Validate and stage immutable artifact workspaces

[shiny-code-bot]

Summary

• add a typed tenant/shared dependency workspace inspector with uv as the lock authority
• stage exact committed source bytes, resolve base images to immutable digests, and reject local Git/config provenance overrides
• extract per-platform dependency evidence from the pushed artifact digest and emit Launchplane artifact-manifest schema v2
• preserve the existing local Compose Dockerfile while adding a dedicated fail-closed artifact build path

Validation

• uv run python -m unittest discover -s tests — 214 passed, 1 skipped
• uv run ruff check --no-fix <changed Python files>
• uv run ruff format --check <changed Python files>
• uv build
• uv run platform --help
• Launchplane ArtifactIdentityManifest.model_validate(...) against the emitted v2 shape
• synthetic CM and OPW tenant/shared workspace lock and exact-member staging proofs
• PyCharm changed-files and whole-project inspections: GREEN
• independent provenance/security review and focused resolution recheck: CLEAN
• GitHub Actions CI and CodeQL: 4/4 checks passed

Immutable Artifact Smoke

• producer publication odoo-docker run 29619164842 completed successfully
  • runtime: sha256:a75632a8076b4f54a2505cc634d6125b29189751e697842bb06a24ef4fd91aca
  • devtools: sha256:83d616f1f9cae6c4a83e37395d9a1ca4df5739e446277a584a6cac23b7cc1cd8
• downstream odoo-enterprise-docker run 29622130887 consumed those exact base digests and completed successfully
  • runtime: sha256:2b71d24892ffd22599c4491d7072d9a39481892c3df3429352ca5cb88b42ea8e
  • devtools: sha256:edf1c19118ef24f3d95e782007bd7ee2884cce66a6b3e810750c4982d364dbca
• a safe Linux arm64 artifact build was pushed to a disposable local registry and re-read by immutable digest
  • artifact: sha256:fd829bbce1b12124397a79a9ffb12ddb0c3295c0afe1aac05f40cd5050ac7a5a
  • artifact ID: artifact-cm-fd829bbce1b12124
  • support lock: docker/runtime-python/uv.lock at 5234299876c6e5a14ddb09527cab642debc291a628638afaf4a6c210529b83bd
  • synthetic tenant lock: uv.lock at e7f7375897b638c895502e455407267d092a97afcc71f62cdc78624c241bf8f6
  • package attribution preserved distinct tenant and shared repository identities

The smoke used synthetic tenant/shared repositories and made no live deployment or production mutation. The published producer and enterprise images were real immutable multi-architecture inputs.

Refs #80

[shiny-code-bot]

Final artifact smoke evidence

The fail-closed artifact path completed against the newly published immutable producer chain:

Stage	Evidence
odoo-docker publish	Run 29619164842; runtime sha256:a75632a8076b4f54a2505cc634d6125b29189751e697842bb06a24ef4fd91aca; devtools sha256:83d616f1f9cae6c4a83e37395d9a1ca4df5739e446277a584a6cac23b7cc1cd8
enterprise rebuild	Run 29622130887; consumed the exact producer digests; runtime sha256:2b71d24892ffd22599c4491d7072d9a39481892c3df3429352ca5cb88b42ea8e; devtools sha256:edf1c19118ef24f3d95e782007bd7ee2884cce66a6b3e810750c4982d364dbca
artifact push/readback	Linux arm64 pushed to a disposable local registry, then evidence extracted from sha256:fd829bbce1b12124397a79a9ffb12ddb0c3295c0afe1aac05f40cd5050ac7a5a
manifest identity	artifact-cm-fd829bbce1b12124; platform linux/arm64
support lock	docker/runtime-python/uv.lock, SHA-256 5234299876c6e5a14ddb09527cab642debc291a628638afaf4a6c210529b83bd, source cbusillo/odoo-devkit@9777313c3b7fbb68186f6d9e9d1e6ee66df2d62a
synthetic tenant lock	uv.lock, SHA-256 e7f7375897b638c895502e455407267d092a97afcc71f62cdc78624c241bf8f6
package attribution	tenant proof-addon and shared shared-addon retained distinct source repositories

Launchplane's live ArtifactIdentityManifest accepted the emitted schema-v2 shape. Separate synthetic CM and OPW proofs also passed exact combined tenant/shared membership, lock-currentness, and committed-byte staging. No hosted target was contacted and no production mutation occurred.