[WilcoLouwerse]

What

Archives the OpenSpec change sources-github-publiccode (#2429). Only the two verification tasks were still open, and both are now done:

• Authenticated crawl against real GitHub. This ran on the WOO-585 test rig against real github.com, through github-api with credentialRef github-publiccode: 24 of 24 shards, 698 components on 2026-10-01 and 902 on 2026-10-13, with Wilco's own GitHub token. The first run is task 7.5 of the OpenCatalogi change (tasks.md); the second is scenario 4 of the WOO-585 test plan.
• composer check:strict once before push. CI on the head of feat(sources): GitHub publiccode sources and YAML response decoding #2429 (b29ce4398) was green for lint, phpcs, phpmd, psalm, phpstan and PHPUnit. The two remaining parts of check:strict, check:no-legacy-types and check:routes, were rerun on b29ce4398 on 2026-10-15. Both exited 0, and all 290 routes point at existing controller methods.

Changes

• tasks.md: both tasks ticked, with the evidence on the line.
• The delta spec becomes the main spec openspec/specs/github-publiccode-source/spec.md, with a Purpose and the four requirements unchanged.
• The change moves to openspec/changes/archive/2026-10-15-sources-github-publiccode/.
• The @spec tags in lib/ and tests/ point at the main spec, as with earlier archives here. The anchors are unchanged, and each one resolves in the new spec.
• The $comment in lib/Settings/register.d/github-source.json points at the archived design.md.

No behaviour changes. openspec validate github-publiccode-source --type spec passes.

Heads-up

#2652 adds openspec/changes/sources-github-publiccode/screens.md. Once this PR is merged, that file would land in the old directory, so it should move to the archive path.

Part of the close-out of Jira WOO-585. The OpenRegister counterpart archives github-provider-code-search.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/integriq @ 0b9bad6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			❌	✅ 143/143
npm			✅	✅ 647/647
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 5488/5488 · 1 skipped
Newman					✅ 130/130
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌
Hydra gates (axe)					✅

---

Quality workflow — 2026-10-15 10:41 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

Description updated to match 30ae60ced: the 902 run of 2026-10-13 is now attributed to WOO-585 test plan scenario 4 (task 7.5 of the OpenCatalogi change records only the 698 run), and the token is named (Wilco's own GitHub token) instead of "not recorded".

[github-actions]

Quality Report — ConductionNL/integriq @ 082c43b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			❌	✅ 143/143
npm			✅	✅ 647/647
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 5488/5488 · 1 skipped
Newman					✅ 130/130
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌
Hydra gates (axe)					✅

---

Quality workflow — 2026-10-15 10:58 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

Verdict: APPROVE (Standard) — self-review posted as COMMENT (GitHub blocks self-APPROVE)

A clean archive move: no behaviour change, every @spec anchor resolves in the new main spec, and the one finding was fixed on the branch before posting. The only red required check, quality / Hydra Gates, fails on gate 4 composer-audit (three new Symfony advisories), and this PR does not touch composer.json or composer.lock.

✅ Fixed before posting (1)

• The 902-components-on-2026-10-13 figure was not in the evidence it cited — openspec/changes/archive/2026-10-15-sources-github-publiccode/tasks.md:52. The tick attributed both runs to OpenCatalogi task 7.5, which records only the 698 run; the 902 run is WOO-585 test plan scenario 4. Fixed in 30ae60ced, and the PR description now says the same.

Gates: CI quality / Hydra Gates ❌ on 30ae60c: 87 of 87 applicable gates ran, 1 failed — gate 4 composer-audit (CVE-2026-109449, CVE-2026-108082, CVE-2026-109413 in Symfony). Not from this PR: composer.lock is identical to development, whose last green run (07:41Z) predates the advisories. Needs a Symfony bump on development before this PR can merge; quality / Security (composer) fails for the same reason.
ADRs verified: ADR-037, ADR-064 — both resolve on hydra main; the references in design.md and the register.d $comment still read correctly.
Jira context: WOO-585 — Als Gemeente Rotterdam wil ik dat OpenCatalogi GitHub uitleest (publiccode.yml-harvest via integriq) (status: Beoordelen)

[WilcoLouwerse]

Note for #2652: that PR adds openspec/changes/sources-github-publiccode/screens.md. This PR moves the change to openspec/changes/archive/2026-10-15-sources-github-publiccode/, so once this one is merged, screens.md would recreate the old change directory. It belongs at openspec/changes/archive/2026-10-15-sources-github-publiccode/screens.md instead. I'm not moving it as part of this PR; it is left to #2652, after this PR is merged.

[github-actions]

Quality Report — ConductionNL/integriq @ e9f90ae

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 143/143
npm			✅	✅ 647/647
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 5488/5488 · 1 skipped
Newman					✅ 130/130
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅
Hydra gates (axe)					✅

---

Quality workflow — 2026-10-15 11:56 UTC

Download the full PDF report from the workflow artifacts.