odoo-weblisted

# Odoo public web (controllers · website · portal) The backend web client is OWL (→ `odoo-owl`). **Everything a browser or external system hits without the backend client is this skill**: an `http.route`, a website page, a portal document, a snippet, public JS. It fails the same way the rest of Odoo does — the route, the template, and *who can reach it* are composed at runtime from the installed addon graph and the acting user's groups, not knowable from one file. And the public surface adds two stakes the backend doesn't: **auth** (a wrong `auth=` exposes data to the world) and **the v17/18 frontend-JS rewrite** (`publicWidget` is being replaced by Interactions). **The rule: read the real route table, template ids, and record-rule reach from the running instance first, then write the smallest controller/template — never guess the URL, the QWeb id, or the auth level.** **Version floor: Odoo 17/18, through Odoo 19 (current LTS).** Frontend JS is mid-migration (`publicWidget`→Interactions, below). Two recent server-side renames bite here too: controller **`type='json'` → `type='jsonrpc'` (v18.1)**, and from **v18.2 public controller/model methods are RPC-callable unless marked `@api.private`** (→ `odoo-security`). See the note below and `skills/odoo-introspect/references/version-matrix.md`. ## Discover before you code (introspect-first) Public wiring is ground truth too — don't grep for it, read it: - **Routes** — list what's actually registered (and at which auth) with t