Current Status
State: Complete. The runtime fix landed in #113 at 0d02e023d235cc843db4c38aa694777c06c1f8b4. All 268 tests passed (one skipped), five PR checks and post-merge CI/CodeQL passed, and independent Anthropic claude-opus-5-5 review found no findings. The reproduced quoted-password failure was fixed in the same startup path. Final changed-file inspection has 13 existing findings outside changed lines; #111 owns preparation and baseline diagnostics. The primary checkout is clean at the landing SHA.
CM's consumer pin landed in cbusillo/odoo-tenant-cm-website#88. Follow-up #89 fixed the observed missing runtime-pin path in the automatic testing trigger and landed at 04d99b112fd5e3ba75752b41775f1fc0e27119a8. Automatic Ship Testing On Merge, CI, Security, artifact publication (36068773378), testing deployment (36069091826), and post-deploy (36069222073) all succeeded. The running testing health endpoint reports pass, artifact artifact-cm_website-7ccd5e3891569910, deployment deployment-20260924T224443Z-cm_website-testing, and that exact source commit. The contact page renders correctly in the browser.
The retained runtime log read covers all 369 available lines from this rollout, including three admin-hardening passes at 22:45:01, 22:45:28 and 22:46:24 UTC, with no mail-send/notification lines. Launchplane redacts the admin_password_updated boolean because its key includes password, so this is not an unredacted proof of the boolean value. The unchanged-password behavior itself is established by the regression tests, and the immutable consumer image plus observed startups establish the rollout.
Actual configured rotations retain Odoo's normal notifications. No additional contact email was sent and the old failed message was not retried. Justin's receipt of the one authorized fresh test and acceptance of #86 remain recorded; CM production still awaits his release checklist.
Next action: None for this fix. Follow CM release progress in cbusillo/launchplane#2446 and separate IDE preparation debt in #111.
Blocked by: None.
Last verified: 2026-09-24 22:56 UTC.
Scope
Make managed startup administrator hardening idempotent: verify the configured Odoo password using Odoo's credential API, and write only when it actually differs. Preserve normal security notifications for real password changes, the configured-user-missing behavior, and the default-password hardening check. Do not globally disable mail or security notices. Keep credentials out of output and tests synthetic.
Finish Line
A repeat startup with the same configured password performs no password write; a genuine configured rotation still applies and retains normal Odoo notifications; failed credential-check infrastructure cannot silently weaken hardening. Behavior tests, required gates, independent review, and a runtime consumer rollout establish the fix. Coordinate the CM runtime pin after accepted #86 rather than silently changing its accepted source revision.
Relationships
Discovered during cbusillo/launchplane#2485 and cbusillo/odoo-tenant-cm-website#23. User reports are explained at https://github.com/cbusillo/odoo-tenant-cm-website/issues/23#issuecomment-5822635915.
Current Status
State: Complete. The runtime fix landed in #113 at
0d02e023d235cc843db4c38aa694777c06c1f8b4. All 268 tests passed (one skipped), five PR checks and post-merge CI/CodeQL passed, and independent Anthropic claude-opus-5-5 review found no findings. The reproduced quoted-password failure was fixed in the same startup path. Final changed-file inspection has 13 existing findings outside changed lines; #111 owns preparation and baseline diagnostics. The primary checkout is clean at the landing SHA.CM's consumer pin landed in cbusillo/odoo-tenant-cm-website#88. Follow-up #89 fixed the observed missing runtime-pin path in the automatic testing trigger and landed at
04d99b112fd5e3ba75752b41775f1fc0e27119a8. Automatic Ship Testing On Merge, CI, Security, artifact publication (36068773378), testing deployment (36069091826), and post-deploy (36069222073) all succeeded. The running testing health endpoint reportspass, artifactartifact-cm_website-7ccd5e3891569910, deploymentdeployment-20260924T224443Z-cm_website-testing, and that exact source commit. The contact page renders correctly in the browser.The retained runtime log read covers all 369 available lines from this rollout, including three admin-hardening passes at 22:45:01, 22:45:28 and 22:46:24 UTC, with no mail-send/notification lines. Launchplane redacts the
admin_password_updatedboolean because its key includes password, so this is not an unredacted proof of the boolean value. The unchanged-password behavior itself is established by the regression tests, and the immutable consumer image plus observed startups establish the rollout.Actual configured rotations retain Odoo's normal notifications. No additional contact email was sent and the old failed message was not retried. Justin's receipt of the one authorized fresh test and acceptance of #86 remain recorded; CM production still awaits his release checklist.
Next action: None for this fix. Follow CM release progress in cbusillo/launchplane#2446 and separate IDE preparation debt in #111.
Blocked by: None.
Last verified: 2026-09-24 22:56 UTC.
Scope
Make managed startup administrator hardening idempotent: verify the configured Odoo password using Odoo's credential API, and write only when it actually differs. Preserve normal security notifications for real password changes, the configured-user-missing behavior, and the default-password hardening check. Do not globally disable mail or security notices. Keep credentials out of output and tests synthetic.
Finish Line
A repeat startup with the same configured password performs no password write; a genuine configured rotation still applies and retains normal Odoo notifications; failed credential-check infrastructure cannot silently weaken hardening. Behavior tests, required gates, independent review, and a runtime consumer rollout establish the fix. Coordinate the CM runtime pin after accepted #86 rather than silently changing its accepted source revision.
Relationships
Discovered during cbusillo/launchplane#2485 and cbusillo/odoo-tenant-cm-website#23. User reports are explained at https://github.com/cbusillo/odoo-tenant-cm-website/issues/23#issuecomment-5822635915.