Close artifact dependency preflight parity gaps

[shiny-code-bot]

Finish Line

Shared support lock satisfies exact addon build backends and all three tenant artifact canaries pass.

Current Status

State: Completed. PR #90 added tracked addon-directory shape parity, PR #91 added exact-base read-only preflight per target platform, and PR #92 locked the canonical package-hash verifier against representation-dependent compatibility shortcuts. Local validation reached 223 tests (1 skipped), targeted Ruff/CLI checks, real image canaries, and clean changed-file/whole-project PyCharm inspections; all PR CI, Security, and CodeQL gates passed.

The public producer fix landed in cbusillo/odoo-docker#67 at 1fb156131c735d81040879734201cd8883176ac1. Public run 29676147382 and automatic enterprise run 29677971385 published canonical dependency-evidence images. Launchplane records now select enterprise runtime sha256:deb36c0f71564be8347e5b6a1c0c795573e07b8e8d0ba910e98fb4552815275f plus devtools sha256:aa83c2ee3e0dc3ffaefb6d65ef9c31c9b861a4f5ab2a86d9190625eab4f44cb7.

Final schema-v2 canaries all passed: CM run 29678464585 recorded artifact-cm-80f7e46a414b98d9; CM Website run 29678472135 recorded artifact-cm_website-a96d14f175eac3b8; OPW run 29678477375 recorded artifact-opw-88d969da9f1aa421 with real immutable GitHub VCS package sources.

Next action: return to cbusillo/launchplane#1774 for evidence-backed narrowing of redundant legacy authz rules. Artifact/dependency parity is no longer a blocker.

Blocked by: none.

Waiting for: nothing.

Last verified: July 19, 2026.

Scope

• Keep the devkit-owned Hatchling support catalog and lock synchronized with staged addon build metadata.
• Preserve explicit empty uv member sets for pure-addon tenants without fake Python projects.
• Evaluate workspace member patterns against the real tracked tenant/shared addon directory shape used by artifact publication.
• Validate staged support and tenant locks against the exact immutable base-runtime image before Buildx starts.
• Preserve exact member equality, tracked regular-file provenance, immutable VCS refs, and uv-owned lock currentness.
• Re-run CM, CM Website, and OPW artifact workflows after the compatible public/enterprise base images and tenant lock are selected.

Acceptance Criteria

• Devkit tests fail when staged addon build metadata advances without a matching support/tenant lock catalog entry.
• A tracked pure-addon root with explicit members = [] and current uv.lock remains publishable without an invented project.
• Broad member globs fail when the tracked artifact layout contains an ordinary addon directory without pyproject.toml.
• Artifact publish resolves exact base-image digests, mounts staged roots read-only, and fails before Buildx when exported support/tenant requirements conflict with base-owned packages.
• The exact-base probe mirrors strict sync lock/export/install-resolution arguments and runs once per requested platform.
• Full test, Ruff, build, CLI smoke, CI, Security, and CodeQL gates pass.
• CM, CM Website, and OPW artifact publish workflows each pass against the selected compatible enterprise image and record Launchplane schema-v2 evidence.
• No deployment secret, tenant runtime authority, mutable dependency reference, fake dependency project, or checked-in base-image identity is introduced.

Relationships

• Regression follow-up to Validate and stage tenant dependency workspaces for artifact publish #80 and Separate artifact build inputs from deployment secrets #85.
• Completed with public-base fixes cbusillo/odoo-docker#64 and cbusillo/odoo-docker#66.
• Completed enterprise publication through cbusillo/odoo-enterprise-docker#38.
• Completed OPW tenant artifact proof through cbusillo/odoo-tenant-opw#101.
• Unblocks cbusillo/launchplane#1774 non-production caller canaries and legacy-rule narrowing.
• Supplies the artifact prerequisites for cbusillo/launchplane#1768 end-to-end Odoo golden-path proof.

Decisions

• Keep build backends in the devkit-owned shared support catalog; do not add them to tenant runtime dependencies.
• Treat explicit empty member lists as exact only when no owned Python projects exist.
• Mirror committed addon directory shape during preflight so uv patterns see the same filesystem topology as artifact builds.
• Preserve base-package ownership: raise the shared base only when a supported downstream minimum exceeds it, and use tenant uv constraints for otherwise compatible overlapping transitives.
• Run exact-base compatibility inside the selected immutable base image before Buildx; Launchplane remains authoritative for selecting image digests.
• Preserve fail-before-push schema-v2 behavior and exact-version requirements.

[shiny-code-bot]

PR #90 closed the tracked-layout parity gap, but the OPW canary then exposed a separate base-runtime compatibility gap: the tenant lock exports requests==2.34.2 while the immutable Odoo base image constrains requests==2.31.0. Reopening until exact-base compatibility is validated before artifact build and all tenant artifact canaries pass.