[rubenvdlinde]

Spec round of 7 October. No code changes: only openspec/parity/capabilities.json moves.

Counts per step

1. Missing specs: 0 written, 2 linked. Two unbuilt rows had no built.change: src-connection-status and adm-connections-panel. Both are owned by integriq, and their note names the change. They now link integriq/connection-registry, archived on integriq development as 2026-09-29-connection-registry.
2. Existing links: 73 fixed. All 73 links resolved, but they were written as paths (openspec/changes/<name>). They now carry the bare change name. The five inventory-pending-updates built rows had the same issue (openspec/changes/archive/2026-09-29-...) and were fixed the same way.
3. Built rows without a link: 99 linked.
   • 68 to the archived change that delivered them.
   • 17 to a main spec (built.spec), where the requirement was added to the spec directly: version-management 9, auto-update-policies 2, security-advisory-correlation 2, external-sources 2, audit-trail 1, source-license-headers 1.
   • 14 set to built.spec: "none" (listed below).
4. Reverse check: 1 row added. inv-enable-app: enable a disabled or just-installed app from its card or the install result. The version-management spec carries it ("One-click enable through Nextcloud's own endpoint"), but no row did. Its competitor cells read unknown, because the schema refuses unchecked.
5. Screens: skipped. Versioniq is not a canvas app (decision 75).

Rows with spec: none

Built, but no spec or change ever described them:
inv-search-filter, rel-filter-versions, saf-signature, saf-maintenance-mode, adv-digest, adv-refresh-interval, adv-branch-aware, adv-offline-db, aud-export, adm-api, adm-openapi, adm-a11y, adm-self-hosted, adm-free.

Verified

• python3 -m json.tool: valid.
• parity_verify.py --strict: exit 0. The only finding is the unknown-cells census, same as on development.
• openspec validate --specs --strict: 12 of 14 pass. The two failures are inherited: security-advisory-correlation and source-license-headers still carry the TBD Purpose that openspec archive writes. This PR does not touch openspec/specs/.
• Hydra gates 19 and 46 not run: the diff touches no spec, change or code file, so neither has input.

Open points

• inv-compat-server is specified (change inventory-upgrade-readiness), but the version-management spec already requires serverCompatible in the web version picker. The row may be partly built. Worth a look in the next parity scan.
• The open change adopt-connection-registry (the versioniq side of the Integrations tab) has no row pointing at it. The two connection rows link integriq's change, as their note says. Repoint them if the local change should own them.

[github-actions]

Quality Report — ConductionNL/versioniq @ 3ffcb7b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 32/32
npm			✅	✅ 302/302
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-07 19:54 UTC

Download the full PDF report from the workflow artifacts.