[rubenvdlinde]

Spec round part 2 of 7 October (decisions 78 and 81). No code changes: only openspec/ moves.

1. Re-rated rows

Row	Before	After	Evidence
src-connection-status	building, partial, integriq/connection-registry	built, partial, adopt-connection-registry	The Integrations tab shows each connection's status and when integriq last checked it (src/components/IntegrationsPanel.vue:152, :156); reports come from ConnectionReportService, called by the App Store source, the advisory feed and the token save and removal.
adm-connections-panel	building, partial, integriq/connection-registry	built, partial, adopt-connection-registry	src/App.vue:2735 mounts the panel when integriq is enabled (lib/Settings/Admin.php:53).
inv-compat-server	specified, partial	specified, partial (unchanged), now also built.spec: openspec/specs/version-management	The built half (App Store and cached forge releases, the picker badge, the occ column) is in the version-management main spec. The other half, a forge release that was never downloaded, is not built: ForgeRangeStore does not exist, so it stays specified in inventory-upgrade-readiness.
adm-openapi	built, yes	built, partial	openapi.json lacks GET /api/updates, added in #493, so the description is one route behind and the openapi check stays red until composer run openapi is committed.

The two connection rows now link the local change adopt-connection-registry, which holds the code; integriq's connection-registry is archived on integriq (2026-09-29-connection-registry). Both stay partial: the tab is absent without integriq, and a self-hosted Forgejo or Gitea forge has no row. The local change still has task 5.1 open (live e2e run with integriq), so it is not archived.

2. Specs for our own spec: none rows

Spec	New requirements	Rows
admin-api (new)	Every page action is an OCS API route; the API is described in a generated OpenAPI document	adm-api, adm-openapi
version-management	The app list and the version list can be filtered; the admin page works with a keyboard and a screen reader	inv-search-filter, rel-filter-versions, adm-a11y
migration-safety	An App Store package is verified against Nextcloud code signing before install; maintenance mode is held around a real install	saf-signature, saf-maintenance-mode
security-advisory-correlation	Advisories are matched per release branch; the admin sets how often advisories are checked; non-urgent advisories arrive in a weekly digest. The TBD Purpose is replaced.	adv-branch-aware, adv-refresh-interval, adv-digest
audit-trail (no edit, already carries it)	"Audit entries are immutable and admin-readable" (GET /api/audit), "Instance settings on a page" (advisory.feed_base mirror)	aud-export, adv-offline-db

Left at spec: none, because they are not our code: adm-self-hosted (the platform runs it on premises) and adm-free (a licence fact, no code path).

Verified

• python3 -m json.tool: valid.
• parity_verify.py --strict: exit 0, only the unknown-cells census.
• openspec validate --specs --strict: 14 of 15 pass. The one failure is inherited and untouched: source-license-headers still carries the TBD Purpose.
• Hydra gates --scope-to-diff: exit 0. Gate 19 (advisory) lists 36 scenarios without a test-file reference; 32 are older scenarios in the spec files this PR touches. Four are new and have a real test that does not yet carry the scenario reference (tests/e2e/pending-updates.spec.ts for the two admin-api scenarios, tests/e2e/shell.spec.ts for the arrow keys, tests/e2e/advisories.spec.ts for the interval). Adding those references is a tests/ edit, outside this round. Gate 46 had no input.

Needs Ruben

• Regenerate openapi.json (composer run openapi) so adm-openapi can go back to yes. It is the small fix/openapi-updates-route PR already in versioniq's queue.
• No unit test asserts that a real install switches maintenance mode on and off again; InstallerServiceTest only runs with maintenance already on. The new migration-safety scenario says so.

[github-actions]

Quality Report — ConductionNL/versioniq @ aa81958

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 32/32
npm			✅	✅ 302/302
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-07 21:16 UTC

Download the full PDF report from the workflow artifacts.