[rubenvdlinde]

Gives the capability matrix one clean feature list, so identity.conduction.nl/capabilities can show one row per feature. Data only: openspec/parity/capabilities.json gets a top-level features list right after areas, and every one of the 219 rows now carries a feature slug from that list. There are no pending rows.

Numbers

• 34 features, 219 rows.
• Rows per feature: min 2, median 5, max 17 (security-advisory-correlation).

Overlay

Versioniq has no openspec/features.overlay.json, so no overlay entries were used.

Old feature values

• Kept as slugs, most of them narrowed: security-advisory-correlation, auto-update-policies, migration-safety, external-sources, version-pinning, audit-trail, changelog-visibility, app-discovery, cli-commands, artifact-cache.
• version-management (50 rows) was a catch-all and is dissolved over app-inventory, upgrade-readiness, lifecycle-signals, version-facts, release-channels, alerts, install-any-version, multi-instance, admin-access, api-and-assistant and open-and-accessible.
• security-advisory-correlation (38) split off advisory-prioritisation, advisory-triage, licence-checks and patch-compliance.
• auto-update-policies (34) split off update-scheduling, update-approval and minimum-release-age.
• migration-safety (20) split off rollback, install-diagnostics and package-integrity.
• Renamed: pat-management became access-tokens, connection-registry became connections.
• 4 rows had no feature before; the key was added after providerHow.

Worth knowing

• licence-checks has 2 rows (adv-license, adv-license-change). It is small but buyers ask for it separately from vulnerabilities.
• The areas in this file have no name_nl. Not touched, since this change is data for features only.
• specs lists main specs from built.spec, open changes from built.change, and for archived changes the main specs the archive touched. A bare change name such as add-occ-cli-commands is matched to its dated archive folder.
• featureConfidence was kept only where it already existed (218 of 219 rows): high, or medium for 15 judgment calls such as ins-server-core-update, aut-presets and adm-ai-assistant.
• No validator in this repo reads parity/capabilities.json. Verified with a script: every row has a feature, every feature has rows, ids and order are unchanged against origin/development, and no other key changed.

[github-actions]

Quality Report — ConductionNL/versioniq @ 0eb1c7f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 32/32
npm			✅	✅ 302/302
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 755/755 (8 legs)
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-08 14:22 UTC

Download the full PDF report from the workflow artifacts.