Repository navigation
Release: merge development into beta - #1304
Open
github-actions[bot] wants to merge 384 commits into
Open
github-actions[bot] wants to merge 384 commits into
github-actions[bot] wants to merge 384 commits into
Conversation
github-actions
Bot
requested review from
WilcoLouwerse,
bbrands02 and
rjzondervan
as code owners
September 13, 2026 17:03
rubenvdlinde
requested review from
Rem-Dam,
SudoThijn,
remko48 and
rubenvdlinde
as code owners
September 14, 2026 09:04
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…d-search fix(publication): a confidential agenda item stays off the public site, and the published agenda carries its items and papers
…port feat(export): administrators export all data with the meeting files in one archive
…ever published (#1544) * wip: mid-task state when the lane was killed by the session limit (29 Sep 21:00); not verified * fix(publication): a decision under a confidentiality restriction is never published Both paths (catalogue publication and the decision's own publish action) read confidentiality-restriction objects in system context and refuse an imposed or ratified one; restrictions that cannot be read fail closed with 503. Verifies the wip commit b84571c: DecisionConfidentialityTest 6 of 8 red on development 7dead20, 8 of 8 green now. * test(decision): the publish success case reads no restrictions for its decision
…their attachments (#1546) * feat(export): export motions and decisions with their attachments as a ZIP or one PDF (backend) * feat(export): Export with attachments on the Motions and Decisions lists * chore(openspec): archive motions-export-with-attachments; mot-16 and pub-17 built * fix(export): gate findings (named arguments, the writer split out of the service, notifier dispatch, psalm stub for IRootFolder) * fix(export): hydra gate findings (guarded file store lookup, @SPEC on the dialog, contract tests for both endpoints) * fix(export): establish OpenRegister is installed before reading attachments (ADR-083)
… the CI coverage leg stops failing them as risky (#1547)
… publish public meetings to a residents' calendar (#1550) * wip(calendar): activity publication source type and public calendar collection, not verified by the gate * wip(calendar): calendar filters, publish action, seed, docs, archive and pla-16 built, not verified by the gate * fix(calendar): gate findings, schema titles, spec tags, public calendar in its own method
…ord them per file on meetings and agenda items (#1553) * wip(documents): document types, details records, guard, widget and dialog, not verified by the gate * wip(documents): translations and frontend for document metadata fields, not verified by the gate * feat(documents): archive platform-document-metadata-fields, docs, e2e and plt-20 built * fix(documents): split the document guard's required-field check out of refusal() and move the before-save subscriptions into SaveGuardSubscriptions * fix(documents): three demo document types, and the before-save subscriptions as a constant
…hey are added (#1556) * wip(agenda): office papers queued for PDF conversion through filinq, renditions recorded, package prefers the PDF; not verified by the gate * wip(agenda): route for Try again and the conversion switch in the settings, not verified by the gate * wip(agenda): Papers as PDF widget on meeting and agenda item pages, admin switch, translations; not verified by the gate * feat(agenda): archive agenda-office-files-to-pdf, docs, e2e, seed and age-17 built * fix(agenda): Try again answers 503 on an unreadable page, spec tags on the widget, schema strings in en and nl * test: list the classes five tests use, so the CI coverage leg stops failing them as risky FlowNodeRegistrarTest and OfficePaperAddedListenerTest (this change) and ActivityPublicationTest and DecisionConfidentialityTest (inherited from development, PublicationRepository) executed classes missing from their @uses lists. Under Xdebug coverage with failOnRisky the stable34 pgsql leg failed on them. Full suite with coverage: 2295 tests, 0 risky, exit 0.
…ts, and send the meeting file back after approval (#1557) * wip(case-system): client, records, document fetch, decision list, meeting file (not verified) * wip(case-system): exchange service, job, controller, routes, approval listener (not verified) * test(case-system): exchange scenarios over an in-memory register validated with Opis * test(case-system): controller, approval listener, connection and authorization expectations * feat(case-system): case widget, fetch dialog, send button, case system widget, admin switch, seeds * test(case-system): e2e scenarios for link, fetch, send and send again * docs(case-system): feature page, design corrections, archive the change, rows plt-23 plt-24 built * style(case-system): prettier and unused catch bindings * l10n(case-system): strings in every shipped locale; phpcs line lengths * fix(case-system): psalm casts and template, listener split for phpmd, seed slug under 36 characters, profile count * wip: saved by the coordinator after the 30 Sep 09:51 WSL restart, not verified by the gate * fix(case-system): gate findings from the verification run psalm TypeDoesNotContainType on MinutesApprovedListener (the helper takes an object), gate-49 CaseSystemController::forItem answers 503 when the agenda item cannot be read, gate-66 MeetingFileService checks OpenRegister is installed before reading item files (503 otherwise). @uses PublicationRepository on two inherited tests, the same lines as #1556, so the CI coverage leg stops failing them as risky.
…d axe scan and a manual checklist (#1560) * feat(accessibility): a WCAG 2.1 AA audit report per release, from a sampled axe scan and a manual checklist plt-22 (platform-accessibility-audit-report) tasks 1 to 4: the WCAG-EM sample and its check, the axe-core scan with its own Playwright config and owner attribution, the manual checklist, and the report generator with the first (not yet scanned) report. Task 5, the scan on release builds, belongs in the shared quality workflow (DECISIONS row 28); drafted for Ruben. Row plt-22 stays building. * style(accessibility): prettier and import order on the scan files; wait for the app root instead of networkidle (gate-58)
…d type, and give their own groups a decidiq role (#1563) * feat(settings): administrators see who may read and change each record type, and give their own groups a decidiq role plt-03 (platform-role-rights-per-record-type). The role to group mapping is written into the register's authorization rules on import (DECISIONS row 22), at the register baseline and in every schema block, so OpenRegister enforces it. Archived; row built. * fix(settings): gate findings on rights per record type (phpcs line length and docblocks, phpmd complexity, keep-open, prettier)
…ntation build (#1566) * fix(accessibility): the audit report no longer breaks the docs build The docs site builds Markdown as MDX, where {id} in the projection screen's note is a JavaScript expression: the static build of /docs/compliance/wcag-2.1-aa-audit/ failed with id undefined (documentation deploy red on development since #1560). The generator now escapes braces and '<'. Red test: the report must hold no bare brace or angle bracket. * style(accessibility): prettier on the MDX test
… the subscriptions section
…lers not wired yet
…ecisions and minutes straight away, daily or weekly Archives publication-subscriptions-and-daily-digest; pub-10 and pub-16 built.
…ses; phpcs, phpmd and psalm findings fixed
The coverage ratchet on PR #1686 failed: GuestInvitationController had no test (12 statements uncovered, changed files 84.23% against 87.50%). The route now has tests for the 201 answer, a refusal with its own status and message, and the empty session.
feat: build open OpenSpec changes (decidiq, part 2)
GovernanceBodyStateRequestedEvent is the read half of the governance-body contract: a consumer (dossiq) asks by governanceBodyId or by its own (sourceApp, externalReference) and gets the body back with active, quorum, jurisdiction and the roster (uid, role, external), answered in process by GovernanceBodyStateRequestedListener through GovernanceBodyQueryService. Only the asking app's own bodies are returned, reads run as the acting user, and a failed read leaves the event unhandled so the consumer falls back to its own copy instead of treating a live committee as gone. For dossiq migrate-committees-to-decidiq task 3. Spec: REQ-GBE-007.
…asses as templates
CnApprovalChainWidget takes reasonTemplates ([{id, name, body}], fallback
integrationContext.reasonTemplates). When given, a 'Start from a template'
picker sits above the reason field (acting yourself and on behalf); picking
fills the reason, which stays editable. decidiq reads no app's template
library. For dossiq starter-content-and-templates 7.2 (decision 156).
Change: openspec/changes/approval-reason-templates.
…rity for an act DelegatedAuthorityCheck answers, for an account, an act key, an optional amount and a moment, whether an in-force bevoegdheidstoedeling grants it. The toedeling gains delegateUser, delegateGroup and acts (schema 0.2.0, register 0.15.0). Every uncertain answer is no. decidiq still gates none of its own Decision transitions (REQ-DMR-006): the asking app enforces. Refactor lane R9, capability C17 (decisions 182, 184, 185).
…e delegated authority check names its moment parameter
…(subjectRegister, subjectSchema, subjectId) A dossiq case session opens as a decidiq meeting and keeps a reference to its session record (refactor C12, ADR-118, decision 191). Same titles and descriptions as Decision's subject fields.
…e-body-read feat(governance): a consumer app reads its governance body back
…reason-templates feat(approval): the approval chain leaf offers ready-made reasons from its host
…1701) * fix(settings): personal preferences move into the user settings dialog Ruben, 11 Oct 2026: no user configuration pages. Decidiq drops its Nextcloud personal settings page (/settings/user/decidiq): <personal> and <personal-section> leave info.xml, with PersonalSettings, PersonalSection, templates/settings/personal.php, src/personal.js, PersonalRoot.vue and the webpack entry. The in-app /user-settings page (manifest.d/user-settings.json, UserSettingsPage, the Preferences entry in the settings foldout) goes too: it was the same five sections on a second page. The five sections (notification preferences, display preferences, delegation and absence, communication preferences, subscriptions) are now sections of the user settings dialog (src/views/settings/UserSettings.vue in CnAppRoot's #user-settings slot), reached from Personal settings in the settings foldout or the #user-settings deep link. Filling the slot drops the library's fallback, so its notifications pane, credentials and walkthrough replay are drawn again from the app. No backend endpoint changes. * test(settings): counts and the a11y sample follow the retired /user-settings page * fix(settings): the user settings dialog follows board DcMijnInstellingen Meldingen, Afwezigheid, Weergave, Contact, Abonnementen, in that order and with those names. The library's generic notifications pane leaves the dialog: the board draws one Meldingen section, which is decidiq's own. Credentials and the walkthrough replay stay after the board's sections, the walkthrough with Dutch labels (Rondleiding). --------- Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
feat(mandates): another app can ask whether an account holds an authority for an act
feat(meetings): a meeting can point back at an object in another app
…st root (#1705) Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
* feat(ui): adopt nextcloud-vue 2.81.0 and the board look at the manifest root * feat(ui): user settings dialog uses the library sections slot and Dutch strings --------- Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
* wip(dashboard): inner scrollbar fix on the dashboard, unfinished and unverified (saved at wind-down, 13 Oct) * fix(dashboard): no inner scrollbars on the dashboard (verified: scrollscan, gates) --------- Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
…1712) * feat(ui): meetings list to board DcVergaderingen: lenses with counts and the board's columns Upcoming (default), This month, Completed and All as quick filters with counts; columns Date and time, Body (title under it), Location, Agenda items, Status, Chair; title, meeting type and mode stay as hidden columns; soonest first; search placeholder 'Search in this list'. * fix(ui): meetings list: no hidden-flag columns, no wrong counts on the date lenses, board footer note --------- Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
…iten (#1714) * feat(ui): bodies, decisions and commitments lists to boards DcOrganen, DcBesluiten, DcToezeggingen Organen: lenses All, Governing bodies, Committees, Other bodies with counts over bodyType; board headers. Besluiten: board headers Stage and Validity. Toezeggingen: lenses as counted chips (All commitments, Open, In execution, Over the deadline, Completed, Lapsed), the deadline as a date that turns red when overdue. All three: search placeholder and the footer note. * fix(ui): commitments: five chips in view, today counts as late, spec follows the Still open lens * revert(ui): commitments list leaves this PR; it ships with the board header (#1708) * revert(l10n): the commitments lens strings move with the commitments list --------- Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
…ipped example data (#1715) The municipality and corporate example sets named a sitting mayor, Femke Halsema, with f.halsema@amsterdam.nl, and other people on real mail domains (amsterdam.nl, utrecht.nl, vng.nl, waterschap.nl, acme.nl), plus the real address of Amsterdam's city hall (Amstel 1). - Femke Halsema becomes the fictitious Wieteke Doornbos (slug wieteke-doornbos, user wieteke.doornbos, w.doornbos@gemeente.example); every reference to the slug moves with it, in the profiles, the register examples, the unit and e2e tests and the specs. - Every e-mail domain in lib/Settings and in test fixtures moves to .example (gemeente, vereniging, waterschap, acme, raad, x). - Amstel 1, Stadskantoor Utrecht and World Forum Den Haag become neutral addresses; the URL domain gemeente-voorbeeldingen.nl becomes .example.
* feat(example-sets): decidiq's part of the Zuiddrecht example set
Adds lib/Settings/example-sets/zuiddrecht.json for the cross-app example-set
loader (openregister#4603): the Gemeenteraad Zuiddrecht with 27 fictitious
members in six fictitious local parties and published voting records, the
college of a mayor and four aldermen, the cast's griffie employee bram as
griffier, three council and three college meetings with agendas, seven
decisions (among them the credit for lighting the Lindelaan cycle path and
the contract award to the cast's Installatiebedrijf Van Dam), and three
public named voting rounds with a vote per member. bram joins
decidiq-secretariat and decidiq-administrators. All dates are relative.
tests/example-sets/validate_example_set.py checks the fragment statically
against the merged register schemas. Data only; inert until #4603 merges.
* feat(example-sets): council on Thursday, college on Tuesday
Pins the Zuiddrecht meetings to their weekday with the loader's
{{datetime:<n>@thu 19:30}} and {{datetime:<n>@TUE 10:00}} (openregister#4603
at 473758abd). Every moment of a meeting (agenda published, opened, closed,
decisions, rounds, stages, votes, the day after for publication, the day
before for the motion) uses the meeting's own anchor shifted by whole days,
so it lands on the meeting's real day. Each meeting keeps its relative
position: two council and two college meetings in the past, one of each
ahead. The validator learns weekday dates, appConfig, the cast's generated
contactsUid and the refusal of the admin group.
…rounds (#1722) Bump @conduction/nextcloud-vue to ^2.82.0. The Meetings index now uses what 2.82 covers: counts on the Upcoming and This month lenses (flat [gte]/[lt] keys count right), the Upcoming lens sorts soonest first while the page reads newest first, the date tile with the end time, the chair as avatar and name of the referenced participant, and title, meeting type and mode declared hidden. Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
…tons, Acties menu) (#1708) * feat(ui): adopt nextcloud-vue 2.81.0 and the board look at the manifest root * feat(ui): index pages show the board header (title, count, add button) * feat(ui): index headers keep download, import and refresh as header buttons * feat(ui): index headers carry the board's Acties menu Meetings, Motions, Decisions and Governance bodies take the nextcloud-vue 2.82 header Actions menu: Import, Copy selected, Delete selected, Refresh and the Documentation link, as the boards draw them. The Import and Refresh header buttons go, and with them the app strings they needed. * fix(icons): register Import, Export and TrashCanOutline for the header Acties menu The menu's Import and Delete selected entries drew the fallback glyph because their icons were not in the app's registry. --------- Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
…s, Termijn) (#1716) * feat(ui): commitments list to board DcToezeggingen: counted lens chips, the deadline as a date that turns red when due All commitments, Open (key Still open: the catalogue translates Open as the verb Openen), In execution, Over the deadline, Completed, and Lapsed behind the overflow chip; search placeholder and footer note. Ships with #1708 (the board header) after the nextcloud-vue release. * feat(ui): commitments list takes the board header Title, the count line and the header buttons (Download, the Acties menu, add), as on the other board index pages, so the lens chips get their own row under the title as board DcToezeggingen draws them. --------- Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR to sync development changes to beta for beta release.
Merging this PR will trigger the beta release workflow.