Outcome

Adds the first governed Odoo deployment path to GroundControl: Odoo Community 19 + PostgreSQL behind host Caddy, with persistence, generated credentials, health checks, and paired local database/filestore recovery archives.

Product path

This establishes the deterministic primitive required before natural-language deployment is exposed to agents:

1. validate a typed Ghana business intent
2. generate reviewed template inputs
3. require approval for stack/domain/business initialization mutations
4. verify public reachability, persistence, requested modules, and recovery artifacts
5. preserve explicit rollback instructions and recovery uncertainty

Changes

• add vps-caddy-odoo-community template
• add OdooDeploymentIntent and deterministic plan generation
• allowlist the first supported Odoo business modules
• validate domain, tagged images, loopback host port, and backup policy
• add template and planner tests
• document the backup/restore maturity boundary

Safety and maturity

• Odoo binds only to a loopback host port and is published through validated Caddy HTTPS.
• Persistent volumes are never part of the template rollback action.
• Local archives are not described as disaster recovery.
• Recoverability remains unconfirmed until a disposable restore test succeeds.
• Ghana payments, tax, and payroll remain out of scope until their own integration acceptance paths exist.

Verification

• Docker image manifest check for odoo:19.0: passed
• Rendered Odoo Compose parsed with docker compose config: passed
• Focused tests: pnpm vitest run src/lib/odoo-deployment.test.ts src/lib/template-engine.test.ts: passed
• Full local tests: pnpm test: 48 files, 366 tests passed
• TypeScript: pnpm tsc --noEmit: passed
• GitHub CI: passed
• GitHub Test: passed