Validate and stage tenant dependency workspaces for artifact publish

[shiny-code-bot]

Finish Line

Devkit validates tenant dependency workspaces and emits immutable v2 artifact provenance.

Current Status

State: In progress/Now. PR #84 is open, mergeable, and green at commit 9777313c3b7fbb68186f6d9e9d1e6ee66df2d62a. The implementation includes the typed tenant/shared workspace checker, exact committed-blob staging, Git-root/remote/replace-ref protections, digest-pinned base provenance, a dedicated two-lock artifact Dockerfile, immutable post-push evidence extraction, and Launchplane schema-v2 emission.

Validation is complete: all 214 repository tests pass with 1 skip; Ruff, package build, CLI smoke, live Launchplane schema validation, PyCharm changed/whole-project inspections, focused security/provenance review, and all four PR checks pass. Synthetic CM and OPW dependency-workspace proofs pass exact combined membership, lock-currentness, and committed-byte staging.

The final safe Linux arm64 smoke used the real refreshed enterprise runtime digest sha256:2b71d24892ffd22599c4491d7072d9a39481892c3df3429352ca5cb88b42ea8e, pushed a synthetic tenant/shared artifact to a disposable local registry, and re-read evidence from immutable artifact digest sha256:fd829bbce1b12124397a79a9ffb12ddb0c3295c0afe1aac05f40cd5050ac7a5a. Launchplane accepted the schema-v2 manifest, including support lock path/hash, tenant lock path/hash, platform identity, and distinct tenant/shared package attribution. No live deployment or production mutation occurred.

The actual CM and OPW inspections correctly expose tenant-owned migration work: both lack root lock pairs and retain legacy workspace metadata; OPW also retains a mutable VCS declaration. Those are pilot inputs, not devkit fallbacks.

Next action: merge PR #84, verify post-merge gates, close this plan, and promote cbusillo/odoo-tenant-cm#105 to the first live tenant pilot.

Blocked by: none.

Waiting for: final independent pre-merge review only; no operator input.

Last verified: July 17, 2026.

Scope

• Add a typed dependency inspection/check command for tenant manifests.
• Validate that every owned addon pyproject is a member of the tenant root uv workspace, workspace members use package = false, the root lock is current, and direct VCS requirements use full commits.
• Require a tenant root pyproject/lock when owned runtime dependency declarations exist; allow pure-addon tenants with no Python runtime dependencies to remain lockless.
• Stage devkit runtime metadata under /opt/runtime and tenant workspace metadata under /opt/project.
• Preflight clean tenant/devkit/shared commits before copying or building.
• Resolve base image references to immutable digests before buildx and pass digest-form references into the Dockerfile.
• Hash the exact staged lock/input bytes before build.
• Ingest odoo-docker's platform evidence and emit artifact-manifest schema v2, including existing base-image/build-tool provenance that the current devkit payload omits.

Acceptance Criteria

• Missing workspace members, stale locks, mutable VCS refs, dirty source repos, changed staged inputs, and non-digest base images fail before image push.
• The build uses the same source commits, lock bytes, and base-image digests recorded in the manifest.
• Shared-addon dependency declarations are included in tenant workspace validation without moving shared addon ownership into the tenant repo.
• Artifact manifests include support/runtime and tenant lock evidence, platform package evidence, external compatibility descriptors, base-image provenance, and devkit build-tool provenance.
• No secret value, authenticated URL, local absolute path, or operator-local override is persisted.
• Tests cover local and non-local publish, no-dependency tenants, missing/stale lock pairs, workspace-member drift, mutable VCS refs, staged-input tampering, base-image tag races, and v2 manifest output.
• Docs and generated workspace guidance describe the contract.

Relationships

• Subissue of cbusillo/odoo-devkit#25.
• Depends on the Launchplane dependency-provenance schema and odoo-docker two-lock installer.
• Blocks the CM and OPW artifact pilots.

Validation

• Use .github/github.json gates.
• Run synthetic CM and OPW workspace lock/export proofs.
• Run a safe single-platform artifact build smoke before tenant live pilots.

Decisions

• Use uv commands as the lock authority; do not parse uv's lock internals as a stable public schema.
• Source selectors may remain repo-owned intent, but build and manifest identities are exact commits/digests.

[shiny-code-bot]

Completed by PR #84, merged as c536108972fa2c6f53e44b53dafeeb85c24c1047.

Acceptance evidence:

• 214 repository tests passed with 1 skip; Ruff, package build, CLI smoke, live Launchplane schema validation, and PyCharm changed/whole-project inspections passed;
• CI run 29622786180 and CodeQL run 29622785879 passed on the merge commit;
• synthetic CM and OPW workspace proofs passed exact combined tenant/shared membership, uv lock-currentness, and committed-byte staging;
• the refreshed enterprise base consumed exact producer digests and the safe Linux arm64 artifact build completed against enterprise runtime digest sha256:2b71d24892ffd22599c4491d7072d9a39481892c3df3429352ca5cb88b42ea8e;
• immutable artifact readback from sha256:fd829bbce1b12124397a79a9ffb12ddb0c3295c0afe1aac05f40cd5050ac7a5a preserved the support and tenant lock paths/hashes, platform identity, and distinct tenant/shared package source attribution;
• Launchplane's live ArtifactIdentityManifest accepted the emitted schema-v2 manifest;
• no hosted target was contacted and no production mutation occurred.

The devkit artifact producer contract is complete. The now-unblocked first live tenant pilot is cbusillo/odoo-tenant-cm#105; OPW follows under cbusillo/odoo-tenant-opw#101.