[shiny-code-app]

Why

The CM production recovery on #6070 stopped on our own tool. The generic caller refused read_release_review with generic_caller_not_supported, because the service did not advertise that read for it. No route showed the website settings production last recorded (last_apply), and that record decides whether the one rollback to the last accepted release is safe (rows in #6070 (comment)). Both are reads. The overall direction says reading is never a stop and a wrongly refused read is fixed so the refusal cannot happen again.

What changed

• read_release_review (GET /v1/release-review) and read_environment_website_bootstrap are advertised with the generic_caller surface, as read-only operations with no idempotency or reviewed evidence. Their existing authorization is unchanged: product_profile.read (or promotion/owner access) and instance-scoped operations.read.
• The website-bootstrap read also returns the override record's last_apply: status and time, whether the website settings were verified, their artifact id, and the recorded settings. The scalar fields are marked safe for the caller to print. The settings object stays in the private response file.
• Regenerated contracts/agent-operator-contract.json; documented the fields in docs/records.md.

The generic caller in the catalog needs no change: it already reads supported_surfaces and safe-output marks from the live OpenAPI description.

Removed: the caller refusal for these two reads. Net lines: +125 (130 added, 5 removed), of which 60 are the regenerated contract artifact. The growth is two allow-list entries, five response fields and their test; no new route or concept.

Verification

• tests.test_odoo_runtime_reads, tests.test_agent_operator_contract, tests.test_service_bootstrap (44 tests) and the agent-contract/OpenAPI tests in tests.test_service pass. The bootstrap read test asserts the recorded settings, verification state and artifact.
• ruff, ruff format and mypy clean on changed files; pnpm check:openapi-drift clean.
• Native PyCharm inspection GREEN, 3 files, 0 findings on changed lines; JSON and Markdown are outside the inspection lanes.
• Outside review by OpenAI (Codex; model not reported by the CLI): no findings.

Coordinated with the controller redesign on #6072: #6072 (comment)

Refs #6070

[shiny-code-app]

Review result: weighed
Head: 5289acd

Outside review: OpenAI through Codex (the CLI did not report the model), read-only, on this head. It was asked about exposure beyond the routes' existing authorization, whether the fields tell apart no recorded settings, unverified settings and verified settings for an artifact, whether the advertised surfaces and modes are truthful, and any contract or test that would break. Result: no findings. Nothing to act on or decline.

[shiny-code-app]

Review result: weighed
Head: 2e09531

Review disposition for head 2e09531. The OpenAI review of 5289acd (no findings, #6073 (comment)) covers this head. The only change since is commit 2e09531, which deletes three comment lines that the repository's new-comment check refused. It changes no code or test behavior, so no rereview was run. Focused tests, ruff and the comment check pass locally on this head.