Validate and stage immutable artifact workspaces

README.md

@@ -10,6 +10,7 @@ The current workspace flow:
 - treats the active tenant checkout as the source of truth for handwritten
   code,
 - emits a `workspace.lock.toml` file with the exact assembled refs,
+- inspects combined tenant/shared-addon uv workspaces before artifact publish,
 - generates a minimal runtime config scaffold under `.generated/`, and
 - generates workspace-root `AGENTS.md`, `docs/README.md`, and
   `docs/session-prompt.md` so Every Code, Codex Lab, and other coding-agent
@@ -39,6 +40,8 @@ uv run platform workspace scaffold-cockpit-root \
   --output-dir /path/to/workspace-root --force
 uv run platform workspace clean --manifest /path/to/workspace.toml
 uv run platform workspace run --manifest /path/to/workspace.toml -- pwd
+uv run platform dependencies inspect --manifest /path/to/workspace.toml
+uv run platform dependencies check --manifest /path/to/workspace.toml
 uv run platform runtime select --manifest /path/to/workspace.toml
 uv run platform runtime build --manifest /path/to/workspace.toml --no-cache
 uv run platform runtime up --manifest /path/to/workspace.toml --build

docker/artifact.Dockerfile

@@ -0,0 +1,80 @@
+# syntax=docker/dockerfile:1.6
+ARG ODOO_VERSION=19.0
+ARG ODOO_BASE_RUNTIME_IMAGE
+ARG ODOO_BASE_DEVTOOLS_IMAGE
+ARG ODOO_ADDON_REPOSITORIES
+ARG OPENUPGRADE_ADDON_REPOSITORY
+ARG ODOO_PYTHON_SYNC_SKIP_ADDONS
+
+FROM scratch AS project-payload
+COPY /platform/config /payload/volumes/config
+COPY /docker/scripts /payload/volumes/scripts
+COPY /runtime /payload/opt/runtime
+COPY /project /payload/opt/project
+COPY /addons /payload/opt/project/addons
+
+FROM ${ODOO_BASE_RUNTIME_IMAGE} AS addon-sources
+ARG ODOO_ADDON_REPOSITORIES
+ARG OPENUPGRADE_ADDON_REPOSITORY
+USER root
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN --mount=type=secret,id=github_token \
+    rm -rf /opt/extra_addons \
+    && mkdir -p /opt/extra_addons \
+    && GITHUB_TOKEN="$(cat /run/secrets/github_token 2>/dev/null || true)" \
+       ODOO_ADDON_REPOSITORIES="${ODOO_ADDON_REPOSITORIES}" \
+       /usr/local/bin/odoo-fetch-addons.sh
+
+FROM ${ODOO_BASE_RUNTIME_IMAGE} AS base-runtime
+ARG ODOO_ADDON_REPOSITORIES
+ARG OPENUPGRADE_ADDON_REPOSITORY
+ARG ODOO_PYTHON_SYNC_SKIP_ADDONS
+USER root
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+RUN rm -rf /opt/runtime /opt/project /opt/extra_addons /opt/launchplane/evidence /volumes/config /volumes/scripts \
+    && mkdir -p /opt/runtime /opt/project /opt/extra_addons /opt/launchplane/evidence /volumes
+
+COPY --from=project-payload /payload/ /
+COPY --from=addon-sources --chown=ubuntu:ubuntu /opt/extra_addons /opt/extra_addons
+
+RUN mkdir -p /volumes /opt/project \
+    && rm -f /volumes/pyproject.toml /volumes/uv.lock \
+    && ln -s /opt/project/pyproject.toml /volumes/pyproject.toml \
+    && ln -s /opt/project/uv.lock /volumes/uv.lock
+
+FROM ${ODOO_BASE_DEVTOOLS_IMAGE} AS base-devtools
+ARG ODOO_ADDON_REPOSITORIES
+ARG OPENUPGRADE_ADDON_REPOSITORY
+ARG ODOO_PYTHON_SYNC_SKIP_ADDONS
+USER root
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+RUN rm -rf /opt/runtime /opt/project /opt/extra_addons /opt/launchplane/evidence /volumes/config /volumes/scripts \
+    && mkdir -p /opt/runtime /opt/project /opt/extra_addons /opt/launchplane/evidence /volumes
+
+COPY --from=project-payload /payload/ /
+COPY --from=addon-sources --chown=ubuntu:ubuntu /opt/extra_addons /opt/extra_addons
+
+RUN mkdir -p /volumes /opt/project \
+    && rm -f /volumes/pyproject.toml /volumes/uv.lock \
+    && ln -s /opt/project/pyproject.toml /volumes/pyproject.toml \
+    && ln -s /opt/project/uv.lock /volumes/uv.lock \
+    && rm -rf /opt/project/tools \
+    && ln -s /volumes/tools /opt/project/tools
+
+FROM base-runtime AS production
+ARG TARGETPLATFORM
+WORKDIR /opt/project
+RUN --mount=type=cache,target=/home/ubuntu/.cache/uv,uid=1000,gid=1000,sharing=locked \
+	TARGETPLATFORM="${TARGETPLATFORM}" ODOO_PYTHON_SYNC_SKIP_ADDONS="${ODOO_PYTHON_SYNC_SKIP_ADDONS}" /usr/local/bin/odoo-python-sync.sh prod
+WORKDIR /
+USER ubuntu
+
+FROM base-devtools AS development
+ARG TARGETPLATFORM
+WORKDIR /opt/project
+
+RUN --mount=type=cache,target=/home/ubuntu/.cache/uv,uid=1000,gid=1000,sharing=locked \
+	TARGETPLATFORM="${TARGETPLATFORM}" ODOO_PYTHON_SYNC_SKIP_ADDONS="${ODOO_PYTHON_SYNC_SKIP_ADDONS}" /usr/local/bin/odoo-python-sync.sh dev
+USER ubuntu

docker/dependency-evidence.Dockerfile

@@ -0,0 +1,7 @@
+# syntax=docker/dockerfile:1.6
+ARG ARTIFACT_IMAGE
+
+FROM --platform=$TARGETPLATFORM ${ARTIFACT_IMAGE} AS artifact
+
+FROM scratch
+COPY --from=artifact /opt/launchplane/evidence/dependency-provenance.json /dependency-provenance.json

docker/runtime-python/pyproject.toml

@@ -0,0 +1,13 @@
+[project]
+name = "odoo-runtime-support"
+version = "0.0.0"
+requires-python = ">=3.13"
+dependencies = [
+    "hatchling==1.27.0",
+    "passlib>=1.7.4",
+    "pydantic>=2.13.4",
+    "pydantic-settings>=2.14.2",
+]
+
+[tool.uv]
+package = false