fix(schema): declare templateId as a cross-app reference to Docudesk

[rubenvdlinde]

gate-54 relation-dialect: 1 → 0. Measured at gate package 365fa31d09a26f980e6dc76cb0800575ef005a4e.

This closes the last gate-54 finding in the repo, using the vocabulary .github#286 added.

Why it had no honest fix before

Automation.actions.items.templateId is format: uuid with a description saying it points at a Docudesk template, so the relation-shape rule matched. But the object it names lives in Docudesk's register, and check (f) requires a $ref that resolves to a schema key in the same register file set. Both arms failed:

shape	verdict
"$ref": <anything>	"does not resolve to a schema key in the register set (case-exact)"
no $ref	"lacks canonical $ref (ADR-062 rule 7)"

The only route to green was rewording the description until _RELATION_DESC_RE stopped matching — degrading documentation to dodge a regex. I refused that and filed ConductionNL/.github#307 instead.

The fix

.github#286 added x-external-register: <app> for exactly this case. The property now declares the cross-app relationship instead of hiding it, and the prose says so too:

"templateId": {
  "title": "Document Template",
  "type": "string",
  "format": "uuid",
  "x-external-register": "docudesk",
  "description": "… The template is an object in DOCUDESK's register, not OpenBuild's, so this carries the bare identifier and no `$ref` — OpenRegister resolves `$ref` within one register set and cannot reach another app's schema."
}

Verified four ways — including that it is not a blanket waiver

arm	state	findings
A	with x-external-register	0
B	with it removed — negative control	1 — "lacks canonical $ref"
C	with it and a $ref — abuse control	1 — "carries x-external-register 'docudesk' AND $ref … drop the $ref"
D	restored	0

Arm B proves the gate still fires here, so this is not a blind pass. Arm C proves the exemption is narrow — it suppresses only the two $ref rules and cannot be used as a general escape.

Full root-scoped suite (--scope-to-diff --base <root-commit>, 0-byte stderr) is otherwise unchanged: gate-54 gone, no other gate moved.

[github-actions]

Quality Report — ConductionNL/openbuild @ c20f65d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
check-gitignore		✅
check-nc-floor		✅
composer			✅	✅ 101/101
npm			✅	✅ 654/654
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-09 21:26 UTC

Download the full PDF report from the workflow artifacts.