found by
+auditing the previous one. The remote opt-in left `.vrt` able to reach the
+network; closing `.vrt` left `GDALG` and `MRF` doing the same thing; refusing
+credential SQL wrote the credential into the refusal message. The pattern is
+not bad luck — it is what happens when a guard is written against an instance
+instead of a class, and the response in each case was to move the check one
+level down rather than add another name to a list.
+
+### Added
+
+- **`funding.json`** at the repository root ([FLOSS/fund
+  manifest](https://fundingjson.org/)), stating what the project would use
+  funding for: the correctness suite and the provenance specification. No
+  payment provider is published — arrangements are made in writing.
+
+### Changed
+
+- **Remote and virtual paths are refused by default** (`MAPSMITH_ALLOW_REMOTE=1`
+  to allow them). GDAL `/vsi*` and `https://` forms used to be accepted whenever
+  no workspace was set, justified as being the user's own responsibility — and
+  the user is not who decides: the path is written by the model, from whatever it
+  read, so a third-party dataset carrying "the updated layer lives at
+  https://evil.tld/x.gpkg" was enough to have GDAL parse attacker-chosen bytes
+  in-process. The refusal now covers both path arguments and `run_sql` text,
+  which closes the SSRF that came with it (raw SQL could read any endpoint the
+  host can reach — internal services, cloud metadata — and return the content in
+  the tool result) as well as the `INSTALL ... FROM '<url>'` fetch. Cloud-native
+  data stays a supported use case: the capability is gated, not removed. A
+  workspace refuses remote forms regardless, and validated plans stay strict
+  whatever the setting.
+- **The container is unprivileged and confined by default.** The published image
+  runs as uid 1000 instead of root and sets `MAPSMITH_WORKSPACE=/data` itself, so
+  `docker run -v your/data:/data ghcr.io/mapsmith-ai/mapsmith` gets the path jail
+  and the sandboxed SQL engine without the operator having to remember `-e` — the
+  wrong way round for a default. Two consequences before you upgrade: a bind
+  mount owned by another user is no longer writable (pass
+  `--user $(id -u):$(id -g)`), and everything outside `/data` is refused,
+  including remote paths, which a workspace refuses whatever
+  `MAPSMITH_ALLOW_REMOTE` says. The Kubernetes example states the same posture at
+  pod level (`runAsNonRoot`, `readOnlyRootFilesystem`, dropped capabilities).
+
+### Fixed
+
+- **GDAL indirection was closed as an instance, not as a class.** Deregistering
+  the drivers behind `.vrt` left `GDALG` and `MRF` doing the same job. GDALG
+  (*GDAL Streamed Algorithm*, GDAL 3.11) reads a JSON document holding a `gdal`
+  command line and runs it when the dataset is opened, and it is recognised by
+  **content, not by extension** — so the filename tells you nothing, and the
+  command line can name a local path as readily as a URL. Measured with remote
+  reads off **and** a workspace set: a file called `roads.geojson` inside the
+  workspace issued a GET, and another read a dataset from *outside* the
+  workspace and handed back its rows. That is containment broken, not only
+  egress. MRF is narrower — extension-gated, fetched on the first pixel read.
+  Both are now skipped, along with the remaining drivers GDAL's own security
+  page names as opening other datasets internally.
+
+  The list is not the fix. It was correct when written and became incomplete
+  because GDAL shipped a new driver, which will happen again. A test now
+  enumerates the drivers registered in a clean subprocess and fails on any name
+  nobody has reviewed — the only version of this check that keeps working
+  across upstream releases.
+- **A workspace no longer loses to the opt-in.** `MAPSMITH_ALLOW_REMOTE=1`
+  together with `MAPSMITH_WORKSPACE` re-registered the indirection drivers,
+  because the predicate answering "is remote allowed" read only the environment
+  variable while its own documentation said a workspace overrides it. Two
+  callers compensated for that and one did not. The predicate answers the whole
+  question now: a check each caller has to remember to add is a check that will
+  be missing somewhere.
+- **Plan manifests are redacted, and the credential refusal no longer quotes the
+  credential.** `<output>.plan.json` is written as a plain dict, so the redaction
+  applied to every provenance record never reached it — while `goal`, each
+  step's `comment` and a failed step's `error` all carry text written by the
+  model or the user. The sharp case: refusing `ATTACH 'postgres://user:pw@…'`
+  produced a message quoting the fragment, password included, and that message
+  is what the manifest recorded. The mechanism that exists to keep credentials
+  out of manifests was putting one in. Redaction now runs on the whole manifest
+  at the point it becomes a file.
+- **A credential written with a quoted identifier is refused.**
+  `SET "s3_secret_access_key" = '…'` and `PRAGMA "…"='…'` defeated *both* layers:
+  the refusal pattern required the credential word to follow `SET` contiguously,
+  and the redaction pattern allowed only whitespace between the name and the
+  `=`, so the closing quote broke each of them. This was not one of the two
+  documented limits — the name was perfectly recognisable.
+- **`crs_decisions` and `notes` are redacted on the paths that actually run.**
+  Redaction happened at construction, and no engine passes those fields to the
+  constructor — every one assigns afterwards. So two of the four fields
+  SECURITY.md lists as covered were never redacted in practice, and
+  `parameters_redacted` stayed false. Redaction now also runs in `write_for`,
+  the single point where a manifest becomes a file, and covers `verification`
+  and `repairs` as well. The test that claimed to cover this passed both fields
+  as constructor arguments — a shape no caller uses — so it was green and
+  proved nothing; it now uses the real one.
+- **A local GDAL indirection file could reach the network from inside a
+  workspace.** A `.vrt` is a plain local path, so the path guard, the SQL scan
+  and DuckDB's `allowed_directories` all saw a local file while GDAL fetched
+  whatever its `<SrcDataSource>` named — measured on 0.2.1 as HEAD and GET
+  leaving the process with `MAPSMITH_ALLOW_REMOTE` unset **and**
+  `MAPSMITH_WORKSPACE` set, through the GeoPandas/pyogrio path. That
+  contradicted the one promise SECURITY.md states as testable, so the fix is at
+  GDAL's level: with remote reads off, the indirection and network drivers are
+  deregistered before the geospatial stack initialises. The opt-in restores
+  them, including when a parent process installed the policy — containers pass
+  their whole environment down, and a switch that cannot lift an inherited
+  policy is a switch that does nothing. Found by an adversarial audit of the
+  commit that introduced the opt-in, i.e. of the fix itself.
+- **Credentials no longer reach provenance manifests or the job ledger.**
+  `run_sql` records the query, and manifests are made to be shared, so an agent
+  emitting `CREATE SECRET (... SECRET 'AKIA…')` in the same session used to write
+  that key into a file destined for a bug report. **SQL that configures a
+  credential is now refused before it runs** — `CREATE SECRET` in any spelling,
+  `SET`/`PRAGMA` of a credential-bearing setting, `ATTACH` carrying a password or
+  URI userinfo — with a message pointing at where credentials belong: the
+  environment of the process that starts the server, out of reach of a tool call.
+  Nothing documented used that path, and in MapSmith's sandbox only one secret
+  type was even constructible.
+
+  Redaction stays as the second layer for credentials that reach a manifest
+  without being SQL (a signed URL as an input path, a connection string as an
+  argument), now covering `crs_decisions`, `notes`, input paths and the ledger's
+  `error` column — an engine error quotes the statement that failed. Masked
+  values are quoted, so a redacted statement still parses when pasted back into
+  a client.
+
+  Refusal came first because redaction alone did not hold: an adversarial audit
+  of the shipped version escaped it with `MAP{'Authorization': 'Bearer …'}`, an
+  `E'…'` literal, dollar quoting and a comment between name and value — and the
+  `E'…'` case masked the *wrong* argument while keeping the secret, producing a
+  manifest both misleading and leaky. All four are regression tests now.
+  Remaining limits, documented rather than implied: detection is name-based, so
+  a bare positional secret is not caught, and neither is a URI that
+  percent-encodes the colon of its own userinfo.
+- **GeoParquet 2.0 files are read instead of refused.** 2.0 (`v2.0.0-rc.1`)
+  moves geometry into Parquet's own `GEOMETRY`/`GEOGRAPHY` logical types and
+  makes the `geo` metadata key optional, and DuckDB already writes such files.
+  MapSmith read them inconsistently: `run_sql` worked, `describe_dataset` failed
+  with a raw GeoPandas `Missing geo metadata` error, and the CRS probe reported
+  `unknown` **even for a file that states its CRS** — which made the CRS
+  precondition refuse valid work for a wrong reason. The CRS now comes from the
+  logical type when there is no `geo` key, in all the forms met in practice: the
+  spec default (`OGC:CRS84`), an authority string, `projjson:<key>`, and the
+  whole PROJJSON document inline, which is what DuckDB writes.
+
+  One form is deliberately not resolved: `srid:<n>`. The spec defines it as a
+  numeric identifier and names no authority (its own example is `srid:0`), so
+  reading it as `EPSG:<n>` would be MapSmith inventing a coordinate system and
+  recording it as fact. Such a file is treated as having no CRS, so the CRS
+  precondition refuses it like any other input without one. The message does
+  not yet quote the `srid:` declaration that caused it, which would tell the
+  agent what to fix — tracked separately rather than claimed here.
+
+  **Writing now states its flavour instead of inheriting one.** `run_sql`
+  materialises with `geoparquet_version 'BOTH'`, so one output file carries
+  Parquet's native geometry types (CRS included as PROJJSON) *and* the 1.x `geo`
+  metadata — a 2.0-native reader and GeoPandas 1.x both open it, which is
+  asserted by a test that reads it back both ways. This was not a free choice:
+  DuckDB 1.4 wrote the native types by default and 1.5 changed the default back
+  to 1.x, so the installed engine version was silently deciding the canonical
+  output format of a provenance product. The GeoPandas writer path stays 1.x,
+  because GeoPandas 1.1 caps `schema_version` there.
+- **Dependency floors raised for a correctness reason, not a housekeeping one.**
+  `pyarrow>=21`: measured on a file DuckDB itself produced, pyarrow 18 and 19
+  **raise** on Parquet's geospatial logical types ("Thrift LogicalType that is
+  not recognized"), 20 opens the file but reports the type as `Undefined`, and 21
+  reports `Geometry` with its CRS. Below 21, MapSmith could not read back its own
+  `run_sql` output — the CRS probe returned `unknown`, which made the CRS
+  precondition refuse a file MapSmith had just written. `duckdb>=1.5` is the
+  floor for the `geoparquet_version` option above.
+- **Persistent DuckDB secrets can no longer be created from a tool call.** They
+  are written to `~/.duckdb/stored_secrets` — outside any workspace and beyond
+  the session. A workspace already refused that write; the connection now sets
+  `allow_persistent_secrets = false` in both modes, before locking the
+  configuration.
+- **The `mcp` floor is 1.28.1.** The SDK range MapSmith allowed admitted three
+  High-severity advisories (CVE-2026-59950, CVE-2026-52869, CVE-2026-52870).
+  None is exploitable here — MapSmith uses stdio and stateless Streamable HTTP
+  with no authentication, never the websocket transport, never task handlers —
+  but a fresh install could resolve to a version carrying them, and a scanner
+  cannot know the difference.
+- **`duckdb` is now capped below 2.0.** The floor was raised to 1.5 for a
+  correctness reason (above); the cap is for a different one. DuckDB 2.0 is on
+  the autumn-2026 calendar with breaking changes, and an unbounded requirement
+  means the first install after that release can fail with nothing on our side
+  having changed. A pin you have to lift deliberately beats an install that
+  breaks on someone else's schedule.
+
+## [0.2.1] — 2026-08-20
+
+Three fixes you would rather not find yourself. All came from reviewing 0.2.0
+*after* it shipped, and all were reproduced through the real MCP tools instead
+of read off a diff.
+
+### Fixed
+
+- **An empty spatial join no longer crashes before writing its manifest.**
+  DuckDB writes no GeoParquet `geo` metadata for a zero-row result, so reading
+  the output back raised — on the default engine path, for exactly the case the
+  verification checks exist to explain, while the tool description promised a
+  warning. A zero-row result is now written as a valid empty GeoParquet with the
+  analysis CRS and the joined schema, and the join goes through the same audited
+  writer as everything else, so the manifest exists even when a check fails.
+- **A GeoParquet declaring `crs: null` is no longer read as CRS84.** MapSmith
+  invented a coordinate system and recorded it in the manifest as fact, with
+  `verified: true` — the worst class of bug a provenance tool can have. The
+  GeoParquet spec distinguishes an *absent* `crs` field, which does mean CRS84,
+  from an explicit null, which means unknown; so does MapSmith now, and an
+  unknown CRS is refused by the preconditions like any other missing CRS.
+- **The DuckDB sandbox locks its configuration in every mode.** The lock used to
+  apply only under `MAPSMITH_WORKSPACE`, so a multi-statement call could switch
+  extension autoloading back on, and an explicit `LOAD httpfs` was never blocked
+  at all. Locking is now unconditional and DuckDB's HTTP and S3 filesystems are
+  disabled, while local reads keep working.
+- **The security documentation no longer claims that unconfined mode blocks
+  network egress.** It does not, and it never did: GDAL carries its own HTTP
+  client, so `ST_Read('/vsicurl/https://…')` in raw SQL reads whatever the host
+  can reach — internal services and metadata endpoints included — and the URL it
+  names can carry data out. Remote reads are deliberately available while the
+  server is unconfined, because cloud-native data is a feature; the claim that
+  the network was closed anyway was the bug. README and SECURITY.md now state
+  the price of that choice, and two tests pin both halves of it: without a
+  workspace the read succeeds, and with one it is refused *before any request
+  leaves*, asserted by counting requests at a loopback server instead of
+  matching an error message. If you do not trust your `run_sql` input, set a
+  workspace.
+- **The multi-layer guard fails closed.** A container whose layer list could not
+  be read looked like a single-layer file, and mechanical geometry repair would
+  then have destroyed the other layers while recording success.
+- **`execute_plan` reports `repairs` per step.** Geometry MapSmith rewrote was
+  visible in a single-operation result and invisible at plan level.
+- **Manifests record `EPSG:32632`, not 2.5 KB of PROJJSON**, when a GeoParquet
+  input carries its CRS as an embedded projection object.
+- **The example `docker-compose.yml` binds MinIO to loopback.** It published
+  ports 9000/9001 on every interface with the documented development
+  credentials.
+
+### Changed
+
+- **The provenance badge has three states instead of two.** "All critical checks
+  passed" is vacuously true when no critical check ran — a `run_sql` manifest,
+  for one — so an output whose only check had *failed* rendered with the same
+  green tick as a verified buffer. `provenance_summary` now reports `verified`,
+  `failed` or `unchecked`, with the reason, and the map panel renders all three.
+  The `verified` boolean stays in the payload, computed correctly, so a client
+  reading it gets a fix rather than a breaking change.
+- **The README says when *not* to use MapSmith**, and the
+  [benchmark results](docs/benchmarks.md) are linked from it — they were public
+  for a day with nothing pointing at them.
+
+## [0.2.0] — 2026-08-20
+
+The first release you can point an agent at and trust the answer: results are
+verified on the way in and on the way out, plans are checked before anything
+runs, and the server can be confined to a single directory.
+
+### Added
+
+- **Interactive map inside the chat.** `preview_map` renders your layers on a
+  pan/zoom map panel in any client implementing the
+  [MCP Apps](https://modelcontextprotocol.io/extensions/apps/overview)
+  extension (field-tested on Claude Desktop), with an OpenStreetMap backdrop
+  and a provenance card per layer showing operation, engine and one of three
+  states: `verified ✓`, `verification failed`, or `not verifiable` when no
+  critical check ran. Fully self-contained; on clients without MCP Apps the
+  same call returns structured data.
+- **Typed plans.** `validate_plan` statically checks a multi-step analysis —
+  operations exist and are installed, arguments complete and well-typed,
+  `$step` references resolve backwards, input files exist, outputs don't
+  collide, and the CRS of every intermediate is simulated from the real
+  inputs — and returns machine-actionable error codes. `execute_plan` then
+  runs the validated plan with per-step provenance plus a plan-level manifest
+  fingerprinting the exact plan that produced the result.
+- **Terrain and hydrology** on the Whitebox Workflows engine (`[whitebox]`
+  extra): `hillshade`, `flow_accumulation` (D8, with depression filling) and
+  `watershed` (many pour points at once).
+- **Zonal statistics** with exact fractional pixel coverage via exactextract
+  (`[raster]` extra).
+- **A searchable operation catalog.** `list_operations` ranks capabilities by
+  relevance (BM25) so an agent can discover what exists — including what is
+  planned but not yet available — instead of guessing from a wall of tools.
+- **Workspace confinement.** Set `MAPSMITH_WORKSPACE` and every path argument
+  must resolve inside it, `run_sql`'s DuckDB connection is sandboxed to that
+  directory with extension loading refused and memory/temp-disk capped, and
+  UNC hosts and NTFS alternate data streams are refused in every mode.
+- **Verification on the way in.** Operations check their inputs for the
+  failures that produce plausible junk: a missing CRS is refused outright, and
+  empty inputs or extents that cannot possibly intersect come back as named
+  warnings with hints — in the tool result, not only in the manifest.
+- **Bounded deterministic repair.** Mechanically broken output geometry is
+  repaired (`make_valid`, at most two rounds, written atomically) and every
+  attempt is recorded in the manifest: a repaired output never looks like one
+  that was right the first time.
+- **A notebook gallery** (`examples/`) and a
+  [benchmarks page](docs/benchmarks.md) with the harness that produced it.
+
+### Fixed
+
+- **Wrong terrain results from ordinary compressed rasters.** Whitebox
+  Workflows 2.x does not undo the TIFF predictor when reading, so any DEM
+  saved with `PREDICTOR=2` or `3` — the standard encoding for elevation data —
+  produced hillshades and flow accumulations that looked like terrain and were
+  not. MapSmith now detects the predictor and converts the input first,
+  recording it in the manifest.
+  ([upstream report](https://github.com/jblindsay/whitebox_next_gen/issues/32))
+- **GeoParquet outputs from the vector engines** were written through a GDAL
+  path that produced unreadable files.
+- `run_sql` materialisations and the DuckDB/SedonaDB join fast paths now run
+  the same deterministic verification as every other writer, and record their
+  CRS decisions.
+
+### Changed
+
+- `spatial_join` with `engine="auto"` falls back to GeoPandas when the inputs'
+  CRS differ or are unknown, instead of joining mismatched coordinates.
+- The planning-failure figure quoted in the docs is stated as the upper bound
+  it is ("up to ~47%"), since the underlying study counts errors multi-label.
+
+## [0.1.0] — 2026-08-18
+
+First public release: the engine dispatcher (SedonaDB / DuckDB / GeoPandas),
+`run_sql`, the job ledger, stateless Streamable HTTP transport, and provenance
+manifests with deterministic verification on every writer.

{mapsmith-0.2.1 → mapsmith-0.2.2}/CONTRIBUTING.md

@@ -30,7 +30,7 @@ ruff check .
 
 ## Contributor License Agreement
 
-To keep dual-licensing possible (AGPL + commercial), we ask contributors to sign a lightweight CLA on their first PR (automated via bot). Your code always remains available under AGPL-3.0.
+To keep dual-licensing possible (AGPL + commercial), we ask contributors to sign a lightweight CLA on their first PR. There is no bot yet: if you open the first outside PR, we will agree the wording with you in the thread rather than block the merge on tooling that does not exist. Your code always remains available under AGPL-3.0.
 
 ## Code style
 

mapsmith-0.2.2/Dockerfile

@@ -0,0 +1,32 @@
+FROM python:3.12-slim
+
+# MCP Registry ownership proof: must equal the server.json "name" exactly.
+LABEL io.modelcontextprotocol.server.name="io.github.mapsmith-ai/mapsmith"
+
+# Geospatial wheels (pyogrio/shapely/pyproj) bundle their native libs; no system GDAL needed.
+WORKDIR /app
+COPY pyproject.toml README.md LICENSE ./
+COPY src ./src
+# raster + whitebox extras ship manylinux x86_64 wheels; the image is amd64-only.
+RUN pip install --no-cache-dir ".[raster,whitebox]"
+
+# Unprivileged by default (#19). uid 1000 on purpose rather than a high system
+# uid: the supported way to run this is a bind mount of your own data directory,
+# which on Linux is usually owned by the first human user — 1000. If yours is
+# not, pass `--user $(id -u):$(id -g)`.
+RUN useradd --create-home --uid 1000 --shell /usr/sbin/nologin mapsmith \
+    && mkdir -p /data \
+    && chown mapsmith:mapsmith /data
+
+# Workspace for datasets: mount your data here. Confined BY DEFAULT — the
+# supported path used to start unconfined unless the operator remembered `-e`,
+# which is the wrong way round for a default.
+VOLUME ["/data"]
+WORKDIR /data
+ENV MAPSMITH_WORKSPACE=/data \
+    HOME=/home/mapsmith \
+    MPLCONFIGDIR=/home/mapsmith/.config/matplotlib
+
+USER mapsmith
+
+ENTRYPOINT ["mapsmith"]

{mapsmith-0.2.1 → mapsmith-0.2.2}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.5
 Name: mapsmith
-Version: 0.2.1
-Summary: Professional-grade geoprocessing for AI agents via MCP, with verifiable provenance
+Version: 0.2.2
+Summary: Professional-grade GIS geoprocessing for AI agents via MCP, with verifiable provenance
 Project-URL: Homepage, https://github.com/mapsmith-ai/MapSmith
 Project-URL: Repository, https://github.com/mapsmith-ai/MapSmith
 Author-email: MapSmith <mapsmith@proton.me>
@@ -13,10 +13,10 @@ Classifier: Intended Audience :: Science/Research
 Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: Scientific/Engineering :: GIS
 Requires-Python: >=3.10
-Requires-Dist: duckdb>=1.4
+Requires-Dist: duckdb<2,>=1.5
 Requires-Dist: geopandas>=1.1.2
-Requires-Dist: mcp<2,>=1.26
-Requires-Dist: pyarrow>=17
+Requires-Dist: mcp<2,>=1.28.1
+Requires-Dist: pyarrow>=21
 Requires-Dist: pyogrio>=0.9
 Requires-Dist: pyproj>=3.6
 Requires-Dist: shapely>=2.0
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 [![MCP](https://img.shields.io/badge/Model_Context_Protocol-server-654FF0)](https://modelcontextprotocol.io)
 [![License: AGPL-3.0](https://img.shields.io/badge/license-AGPL--3.0-blue)](LICENSE)
 
-**Professional-grade geoprocessing for AI agents — with provenance you can verify.**
+**Professional-grade GIS geoprocessing for AI agents — with provenance you can verify.**
 
 MapSmith is an open-source [MCP](https://modelcontextprotocol.io) server that gives an AI
 agent real GIS analysis — buffers, overlays, reprojections, zonal statistics, terrain and
@@ -111,6 +111,11 @@ with working wheels — is the only supported installation path**: geospatial na
 dependencies across three OSes are a support black hole, and issues about broken local
 environments will be redirected here.
 
+Two things about the image, because they change what happens on your machine: it sets
+`MAPSMITH_WORKSPACE=/data` itself (the `-e` above is explicit, not required) and runs as
+uid 1000, so pass `--user $(id -u):$(id -g)` if the directory you mount belongs to another
+user; and it is built for amd64 only, so on Apple Silicon it runs under emulation.
+
 ## What you get back
 
 Every dataset comes with the file below, written next to it as
@@ -119,7 +124,7 @@ for it:
 
 ```json
 {
-  "mapsmith_version": "0.2.1",
+  "mapsmith_version": "0.2.2",
   "operation": "buffer_layer",
   "parameters": {"distance_meters": 300.0},
   "inputs": [{"path": "rivers.gpkg", "sha256": "9f2c…", "crs": "EPSG:4326"}],
@@ -137,7 +142,7 @@ had to repair. `get_provenance` returns it for any output.
 
 - **Real geoprocessing, not map CRUD.** Built on the proven open geospatial stack: GDAL,
   GeoPandas, Shapely, DuckDB Spatial, Whitebox Workflows and exactextract ship today
-  (more to come: PDAL, QGIS Processing via sidecar).
+  (more to come: QGIS Processing via sidecar).
 - **Provenance by design.** Every layer MapSmith produces ships with a machine-readable
   lineage manifest — source datasets with checksums, tools executed, exact parameters, CRS
   decisions, software versions, timestamps. Everything needed to re-run the analysis
@@ -173,6 +178,28 @@ had to repair. `get_provenance` returns it for any output.
 | `list_operations` | BM25-ranked catalog search; `detail=true` returns parameters and worked examples |
 | `server_info` | Version, license, available engines |
 
+### Formats
+
+| Format | Read | Write |
+|---|---|---|
+| GeoParquet 1.0 / 1.1 — WKB plus `geo` metadata | yes | yes, every path |
+| **GeoParquet 2.0** — Parquet-native `GEOMETRY`/`GEOGRAPHY` logical types | yes, including files that carry no `geo` key at all | yes on the SQL path: `run_sql` writes **both** layers into one file |
+| GeoPackage, Shapefile, FlatGeobuf, GeoJSON, … | anything pyogrio/GDAL opens | via GDAL |
+| GeoTIFF / COG | yes | outputs of the `[raster]` and `[whitebox]` engines |
+
+GeoParquet [2.0](https://github.com/opengeospatial/geoparquet/releases) moves geometry
+into Parquet's own logical types and makes the `geo` key optional, so "a Parquet file with
+geometry in it" no longer implies that key. MapSmith reads the CRS from the logical type
+when it is the only place it exists — the spec default, an authority string,
+`projjson:<key>`, or the whole PROJJSON document inline, which is what DuckDB writes.
+`run_sql` emits both layers (`geoparquet_version 'BOTH'`), so one output file satisfies a
+2.0-native reader and a GeoPandas 1.x one; the GeoPandas writer path stays 1.x because
+GeoPandas 1.1 caps `schema_version` there.
+
+One declaration is deliberately refused rather than guessed: `srid:<n>`. The spec defines
+it as a numeric identifier and names no authority — its own example is `srid:0` — so
+reading it as `EPSG:<n>` would be inventing a coordinate system and recording it as fact.
+
 ## Verification, in and out
 
 Every tool that writes a dataset also writes `<output>.provenance.json` beside it and
@@ -253,9 +280,9 @@ that produced the result.
 UNC hosts and NTFS alternate data streams are refused in every path *argument* of every
 tool call, before anything touches the filesystem (on Windows even an existence check on a
 UNC path talks to an attacker-chosen host). Remote and virtual forms — GDAL `/vsi*`,
-`https://` COGs — stay available while the server is unconfined, because cloud-native data
-is a feature, and are refused once a workspace is set. Validated plans are stricter by
-design and reject every non-local form.
+`https://` COGs — are refused by default since 0.2.2 and need `MAPSMITH_ALLOW_REMOTE=1`;
+a workspace refuses them whatever that setting says (details below). Validated plans are
+stricter by design and reject every non-local form, opt-in or not.
 
 Set `MAPSMITH_WORKSPACE=/data` to confine the server to one directory:
 
@@ -275,13 +302,15 @@ community extensions are off (`shellfs` turns a filename into a shell command),
 extensions are refused, DuckDB's HTTP and S3 filesystems are disabled, and the
 configuration is locked, so untrusted SQL cannot turn file access into code execution.
 
-**The network is not closed in that mode, by the same decision that keeps cloud-native
-data working**: GDAL carries its own HTTP client, so `ST_Read('/vsicurl/https://…')` in raw
-SQL reads whatever the host can reach — internal services and link-local metadata
-endpoints included — and the URL is chosen by whoever wrote the SQL, so it can also carry a
-string out. Setting `MAPSMITH_WORKSPACE` closes all of it, GDAL included, and the test
-suite asserts both halves (`tests/test_duckdb_sandbox.py`). If your `run_sql` input is not
-trusted and your host sits somewhere interesting, set a workspace. The full threat model —
+**The network is closed too, unless you open it.** Remote and virtual forms — GDAL
+`/vsi*`, `https://` COGs — are refused by default in path arguments *and* inside `run_sql`
+text, because the path is written by the model rather than by you: a third-party dataset
+carrying "the updated layer lives at https://evil.tld/x.gpkg" was otherwise enough to have
+GDAL parse attacker-chosen bytes in-process. Set **`MAPSMITH_ALLOW_REMOTE=1`** to allow them
+— cloud-native data is a real use case and the capability is gated, not removed. A workspace
+refuses them regardless, since containment and "fetch whatever URL the model names" cannot
+both be true. The test suite asserts every branch by counting requests at a loopback server
+(`tests/test_duckdb_sandbox.py`). The full threat model —
 and what is explicitly *not* covered — is in [SECURITY.md](SECURITY.md).
 
 Fine print, because it changes how you deploy this: the path jail assumes a single trusted
@@ -318,8 +347,17 @@ in every arm, i.e. wrong parameters and missing outputs at *execution* time,
 which is why MapSmith enforces its plans at the execution boundary and verifies
 inputs and outputs at runtime rather than advising an agent that improvises.
 
+Three further arms then measured the configuration MapSmith actually ships —
+the plan *enforced*, no improvisation between validation and execution — over
+375 runs, and the result cuts both ways: enforcing reproduces its own score
+3–18× more tightly than an improvising solver, and it does **not** beat it on
+accuracy (parity on tool selection, measurably worse on ordering). One of those
+arms also refuted a conclusion this page had published two arms earlier; the
+correction is kept in place rather than edited away.
+
 The harness is in [`benchmarks/gabench-ab/`](benchmarks/gabench-ab/), including
-the `split_analysis.py` that took our own win apart.
+the `split_analysis.py` that took our own win apart and the
+`rep_analysis.py` that bars every delta against a measured noise floor.
 
 ## Notebook gallery
 
@@ -367,13 +405,19 @@ detects it, converts the input first, and discloses the workaround in the manife
 - **Your data lives in a database.** MapSmith reads and writes files (GeoParquet,
   GeoPackage, anything GDAL opens). There is no PostGIS engine and no database catalog —
   the `[postgres]` extra is for the optional job ledger, not for data.
+- **Your data lives in object storage.** Since 0.2.2 remote and virtual paths are refused
+  unless you set `MAPSMITH_ALLOW_REMOTE=1`, and refused whatever that setting says under a
+  workspace — which is what the container runs with by default. DuckDB's own HTTP and S3
+  filesystems stay off in every mode, so `read_parquet('s3://…')` does not work even with
+  the opt-in: fetch the data down first, or run unconfined with remote reads on.
 - **You want the full breadth of a desktop GIS.** 16 tools plus a catalog that tells the
   agent what does *not* exist yet. The ~900 QGIS Processing algorithms are on the roadmap,
   not in the box.
 - **You expect plan validation to make a weak model strong.** Our own A/B says advisory
   validation upstream of an improvising solver does approximately nothing at aggregate
-  level; MapSmith's answer is enforcement at the execution boundary, and that hypothesis
-  is not measured yet.
+  level — and the enforced configuration MapSmith ships, measured afterwards, did not beat
+  it on accuracy either. What enforcement buys is reproducibility
+  ([the numbers](docs/benchmarks.md)).
 - **You want us to debug your local geospatial toolchain.** Docker, or `uvx` where the
   wheels work, are the only supported paths; a hand-built native GDAL stack is not, on
   purpose.
@@ -385,12 +429,19 @@ detects it, converts the input first, and discloses the workaround in the manife
 - [x] Typed analysis plans: static validation against the operation registry + simulated CRS flow before execution
 - [x] Runtime verification: input preconditions, warnings with hints in the tool result, bounded deterministic repair recorded in the manifest
 - [x] MCP Apps in-chat map panel with provenance cards (self-contained, works under the default host sandbox)
-- [ ] Agent-loop repair: hand verification failures back to the agent for a bounded number of retries
+- [x] GeoParquet 2.0: read Parquet-native geometry types (including files with no `geo` key), write both layers from the SQL path — the GeoPandas writer path follows when GeoPandas lifts its `schema_version` cap and 2.0.0 stops being a release candidate
+
+Next, in the order we intend to do it. The linked items carry a written spec — a roadmap line without one is a wish, so the rest get theirs before work starts on them:
+
+- [ ] [**Silent-corruption suite**](https://github.com/mapsmith-ai/MapSmith/issues/25): an eval for the failure every existing benchmark misses — a result that is wrong and reported as successful. Closed-form truth, no LLM in the evaluator, and it runs against MapSmith with verification *disabled* so it can fail us in public
+- [ ] [Agent-loop repair](https://github.com/mapsmith-ai/MapSmith/issues/26): hand verification failures back to the agent as structured, actionable errors, with a bounded retry budget recorded in the manifest. Our [own measurements](docs/benchmarks.md) say the runtime error message is the information channel that works
+- [ ] [Tool contracts that carry their own rules](https://github.com/mapsmith-ai/MapSmith/issues/27): argument constraints enforced *and* stated, and errors that name the rule rather than only the violation. The one intervention in our benchmark work that moved a metric past its noise floor
+- [ ] [Satellite embeddings as a first-class input](https://github.com/mapsmith-ai/MapSmith/issues/24): per-zone embedding vectors (multiband zonal statistics) and similarity rasters against a reference location, over the open [AlphaEarth annual dataset](https://developers.google.com/earth-engine/guides/aef_on_gcs_readme) (CC-BY 4.0 COGs). Deterministic arithmetic on a raster — no model inference in MapSmith — with the tile, year and reference vector recorded in the manifest
+- [ ] Authenticated remote mode (OAuth on the existing Streamable HTTP transport) and [long-job progress via MCP Tasks](https://github.com/mapsmith-ai/MapSmith/issues/8). This is the item that closes the one limitation [SECURITY.md](SECURITY.md) declares outright: the HTTP transport has no authentication today
 - [ ] More terrain & hydrology: slope/aspect, stream network extraction
-- [ ] QGIS Processing sidecar (subprocess-isolated): ~900 algorithms
-- [ ] Sandboxed code-execution tool for the long tail
-- [ ] Map panel: MapLibre vector rendering and shareable viewer URLs (raster OSM tiles already ship)
-- [ ] Authenticated remote mode (OAuth on the existing Streamable HTTP transport) and long-job progress via MCP Tasks
+- [ ] Map panel: MapLibre vector rendering, and an export of the panel as a self-contained HTML file you host yourself (raster OSM tiles already ship). No hosted viewer — MapSmith runs on your machine and we would rather not own your maps
+- [ ] [Sandboxed code-execution tool](https://github.com/mapsmith-ai/MapSmith/issues/7) for the long tail
+- [ ] QGIS Processing sidecar (subprocess-isolated): ~900 algorithms. By far the largest item on this list — parameter mapping and error handling for an external process, not an afternoon
 
 ## License and project
 
@@ -401,6 +452,11 @@ You can self-host MapSmith freely, forever. If you modify it and offer it as a s
 AGPL asks you to share your changes — or [talk to us](mailto:mapsmith@proton.me) about a
 commercial license.
 
+Nothing here has been funded so far. [`funding.json`](funding.json) states, in the
+[FLOSS/fund](https://fundingjson.org/) format, the two pieces of work that money would go
+to: a public suite of geospatial traps with hand-computable answers, and the provenance
+manifest as a specification other tools can implement.
+
 Release notes are in [CHANGELOG.md](CHANGELOG.md), how to contribute in
 [CONTRIBUTING.md](CONTRIBUTING.md), how to report a vulnerability in
 [SECURITY.md](SECURITY.md). "MapSmith" is a trademark of the MapSmith project — see