[rubenvdlinde]

Every capability on a screen and every spec under a feature (decisions 112 to 116). Only openspec/parity/capabilities.json changes.

Screens

All eleven boards sit in the Nextcloud admin settings chrome (Beheerinstellingen / Versioniq), with one folder tab strip: Apps, Beveiligingsadviezen, Automatische updates, Historie, Bronnen, Tokens, Ontdekken, Instellingen.

Board	What it shows	Features (rows)
VqApps	Apps tab as an index list: installed version and lag, update available, source and verified publisher, advisory badge, pin and drift banner, per-app policy with retry, disabled, deprecated, protected and developer-checkout apps, bulk update and bulk rollback, inventory download, environment selector	app-inventory, version-pinning, auto-update-policies, rollback, lifecycle-signals, patch-compliance, admin-access (38 rows)
VqAppVersies	One app opened: every version with date, compatibility, pre-release, withdrawn, minimum-age hold with early release, adoption, known issues, release notes with a Dutch translation, combined changelog, pin with range and skipped version, one-off source, promotion across environments	version-facts, changelog-visibility, release-channels, minimum-release-age, install-any-version, multi-instance, version-pinning (31 rows)
VqInstalleren	Install dialog over the Apps tab: preflight, backup, maintenance mode, signature and revocation, checksum, migrations, a failed finalize explained in plain words with recovery, debug output, earlier outcomes (checksum mismatch, unverified install, revoked certificate, re-enabled app)	install-diagnostics, package-integrity, migration-safety (15 rows)
VqVersieTerugzetten	Destructive rollback dialog: migrations left behind, dry-run preview, guard override, password, type-to-confirm	rollback, migration-safety, admin-access (5 rows)
VqAutomatischeUpdates	Scheduled, waiting, held and failed updates with approve/reject and retry, plus the policy: kill switch, default policy, security-only, LTS-only, window, days, per-type schedule, batch size, minimum age, approval and advance notice, patch policy, policy as code, dry run	auto-update-policies, update-scheduling, update-approval, minimum-release-age, release-channels, patch-compliance (20 rows)
VqBeveiligingsadviezen	Advisories from Nextcloud, GitHub, OSV and NCSC: severity, one-click fix, assign, dismiss with reason, unfixable reason, backports, malicious package alert, server advisories, remediation KPIs per severity	security-advisory-correlation, advisory-prioritisation, advisory-triage, patch-compliance (15 rows)
VqHistorie	Immutable audit list: installs, rollbacks, pins, source and policy changes, automatic vs manual, changes made outside Versioniq, export, security update report	audit-trail, patch-compliance (9 rows)
VqBronnen	Source binding per app (App Store, GitHub, GitLab, Forgejo, Gitea) with reachability, bind form, trusted-source allowlist, connection health from integriq	external-sources, connections (8 rows)
VqTokens	Stored tokens with scopes, owner, sharing, expiry warning, unattended use; add form with validation and the forge's create link	access-tokens, external-sources (7 rows)
VqOntdekken	Search across App Store, public GitHub and private repositories with routes to version picker, install or bind; upload an archive	app-discovery, external-sources (6 rows)
VqInstellingen	Server-wide settings: addresses and mirror, offline advisory feed, retention, activity stream and SIEM, artifact cache, notifications and webhook, SBOM and metrics, server upgrade readiness	artifact-cache, alerts, audit-trail, sbom-and-metrics, upgrade-readiness, changelog-visibility (17 rows)

Counts

• Specs to features: 0, specs internal: 0. All 15 main specs were already listed in a feature's specs.
• Rows linked to new design-system boards: 170 (built.screen)
• Rows with screen: {board: null, reason}: 10 (adm-api, adm-openapi, adm-self-hosted, adm-open-licence, adm-free, adm-ai-assistant, adm-cli-machine-output, ins-cli-list, ins-cli-install, tok-cleanup)
• specScreens: pat-management on VqTokens, pending-updates on VqApps and VqAutomatischeUpdates
• Decided-no rows (39): untouched

Verified

• Screens generator, run against this branch: versioniq onScreen 182, reason 13, missing 0.
• parity_verify.py --strict: 2 findings in 2 checks, the same as development (feature-without-confidence and unknown-cells, both inherited).

Odd cases

• screen sits inside built, not at the top of the row. A top-level screen is read by the parity schema as a competitor cell and fails 180 times (is not one of yes, partial, no, unknown). The generator reads built.screen too.
• The specs admin-api, cli-commands and source-license-headers inherit the "no screen" reason of the rows that link them.

Design-system PR: ConductionNL/design-system#116

[github-actions]

Quality Report — ConductionNL/versioniq @ a8f321c

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 32/32
npm			✅	✅ 302/302
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 755/755 (8 legs)
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-08 15:32 UTC

Download the full PDF report from the workflow artifacts.