feat(opencompany): add companies catalog route to the contract

[YellowSnnowmann]

Syncs the public Rust SDK contract against backend main for the new company-template picker (backend PR tinyhumansai/backend#1365).

Generated via scripts/sync-openapi.mjs --input <branch spec>:

• Add GET /opencompany/companies — the company-template catalog the dashboard and landing read so users can pick a company on create.
• Restore POST /opencompany/instances/{slug}/update to PUBLIC_ROUTES. It shipped in feat: add opencompany instance update route to the contract #30 but a later bare resync against the deployed spec (which predated the route) reverted it back out; it is served by main.
• operationCount 206 -> 208; pinned counts in tests/openapi_sync.rs updated to match.

Verification: cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, and cargo test all clean.

Companion to tinyhumansai/backend#1365; the backend sdk gitlink should be bumped to this commit once merged.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 2 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Changes requested
Priority: high
Reviewed head: b17b6c76fb69
Updated: 1789991533 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	2
Tests	1	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

• high · critique · Update the manifest before raising the operation count — The diff adds two routes to `PUBLIC_ROUTES` and changes the expected manifest operation count to 208, but it does not update the checked-in `api/tinyhumans.backend.json`. The manif (tests/openapi\_sync\.rs:167)
• medium · description · Add client method for the new GET /opencompany/companies route — The route registry and test file are updated to include `GET /opencompany/companies`, but no matching public method is added to the Rust SDK client. The repository's coding rules s (\(pull request description\))

Before merge

• Address Update the manifest before raising the operation count (tests/openapi\_sync\.rs).

How this fits together

flowchart LR
  n0["..._api_key_request_uses_openapi_field_names"]:::impacted
  n1["path_segments_are_encoded_on_typed_routes"]:::impacted
  n2["create"]:::impacted
  n3["try_from"]:::impacted
  n4["get_feedback"]:::impacted
  n5["...ejects_the_machine_only_connections_scope"]:::impacted
  n0 -->|calls| n2
  n0 -->|tests| n2
  n1 -->|calls| n4
  n1 -->|tests| n4
  n5 -->|calls| n3
  n5 -->|tests| n3
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Failure
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 1 finding. _The code index is behind this pull request (indexed at `c600fb46f9d1`), so retrieved context may be out of date._ _Memory was unavailable (model: cortex: v1/recall: timed out after 10s), so this review ran without it._
• Evidence: tests/openapi\_sync\.rs — Update the manifest before raising the operation count

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 0 findings. _The code index is behind this pull request (indexed at `c600fb46f9d1`), so retrieved context may be out of date._ _Memory was unavailable (model: cortex: v1/recall: timed out after 10s), so this review ran without it._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds two public OpenCompany routes to the manifest and generated route registry but omits the typed client methods and any SDK-level tests for them. The only test updates are count assertions that verify consistency between the two generated artifacts, not that the new routes are actually usable through the client. This violates the repository's own rule that client, tests, route registry, and docs must be kept in the same contract change. (1 finding discarded for not matching a changed line) _The code index is behind this pull request (indexed at `c600fb46f9d1`), so retrieved context may be out of date._ _Memory was unavailable (model: cortex: v1/recall: timed out after 10s), so this review ran without it._

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This PR syncs the public route registry against backend main, adding `GET /opencompany/companies` and restoring `POST /opencompany/instances/{slug}/update`, and updates the operation-count assertions. However, it does not include the corresponding client method for the new `GET /opencompany/companies` route, violating the rule to keep client methods in the same contract change. Merge after adding the missing method and any necessary docs. _The code index is behind this pull request (indexed at `c600fb46f9d1`), so retrieved context may be out of date._ _Memory was unavailable (model: cortex: v1/recall: timed out after 10s), so this review ran without it._
• Evidence: \(pull request description\) — Add client method for the new GET /opencompany/companies route

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No end-to-end harness in this repository: no e2e test files and no e2e workflow.

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek/deepseek-v4-flash
• Spend: $0.008997
• Tokens: 110489 input · 10359 output · 9761 cached · 153 embedding

Head	State	Pass summary
b17b6c76fb69	changes requested	2 active finding(s), 0 resolved finding(s) (at 1789991533)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9e282b89-e113-4d17-ad8e-f341d743b8a8

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0090 · 110,489 in / 10,359 out · 9,761 cached (9%)  · ladder/vectors, gpt-5.6-luna, deepseek/deepseek-v4-flash · 153 embedded
critique:    $0.0032 · 42,121 in  / 2,673 out  · 2,026 cached (5%)  · gpt-5.6-luna, deepseek/deepseek-v4-flash
security:    $0.0031 · 48,549 in  / 1,003 out  · 3,639 cached (7%)  · gpt-5.6-luna
tests:       $0.0015 · 12,776 in  / 1,807 out  · 0 cached (0%)      · deepseek/deepseek-v4-flash
description: $0.0007 · 4,217 in   / 2,510 out  · 1,280 cached (30%) · deepseek/deepseek-v4-flash

[tinysweeper]

Update the manifest before raising the operation count

The diff adds two routes to PUBLIC_ROUTES and changes the expected manifest operation count to 208, but it does not update the checked-in api/tinyhumans.backend.json. The manifest therefore still has the previous operation count and route set, causing this assertion and the subsequent rust_routes/manifest_routes equality check to fail. Add both routes to the manifest (and its derived metadata) or do not change the generated registry and expectations.

[RULE] contract-parity ·

[YellowSnnowmann]

This is a false positive. api/tinyhumans.backend.json is updated in this same commit (b17b6c7): "operationCount": 208 and "totalOperationCount": 262, with both GET /opencompany/companies and POST /opencompany/instances/{slug}/update present in the namespace routes. The generated_rust_routes_match_the_public_manifest test — which asserts both operationCount == 208 and rust_routes == manifest_routes — passes in the green Rust SDK CI run for this commit, so the described assertion failure does not occur. No change needed.