[wax911]

Refs #652 and #653

Problem

The P0 inventory collector existed only in a local draft. Publishing it makes the remaining inventory and migration handoff reproducible without depending on one workstation. Live ownership, target configuration and recovery evidence are still incomplete.

What changed

• Add read-only platform-inventory and platform-inventory-validate commands, normalized Docker/Compose metadata, and strict inventory/environment schemas.
• Require confirmed current production inputs, approved context binding, resolved ownership and complete matched/unmatched container reconciliation before an operator-supplied G0 pass can validate. Confirmed health/database records require evidence, versions/topology and data paths.
• Preserve real Docker numeric-string volume reference counts and normalize systemd integer-microsecond timestamps without float precision loss. Explicitly label timers as collector-host observations, not Docker-engine-host proof.
• Keep normalized artifacts private under ignored directories (0700) and JSON files (0600); omit environment values and raw command output from public reporting.
• Publish the dated sanitized source-host-candidate snapshot with limitations and separate later lab verification results.
• Add a contents: read CI job running all inventory tests without cloud credentials or runtime mutation.

Verification

• /tmp/omp-platform-lab-654-testenv/bin/python -m pytest -q tests/platform: 30 passed.
• The new reconciliation/normalization regression file, loaded against the published pre-repair a094dbf collector in a throwaway fixture, produced 23 failures and one passing semantic control. All cases pass after repair.
• make platform-inventory ENV=lab DOCKER_CONTEXT=default PYTHON=/tmp/omp-platform-lab-654-testenv/bin/python: repaired read-only collection succeeded, run 20261027T192226Z-bf4b5c69, schema=valid reconciliation=blocked.
• make platform-inventory-validate ENV=lab INVENTORY_FILE=.artifacts/platform/20261027T192226Z-bf4b5c69/inventory.json PYTHON=/tmp/omp-platform-lab-654-testenv/bin/python: schema=valid gate=blocked.
• /tmp/omp-platform-lab-654-testenv/bin/python -m py_compile tools/platform/inventory.py: passed.
• CI YAML parsed locally; inventory-job permissions are contents: read.
• Staged whitespace check passed. Only explicit source, schema, tests, workflow and sanitized documentation paths were staged, not private artifacts/caches.

Boundaries and remaining acceptance

• Stacked on docs/platform-roadmap-2026-10-24 (PR docs(platform): define phased Pulumi, Ansible and Dokploy migration #651). This does not change service-local authored configuration or generated stacks.
• G0 remains blocked: the selected engine is not an owner-confirmed production identity; live workload owners/dispositions, external providers/gateway exports, target/DNS/access inputs and tested recovery remain unresolved.
• Docker CLI fixture tests are synthetic. No disposable Docker daemon was designated for separate actual-fixture acceptance. No cloud, VM, backup, ingress or cutover acceptance is claimed.
• No daemon resources, credentials, DNS records or cloud resources were changed. No raw inventory JSON, private keys, environment exports or backup data are published.
• The operational handoff is being delivered in stacked PR feat(platform): add host baseline, evidence validation and operator runbooks #671 at docs/platform/runbooks/README.md, including a portable separate-clone procedure for this PR and the remaining live reconciliation.
• Keep this PR draft until applicable acceptance/review gates are satisfied. It does not close docs(platform): phase 0 reconcile the live inventory and migration constraints #653 or feat(platform): track the phased AniTrend private platform migration #652.