Restore supported local runtime config resolution

README.md

@@ -54,6 +54,41 @@ uv run platform runtime odoo-shell --manifest /path/to/workspace.toml \
 If `--manifest` is omitted, the CLI looks for `workspace.toml` in the current
 directory.
 
+## Local Runtime Input
+
+All `platform runtime` commands consume runtime values through one typed input:
+`ODOO_DEVKIT_RUNTIME_ENVIRONMENT_JSON`. The JSON object must contain the exact
+selected `context`, the exact selected `instance`, and a non-empty
+`environment` object whose keys and values are strings:
+
+```json
+{
+  "context": "replace-me",
+  "instance": "local",
+  "environment": {
+    "ODOO_MASTER_PASSWORD": "<operator-local-value>",
+    "ODOO_DB_USER": "odoo",
+    "ODOO_DB_PASSWORD": "<operator-local-value>"
+  }
+}
+```
+
+Inject the payload from an operator-owned shell, password manager, or a
+mode-`0600` file outside the repository before running `runtime select`,
+`inspect`, `up`, or local workflows. For example:
+
+```bash
+export ODOO_DEVKIT_RUNTIME_ENVIRONMENT_JSON="$(cat ~/.config/odoo-devkit/runtime-environment.json)"
+uv run platform runtime inspect --manifest /path/to/workspace.toml --instance local
+```
+
+Do not put the payload or its values in `workspace.toml`, generated workspace
+docs, checked-in config, `.env`, `platform/.env`, or
+`platform/secrets.toml`. Missing input, context/instance mismatches, non-string
+values, and legacy devkit-local env/secrets files fail closed. Non-local
+Launchplane artifact workflows may inject the same typed payload boundary;
+non-local mutation remains Launchplane-owned.
+
 ## Scope
 
 This repo is intentionally small. It owns the manifest/runtime contract for

docker-compose.yml

@@ -6,9 +6,6 @@ x-odoo-base: &odoo-base
   image: ${DOCKER_IMAGE_REFERENCE:-${DOCKER_IMAGE:-odoo-devkit}:${DOCKER_IMAGE_TAG:-latest}}
   pull_policy: ${DOCKER_PULL_POLICY:-never}
   restart: unless-stopped
-  env_file:
-    - path: .env
-      required: false
 
 x-odoo-env: &odoo-env
   ODOO_STACK_NAME: ${ODOO_STACK_NAME:-}

docs/ARCHITECTURE.md

@@ -60,7 +60,8 @@ When
 - Legacy or disposable local runtime output under `state/`, when an older
   workspace still has it.
 - Optional local `AGENTS.override.md` for non-secret implementation facts that
-  should stay out of generated docs. Secrets still belong in `.env`.
+  should stay out of generated docs. Local runtime secrets are injected through
+  `ODOO_DEVKIT_RUNTIME_ENVIRONMENT_JSON`, not stored in workspace files.
 
 ### Control plane
 

docs/tooling/command-patterns.md

@@ -14,6 +14,10 @@ When
 These examples are workspace, local runtime, and artifact-handoff patterns.
 Remote release and non-local data actions such as ship, promote, restore,
 bootstrap, update, and Launchplane preview lifecycle belong in `launchplane`.
+Before a local `platform runtime` command, inject the context/instance-scoped
+`ODOO_DEVKIT_RUNTIME_ENVIRONMENT_JSON` payload from operator-local secret
+storage. Never add that payload to the tenant manifest or generated workspace
+files.
 
 - Sync the current tenant workspace:
 
@@ -27,6 +31,13 @@ uv run platform workspace sync --manifest /path/to/workspace.toml
 uv run platform workspace status --manifest /path/to/workspace.toml
 ```
 
+- Safely inspect the selected local runtime after operator setup:
+
+```bash
+export ODOO_DEVKIT_RUNTIME_ENVIRONMENT_JSON="$(cat ~/.config/odoo-devkit/runtime-environment.json)"
+uv run platform runtime inspect --manifest /path/to/workspace.toml --instance local
+```
+
 - Run a command from the workspace root:
 
 ```bash
@@ -71,6 +82,7 @@ uv run platform workspace scaffold-tenant-overlay \
 - Do not hand-edit generated workspace-root cockpit files.
 - If the workspace surface is wrong, fix `odoo-devkit` and re-sync.
 - Keep implementation-specific, non-secret local facts in an untracked
-  `AGENTS.override.md`; keep credentials in `.env`.
+  `AGENTS.override.md`; keep credentials in operator-local secret storage
+  outside the repo.
 - Keep tenant repo docs thin; use the generated workspace docs index for shared
   guidance.

docs/tooling/workspace-cli.md

@@ -152,6 +152,21 @@ Purpose
   workflows natively against `odoo-devkit`, while leaving non-local mutation to
   Launchplane service routes and reusable workflows.
 
+Local runtime input
+
+- Before `select`, `inspect`, `build`, `up`, `down`, or a local workflow, set
+  `ODOO_DEVKIT_RUNTIME_ENVIRONMENT_JSON` from an operator-owned shell, password
+  manager, or mode-`0600` file outside the repository.
+- The payload must be a JSON object with the exact selected `context`, the exact
+  selected `instance`, and a non-empty `environment` object containing only
+  string keys and values. The checked-in stack declares which environment keys
+  are required for the selected command.
+- This is the only supported runtime-environment input path. Do not put runtime
+  values in `workspace.toml`, generated workspace docs, checked-in config,
+  `.env`, `platform/.env`, or `platform/secrets.toml`.
+- `runtime inspect` reports selected runtime metadata and generated config paths;
+  it does not print the payload or environment values.
+
 Notes
 
 - The tenant repo remains path-based and user-owned. `workspace sync` does not
@@ -212,13 +227,10 @@ Notes
   typed `odoo_overrides` instead. Unrelated devkit control keys such as
   `ENV_OVERRIDE_DISABLE_CRON` remain available until they get their own typed
   local contract.
-- When `ODOO_CONTROL_PLANE_ROOT` points at a valid `launchplane`
-  checkout, local runtime env resolution comes from the control-plane-owned
-  environment contract. Devkit-local `.env` / `platform/secrets.toml` runtime
-  authority is unsupported. Leftover devkit-local env/secrets files are
-  treated as a hard conflict so environment authority stays single-source, and
-  build/restore requirements are expected to live in `launchplane`'s
-  `config/runtime-environments.toml` surface.
+- Local runtime environment input comes only from
+  `ODOO_DEVKIT_RUNTIME_ENVIRONMENT_JSON`. Leftover devkit-local `.env`,
+  `platform/.env`, or `platform/secrets.toml` files are a hard conflict so the
+  runtime boundary stays single-source and fail-closed.
 - Non-local `restore`, `workflow bootstrap`, and `workflow update` now fail
   closed with Launchplane handoff guidance. Devkit should not grow arbitrary
   checkout remote mutation flows; add or use a Launchplane service route first.