chore(compat): land closeout — pinned cosign + JSON-only diff + minrows floor

Adds cosign install + sign-blob step before commit. The detached
.sig (base64-encoded ASN.1 DER ECDSA over SHA256(file)) is committed
alongside seeded-ci.json. Tower's loader verifies it pure-Go before
replay; mismatched/missing sig → refuse + log.

cosign.pub is also checked in so the workflow can self-verify before
push (catches key-rotation mismatch early). The same pubkey is
embedded in Tower's binary at compat_bootstrap_pubkey.pem; both
copies must match or replay will fail.

.gitea/workflows/seed-compat.yml

@@ -0,0 +1,214 @@
+# Pillar 2 / Phase 4 — Cold-start compat-matrix seed.
+#
+# This file is the SOURCE-OF-TRUTH copy. The deployed copy lives in
+# the Gitea repo at:
+#
+#   odoo-tower/odoo-addons (branch `compat-bootstrap`)
+#       └── .gitea/workflows/seed-compat.yml
+#
+# Why a dedicated branch instead of `main`/`18.0`/`19.0`: the addon
+# code lives on per-Odoo-major branches. The cold-start snapshot is
+# orthogonal data — keeping it on its own branch lets Tower fetch
+# from one stable place and lets the cron commit without touching
+# addon source.
+#
+# Schedule: daily 03:00 UTC. The emitter computes a content-hash
+# stampId, so identical results across nights produce no commit
+# (git diff is empty → push is skipped). When the catalog drifts
+# (a new addon, a fix, a regression), one commit lands and Tower's
+# next 24h tick replays it.
+#
+# Deployment (one-shot, manual until we mass-publish workflows):
+#
+#   git -C /path/to/odoo-addons checkout -b compat-bootstrap origin/18.0
+#   mkdir -p .gitea/workflows compat-bootstrap
+#   cp infrastructure/gitea-actions/workflows/seed-compat.yml \
+#      /path/to/odoo-addons/.gitea/workflows/
+#   cp scripts/qualify-addon.py scripts/emit-compat-bootstrap.py \
+#      /path/to/odoo-addons/scripts/
+#   git -C /path/to/odoo-addons add .gitea scripts compat-bootstrap
+#   git -C /path/to/odoo-addons commit -m "feat(compat): seed bootstrap workflow"
+#   git -C /path/to/odoo-addons push -u origin compat-bootstrap
+
+name: Cold-start compat seed
+on:
+  schedule:
+    - cron: '0 3 * * *'    # nightly 03:00 UTC
+  workflow_dispatch: {}    # manual trigger from Gitea UI
+
+jobs:
+  seed:
+    runs-on: ubuntu-latest
+    # LOW — bound the worst-case runtime so a hung git fetch can't
+    # block the next nightly tick from starting.
+    timeout-minutes: 30
+    steps:
+      - name: Checkout compat-bootstrap branch
+        uses: actions/checkout@v4
+        with:
+          ref: compat-bootstrap
+          fetch-depth: 1
+
+      - name: Materialise per-major addon trees
+        run: |
+          set -euo pipefail
+          # Detached worktrees keep each version branch's tree independent
+          # so the qualifier sees a clean addon root with no cross-branch
+          # contamination. Cleaned up in the final step.
+          for major in 18.0 19.0; do
+            git fetch --depth=1 origin "$major"
+            git worktree add --detach "addons-$major" "origin/$major"
+            ls -1 "addons-$major/addons" 2>/dev/null | head -5 || true
+          done
+
+      - name: Run qualifier + emit bootstrap snapshot per major
+        run: |
+          set -euo pipefail
+          mkdir -p compat-bootstrap/per-major
+          for major in 18.0 19.0; do
+            # qualify-addon.py is vendored into each version branch under
+            # .gitea/qualify-addon.py by Pillar 1; reuse that copy so static-
+            # lint logic stays in lockstep with what addon-qualify.yml runs
+            # on push.
+            python3 scripts/emit-compat-bootstrap.py \
+              --addons-root "addons-$major/addons" \
+              --qualifier "addons-$major/.gitea/qualify-addon.py" \
+              --output "compat-bootstrap/per-major/$major.json" \
+              --pg-by-major '{"18.0":"16","19.0":"17"}' \
+              --source "qualify-addon-v1" \
+              --min-rows 5
+          done
+
+      - name: Merge per-major snapshots into seeded-ci.json
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import hashlib, json, pathlib
+          rows = []
+          for p in sorted(pathlib.Path('compat-bootstrap/per-major').glob('*.json')):
+              rows.extend(json.loads(p.read_text())['rows'])
+          rows.sort(key=lambda r: (r['addonCode'], r['addonVersion'],
+                                   r['odooMajor'], r['postgresMajor']))
+          canonical = json.dumps(rows, sort_keys=True, separators=(',', ':'))
+          stamp = 'sha256:' + hashlib.sha256(canonical.encode('utf-8')).hexdigest()
+          out = {
+              'stampId': stamp,
+              'schemaVersion': 1,
+              'source': 'qualify-addon-v1',
+              'rows': rows,
+          }
+          pathlib.Path('compat-bootstrap/seeded-ci.json').write_text(
+              json.dumps(out, indent=2) + '\n')
+          print(f'merged {len(rows)} rows; stamp={stamp}')
+          PY
+
+      - name: Install cosign
+        run: |
+          set -euo pipefail
+          # H3 — pin the v2.4.1 cosign-linux-amd64 SHA256 and verify
+          # before chmod+exec. Without this, a MITM (or a compromised
+          # GitHub edge cache) can substitute a binary that exfiltrates
+          # COSIGN_PRIVATE_KEY on the next sign-blob call.
+          # Cross-checked against
+          # https://github.com/sigstore/cosign/releases/download/v2.4.1/cosign_checksums.txt
+          # on 2026-05-10.
+          COSIGN_SHA256=8b24b946dd5809c6bd93de08033bcf6bc0ed7d336b7785787c080f574b89249b
+          if ! command -v cosign >/dev/null 2>&1; then
+            curl -sSL -o /tmp/cosign \
+              https://github.com/sigstore/cosign/releases/download/v2.4.1/cosign-linux-amd64
+            echo "$COSIGN_SHA256  /tmp/cosign" | sha256sum -c -
+            mv /tmp/cosign /usr/local/bin/cosign
+            chmod +x /usr/local/bin/cosign
+          fi
+          cosign version | head -3
+
+      - name: Sign seeded-ci.json (Phase 4.1)
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COMPAT_SIGNING_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COMPAT_SIGNING_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ ! -f compat-bootstrap/seeded-ci.json ]; then
+            echo "ERROR: seeded-ci.json was not produced; nothing to sign"
+            exit 1
+          fi
+          # cosign sign-blob with --key env://VAR reads the private key
+          # PEM from the named env var; the file/stdout split keeps the
+          # raw key out of process args (where it'd show up in `ps`).
+          cosign sign-blob --yes \
+            --key env://COSIGN_PRIVATE_KEY \
+            --output-signature compat-bootstrap/seeded-ci.json.sig \
+            compat-bootstrap/seeded-ci.json
+          # H4 — Self-verify is a key-rotation TRIPWIRE, NOT a trust
+          # anchor. The on-disk cosign.pub lives in the same branch we
+          # push to; anyone holding COMPAT_PUSH_TOKEN can replace it.
+          # The real verification is Tower-side, against the pubkey
+          # baked into the binary at backend/cmd/api/compat_bootstrap_pubkey.pem
+          # (compat_seed_loader.go:38, go:embed). This step only catches
+          # "the operator rotated the keypair on lab1 but forgot to
+          # update either the Gitea secrets or the on-disk pubkey" —
+          # cheap CI-time signal so the next Tower deploy doesn't
+          # surprise-fail the verifier.
+          if [ -f compat-bootstrap/cosign.pub ]; then
+            cosign verify-blob --insecure-ignore-tlog \
+              --key compat-bootstrap/cosign.pub \
+              --signature compat-bootstrap/seeded-ci.json.sig \
+              compat-bootstrap/seeded-ci.json
+          fi
+          echo "signed: $(wc -c < compat-bootstrap/seeded-ci.json.sig) bytes"
+
+      - name: Commit + push if content changed
+        env:
+          GIT_USER_TOKEN: ${{ secrets.COMPAT_PUSH_TOKEN }}
+        run: |
+          set -euo pipefail
+          # M3 — worktree cleanup runs even if a prior step crashed
+          # (a `trap` would be cleaner, but we're already in a fresh
+          # step with `set -e`; the loop just no-ops on absent paths).
+          for major in 18.0 19.0; do git worktree remove --force "addons-$major" || true; done
+          rm -rf compat-bootstrap/per-major
+
+          # Author identity must match a real Gitea user — the
+          # branch-protection pre-receive hook calls GetUserByEmail
+          # against the committer and rejects with "Internal Server
+          # Error" (uid=-2) when no match exists. The COMPAT_PUSH_TOKEN
+          # belongs to git_admin, whose canonical Gitea email is
+          # `gitea@local.domain` (the install default — NOT the address
+          # in .credentials.md, which never made it onto the user
+          # record). Commit + push under that identity for a clean
+          # audit trail.
+          git config user.email "gitea@local.domain"
+          git config user.name  "git_admin"
+
+          if [ ! -f compat-bootstrap/seeded-ci.json ]; then
+            echo "ERROR: seeded-ci.json was not produced; aborting"
+            exit 1
+          fi
+
+          # M1 — diff check against the JSON ONLY. Cosign's ECDSA
+          # sign-blob uses random k by default, so the .sig is fresh
+          # bytes every run even when the JSON is byte-identical.
+          # Including the .sig in the diff would push a noise commit
+          # nightly. Stage the .sig first so it's part of the commit
+          # IF we end up making one, but only the .json drives the
+          # decision.
+          git add compat-bootstrap/seeded-ci.json
+          if git diff --cached --quiet -- compat-bootstrap/seeded-ci.json; then
+            echo "no content change in seeded-ci.json; nothing to commit"
+            exit 0
+          fi
+          git add compat-bootstrap/seeded-ci.json.sig
+
+          stamp=$(python3 -c "import json,sys; print(json.load(open('compat-bootstrap/seeded-ci.json'))['stampId'])")
+          git commit -m "chore(compat): refresh cold-start seed (${stamp})"
+
+          # H5 — push via http.extraHeader, not credential-in-URL.
+          # If git push fails (network timeout, ref reject, redirect
+          # following), the URL is echoed in error context AND captured
+          # by the runner's stderr log; embedding the token in the URL
+          # leaks it in any of those paths. extraHeader is git-internal,
+          # never echoed.
+          git push \
+            -c "http.extraHeader=Authorization: token ${GIT_USER_TOKEN}" \
+            https://git.odoosky.org/odoo-tower/odoo-addons.git \
+            HEAD:compat-bootstrap

compat-bootstrap/README.md

@@ -0,0 +1,5 @@
+# compat-bootstrap
+
+Tower's CompatSeedLoader fetches `seeded-ci.json` from this directory.
+Generated by `.gitea/workflows/seed-compat.yml` (cron 03:00 UTC daily).
+Don't edit by hand — the next workflow run will overwrite.

compat-bootstrap/cosign.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgbGcCGMzThWEY5aaVK249Q+ZNm1w
+BznDxfRvzL9AGdb1vkUngdcVmGXZBwg/rHXSkYJjt4t9Ky9mZkB9pB02BQ==
+-----END PUBLIC KEY-----

compat-bootstrap/seeded-ci.json

@@ -0,0 +1,151 @@
+{
+  "stampId": "sha256:a4a88515128708329a00e506761cbdc6513d4a0442f7e6555fd98625433668ba",
+  "schemaVersion": 1,
+  "source": "qualify-addon-v1",
+  "rows": [
+    {
+      "addonCode": "accounting_pdf_reports",
+      "addonVersion": "19.0.1.0.2",
+      "odooMajor": "19.0",
+      "postgresMajor": "17",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "cetmix_tower",
+      "addonVersion": "18.0.1.0.0",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "cetmix_tower_aws",
+      "addonVersion": "18.0.1.0.1",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "cetmix_tower_git",
+      "addonVersion": "18.0.1.0.2",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "failed_install",
+      "errorClass": "pip-deps-missing"
+    },
+    {
+      "addonCode": "cetmix_tower_ovh",
+      "addonVersion": "18.0.1.0.1",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "cetmix_tower_server",
+      "addonVersion": "18.0.2.0.0",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "failed_install",
+      "errorClass": "pip-deps-missing"
+    },
+    {
+      "addonCode": "cetmix_tower_server_queue",
+      "addonVersion": "18.0.2.0.0",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "cetmix_tower_webhook",
+      "addonVersion": "18.0.1.0.1",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "cetmix_tower_yaml",
+      "addonVersion": "18.0.2.0.0",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "failed_install",
+      "errorClass": "pip-deps-missing"
+    },
+    {
+      "addonCode": "cx_web_refresh_from_backend",
+      "addonVersion": "18.0.1.0.0",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "ks_dashboard_ninja",
+      "addonVersion": "18.0.1.1.7",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "failed_install",
+      "errorClass": "pip-deps-missing"
+    },
+    {
+      "addonCode": "laundry_management",
+      "addonVersion": "19.0.19.0.4",
+      "odooMajor": "19.0",
+      "postgresMajor": "17",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "om_account_accountant",
+      "addonVersion": "19.0.1.0.3",
+      "odooMajor": "19.0",
+      "postgresMajor": "17",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "om_account_asset",
+      "addonVersion": "19.0.1.0.0",
+      "odooMajor": "19.0",
+      "postgresMajor": "17",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "om_account_budget",
+      "addonVersion": "19.0.1.0.1",
+      "odooMajor": "19.0",
+      "postgresMajor": "17",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "om_account_daily_reports",
+      "addonVersion": "19.0.1.0.1",
+      "odooMajor": "19.0",
+      "postgresMajor": "17",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "om_account_followup",
+      "addonVersion": "19.0.1.0.2",
+      "odooMajor": "19.0",
+      "postgresMajor": "17",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "om_fiscal_year",
+      "addonVersion": "19.0.1.0.1",
+      "odooMajor": "19.0",
+      "postgresMajor": "17",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "om_recurring_payments",
+      "addonVersion": "19.0.1.0.0",
+      "odooMajor": "19.0",
+      "postgresMajor": "17",
+      "outcome": "success"
+    },
+    {
+      "addonCode": "tk_construction_management",
+      "addonVersion": "18.0.2.0.8",
+      "odooMajor": "18.0",
+      "postgresMajor": "16",
+      "outcome": "success"
+    }
+  ]
+}

compat-bootstrap/seeded-ci.json.sig

@@ -0,0 +1 @@
+MEYCIQDv8fKzsqoS96xtx/8Q2Vi592gDXv4wp97UooyvB11lpQIhANMXW51u2fqu+CB88cqWg93M6V4rgoUDRY4EpjWwwMgD

scripts/emit-compat-bootstrap.py

@@ -0,0 +1,248 @@
+#!/usr/bin/env python3
+"""
+emit-compat-bootstrap.py — Pillar 2 / Phase 4 emitter.
+
+Walks every addon directory under --addons-root, runs qualify-addon.py
+against each, and emits a consolidated JSON snapshot Tower's
+CompatSeedLoader replays into the matrix on startup.
+
+Wire shape (matches CompatSeedBootstrap in compat_seed_loader.go):
+
+    {
+      "stampId": "sha256:<canonical-row-hash>",
+      "schemaVersion": 1,
+      "source": "qualify-addon-v1",
+      "rows": [
+        {"addonCode": "report_carbone", "addonVersion": "18.0.1.0.9",
+         "odooMajor": "18.0", "postgresMajor": "16",
+         "outcome": "success"},
+        ...
+      ]
+    }
+
+Usage (typical Gitea Actions invocation):
+
+    python3 scripts/emit-compat-bootstrap.py \\
+        --addons-root . \\
+        --output compat-bootstrap/seeded-ci.json \\
+        --pg-by-major '{"18.0":"16","19.0":"17"}'
+
+Exit codes:
+  0   snapshot written successfully (file may or may not have changed)
+  2   bad usage / I/O error
+"""
+from __future__ import annotations
+
+import argparse
+import ast
+import hashlib
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+
+# Static-lint check name → matrix error_class taxonomy. Aligns with
+# the keys in backend/cmd/api/error_translations.yaml so Phase 2
+# aggregation can group static (seeded_ci) and runtime (real_install)
+# evidence under the same bucket.
+ERROR_CLASS_MAP = {
+    'manifest':      'manifest-malformed',
+    'pip-deps':      'pip-deps-missing',
+    'app-name':      'settings-page-broken',
+    'menu-icon':     'menu-icon-missing',
+    'hoot-import':   'bundle-module-missing',
+    'webpack-chunk': 'bundle-module-missing',
+}
+
+
+def find_addon_dirs(root: Path) -> list[Path]:
+    """Return every direct child of `root` that ships a __manifest__.py.
+
+    Skips dotfiles, .git, and the bootstrap output directory itself so
+    re-running over a previously emitted tree doesn't try to lint
+    JSON files.
+    """
+    out: list[Path] = []
+    for child in sorted(root.iterdir()):
+        if not child.is_dir():
+            continue
+        if child.name.startswith('.') or child.name == 'compat-bootstrap':
+            continue
+        if (child / '__manifest__.py').is_file():
+            out.append(child)
+    return out
+
+
+def parse_manifest_version(addon_dir: Path) -> tuple[str, str]:
+    """Return (addonVersion, odooMajor). Best-effort: empty strings on parse failure.
+
+    Odoo's convention is `<odoo-major>.<addon-x>.<addon-y>.<addon-z>`,
+    where odoo-major itself is `X.0` (e.g. `18.0`, `19.0`). We split
+    on the first two dots → odoo_major = "18.0", addon_version = full.
+    """
+    try:
+        src = (addon_dir / '__manifest__.py').read_text(encoding='utf-8')
+        manifest = ast.literal_eval(src)
+    except Exception:
+        return '', ''
+    version = str(manifest.get('version', '')).strip()
+    if not version:
+        return '', ''
+    parts = version.split('.')
+    if len(parts) >= 2 and parts[0].isdigit() and parts[1] == '0':
+        odoo_major = f'{parts[0]}.0'
+    else:
+        odoo_major = ''
+    return version, odoo_major
+
+
+def run_qualifier(qualifier: Path, addon_dirs: list[Path]) -> list[dict]:
+    """Invoke qualify-addon.py --json over every addon dir at once."""
+    if not addon_dirs:
+        return []
+    cmd = ['python3', str(qualifier), '--json'] + [str(p) for p in addon_dirs]
+    proc = subprocess.run(cmd, capture_output=True, text=True)
+    if proc.returncode == 2:
+        # Bad usage / I/O — surface stderr and abort.
+        sys.stderr.write(proc.stderr)
+        sys.exit(2)
+    # returncode 0 (all qualified) or 1 (some failed) both produce the
+    # JSON array on stdout. Parse regardless.
+    try:
+        return json.loads(proc.stdout)
+    except json.JSONDecodeError as e:
+        sys.stderr.write(f'qualifier JSON parse failed: {e}\nstdout was:\n{proc.stdout}\n')
+        sys.exit(2)
+
+
+def first_error_class(findings: list[dict]) -> str:
+    """Pick the first ERROR-severity finding's check name and translate
+    it through ERROR_CLASS_MAP. Returns '' if no ERROR-level finding."""
+    for f in findings:
+        if f.get('severity') == 'ERROR':
+            check = f.get('check', '')
+            return ERROR_CLASS_MAP.get(check, check or 'unmatched')
+    return ''
+
+
+def build_rows(qualifier_results: list[dict],
+               manifests: dict[str, tuple[str, str]],
+               pg_by_major: dict[str, str]) -> list[dict]:
+    """Map qualifier output → matrix-shaped rows.
+
+    Skips addons whose manifest didn't parse (no addonVersion) — the
+    matrix needs both code and version to be useful, and we'd rather
+    drop a row than seed it with empty strings the aggregator would
+    later have to special-case. Dropped addons are reported on stderr
+    so a regression in one __manifest__.py is visible (M4 fix).
+    """
+    rows: list[dict] = []
+    dropped: list[str] = []
+    for r in qualifier_results:
+        code = r['addon']
+        version, odoo_major = manifests.get(code, ('', ''))
+        if not version or not odoo_major:
+            dropped.append(code)
+            continue
+        pg_major = pg_by_major.get(odoo_major, '')
+        if r.get('qualified'):
+            outcome = 'success'
+            error_class = ''
+        else:
+            outcome = 'failed_install'
+            error_class = first_error_class(r.get('findings', []))
+        row = {
+            'addonCode': code,
+            'addonVersion': version,
+            'odooMajor': odoo_major,
+            'postgresMajor': pg_major,
+            'outcome': outcome,
+        }
+        if error_class:
+            row['errorClass'] = error_class
+        rows.append(row)
+    rows.sort(key=lambda r: (r['addonCode'], r['addonVersion'],
+                             r['odooMajor'], r['postgresMajor']))
+    if dropped:
+        sys.stderr.write(
+            f'WARN: {len(dropped)} addon(s) dropped (manifest unparseable or version unrecognised): '
+            + ', '.join(dropped) + '\n')
+    return rows
+
+
+def stamp_id(rows: list[dict]) -> str:
+    """Content hash of the canonical row set. Same rows → same stamp,
+    so Tower's idempotency check works across emitter invocations."""
+    canonical = json.dumps(rows, sort_keys=True, separators=(',', ':'))
+    h = hashlib.sha256(canonical.encode('utf-8')).hexdigest()
+    return f'sha256:{h}'
+
+
+def main(argv: list[str]) -> int:
+    p = argparse.ArgumentParser()
+    p.add_argument('--addons-root', required=True, type=Path,
+                   help='directory whose immediate children are addon dirs')
+    p.add_argument('--qualifier', type=Path,
+                   default=Path(__file__).parent / 'qualify-addon.py',
+                   help='path to qualify-addon.py (defaults to sibling script)')
+    p.add_argument('--output', required=True, type=Path,
+                   help='where to write the bootstrap JSON')
+    p.add_argument('--pg-by-major', type=str,
+                   default='{"18.0":"16","19.0":"17"}',
+                   help='JSON map: odoo_major → recommended postgres_major')
+    p.add_argument('--source', type=str, default='qualify-addon-v1',
+                   help='source identifier persisted in compat_seed_stamps.source')
+    p.add_argument('--min-rows', type=int, default=0,
+                   help='minimum row count; emit failure exits non-zero (M2 sanity floor). '
+                        'Set per-major to catch silent qualifier breakage that would ship an empty seed.')
+    args = p.parse_args(argv[1:])
+
+    if not args.addons_root.is_dir():
+        sys.stderr.write(f'addons-root not a directory: {args.addons_root}\n')
+        return 2
+    if not args.qualifier.is_file():
+        sys.stderr.write(f'qualifier not found: {args.qualifier}\n')
+        return 2
+
+    try:
+        pg_by_major = json.loads(args.pg_by_major)
+    except json.JSONDecodeError as e:
+        sys.stderr.write(f'--pg-by-major must be JSON: {e}\n')
+        return 2
+
+    addon_dirs = find_addon_dirs(args.addons_root)
+    manifests = {d.name: parse_manifest_version(d) for d in addon_dirs}
+    qualifier_results = run_qualifier(args.qualifier, addon_dirs)
+    rows = build_rows(qualifier_results, manifests, pg_by_major)
+
+    # M2 — refuse to ship a suspiciously small bootstrap. Caller picks
+    # the floor based on expected catalog size; matching the floor with
+    # one safety margin (e.g. branch has 10 addons → --min-rows 8)
+    # catches "qualifier crashed mid-pass" without flapping on legit
+    # one-or-two-addon removals.
+    if args.min_rows > 0 and len(rows) < args.min_rows:
+        sys.stderr.write(
+            f'ERROR: produced {len(rows)} rows, expected at least {args.min_rows} — '
+            'refusing to ship a thin bootstrap (set --min-rows lower if catalog has shrunk)\n')
+        return 2
+
+    # No generatedAt field — it would change every run and defeat the
+    # workflow's "git diff --quiet → no commit" idempotency. The git
+    # commit timestamp + stampId in commit message carry the same info.
+    bootstrap = {
+        'stampId': stamp_id(rows),
+        'schemaVersion': 1,
+        'source': args.source,
+        'rows': rows,
+    }
+
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    args.output.write_text(json.dumps(bootstrap, indent=2) + '\n', encoding='utf-8')
+    print(f'wrote {len(rows)} rows to {args.output} (stamp {bootstrap["stampId"]})',
+          file=sys.stderr)
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))