chore(deps-dev): bump conduction/hydra-gates from 1.16.1 to 1.18.0

[dependabot]

Bumps conduction/hydra-gates from 1.16.1 to 1.18.0.

Release notes

Sourced from conduction/hydra-gates's releases.

v1.17.0

Five new gates and two behaviour changes. The reason this tag matters is that it closes a gap nobody could see: gates 111 to 113 merged after v1.16.1 was cut on 2026-09-07, so since then every app's vendored copy has declared 90 gates while CI ran 93, and the three missing ones included both report-only gates. Nothing in a consuming repo could close that. composer update would have reported success and changed nothing, because the constraints were already satisfied and the versions were simply not released.

v1.16.1 declared 90 gates. v1.17.0 declares 95.

What is new

gate	name	posture
111	flow-node-taxonomy	blocking
112	newman-reach	report-only, HYDRA_GATE_NEWMAN_REACH_BLOCKING=1
113	exclusion-evidence	report-only, HYDRA_GATE_EXCLUSION_EVIDENCE_BLOCKING=1
114	header-action-budget	report-only, HYDRA_GATE_HEADER_ACTION_BUDGET_BLOCKING=1
115	stale-fleet-app-id	report-only, HYDRA_GATE_STALE_FLEET_APP_ID_BLOCKING=1

Two behaviour changes to gates you already have:

• gate-46 now resolves @e2e anchors (report-only) and opens appinfo/ and scripts/ (blocking).
• A report-only gate no longer prints a FAIL verdict line. gate-112 and gate-113 used to print FAIL from their helper while the runner printed WARNING for the same gate 45 lines later. Two readers counted a failure that had not happened. There is now one verdict line per gate, enforced by the acceptance matrix.

What your repo will start seeing

Measured 2026-09-10 against a clean development clone of each of the 21 core apps. Repos not listed are clean for that gate.

gate-115 stale-fleet-app-id — 20 findings in 6 repos

repo	stale names	migrated slugs	total
pipelinq	2	5	7
learniq	4	0	4
openregister	1	2	3
buildiq	1	2	3
launchpad	2	0	2
hermiq	0	1	1

gate-112 newman-reach — 28 findings in 9 repos: openregister 17, pipelinq 3, opencatalogi 2, and one each in decidiq, dossiq, hermiq, learniq, portaliq, stackiq.

gate-113 exclusion-evidence — 0 unresolved anywhere. It still prints its worklist on every run, so you will see a line like 468 exclusion(s) — 156 name a test that is here, 254 claim a tier without naming a member of it. That is a census, not a finding.

gate-114 header-action-budget — 0 findings without a delta base. It is a ratchet, so a full-scope run with no --base prints its census and says the ratchet half did not run. It reports growth only against a base.

gate-46 — per the change authors, 194 dangling @e2e anchors across four repos (report-only) and 10 findings in three repos from the new directories (blocking). Those figures are theirs, not measured here.

Read this before "fixing" gate-115's slug findings

Ten of the twenty are register slugs the owning app has migrated away from, and they cannot be fixed by swapping the literal.

Both slugs are live across the fleet depending on whether a given instance has run that app's repair step. Swapping 'openconnector' to 'integriq' breaks every instance that has not migrated yet, which is the same bug pointing the other way. The fix is a probe against OpenRegister for the slug the register actually answers to.

Two things to know before deciding whether a slug reference is one of these:

... (truncated)

Commits

• 477f930 feat(quality): let a repo opt into gate-46 blocking on @​e2e anchors (#741)
• 81b56a1 feat(contracts): publish the register slug resolver so leaf apps can load it ...
• 29f31d9 feat(gate-115): record a stale name whose target does not exist (#738)
• 80c58c0 feat(gate-46): resolve @​e2e anchors too, report-only (#733)
• d114d86 feat(gate-115): a cross-app lookup naming an app the fleet has retired (#736)
• 1a33042 feat(gate-46): open appinfo/ and scripts/ as well (#734)
• 930e33d fix(gates): a report-only gate must not print a FAIL verdict (#731)
• 9452c35 feat(gate-114): count the header actions bar, and warn when it grows (#723)
• 2a3292b fix(ci): build an additional app's frontend before the browser jobs run (#722)
• 35412eb feat(gate-96): warn on em-dashes in the App Store description (#721)
• Additional commits viewable in compare view

[github-actions]

Quality Report — ConductionNL/stackiq @ 77f3df8

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		❌
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 130/130
npm			✅	✅ 704/704
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					✅

---

Quality workflow — 2026-09-15 07:40 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/stackiq @ e90c127

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 133/133
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1223/1223 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-09 08:04 UTC

Download the full PDF report from the workflow artifacts.