chore: mark project as archived/unmaintained, bump to 1.12.17

Add archive notice to README.md, update pyproject.toml description,
and bump the pinned gis-prediction base image tag in Dockerfile to
match, reflecting that this project is no longer actively maintained.

Dockerfile

@@ -1,4 +1,4 @@
-FROM registry.gitlab.com/aletrn/gis-prediction:1.12.16
+FROM registry.gitlab.com/aletrn/gis-prediction:1.12.17
 
 ARG WORKDIR_ROOT="/var/task"
 ARG MODEL_VARIANT="sam2.1_hiera_base_plus_uint8"

README.md

@@ -8,6 +8,8 @@ pinned: true
 license: mit
 ---
 
+⚠️ Archived / unmaintained. This project is part of the samgis-* line, which I'm no longer actively maintaining. Maintaining it has been unpaid work, and without real user feedback to justify the continued time investment, I'm redirecting my effort toward projects with a sustainable return. The code stays available as-is (MIT) — issues and PRs may go unreviewed. Forks are welcome.
+
 # About this README
 
 I tested these instructions on macOS, but should work on linux as well.

SUPPLY_CHAIN_TODO.md

@@ -14,6 +14,41 @@ Triggered 2026-04-06 by tomshw "code resurrection" article. Cross-cutting work t
 - [ ] **Wire `pip-audit` into CI gate** — currently declared in dev group but not run on every build. Add to post-production / CI step.
 - [ ] **Lockfile-diff guard** in pre-commit (one-line bash check via `/supply-chain` skill once shipped).
 
+## Python `.pth` injection + runtime-exec hardening
+
+Defense-in-depth against a compromised dependency planting a malicious `.pth` file in
+site-packages — it executes arbitrary Python at every interpreter startup, a stealthy persistence
+vector that `pip-audit`/Trivy/Syft do **not** detect (they treat packages as files, not as
+executable code). Mirrors the `.pth` sentinel added to `devcontainer-guard` (MIASMA-3/MIASMA-5,
+2026-07-02).
+
+- [ ] **Dockerfile env hardening** (this repo): set `PYTHONNOUSERSITE=1` + `PYTHONPATH=` (empty) in
+      the samgis-be Dockerfile. Cheap, no runtime cost, independent of the base image.
+- [ ] **Startup/healthcheck `.pth` sentinel** (design corrected 2026-07-02 after adversarial review).
+      site.py exec's any `.pth` line starting with `import `/`import\t` (single line; `from`-imports
+      inert). **Detection = an `import`-line that makes a call `(` or chains `;` is suspicious UNLESS
+      it matches a small safe-pattern allowlist.** Do NOT use a raw marker substring blocklist
+      (`os.system(`…) — trivially evaded by `import os as o; o.system(...)`, getattr/importlib
+      indirection, string-concat, `sys.path` manipulation; keep markers only as a secondary
+      escalator. Severity: unexpected name in system root → CRIT, in workspace/user venv → WARN;
+      suspicious content → CRIT; `.pth` > 4 KB → CRIT (weak size heuristic). Scan top-level of each
+      site dir only (site.py doesn't recurse).
+  - **⚠ MANDATORY content-pattern allowlist**: `distutils-precedence.pth` ships with setuptools in
+      nearly every image (`import os; ...__import__('_distutils_hack').add_shim();`) and a naive scan
+      FAILs it. Allowlist by content pattern: (1) `distutils-precedence.pth`, (2) editable finders
+      `^import __editable___\w+_finder; __editable___\w+_finder\.install\(\)$` (regex, keep tight),
+      (3) `declare_namespace` lines.
+  - **Also scan (same pass)**: unexpected `sitecustomize.py`/`usercustomize.py` and
+      **`/etc/ld.so.preload`** (native LD_PRELOAD persistence; any content = CRIT). Note most
+      site-packages come from the `gis-prediction` base image — the sentinel scanning the *running*
+      image covers them regardless of install origin. Reference impl: `devcontainer-guard`
+      `scripts/_shared/pth_sentinel.py` once shipped (copy the inverted predicate + allowlist).
+- [ ] **Base-image note**: most site-packages come from `gis-prediction` — the sentinel scanning
+      the *running* image covers those regardless of where they were installed. The env hardening
+      above is the only part that must live in this repo's Dockerfile.
+- **Defer until**: pre-production hardening pass, or sooner if a dep audit flags a suspicious
+      package. HF Space is private / low public attack surface (see Notes) — not blocking.
+
 ## Deferred — base image owns the real risk
 
 The dependency installation surface for samgis-be lives in the **base image build pipeline**, not in this repo. The Dockerfile here only imports the prebuilt image and runs smoke tests.

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "samgis"
-version = "1.12.16"
-description = "A backend for machine learning instance segmentation on geospatial data even without dedicated graphics cards."
+version = "1.12.17"
+description = "A backend for machine learning instance segmentation on geospatial data even without dedicated graphics cards. (ARCHIVED - no longer maintained)"
 authors = [
   { name = "alessandro trinca tornidor", email = "alessandro@trinca.tornidor.com" },
 ]

uv.lock

@@ -1299,7 +1299,7 @@ wheels = [
 
 [[package]]
 name = "samgis"
-version = "1.12.16"
+version = "1.12.17"
 source = { virtual = "." }
 dependencies = [
     { name = "onnxruntime" },