Use this skill to map how Odoo code actually executes. Trace only what you can verify in code. If a path is uncertain, mark it as uncertain and explain what evidence is missing.
First Move
Identify the starting point:
- HTTP route or controller
- form/list button action
- server action or automated action
- cron job
- ORM method called by another addon
- compute, onchange, constraint, inverse, or create/write/unlink hook
- report render
- OWL/web client action calling backend code
- external webhook or integration callback
Detect the target Odoo version. If a version-specific reference exists, consult it before tracing version-sensitive behavior:
- Odoo 17:
odoo-17.0 - Odoo 18:
odoo-18.0 - Odoo 19:
odoo-19.0 - Odoo 20:
odoo-20.0
If $ODOO_SOURCE is set, inspect local framework code for controller dispatch, ORM behavior, decorators, web client actions, assets, tests, and version-specific execution details.
Tracing Process
- Locate the entry point with file and line reference.
- Follow the direct method call chain.
- Follow inheritance and
super()calls through parent implementations. - Check decorators and implicit triggers:
@api.depends,@api.constrains,@api.onchange, inverse methods,@api.ondelete, create/write/unlink overrides. - Follow XML wiring: buttons, actions, menus, reports, cron records, server actions, and external IDs.
- Follow frontend wiring when relevant: asset bundle, JS module, registry entry, service call, RPC/ORM call, template event.
- Record database operations:
search,browse,read,read_group,create,write,unlink, direct SQL, savepoints, locks. - Record side effects: chatter, emails, notifications, activities, reports, attachments, external API calls, queue jobs, bus events.
- Record security checks: auth mode, ACLs, record rules, groups, domains, company filters,
sudo()boundaries. - Mark exit points and returned actions/data.
What To Watch For
- N+1 queries from searches, browses, reads, creates, writes, or unlinks inside loops.
- Hidden side effects from computed fields, constraints, onchange methods, mail mixins, activities, and automation.
- Unsafe
sudo()that bypasses ownership, company, portal, or public-user boundaries. - Fragile XML linkage through renamed methods, missing external IDs, or version-specific view syntax.
- Transaction hazards from caught database exceptions without savepoints.
- Business rules split across views, onchanges, controllers, and scheduled actions.
Common Entry Patterns
| Entry Type | Where To Look | Follow Next |
|---|---|---|
| Controller | controllers/*.py, @http.route |
request env, auth, params, model calls |
| Button | XML <button name="..." type="object"> |
model method, overrides, returned action |
| Cron | XML/data ir.cron record |
model method, batching, side effects |
| Server action | XML/data ir.actions.server |
model, code block, target records |
| Compute | field compute="...", @api.depends |
dependencies, store behavior, recompute path |
| Onchange | @api.onchange, form view fields |
UI-only behavior, persisted equivalent |
| Constraint | @api.constrains, SQL constraints |
validation path and exception behavior |
| Report | ir.actions.report, QWeb template |
access, render context, attachments |
| OWL/RPC | static/src, services, registries |
backend route/model method |
Output Format
## Code Execution Trace
### Entry Point
- Type: Controller / Button / Cron / Server action / Compute / Onchange / Constraint / Report / OWL / Other
- Location: `path/to/file.py:XX`
- Trigger: user action, scheduler, external request, field access, module update, etc.
### Flow
```text
ENTRY: `path/to/file.xml:XX` button/action/route
-> `models/foo.py:42` Foo.action_do_thing()
-> `models/foo.py:63` Foo._prepare_values()
-> `models/bar.py:18` Bar.create()
-> side effect: message_post()
RETURN: `ir.actions.act_window`
```
### Detailed Trace
- `path/to/file.py:XX` method name, decorators, inputs, key branches.
- `path/to/parent.py:XX` parent implementation reached via `super()`.
- `path/to/data.xml:XX` cron/action/report/XML ID involved.
### Database Operations
- `search`: model/domain/count if known.
- `create/write/unlink`: model/count if known.
- Direct SQL/savepoints/locks: state exact location.
- N+1 risk: yes/no/uncertain with reason.
### Security Notes
- Auth mode, ACL/record-rule expectations, groups, company behavior, `sudo()` boundaries.
### Side Effects
- Emails, chatter, activities, attachments, reports, external calls, queue jobs, bus events.
### Uncertain Paths
- State what could not be proven and what file/source would resolve it.
Response Rules
- Always include file/line references for traced code.
- Trace inheritance and
super()explicitly. - Do not assume a framework path if local source is available; inspect it.
- Do not run Odoo commands that touch a database or service without user confirmation.
- If the trace reveals review findings, compose with
odoo-code-review.