[shiny-code-app]

Installed Odoo importer defaults and TLS prerequisites could not be inspected without treating omitted optional settings as missing evidence. Add a fixed testing-only GET that reports closed, value-free option origins, agreement and TLS configuration from the exact verified web artifact. It makes no source connection and leaves source-grant qualification unchanged.

Verify importer callers/producers and the installed shared payload parser/applier against complete artifact inventories, reject overlays/shadows/symlinks, and bracket a bounded read-only local PostgreSQL transaction with identity, authority, artifact, code and parameter drift checks. Typed override literals supply option intent; the actual encoded payload supplies delivery through the installed shared parser. Legacy per-field variables are never a delivery fallback. Omitted overrides with persisted optional values retain unknown comparisons, rather than claiming that omission clears the stored value. Password comparisons remain local and never attest managed-secret value agreement.

Closes #4061
Refs #3845, cbusillo/odoo-shared-addons#68 and cbusillo/direction#5

Validation: the retained canonical-renderer regression failed on refreshed main before the fix. All 147 tests across the full prerequisite, runtime reads, diagnostics, runtime grants, diagnostic identity and instance-override modules pass. Whole-project Ruff, formatting, mypy (1,764 files), TLS/public-safety/comment/diff checks pass. Frontend validation passes 203 tests, API drift/types and the production build. Tests stage an immutable shipped parser artifact and synthetic connection producers, with no sibling checkout dependency or copied tenant defaults. Inspection NOT RUN under the brief's explicit no-JetBrains instruction.

The own Anthropic review found no blocking defects and is weighed on the current head. All three LOW findings were addressed with an ambiguity regression, removal of literal-bound assertions, and accurate documentation. An injected first-inventory selection is caught by the new regression. The pre-existing preview-source sibling is recorded on #3845. CI on the final PR head remains required. No live qualification, Client data, credentials/grants, production operation or Client contact is part of this source task. The original retained red draft was resumed through the supported claim route after catalog PR2668 landed; no ownership bypass was used.

Removed: the draft's legacy authority/delivery model and stale generated artifact; no existing main code is deleted.
Net lines: +2,119. This adds the bounded read, verification programs, API documentation and behavioral fixtures; generated OpenAPI remains ignored under the current repository contract.

Client test notes

Nothing for the Client to test: this adds an agent diagnostic read without changing CM inventory behavior or connecting to a source. Actual source qualification and the CM staff trial remain on their owning issues.

[shiny-code-app]

Review result: weighed
Head: 91a8109

Review of record: Anthropic claude-opus-5-5[1m], effort not reported, completed against 2b6174f. It found no blocking, high or medium defects and confirmed the actual payload authority/delivery correction and persisted-omission semantics. Current 91a8109 changes only tests and documentation; executable product code is unchanged since review.

Acted on all three LOW findings: added duplicate complete shared-inventory behavior coverage; removed exact timeout/fetch-size assertions and the sibling literal bound; corrected the installation-state wording without fixing it to a count. All28 reader cases pass. Injecting arbitrary first-inventory selection makes the new case fail, proving it catches the reported regression. The six complete affected safety modules previously passed146 cases; the additional reader case brings current coverage to147. Whole-project mypy1764 files and focused Ruff pass again. Required comment/TLS/public-safety/diff checks passed; frontend203 tests, API drift/types and build passed. Inspection NOT RUN under the unconditional no-JetBrains brief.

Tracked: the review also identified the pre-existing preview import source's legacy settings/copied-default sibling in odoo_preview_import_source.py. It is being recorded on canonical source qualification #3845, alongside the already-known grant-reader siblings, without widening this PR. Searches for its exact source module and copied-default symbol found no separate owner issue. No new lifecycle, grant or Client operation is inferred.

Missing deployed evidence remains missing: actual CM image layout, installed producer revision, legacy option inputs, managed-value agreement, TLS handshake and source privileges are not qualified here. Until the required installed support is present, this endpoint stays unknown. Source-only tests do not prove any live credential or source. No live endpoint, Odoo registry, source connection, Client data, production, grant, Client contact or IDE operation ran. Background review: no matching additional lifecycle evidence observable.

[shiny-code-app]

Ready for the merge train

Head: 91a8109

[shiny-code-app]

Launchplane completed the merge-train step for this pull request.

• Repository: cbusillo/launchplane
• Base branch: main
• Pull request: Read value-free prerequisites from verified installed Odoo importers #4707
• Controller action: land_batch
• Controller record: merge-train-batch-landing-plan-20261024T181954Z-9d71364b07d6d476

Launchplane landed this pull request through protected batch PR #4731.

Launchplane manages this comment and will update it as the train moves.