[WilcoLouwerse]

What

OpenRegister gets a management UI for its migration packs. An admin can view and edit the column mappings an import runs, in OpenRegister itself. Decision (2026-10-12, Ruben): mappings are stored and managed in OpenRegister. Integriq's mapping UI is the UX template and stays untouched.

The first user is the stackiq TOPdesk CMDB import (WOO-588, Gemeente Rotterdam). Its packs are already migration packs run by MappingEngine. The stackiq side is ConductionNL/stackiq#1288 / #1289.

Changes

UI (Integration → Migration packs)

• List: shows name, slug, source format, version, built-in and updated. Actions: Edit, Export, Delete (with confirmation) and Import JSON.
• Editor:
  • A General card. The slug is read-only for built-in packs.
  • An ordered field-mapping table. Rows can be added, removed and reordered; for the same target, the later row wins.
  • A transform dialog for every transform that PackDefinitionValidator allows. A lookup's default has three options: none, empty or a value. Yes/no tables store real booleans.
  • Defaults, an Advanced (JSON) view, and a "Test with a sample row" panel.
  • Readable errors per finding.
  • Unknown keys round-trip unchanged, for example an app's own x-… marker.
• Safety:
  • Leaving with unsaved changes asks for confirmation.
  • A save based on an older read is refused, with a way to reload.
  • A pack deleted while it is being edited can be saved as a new pack.
• Admin-only for real: the menu entry is gated, and the editor is read-only for non-admins. OpenRegister does not enforce the manifest's permission.
• Accessibility (WCAG 2.2 AA):
  • Names include the visible text.
  • Focus stays on a moved row, and the move is announced.
  • Status messages and errors are in live regions.

API

• POST /api/migration-packs and PUT /api/migration-packs/{id} accept {"definition": {...}}. On update, the route id always wins. Before, a body id (the pack slug) replaced the route id and the update ended in a 404.

• A built-in pack's slug cannot change (422 builtin-slug-locked). This also holds through a delete followed by a re-create or import.

• An update based on an older read is refused with 409 pack-changed.

• New POST /api/migration-packs/preview: takes {definition, rows} and returns the mapped rows and errors. It takes at most 20 rows and 1 MiB.

• The write routes (create, update, destroy, import and preview) are admin-only and require CSRF; reads are unchanged.

  • There is no #[AuthorizedAdminSetting], which would let delegated admins in. The default middleware admits admins only, the methods are marked @auth admin-only, and the method body checks again.

• Create, update, import and destroy each log an info line with the acting user, the slug and the row id.

• Every error uses one ADR-050 shape, {message, error, details?}, and never carries exception text:

  Status	Error codes
  401	not-authenticated
  403	admin-required
  404	pack-not-found
  400	invalid-request, too-many-rows
  409	pack-changed
  422	invalid-pack (with details.errors), builtin-slug-locked
  500	migration-pack-error (logged)

Spec

OpenSpec change migration-pack-editor-ui, a delta on migration-mapping-packs, with a MODIFIED block for the admin-gated CRUD requirement. openspec validate --strict reports it as valid. Every scenario is anchored to a running Playwright test.

l10n

The frontend strings are translated in every locale. The bundles are appended in their current layout, not written by scripts/l10n/apply.js. On development the bundles are not in the writer's layout, so the writer re-serialises all of them, about 248k changed lines. That reformat belongs in its own PR. The backend messages are in nl.json only, so other locales fall back to English for API messages. The frontend shows its own translated text per error code.

Checks

At 7321876:

• PHPUnit for the migration-pack controller, service and tests/Unit/Service/MigrationPack: green. testUpdateReadsTheRouteIdFromARealNextcloudRequest skips outside an installed Nextcloud.
• Jest src/views/migrationPack: 109 of 109.
• test:l10n and test:l10n:parity: OK.
• phpmd and phpcs: clean.

Hydra gates (local, diff scope): every applicable gate passes except gate-69 page-type-discipline. Custom pages went from 36 to 38. Both new pages carry a _note: packs are not register objects, and @conduction/nextcloud-vue 2.72.0 has no named entity source an app can add. Accepted in review.

Rig (Nextcloud 35.0.1, OpenRegister development with this branch built; stackiq with #1288/#1289; fixtures only):

• tests/e2e/ci/migration-pack-pages.spec.ts passes 38 of 38.
• The stackiq packs are listed.
• An edited pack is what the next import runs (2 of 2 rows).
• A PUT without a CSRF token gets 412.

Heads-up

Task 1.6 of the OpenSpec change flow-parity-mapping-and-webhooks plans to delete Integriq's MappingService. That conflicts with the decision to leave Integriq untouched for now.

Jira: WOO-588. Plan: https://github.com/ConductionNL/readonly-mirror-wilco-claude-plans/tree/dev-mirror/issues/jira/WOO-586/sub-tasks/WOO-588/

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openregister @ be1ef7d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 25837/25837 · 25 skipped
Newman					✅ 635/635
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-12 19:51 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

Verdict: Approve once the running CI is green

Strict review of 99c6e4b, covering backend, frontend, and spec/tests/l10n. All 36 findings were fixed on this branch before posting, except three minors, listed under "Still open". This is posted as a comment because GitHub does not let an author approve their own pull request.

Blockers (inline, fixed before posting)

• 🔴 phpmd failed on the controller. The request handling is split into MigrationPackRequestReader and MigrationPackErrorResponder (e5d8799).
• 🔴 openspec validate --strict rejected the change. Both requirement bodies now use SHALL (350e6b7).
• 🔴 The Playwright spec had never run. It now passes 38 of 38 on Nextcloud 35.0.1 with this branch built. The run found a duplicate accessible name, which is fixed (1c54568, 8ef92f0).

Fixed before posting

Backend (e5d8799, 6d614a3, 27bc051, 93269f9)

• Every error from MigrationPacksController now uses one ADR-050 shape, {message, error, details?}, and no response carries exception text. The codes are not-authenticated 401, admin-required 403, pack-not-found 404, invalid-request and too-many-rows 400, invalid-pack and builtin-slug-locked 422, and migration-pack-error 500 (logged).
• The write routes no longer carry #[AuthorizedAdminSetting], which would have let delegated admins in. They are admin-only through the default middleware, marked @auth admin-only, and the method body checks again.
• An update based on an older read is refused on the server with 409 pack-changed.
• A taken slug is answered with its own code.
• A built-in slug stays locked after a delete, even when remembering it fails.
• The import pre-lookup moved inside the try.
• A preview is capped at 20 rows and 1 MiB.
• Raw-body edge cases are handled.
• The docblocks describe the lifecycle of the slug lock correctly.

Frontend (c76eec7, b3844cc, 6cb5659, 7366876)

• Leaving the editor with unsaved changes asks for confirmation, both on a route change and on beforeunload. The dialog lives in src/dialogs/.
• t() no longer HTML-escapes the placeholders.
• A yes/no table stores real booleans and keeps a stored 1 or 0.
• A 412 response is no longer read as someone else's save.
• A pack deleted while it is being edited shows a translated message and offers "Save as a new pack" or "Show the JSON".
• Errors are mapped from the slug to translated text, and details.errors is shown as a list.
• Accessibility (WCAG 2.2 AA):
  • The transform button's name contains its visible summary.
  • Focus stays on a moved row, and the move is announced.
  • Status messages and errors are in live regions.
  • Hints are linked with aria-describedby.
• The preview clears a stale result.
• sampleRowFrom cannot write to the prototype.
• A whitespace-only edit in the JSON view no longer counts as a change.
• Row labels are built with t(), and dates use the Nextcloud locale.
• The read-only unit test now mounts the components.

Spec, tests and docs (350e6b7, 609444b, 98da1eb, 7321876)

• Every scenario has an @e2e migration-mapping-packs::<slug> anchor on a test that runs.
• The e2e spec covers what its scenarios claim:
  • editing and saving a lookup value;
  • moving a row;
  • refused saves;
  • delete, import, preview, the non-admin cases and the menu entry.
• Cleanup fails loudly when a delete fails.
• The proposal, design and tasks agree with the code on four audit lines.
• The proposal has a WCAG 2.2 AA section.
• The preview failure scenarios name their status codes and slugs.
• A MODIFIED block covers the admin-gated CRUD requirement.
• The design explains five fixtures against four seeded packs.
• The Swedish menu label is fixed.
• The strings added in review are translated in every locale.

Still open (minor, not blocking)

• The six controller messages in the backend catalogue are translated in nl.json only. The other locales fall back to English for API error messages. The frontend shows its own translated text per error slug.
• testUpdateReadsTheRouteIdFromARealNextcloudRequest skips outside an installed Nextcloud. The design says where it runs (the in-container step of api-test-coverage.yml).
• The l10n bundles are compact appends, not output of apply.js. The repo rule says apply.js is the only writer. On development the bundles are not in the writer's layout, though, so running the writer here re-serialises every bundle: about 248k changed lines. The writer's output is kept on a local branch for a separate, reformat-only PR if wanted.

Gates and checks

Local checks at 7321876:

• PHPUnit for the migration-pack controller, service and MigrationPack tests: green.
• Jest 109 of 109 for src/views/migrationPack.
• test:l10n and test:l10n:parity OK.
• openspec validate --strict valid.
• phpmd and phpcs clean.
• Playwright 38 of 38.

Hydra gates (local, diff scope, on c775d20): every applicable gate passes except gate-69 page-type-discipline. Custom pages went from 36 to 38. Both new pages carry a _note: migration packs are not register objects, and @conduction/nextcloud-vue 2.72.0 has no named index source an app can add. I accept that as the reviewer.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openregister @ 9edbe31

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 25881/25881 · 25 skipped
Newman					✅ 635/635
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-13 08:48 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ 8ec8678

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 25881/25881 · 25 skipped
Newman					✅ 635/635
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-13 16:41 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ 64c975c

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 25881/25881 · 25 skipped
Newman					✅ 635/635
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-13 17:56 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

Verdict: APPROVE (Standard) — self-review posted as COMMENT (GitHub blocks self-APPROVE)

Nothing left to address in the delta: its 2 concerns were fixed on the branch before posting. The 3 minors listed as "Still open" in round 1 stay open, each with a reason below, and they do not block. What still stands between this PR and a merge: 1 approval, and stackiq#1288 for the fixture versions to match what stackiq ships.

Round	Found	Status
1 (7321876)	36 findings fixed before posting · 3 🟢 still open	3 🟢 left open, with reasons
2 (1db4923) — this review	2 🟡 (fixtures claimed stackiq ships 1.0.0; the mapping table overflowed at narrow widths)	fixed before posting in 1db4923

Finding	Was	Now	Where
🟡 Fixtures claimed stackiq ships 1.0.0	new	fixed before posting in 1db4923	tests/fixtures/migration-packs/README.md, e2e docblock
🟡 Fixed table layout overflowed at narrow widths	new	fixed before posting in 1db4923	src/views/migrationPack/MigrationPackDetail.vue

Details of this round

Scope decision: delta 7321876…170f1cd (3 commits, 10 files, 199 changed lines: cdd560d, 9fee28c, 170f1cd), plus this run's fix 1db4923.

✅ Fixed before posting (2)

• Fixture provenance (1db4923): the fixtures README, the e2e docblock and the assertion message now say these are copies of the packs stackiq#1288 ships (1.0.x, taken at stackiq e2081bb). stackiq development still ships topdesk-module 2.0.0, and the tests do not read stackiq.
• Table overflow (1db4923): the mapping table sits in div.migration-pack__table-scroll with overflow-x: auto, role="region", aria-labelledby pointing at the existing "Field mappings" heading, and tabindex="0". The table has min-width: 720px. The rest of that file's diff is only prettier re-indentation (git diff -w shows the wrapper and the CSS).

Still open from round 1, not blocking

• Controller messages translated in nl only: a translation batch for every locale, which belongs in the apply.js pipeline. The frontend shows its own translated text per error slug.
• testUpdateReadsTheRouteIdFromARealNextcloudRequest skips outside Nextcloud: by design it runs in the in-container step of api-test-coverage.yml.
• l10n bundles are compact appends: re-running the writer re-serialises about 248k lines. That belongs in a separate reformat-only PR.

Gates: CI quality / Hydra Gates ✅ on 170f1cd. CI on 1db4923 started with this push.
Checks after the fix: prettier, eslint and stylelint clean; Jest src/views/migrationPack 109/109; test:l10n and test:l10n:parity OK. Playwright was not run, and the narrow-width layout was not checked in a browser.
Before the next round: fix rules on (fix-induced 2 + missed-sibling 0 ≥ new 0).
After posting: Frontend Check (format) went red on 1db4923, because the reworded e2e spec was not prettier-formatted. Fixed in 948520d (prettier --check on all files passes).

[github-actions]

Quality Report — ConductionNL/openregister @ 94d2729

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		❌
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 25881/25881 · 25 skipped
Newman					✅ 635/635
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-13 19:19 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ 312ba1d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					❌ 25965/25965 · 25 skipped (no test failed, the job failed for another reason — see its log)
Newman					✅ 635/635
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-13 19:48 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ 73de2aa

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 26198/26198 · 25 skipped
Newman					✅ 714/714
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-15 09:00 UTC

Download the full PDF report from the workflow artifacts.