feat(operations): add read-only manifest context

[aparragithub]

Closes #189

Type

• New feature

Summary

• Add a scoped GET-only manifest context API and SSR panel.
• Validate through the existing Manifest authority and expose only allowlisted fields.
• Preserve loopback, non-production, redaction, and non-mutation boundaries.

Changes

Area	Change
Server composition	Inject optional manifest scope, location, and loader seams.
API and SSR	Render bounded valid, unavailable, and invalid manifest states.
Runtime safety	Share the literal-loopback request guard.
Tests	Cover scoping, guards, redaction, GET-only behavior, SSR, and composition.

Test plan

• uv run pytest — 1905 passed, 46 deselected
• Focused server suite — 50 passed
• uv run mypy src/odoo_forge_server tests/odoo_forge_server
• uv run ruff check src/odoo_forge_server tests/odoo_forge_server

Contributor checklist

• Linked approved issue Add read-only project manifest context to Operations UI #189
• Added exactly one type:* label
• No modified shell scripts require shellcheck
• Strict TDD and SDD verification completed
• Documentation/portfolio updates intentionally excluded for integration coordination
• Conventional commit format used
• No AI attribution or co-author trailer

Summary by CodeRabbit

• New Features
  • Added project manifest details to the dashboard, including project name, Odoo version, edition, layers, and backend connection information.
  • Added a manifest status endpoint reporting valid, unavailable, or invalid states.
• Security
  • Restricted local UI and manifest access to approved loopback requests.
  • Redacted sensitive manifest data and rejected invalid project scopes.
• Bug Fixes
  • Improved handling of missing, invalid, or unavailable project manifests without disrupting the dashboard.

[coderabbitai]

Warning

Review limit reached

@aparragithub, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 26 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6bb0cfc9-cc1d-44be-b854-11329c59df9d

📥 Commits

Reviewing files that changed from the base of the PR and between a9f9f29 and f0f5db3.

📒 Files selected for processing (3)

• tests/odoo_forge_server/test_api.py
• tests/odoo_forge_server/test_composition.py
• tests/odoo_forge_server/test_ui.py

📝 Walkthrough

Walkthrough

The application now accepts manifest configuration, exposes a loopback-protected read-only manifest endpoint, and renders validated manifest context in the Operations UI. Responses and SSR output allowlist non-secret fields and represent unavailable or invalid manifests with bounded states.

Changes

Manifest context

Layer / File(s)	Summary
Manifest API and loopback protection src/odoo_forge_server/routes/instances.py, src/odoo_forge_server/runtime.py, tests/odoo_forge_server/test_api.py	The instances router validates configured manifests, enforces loopback and project-scope checks, returns allowlisted summaries, and maps missing or malformed manifests to bounded states. API tests cover redaction and rejected methods.
SSR manifest rendering src/odoo_forge_server/views.py, src/odoo_forge_server/templates/instances.html, tests/odoo_forge_server/test_ui.py	The UI router loads manifest context for the reconciled project and passes it to the dashboard template. The template renders safe status and summary fields. UI tests cover valid, unavailable, and invalid states.
Application composition wiring src/odoo_forge_server/app.py, src/odoo_forge_server/composition.py, tests/odoo_forge_server/test_composition.py	Application factories accept manifest scope, location, and loader parameters and forward them to both routers. Composition tests verify API and SSR access.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant OperationsUI
  participant InstancesRouter
  participant ManifestLoader
  Operator->>OperationsUI: Request dashboard
  OperationsUI->>InstancesRouter: Load project manifest context
  InstancesRouter->>ManifestLoader: Load configured manifest
  ManifestLoader-->>InstancesRouter: Valid or bounded failure result
  InstancesRouter-->>OperationsUI: Allowlisted manifest context
  OperationsUI-->>Operator: Render manifest status and summary

Loading

Possibly related PRs

• aparragithub/odoo-forge#128: Introduced the application factory, composition root, and instances router extended by this change.
• aparragithub/odoo-forge#131: Introduced the UI router, runtime guard, composition, and templates extended by this change.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 12.12% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding read-only manifest context for Operations.
Linked Issues check	✅ Passed	The changes satisfy issue #189 with scoped GET-only API and SSR context, allowlisting, guards, bounded states, redaction, and focused tests.
Out of Scope Changes check	✅ Passed	The changes stay within issue #189 and do not add mutation paths, automation, adapters, or unrelated functionality.

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/operations-manifest-context

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/odoo_forge_server/test_api.py`:
- Around line 205-229: Update tests/odoo_forge_server/test_api.py lines 205-229
by removing the loaded tracking and exact-list assertion; make its loader return
valid manifest data only for the expected path, while retaining the response
assertions. Update tests/odoo_forge_server/test_composition.py lines 239-273 by
removing locations tracking and its exact-list assertion, keeping the API and
SSR output assertions independent of loader call counts.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d0d5f7bf-62bc-4fa4-b441-6560bc7cc78b

📥 Commits

Reviewing files that changed from the base of the PR and between dc51eba and a9f9f29.

📒 Files selected for processing (9)

• src/odoo_forge_server/app.py
• src/odoo_forge_server/composition.py
• src/odoo_forge_server/routes/instances.py
• src/odoo_forge_server/runtime.py
• src/odoo_forge_server/templates/instances.html
• src/odoo_forge_server/views.py
• tests/odoo_forge_server/test_api.py
• tests/odoo_forge_server/test_composition.py
• tests/odoo_forge_server/test_ui.py