fix(gates): clear gate-7 (6) and gate-26 (3)

[rubenvdlinde]

Hydra Gates stays red on gate-66 (13 ADR-083 violations) — that's a dependency-shape question about how this app reaches OpenRegister, not something to fold into a gates sweep. Two of three gates are cleared here.

gate-26 — the coverage existed and nothing could read it

All three views are driven by e2e specs; the component names just appear only in comments, never in executable text:

view	spec	where the name was
DashboardIndex	dashboard-overview.spec.ts	file docblock
FeaturesRoadmap	features-roadmap.spec.ts	file docblock
TemplateGallery	openbuild-template-catalogue.spec.ts	inline comment, line 101

FeaturesRoadmap is the sharpest case: its manifest page is type: "roadmap" with no component key, so the component name genuinely appears nowhere in any executable text in the repo.

Each spec now binds its route to a constant named after the component and navigates through it — 11 goto() calls rewritten across the three files. URLs unchanged. gate-26: 3 findings → PASS, 5 pages all proven. prettier clean.

gate-7 — six methods, two different reasons, both checkable

RulesController evaluate/schema/testAll — authorization is delegated to OpenRegister's schema RBAC. Every read goes through the controller's private query(), which calls searchObjectsBySlug(..., _rbac: true, _multitenancy: false). The tenancy opt-out is deliberate and already documented there: openbuild is a system-wide register, not org-scoped, so a true org filter would throw and break resolution for every caller. _rbac: true is the guard and it's explicit — the opposite of the usual gate-7 finding.

StoreController search/install, ShopController githubInstall — these address no openbuild-owned object at all. The slug identifies a template in an external catalogue (the configured store registry, or a GitHub repo), so there's nothing of another tenant's to reach by guessing it, and the install path creates a new app owned by the calling user rather than reading an existing one.

Accounting: 6 findings, 6 new tags, 0 remaining. The tree now shows 8 because it already carried 2 — reconciled against development rather than trusting the total, and each tag confirmed to sit on the method it was written for.

[github-actions]

Quality Report — ConductionNL/openbuild @ 25a2656

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
check-gitignore		✅
check-nc-floor		✅
format		✅
composer			✅	✅ 106/106
npm			✅	✅ 626/626
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					❌
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-16 18:54 UTC

Download the full PDF report from the workflow artifacts.