Consume generated Odoo workspaces safely in Codex Lab

[shiny-code-bot]

Finish Line

Codex Lab can launch interactive, exec, and delegated-agent work from a generated non-Git Odoo workspace while loading canonical guidance and granting only declared editable source roots.

Current Status

State: Complete on July 24, 2026.

PR #467 merged as fa23beb87fb0a4da197c74e42f6bc1a382df55aa and closes this consumer proof. Codex Lab now launches generated non-Git Odoo workspaces through a fail-closed adapter while generic core owns only an exact-root --workspace-root permission primitive.

Delivered evidence:

• interactive and exec command construction from the generated workspace root;
• exact writable roots propagated through native child/session startup without making the generated root writable;
• canonical guide, status currentness, binary provenance, symlink, overlap, Git-parent, and ancestor-guidance validation;
• deterministic macOS and Linux proofs that declared tenant/devkit roots are writable while managed, generated-root, and outside paths are denied;
• real CM workspace status and exact-candidate dry-run evidence.

The implementation intentionally replaced the original --add-dir direction because that mechanism preserves an implicitly writable launch CWD. No Odoo-specific runtime authority was added to generic Codex Lab core.

Blocked by: none.

Broader generic provider lifecycle work remains separate in #149. Paired exact-candidate dogfood remains separate in #83 and is still blocked by #308.

Scope

• Exercise both interactive/app and exec startup from a generated non-Git workspace root.
• Load the canonical root AGENTS.md and preserve its provenance in model-visible context.
• Consume devkit's structured readiness and source/edit-root output rather than parsing Odoo-specific prose in Codex Lab core.
• Grant only declared path-based editable roots through the generic exact-root workspace permission mechanism.
• Keep managed source checkouts, secret storage, and unrelated sibling repos outside writable scope.
• Verify child and delegated-agent behavior from the workspace root and when operating on nested source files.
• Surface stale workspace guidance before relying on it; do not auto-sync or mutate an untrusted workspace silently.
• Keep generic lifecycle integration aligned with cbusillo/codex-lab#149 and exact-candidate proof aligned with cbusillo/codex-lab#83.

Acceptance Criteria

• A fixture matching the devkit generated layout starts successfully without turning the workspace into a Git repo.
• Interactive and exec paths have explicit, tested non-Git behavior.
• The loaded instruction sources include the canonical workspace guide and do not lose it because of local-note override semantics.
• Tenant and devkit edits succeed only when their resolved roots are declared editable.
• Managed checkouts and arbitrary paths outside the declared edit roots remain read-only.
• Child/delegated agents retain or receive the workspace ownership and Launchplane boundary needed for their assigned files.
• Stale devkit status produces a bounded actionable warning/failure rather than silent use of obsolete guidance.
• No Odoo-specific root marker, command parser, or runtime authority is hard-coded into generic Codex Lab core.
• Exec-harness evidence records the exact Codex Lab binary/source, fixture, loaded instructions, permissions, and result.
• The scenario is included in the paired quality/context proof owned by cbusillo/codex-lab#83 when the exact candidate is ready.

Relationships

• Subissue of cbusillo/odoo-devkit#81.
• Completed prerequisite: cbusillo/odoo-devkit#82.
• Related to cbusillo/codex-lab#149 for workspace preparation/provider lifecycle.
• Related to cbusillo/codex-lab#83 for exact-candidate context and skills dogfood.
• Completed as a local consumer/harness proof; broader generic provider lifecycle remains in Plugin lifecycle hooks for workspace preparation and quality providers #149.
• related: Plugin lifecycle hooks for workspace preparation and quality providers #149 - Plugin lifecycle hooks for workspace preparation and quality providers #149
• related: Audit codex-skills inside Codex Lab dogfood #83 - Audit codex-skills inside Codex Lab dogfood #83

Decisions

• Do not make the generated root a Git repo.
• Do not add Odoo behavior to generic Codex Lab core.
• Do not grant the whole developer directory as writable.
• Do not auto-run workspace sync before trust and mutation policy are explicit.