Manage runtime-python catalog and tenant build-tool synchronization

[shiny-code-bot]

Goal

Implement the devkit-owned catalog validation and reusable synchronization surface for centrally managed build tools.

Current Status

State: Implementation complete and pushed on August 16, 2026. Branch feat/101-build-tool-coordination adds independent runtime-python Dependabot/lock CI, a formatting-preserving atomic build-tool sync command, bounded provenance validation, tests, and shared docs. The implementation composes with #97 but no longer depends on its active normalization branch, so the native blocker was removed.

Next evidence: open the PR, pass CI, merge devkit first, then repin and merge the OPW tenant change.

Finish Line

The independent runtime-python uv project is bot-managed and lock-validated, with reusable atomic tenant pin synchronization built on dependency normalization.

Acceptance Criteria

• Dependabot monitors /docker/runtime-python as an independent uv project.
• Devkit CI runs uv lock --check --offline --no-config for that project.
• Repository metadata names the new required validation command/check.
• Synchronization reuses the final Add deterministic tenant dependency normalization command #97 normalization path and formatting-preserving exact-pin updates.
• Check mode is no-write and apply mode rolls back on failure.
• Focused unit/integration tests and docs cover security, rollback, and Launchplane orchestration boundaries.

Relationships

• Parent: Coordinate centrally managed build-tool upgrades across tenants #100.
• Blocked in part by active implementation Add deterministic tenant dependency normalization command #97.

Next Action

Land the catalog/CI guardrails on an isolated branch, then integrate synchronization after #97 is merged or its implementation is safely available.

[shiny-code-bot]

Completed by PR #102 on August 16, 2026. The merge added independent runtime-python Dependabot and lock validation, atomic build-tool synchronization with exact checkout/catalog provenance, focused tests, and the Launchplane orchestration/rollback contract. CI passed 5/5 checks and the merge commit is 4a26e46.