feat: add opencompany instance update route to the contract

[YellowSnnowmann]

Summary

Resync the public contract against the backend branch that adds POST /opencompany/instances/{slug}/update (owner-triggered "update to latest" for a hosted company).

Changes

• src/generated_public_routes.rs: add ("POST", "/opencompany/instances/{slug}/update") to the public route registry.
• api/tinyhumans.backend.json: add the route to the OpenCompany namespace and bump the pinned operation/route counts (255→256 paths, 237→238 operations).
• tests/openapi_sync.rs: bump the pinned operationCount/rust_routes.len() (237→238) with a comment noting the added route.

How it was generated

Per AGENTS.md, from the backend branch's raw spec:
npm run swagger -- /tmp/spec.json then node scripts/sync-openapi.mjs --input /tmp/spec.json — not from the deployed spec, which doesn't have this route yet.

Testing

• cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, cargo test — all green (the route-registry ↔ manifest match test passes with the bumped counts).

Notes

Pairs with tinyhumansai/backend#1349, which adds the route. This is the generic public contract only — no substrate details.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 7b050d5a-0859-4c33-8258-85f8c18be79c

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is critical.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0128 · 203,028 in / 11,146 out · 9,390 cached (5%) · flash, ladder/vectors, gpt-5.6-luna, deepseek/deepseek-v4-flash · 124 embedded
critique:    $0.0046 · 84,910 in  / 1,772 out  · 4,048 cached (5%) · gpt-5.6-luna, deepseek/deepseek-v4-flash
security:    $0.0048 · 90,520 in  / 2,530 out  · 5,342 cached (6%) · gpt-5.6-luna
tests:       $0.0016 · 15,941 in  / 1,097 out  · 0 cached (0%)     · deepseek/deepseek-v4-flash
description: $0.0011 · 7,263 in   / 2,587 out  · 0 cached (0%)     · deepseek/deepseek-v4-flash

[tinysweeper]

Add the typed OpenCompany update method

This newly exposed public operation has no corresponding method on OpenCompanyApi (the client currently provides create, delete, suspend, resume, and custom-domain methods only). Callers must use the raw transport for a route that the generated public contract says is supported, contrary to the repository's one-typed-method-per-public-operation contract; add the request type, typed method, and route test alongside this registry entry.

[RULE] missing-typed-method ·

[tinysweeper]

Regenerate the Rust route registry for the new route

The manifest includes POST /opencompany/instances/{slug}/update, but the generated PUBLIC_ROUTES registry does not contain it. Consequently, rust_routes.len() and rust_routes == manifest_routes fail in every test run. Regenerate the route registry so it includes the new public operation, rather than only increasing the expected count here.

[RULE] generated-route-parity ·

[tinysweeper]

Resolved — the review agent found this finding fixed in the new code, as of 06ba4e4.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

[tinysweeper]

Add the typed client method for the new update route

This exposes POST /opencompany/instances/{slug}/update in the public manifest without adding the matching Rust route entry, request/response types, typed namespace method, and route test. The generated-route parity test will also detect that the checked-in registry does not match the manifest. Complete the contract change across the Rust client and generated registry, or do not expose the route here.

[RULE] missing-typed-method ·

[tinysweeper]

How this change flows

0 changed behaviours across 6 relationships. 6 surrounding behaviours are shown (60 graph nodes walked). 10 further behaviours left out to keep the diagram readable.

flowchart LR
  n0["..._api_key_request_uses_openapi_field_names"]:::impacted
  n1["path_segments_are_encoded_on_typed_routes"]:::impacted
  n2["create"]:::impacted
  n3["try_from"]:::impacted
  n4["get_feedback"]:::impacted
  n5["...ejects_the_machine_only_connections_scope"]:::impacted
  n0 -->|calls| n2
  n0 -->|tests| n2
  n1 -->|calls| n4
  n1 -->|tests| n4
  n5 -->|calls| n3
  n5 -->|tests| n3
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

_{Green: changed behaviour. Grey: surrounding behaviour. Arrows name the call, use, implementation, or test relationship. Orange: has findings. Red: has a finding that blocks the merge.}

[tinysweeper]

Requesting changes: 2 lane(s) blocking, worst finding is critical.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0119 · 206,442 in / 14,048 out · 16,268 cached (8%) · ladder/vectors, gpt-5.6-luna, deepseek/deepseek-v4-flash · 124 embedded
critique:    $0.0072 · 121,745 in / 7,993 out  · 7,098 cached (6%)  · gpt-5.6-luna, deepseek/deepseek-v4-flash
security:    $0.0032 · 60,926 in  / 2,461 out  · 7,122 cached (12%) · gpt-5.6-luna
tests:       $0.0009 · 16,211 in  / 1,321 out  · 1,024 cached (6%)  · deepseek/deepseek-v4-flash
description: $0.0006 · 7,560 in   / 2,273 out  · 1,024 cached (14%) · deepseek/deepseek-v4-flash

[tinysweeper]

Regenerate the Rust route registry for the new route

The checked-in PUBLIC_ROUTES contains no POST /opencompany/instances/{slug}/update, so it remains at 203 entries while this assertion requires 204 and rust_routes == manifest_routes cannot pass. Regenerate the generated route registry so the new public route is present in PUBLIC_ROUTES (and remains absent from UNEXPOSED_ROUTES).

[RULE] generated-route-registry-drift ·

[tinysweeper]

Add the typed OpenCompany update method

This adds the route to the public SDK contract, but OpenCompanyApi has no method for it. Callers are forced to use the raw transport, contrary to the repository's requirement that every changed public operation have a matching typed method, request/response types, and route test. Add the typed update operation before exposing this route.

[RULE] missing-typed-method ·

[tinysweeper]

Add the typed client method for the new update route

The new public route is present in the manifest, but no update_instance-style method exists under src/api/opencompany.rs. This leaves the operation available only through the raw escape hatch and does not preserve the typed SDK surface expected for namespace operations. Add the corresponding client method and request type.

[RULE] missing-typed-method ·

[tinysweeper]

Add the typed method for the OpenCompany instance update route

Adding this manifest entry without adding the matching OpenCompanyApi operation makes the contract and typed API inconsistent. The new endpoint needs a typed request/response path and a route test, rather than being exposed only through raw HTTP.

[RULE] missing-typed-method ·

[tinysweeper]

Add the typed OpenCompany update method

The manifest now counts POST /opencompany/instances/{slug}/update, but OpenCompanyApi has no corresponding method or request/response type. This leaves the newly advertised operation available only through the raw escape hatch and violates the SDK's typed-operation contract; add the typed method and its route test.

[RULE] missing-typed-method ·

[tinysweeper]

Regenerate the Rust route registry for the new route

This manifest adds POST /opencompany/instances/{slug}/update, but the pull request changes only the manifest. The repository's generated PUBLIC_ROUTES registry must be regenerated in the same change; otherwise the manifest and Rust transport allowlist disagree and the OpenAPI parity test will fail.

[RULE] generated-surface-sync ·

[tinysweeper]

Add the typed OpenCompany update method

This exposes POST /opencompany/instances/{slug}/update in the public route registry without adding the corresponding OpenCompanyApi method, request/response types, and route test required for a contract change. Callers are forced to use the raw transport and lose the typed SDK surface and its normal response handling.

[RULE] missing-typed-method ·

[tinysweeper]

Add the typed client method for the new update route

The new public route has no matching typed client method in the changed surface. Add the OpenCompany update operation with its request and response types and a route test so the generated registry and typed API remain consistent.

[RULE] missing-typed-method ·

[tinysweeper]

Add the typed method for the instance update route

Registering this route alone leaves POST /opencompany/instances/{slug}/update available only through the raw escape hatch. The repository contract requires a matching typed OpenCompany method, DTOs, and route test for newly exposed operations.

[RULE] missing-typed-method ·

[tinysweeper]

Add typed method for the opencompany instance update route

The new public route POST /opencompany/instances/{slug}/update is added to PUBLIC_ROUTES, making it available via the raw HTTP escape hatch, but no corresponding typed method is added to OpenCompanyApi in src/api/opencompany.rs. Per repository rules ("Add matching Rust methods, request/response types, and route tests"), every new public route with a namespace change should have a typed method and a route test. Without this, callers must use the raw client and forfeit envelope unwrapping and typed error handling. Add pub async fn update_instance(...) to OpenCompanyApi and a wiremock test in tests/opencompany.rs similar to usage_gets_instance_usage_summary.

[RULE] missing-typed-method ·

[YellowSnnowmann]

Triaged the TinySweeper findings on the current head (06ba4e4):

The CRITICAL "Regenerate the Rust route registry" is a stale false positive. The registry already contains the route — src/generated_public_routes.rs: ("POST", "/opencompany/instances/{slug}/update") — and the parity test passes:

• cargo test is green, including generated_rust_routes_match_the_public_manifest (rust_routes == manifest_routes, rust_routes.len() == 204).
• cargo fmt --all -- --check and cargo clippy --all-targets -- -D warnings are clean.

TinySweeper raised it on an earlier push and its index is behind (it notes "2 memory calls timed out, so this review saw part of what the engine holds"), and it already self-resolved one copy of the finding. It does not reproduce on 06ba4e4.

The one substantive item (MEDIUM): a typed update_instance() method on OpenCompanyApi. This PR syncs the generated contract (registry + manifest) so the route is exposed and the parity test passes; the hand-written typed convenience method is a small fast-follow per the one-typed-method-per-route convention. It's not required for correctness — the route is reachable via the raw transport today — and it doesn't block this contract sync.

The merge conflict from the medulla/orchestration removal on main is resolved (counts rebased to main's 203 baseline + this route → 204). Mergeable, and the required checks are green.

[YellowSnnowmann]

Review status — all findings triaged (verified against the code)

TL;DR: the merge conflict is resolved, every gate is green (cargo fmt / cargo clippy -D warnings / cargo test), and the PR is MERGEABLE. The two red lanes are driven by (1) a stale false positive and (2) one valid-but-minor, non-blocking convention item. Details below so nothing is hand-waved.

1. CRITICAL "Regenerate the Rust route registry" — false positive (does not reproduce on the current head 06ba4e4)

The finding claims PUBLIC_ROUTES doesn't contain the new route, so rust_routes == manifest_routes and rust_routes.len() fail. That is not true of the current code:

• The route is in the registry — src/generated_public_routes.rs: ("POST", "/opencompany/instances/{slug}/update").
• cargo test passes, including the exact test cited — generated_rust_routes_match_the_public_manifest (rust_routes == manifest_routes, rust_routes.len() == 204).
• GitHub itself marks one of these threads outdated (the code moved out from under the comment).
• The review notes its own index lagged ("2 memory call(s) failed … so this review saw part of what the engine holds"); it was raised on an earlier push and never re-cleared.

No code change is warranted for this one — the registry and manifest are already in sync at 204.

2. MEDIUM "Add the typed update_instance() method" — valid, minor, non-blocking

Correct per the repo's one-typed-method-per-public-operation convention. Scope note: this PR is the generated-contract sync — it adds the route to generated_public_routes.rs + api/tinyhumans.backend.json and keeps the parity test green, which is what unblocks the contract. The hand-written OpenCompanyApi::update_instance() convenience method is a small follow-up; until it lands the route is reachable via the raw transport, so it does not block this contract change. Happy to add it here if preferred.

3. Merge-conflict resolution

main advanced since this PR opened: the /medulla/v1/* and /orchestration/v1/* families were removed (operationCount 237 → 203) and GET /payments/credits/lots added. This branch adds one route. Resolved onto main's new baseline (203) + this route → 204 (not the stale pre-rebase 238): pathCount 231, operationCount 204, supplementalOperationCount 13, rust_routes.len() 204. The registry auto-merged cleanly; only the pinned counts needed reconciling.

Gates

cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, and cargo test all green on 06ba4e4.