[18.0][ADD] web_field_provenance: ORM dirty bit + SAP-style badge

[dnplkndll]

Summary

New ledoent module that fixes the OCA-wide bug class where compute=..., store=True, readonly=False fields silently overwrite manual user overrides on every recompute pass. Ships:

• record._user_set(fname) — combine a persisted provenance map with an _origin transactional fallback. Compute overrides call this to gate super() on real user intent.

• record._stamp_provenance(keys, *, source, by, rule=None, when=None) — public API for cascade methods, EDI connectors, and import loaders to stamp rule/cascade provenance on writes they perform on behalf of users.

• record._provenance_for(fname) — returns the badge-tooltip dict (also useful as golden-output target in tests).

• OWL provenance_m2o widget — small badge next to opted-in fields with three states:

  • grey outline = default (no entry — value still at its initial state)
  • green cog = rule / cascade / EDI
  • pencil = user-set

  Hover reveals the writer and timestamp. Clicking promotes the value to user-anchored; the server sanitizes the payload so writer identity cannot be spoofed.

• _provenance JSON column on every model — compact {s, b, t, r?} entries, only populated for fields opted in via ir.model.fields.track_provenance. Default state is implicit (no entry) so the column stays compact.

Visual proof — three badge states

Demo data opts in res.partner.title so the widget can be verified without any other module installed. Three partners on a fresh DB cover all states:

State	Trigger	Screenshot
Default (grey circle)	record created, _provenance empty
Rule/cascade (green cog)	written via _stamp_provenance(..., source="r", rule="Sale Order Type cascade")
User-anchored (pencil)	written via _stamp_provenance(..., source="u") or a real user write

Hover tooltips (verified in DOM snapshots):

• Cascade: Set by Sale Order Type cascade at 5/17/2026, 12:50:13 PM
• User: Set by user admin at 5/17/2026, 12:50:13 PM
• Default: Default value — set when the record was created

Why

OCA sale_order_type is one example: every time a partner or type changes, the seven mirror computes call super() and clobber manual user-set values for pricelist, payment term, warehouse, etc. PR OCA/sale-workflow#4273 patches one symptom; this module is the missing infrastructure.

First consumer: ledoent/sale-workflow#3 — _sot_resolve already has a soft-dependency hook (hasattr(self, "_user_set")) that integrates the moment this module is installed.

What's inside

File	Purpose
models/base_model.py	The whole API: _provenance field, _user_set, _stamp_provenance, _provenance_for, web_read injection, sanitization of client writes
models/ir_model_fields.py	track_provenance opt-in flag + cache invalidation on toggle
static/src/provenance_badge.{esm.js,xml,scss}	OWL widget for 3-state badge + hover tooltip
demo/web_field_provenance_demo.xml	Opts in res.partner.title so the badge can be visually verified on a demo DB
tests/test_provenance.py	23 tests covering all paths
readme/{DESCRIPTION,USAGE,ROADMAP}.md	Documentation including the cascade-attribution API and the security note
views/ir_model_fields_views.xml	Surfaces the opt-in checkbox

Tests (23/23 pass)

sale_order_type/_user_set integration:
  test_create_with_value_stamps_user
  test_create_without_value_does_not_stamp
  test_write_stamps_user
  test_user_write_flips_rule_to_user
  test_user_set_via_explicit_stamp

Rule / cascade public API:
  test_stamp_provenance_rule
  test_stamp_provenance_user_via_public_api
  test_stamp_provenance_rejects_unknown_source
  test_stamp_provenance_requires_by
  test_stamp_provenance_skips_untracked_keys
  test_explicit_when_is_persisted
  test_multirecord_stamp_writes_each

Badge tooltip:
  test_provenance_for_default
  test_provenance_for_user
  test_provenance_for_rule
  test_provenance_for_legacy_string_entry

Backward-compat:
  test_legacy_system_string_falls_back_to_default

Security (sanitization):
  test_client_provenance_write_forces_env_user
  test_client_cannot_claim_rule_provenance
  test_client_provenance_non_dict_payload_rejected

Field-tracking caching:
  test_untracked_field_not_stamped
  test_cache_invalidated_on_flag_toggle
  test_unlink_invalidates_track_cache

Web client integration:
  test_web_read_emits_provenance

Test plan

• Install the module against a fresh 18.0 DB.
• Run scoped suite: odoo -i web_field_provenance --test-enable --test-tags '/web_field_provenance' → 23/23 pass.
• Manual UI walk on a demo DB: opt res.partner.title into the badge (via demo XML) and visually verify all three states render with correct icons and tooltips. See screenshots above.
• Doodba review env: install on top of ledoent/sale-workflow#3, opt-in sale.order.payment_term_id, repeat the UI walk against a real cascade.
• Verify the cross-system claim: a malicious RPC client cannot write {_provenance: {payment_term_id: {s:"u", b:"admin", t:0}}} — server sanitizes to b=env.user.login.

Notes for reviewers

• This is a review-only PR on the fork for now. Once we've shaken it out with a downstream consumer (sale-workflow#3) and a Doodba review env, intent is to file the equivalent PR on OCA/web.
• Cross-cuts every model via _inherit = "base". The cost is gated behind ir.model.fields.track_provenance — for any field that hasn't opted in, the write-path overhead is one frozenset lookup and the read-path is untouched.
• Base-field protection in ir.model.fields.write() blocks the UI from flipping track_provenance on fields declared in Python. ROADMAP lists a small admin wizard to do this via the documented SQL bypass; tests use it directly.
• Sibling Huly tracker: OCA-23.