docs(openspec): re-rated rows and specs for unspecified built capabilities

[rubenvdlinde]

Spec round part 2 (decisions 78 and 81). Only openspec/ changes: the capability file, one new main spec and one requirement added to an existing main spec. No code.

Step 1: re-rated rows

No row in specified or building points at an archived change (checked against openspec/changes/archive/), so there were no stale rows. One row was flagged in round 1:

• build-keyboard: built, yes → built, yes. New evidence and a note. nextcloud-vue's CnDashboardGrid makes each grid item in edit mode focusable and turns Enter into the context menu. The menu's Move opens src/modals/WidgetMovePanel.vue: arrow keys move, Shift and the arrow keys resize, Enter saves through nudgePlacement(). tests/e2e/keyboard-widget-repositioning.spec.ts drives it with the keyboard only. The change keyboard-accessible-widget-repositioning still has its 11 tasks unticked, but all of them are delivered. Tasks 1 to 3 landed in nextcloud-vue, not in the src/components/DashboardGrid.vue the tasks name, which no longer exists.

Step 2: specs for our own spec: none rows

Written or extended:

Spec	Rows	What it describes
openspec/specs/action-authorization (new)	t-action-matrix	ADR-023 action RBAC: ActionAuthService::requireAction() and how an action resolves (admin, @all, admin-only, group intersection, unknown means admin-only), the Action authorization grid on the Roles and permissions tab, the admin-only matrix endpoints, and the seed and baseline repair steps
openspec/specs/runtime-shell, REQ-SHELL-010 (added)	d-tour	The first-visit tour LaunchPad declares in src/manifest.json: three steps, per-user completion against version 1. Drawing the tour is nextcloud-vue's
openspec/specs/runtime-or-consumption (linked, unchanged)	p-standalone	REQ-OR-001 already says LaunchPad installs and runs without OpenRegister

Left at spec: none, because they are not LaunchPad's code:

• Nextcloud: p-sso, p-own-servers, p-theme, p-languages, d-idp-groups (groups come from user_oidc or user_saml), d-pwa (the theming app serves the web app manifest), d-dark-mode.
• nextcloud-vue and OpenRegister: w-charts. The chart, statistic, gauge, delta and table widgets, their configuration forms and their data all come from nextcloud-vue and OpenRegister. LaunchPad only adds two thin adapters (ChartHost.vue, StatsBlockHost.vue). I corrected the row's evidence: it cited graphqlClient.js, which belongs to the spend-analytics widget.

Validation

• openspec validate --type spec --strict: action-authorization, runtime-shell and runtime-or-consumption are valid.
• openspec validate --specs --strict: 71 of 80. The 9 failures existed before this change and none of them is in a spec this PR touches.
• python3 -m json.tool on capabilities.json passes.
• Hydra gates --scope-to-diff --base origin/development: gate 16 passes. Gate 46 does not apply. Two findings were already there before this PR. Gate 19 names runtime-shell::save-button-disabled-while-in-flight, an old scenario, not one this PR adds. Gate 23 flags PermissionService.php and RoleFeaturePermissionService.php, and neither file is in this diff.

Needs Ruben

1. keyboard-accessible-widget-repositioning: tick its 11 tasks and archive it? The work has shipped. The tasks name a file that is gone, so a reader of the open change thinks it has not.
2. d-tour: the row says the tour covers "the dashboard and the admin area". The declared tour has three steps (welcome, Dashboards, Flows) and none of them is in the admin settings. Rename the row, or keep yes and add an admin step later?
3. w-charts names ConductionNL/openregister as owner. The renderers and forms are nextcloud-vue's. Should the owner be nextcloud-vue, with OpenRegister as the data source?

[github-actions]

Quality Report — ConductionNL/launchpad @ 1ac94c7

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
format		❌
check-schema-l10n		✅
composer			✅	✅ 107/107
npm			✅	✅ 636/636
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					⏭️ not run for this diff — no file in this diff matches the code globs, and none carries a source extension — the heavy tier has nothing to decide about it.
Newman					✅
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-07 21:29 UTC

Download the full PDF report from the workflow artifacts.