[DTP-Worker] Sprint 8 · buffer L75 · Reproductibilité checkout propre : hand-off out/ des 4 générateurs RBAC était .gitignore-é (gate rouge en CI, vert local seulement) + durcissement check_artifacts (build produit ⇒ DOIT être suivi par git)

Défaut réel (même classe que le bug regression_run.json corrigé plus tôt) :
les 4 générateurs RBAC (fixtures_gen/userperm_gen/roleprofile_gen/apply_plan)
.gitignore-aient leur out/, alors qu'ils sont audités en archétype `generator`
(critère HANDOFF). En checkout PROPRE (git archive HEAD = ce que voit le runner
Gitea) leur out/ est absent → qa/audit_4big (dont le build relit le out/ de
CHAQUE module) les note 80<95 ⇒ INV7 ⇒ build refusé ⇒ check-artifacts ET
check-regression ROUGES. Ça ne passait qu'en local via les out/ non suivis
laissés par des build manuels.

Fix : committer le out/ des 4 générateurs (build byte-déterministe prouvé ;
apply_plan lit ses frères en process, pas via out/) → alignement sur les 15
autres générateurs ; audit 100/100 en checkout propre.

Durcissement : check_artifacts.sh exige désormais `git ls-files --error-unmatch`
sur chaque fichier produit → un out/ ignoré/non commité devient une erreur
LOCALE honnête au lieu d'une surprise en CI. Bite-proof : git rm --cached d'un
artefact (laissé sur disque) ⇒ exit 1 ; re-add ⇒ exit 0.

Régénéré : quality_report.json (dérive DOC = taille des 4 README édités).
Vérifs : 6 gates verts sur git archive propre ; 534/21 inchangé ; suites OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

05_deliverables_mvp/rbac/userperm_gen/.gitignore

@@ -1,5 +1,7 @@
-# Artefacts de génération locale (jamais commités — produits à la demande par
-# `python3 userperm_gen.py build`, re-générables en CI).
+# Artefacts Python (jamais commit — reproductibles).
 __pycache__/
 *.pyc
-out/
+# NB : out/ EST commité (hand-off audité · archétype `generator` · critère
+# HANDOFF · CLAUDE.md #5). `build` est byte-déterministe → out/ se régénère à
+# l'identique par `python3 userperm_gen.py build -o out` et est gardé par
+# ci/check_artifacts.sh (build frais == commité).

05_deliverables_mvp/rbac/userperm_gen/README.md

@@ -21,7 +21,7 @@ produire qu'un **template par rôle** dont le champ `user` est une sentinelle
 (`__ASSIGN_PER_USER__`). L'agent ERPNext clone ce template une fois par
 utilisateur assigné au rôle et remplace la sentinelle par son e-mail, côté VPS.
 
-## Ce qui est généré (`out/`, non commité)
+## Ce qui est généré (`out/`, commité · byte-déterministe)
 
 | Fichier | Rôle |
 |---|---|

05_deliverables_mvp/rbac/userperm_gen/out/MANIFEST.json

@@ -0,0 +1,28 @@
+{
+  "generated_from": "rbac_50_roles.json",
+  "source_version": "1.0.0",
+  "cible_rbac_roles": 50,
+  "counts": {
+    "plan_entries": 50,
+    "user_permission_templates": 28,
+    "by_mechanism": {
+      "docperm_if_owner": 2,
+      "user_permission_company": 28,
+      "none_consolidated": 16,
+      "vps_confirm_team": 4
+    }
+  },
+  "companies_a_confirmer": [
+    "AC Arias Cuevas",
+    "Consortium ECR DR",
+    "Helios RD",
+    "Ploutos",
+    "WA SRL"
+  ],
+  "roles_scope_equipe_a_confirmer": [
+    "OTO Construction Chef Projet",
+    "OTO Construction Ingénieur",
+    "OTO Construction Sous-traitants",
+    "OTO Ventes Chef Équipe"
+  ]
+}

05_deliverables_mvp/rbac/userperm_gen/out/user_permission_plan.json

@@ -0,0 +1,576 @@
+[
+  {
+    "erpnext_role_name": "OTO Achat Acheteur",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Achat Directeur",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Achat Fournisseurs",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Achat Magasinier",
+    "scope_donnees": "entite",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "AC Arias Cuevas",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Achat Réception",
+    "scope_donnees": "entite",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "AC Arias Cuevas",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Compta Audit UAF",
+    "scope_donnees": "groupe",
+    "entite_principale": "Groupe",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Compta Clients AR",
+    "scope_donnees": "entite",
+    "entite_principale": "Helios RD",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Helios RD",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Compta Contrôle Gestion",
+    "scope_donnees": "groupe",
+    "entite_principale": "Groupe",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Compta Fiscaliste eCF",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Compta Fournisseurs AP",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Compta Général",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Compta Paie",
+    "scope_donnees": "entite",
+    "entite_principale": "Consortium ECR DR",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Consortium ECR DR",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Compta Trésorier",
+    "scope_donnees": "entite",
+    "entite_principale": "Ploutos",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Ploutos",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Conseil Administration",
+    "scope_donnees": "groupe",
+    "entite_principale": "Groupe",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Construction Architecte",
+    "scope_donnees": "entite",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "AC Arias Cuevas",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Construction BIM",
+    "scope_donnees": "entite",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "AC Arias Cuevas",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Construction Chef Projet",
+    "scope_donnees": "equipe",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "vps_confirm_team",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Construction Directeur",
+    "scope_donnees": "entite",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "AC Arias Cuevas",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Construction Ingénieur",
+    "scope_donnees": "equipe",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "vps_confirm_team",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Construction QAQC",
+    "scope_donnees": "entite",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "AC Arias Cuevas",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Construction Sous-traitants",
+    "scope_donnees": "equipe",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "vps_confirm_team",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Direction Commerciale",
+    "scope_donnees": "groupe",
+    "entite_principale": "Groupe",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Direction Financière",
+    "scope_donnees": "groupe",
+    "entite_principale": "Groupe",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Direction Générale",
+    "scope_donnees": "groupe",
+    "entite_principale": "Groupe",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Direction Opérations",
+    "scope_donnees": "groupe",
+    "entite_principale": "Groupe",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Direction Président",
+    "scope_donnees": "groupe",
+    "entite_principale": "WAF",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Faisabilité Analyste",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Faisabilité IFC Speckle",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Faisabilité Rendu 3D",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Faisabilité Économiste",
+    "scope_donnees": "entite",
+    "entite_principale": "AC Arias Cuevas",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "AC Arias Cuevas",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Legal Directeur",
+    "scope_donnees": "groupe",
+    "entite_principale": "WAF",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Legal ONAPI",
+    "scope_donnees": "groupe",
+    "entite_principale": "WAF",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Marketing Directeur",
+    "scope_donnees": "entite",
+    "entite_principale": "Helios RD",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Helios RD",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Marketing Publiciste",
+    "scope_donnees": "entite",
+    "entite_principale": "Helios RD",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Helios RD",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Marketing SEO",
+    "scope_donnees": "entite",
+    "entite_principale": "Helios RD",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Helios RD",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Marketing Social",
+    "scope_donnees": "entite",
+    "entite_principale": "Helios RD",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Helios RD",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Plateforme BI",
+    "scope_donnees": "groupe",
+    "entite_principale": "Groupe",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Plateforme DevOps",
+    "scope_donnees": "groupe",
+    "entite_principale": "9060 QC",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Plateforme Mobile",
+    "scope_donnees": "groupe",
+    "entite_principale": "9060 QC",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Plateforme OTOIA",
+    "scope_donnees": "groupe",
+    "entite_principale": "9060 QC",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Plateforme QA",
+    "scope_donnees": "groupe",
+    "entite_principale": "9060 QC",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Plateforme RBAC Admin",
+    "scope_donnees": "groupe",
+    "entite_principale": "9060 QC",
+    "mechanism": "none_consolidated",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Ventes Après-Vente",
+    "scope_donnees": "entite",
+    "entite_principale": "Helios RD",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Helios RD",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Ventes CONFOTUR",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Ventes Chef Équipe",
+    "scope_donnees": "equipe",
+    "entite_principale": "Helios RD",
+    "mechanism": "vps_confirm_team",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Ventes Conseiller",
+    "scope_donnees": "own",
+    "entite_principale": "Helios RD",
+    "mechanism": "docperm_if_owner",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Ventes Contrats",
+    "scope_donnees": "entite",
+    "entite_principale": "WA SRL",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "WA SRL",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Ventes Courtier Externe",
+    "scope_donnees": "own",
+    "entite_principale": "Helios RD",
+    "mechanism": "docperm_if_owner",
+    "user_permission_template": null
+  },
+  {
+    "erpnext_role_name": "OTO Ventes Directeur",
+    "scope_donnees": "entite",
+    "entite_principale": "Helios RD",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Helios RD",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  },
+  {
+    "erpnext_role_name": "OTO Ventes Réservations",
+    "scope_donnees": "entite",
+    "entite_principale": "Helios RD",
+    "mechanism": "user_permission_company",
+    "user_permission_template": {
+      "doctype": "User Permission",
+      "user": "__ASSIGN_PER_USER__",
+      "allow": "Company",
+      "for_value": "Helios RD",
+      "apply_to_all_doctypes": 1,
+      "is_default": 0,
+      "hide_descendants": 0
+    }
+  }
+]