Release 0.6.2

What's Changed

• refactor(store): consume OpenRegister's GenericStoreService, delete the app-local proxy (ADR-080) by @rubenvdlinde in #109
• chore(deps): nc-vue 3.0.0-vue3.2, and declare four undeclared peers by @rubenvdlinde in #110
• build(quality): run the Hydra gates as part of composer check:strict by @rubenvdlinde in #104
• docs(ci): drop the hard-coded Hydra gate count from the workflow comment by @rubenvdlinde in #113
• ci: rename branch-protection caller job id to branch-protection by @rubenvdlinde in #116
• chore(deps): @conduction/nextcloud-vue 3.0.0-vue3.4 by @rubenvdlinde in #112
• feat(publish): rescue buildScaffoldMap() — openbuild-app repos are installable standalone apps by @rubenvdlinde in #117
• chore(ci): remove dead Forgejo/Codeberg CI residue by @rubenvdlinde in #120
• fix(ui): NcButton carried both v8 prop spellings on the settings Save button by @rubenvdlinde in #121
• fix(quality): composer test:all could not fail when vendor/ was absent by @rubenvdlinde in #119
• chore(deps): @conduction/nextcloud-vue 3.0.0-vue3.6 by @rubenvdlinde in #122
• ci(quality): enable the Code Quality gates this repo was silently skipping by @rubenvdlinde in #123
• fix(register): the openbuild register could never be created on a clean install by @rubenvdlinde in #125
• chore(deps): move to @conduction/nextcloud-vue 2.2.0-vue3.1 by @rubenvdlinde in #126
• chore(deps): move to @conduction/nextcloud-vue 2.2.0-vue3.3 by @rubenvdlinde in #131
• ci(quality): move the hydra-gates pin v1.0.1 -> v1.3.0 by @rubenvdlinde in #130
• chore(license): normalise 3 stray AGPL-3.0 SPDX declarations to EUPL-1.2 by @rubenvdlinde in #134
• chore(phpmd): burn down 33 baselined findings (195 → 162) and fix the inert exclude-pattern by @rubenvdlinde in #129
• fix(export): every generated app was born declaring AGPL, not EUPL-1.2 by @rubenvdlinde in #135
• ci: run the E2E (Playwright) job — it has never executed by @rubenvdlinde in #133
• fix(ci): compare the coverage ratchet against the measured merge base by @rubenvdlinde in #137
• chore(ci): stop pinning hydra-gates — track the package at @main by @rubenvdlinde in #136
• ci: publish an installable build of development by @rubenvdlinde in #141
• fix(security): PHP_CodeSniffer 3.13.5 → 3.13.6 (CVE-2026-67434, OS command injection) by @rubenvdlinde in #143
• fix(apphost): register OpenRegister's autoloader before referencing AppHost (gate-64 / ADR-040) by @rubenvdlinde in #138
• fix: declare NC 32 as the floor — openregister cannot install below it by @rubenvdlinde in #144
• fix: restore the pre-32 Nextcloud floor — this repo tests stable31 by @rubenvdlinde in #146
• fix(security): the setup wizard's #[NoAdminRequired] removed a layer, not added one by @rubenvdlinde in #127
• fix(e2e): install Docudesk in CI, repair 2 lying skips, turn traces back on by @rubenvdlinde in #142
• fix(security): the wizard's #[NoAdminRequired] removed the middleware layer, not added one by @rubenvdlinde in #147
• fix: .gitignore swallowed two tracked source files, and the gates measured two different numbers because of it by @rubenvdlinde in #149
• fix(phpcs): stop the SpecTagSniff instructing the pattern gate-46 rejects by @rubenvdlinde in #152
• fix(settings): implement SettingsController::update() for the canonical PUT /api/settings by @rubenvdlinde in #155
• fix(a11y): keyboard parity, table semantics and reduced-motion — gates 32, 43 and 45 to green by @rubenvdlinde in #150
• fix(spec): 102 @SPEC anchors pointed at nothing — three distinct causes by @rubenvdlinde in #157
• fix(schema): name the 11 unnamed Automation properties, and relate versionUuid by @rubenvdlinde in #158
• chore: raise the Nextcloud floor to 32, and pin it to what CI actually installs on by @rubenvdlinde in #148
• fix(controllers): seven 404 branches were unreachable — the lookup threw first by @rubenvdlinde in #159
• fix(a11y): 54 form controls had no accessible name — a placeholder is not a label by @rubenvdlinde in #160
• fix(docs): untrack 263 generated Docusaurus files that .gitignore already ignores by @rubenvdlinde in #161
• fix(schema): declare templateId as a cross-app reference to Docudesk by @rubenvdlinde in #165
• fix(a11y): replace 7 native window.confirm/prompt calls with real dialogs by @rubenvdlinde in #163
• test(contract): cover the 10 public endpoints that had no wire proof by @rubenvdlinde in #167
• chore(deps): pin @conduction/nextcloud-vue to 2.2.0-vue3.9 by @rubenvdlinde in #168
• fix(e2e): two specs answered a window.confirm the product stopped using by @rubenvdlinde in #172
• test(e2e): replace 14 networkidle waits with deterministic signals (gate-58) by @rubenvdlinde in #174
• test(e2e): gate-19 186 → 161 — 25 verified anchors, 1 refusal, 2 false anchors removed by @rubenvdlinde in #179
• test(e2e): remove 7 latent false @e2e anchors — proven by a +7/-7 control by @rubenvdlinde in #182
• chore(security): phpcsutils 1.2.2 → 1.2.3 (CVE-2026-65954) by @rubenvdlinde in #184
• fix(listeners): method_exists() cannot see OpenRegister's magic accessors — the slug resolver was dead by @rubenvdlinde in #185
• feat(openbuild): English vocabulary across schema, code and tests by @rubenvdlinde in #176
• fix(rbac): openbuild authorised the automation write, OpenRegister refused it, the user got a 500 (#173) by @rubenvdlinde in #177
• chore: adopt Nextcloud's coding standard, .editorconfig and NC 34 by @rubenvdlinde in #189
• chore: delete the inert .prettierrc by @rubenvdlinde in #190
• chore(quality): point PHPMD at the central ruleset by @rubenvdlinde in #191
• chore(quality): adopt the central PHPStan base config by @rubenvdlinde in #192
• fix(phpstan): carry this app's own excludePaths, the base no longer does by @rubenvdlinde in #194
• chore(deps): pin @conduction/nextcloud-vue to 2.2.0-vue3.16 by @rubenvdlinde in #193
• chore(deps): resolve conduction/hydra-gates v1.7.3 by @rubenvdlinde in #195
• fix(gate-7): drop a redundant (string) cast that hid a real ownership guard by @rubenvdlinde in #196
• feat(format): adopt Nextcloud's prettier config, so styles are tabs too by @rubenvdlinde in #197
• ci: enforce prettier via a format Frontend Check leg by @rubenvdlinde in #198
• build(lint): migrate to eslint 10 + @nextcloud/eslint-config 9 by @rubenvdlinde in #201
• ci: a branch nobody named got no checks at all by @rubenvdlinde in #202
• feat(application): an app can declare the FLOWS and AGENTS it is made of by @rubenvdlinde in #205
• chore(deps): track @conduction/nextcloud-vue ^2.3.0 by @rubenvdlinde in #211
• fix(build): make local-lib opt-in and fail the version check closed by @rubenvdlinde in #210
• chore(lint): migrate NcButton type -> variant, and move the translations with the keys by @rubenvdlinde in #214
• fix(supply-chain): make the npm cooldown actually work (gate-84) by @rubenvdlinde in #215
• ci: run every npm job on Node 24 by @rubenvdlinde in #216
• fix(lint): clear the last tranche-A suppression — require.context under a file-wide no-undef by @rubenvdlinde in #217
• refactor(deps): type-hint OpenRegister's published contract (ADR-084) by @rubenvdlinde in #208
• refactor(deps): inject OpenRegister instead of looking it up (ADR-083) by @rubenvdlinde in #203
• docs(spec): Journey Designer beside the Page Designer by @rubenvdlinde in #207
• feat(export): carry the flows an app is made of, and make them runnable by @rubenvdlinde in #206
• docs(product-page): add canonical UseCases/Features/Integrations/Technical sections by @rubenvdlinde in #200
• ci: turn Newman on — it has never run, and its seed could not fail by @rubenvdlinde in #156
• test(e2e): cover 10 gate-19 scenarios with real tests, and fix the icon-remove 404 they found by @rubenvdlinde in #175
• fix(coverage-guard): scope the ratchet to the files a change touches by @rubenvdlinde in #218
• fix(gate-49): declare the exceptions loadRunsForAgent() propagates by @rubenvdlinde in #220
• fix(adr-084): finish the contract type-hint rollout — phpstan 14→0, PHPUnit 6 red cells → green by @rubenvdlinde in #221
• fix(ui): four dialogs are dismissible mid-work — canClose is not a prop by @rubenvdlinde in #223
• style: satisfy the Frontend Check (format) job by @rubenvdlinde in #224
• fix(newman): the approval-steps collection asserted two things that are not true by @rubenvdlinde in #225
• docs(openspec): scope schedules-editor's migration off the classic OpenConnector dialect by @rubenvdlinde in #226
• fix(gates): clear gate-7 (6) and gate-26 (3) by @rubenvdlinde in #227
• fix(ci): green the E2E, Newman and Hydra Gates jobs — at their real causes by @rubenvdlinde in #229
• test(e2e): fix the version-history flake — require rows inside the toPass() retry by @rubenvdlinde in #232
• test(export): the stuck-export census was taken after the worker, so it could not answer its own question by @rubenvdlinde in #231
• fix(shop-install): four bugs blocking a real GitHub-shop virtual-app install by @rubenvdlinde in #230
• fix(phpcs): clear the 10 PHPCS errors the shared gate was swallowing by @rubenvdlinde in #233
• chore(deps): add composer cooldown to dependabot.yml by @rubenvdlinde in #234
• ci(release): converge on the shared release.yml by @rubenvdlinde in #251
• feat(automations): 'Edit flows…' can finally edit — flow picker before the modal by @rubenvdlinde in #253
• feat(github-sync): publish and pull an app's flows and agents in app-repo-format-v2 by @rubenvdlinde in #255
• fix(export): resolve agent register/schema by slug, not hardcoded numeric id by @rubenvdlinde in #258
• feat(tools): declare subject and action on the agent tool catalogue by @rubenvdlinde in #259
• fix(github-push): surface the real upstream status/body when a broker call fails by @rubenvdlinde in #262
• build(deps-dev): bump phpcsstandards/phpcsextra from 1.5.0 to 1.5.1 by @dependabot[bot] in #235
• fix(shop-install): surface a credential missing hermiq's skills scope by @rubenvdlinde in #264
• chore(release): 0.6.1-unstable.20260819162549 by @github-actions[bot] in #263
• chore(deps): @conduction/nextcloud-vue ^2.6.2 — consolidated flow editor, stable by @rubenvdlinde in #256
• build(deps): bump marked from 12.0.2 to 18.0.9 by @dependabot[bot] in #248
• build(deps-dev): bump @cyclonedx/cyclonedx-npm from 4.2.1 to 6.0.1 by @dependabot[bot] in #243
• build(deps-dev): bump nextcloud/ocp from 34.0.2 to 34.0.3 by @dependabot[bot] in #241
• build(deps-dev): bump twig/twig from 3.27.1 to 3.28.0 by @dependabot[bot] in #238
• build(deps-dev): bump phpmetrics/phpmetrics from 2.9.1 to 2.11.0 by @dependabot[bot] in #237
• fix: event listeners cannot constructor-inject a published OpenRegister interface by @rubenvdlinde in #228
• fix(tests): stub the OpenRegister FlowService for AppChannelApplierTest by @rubenvdlinde in #271
• fix(adr-083): guard the three unguarded OpenRegister reaches by @rubenvdlinde in #269
• test(e2e): cover the GitHub shop's write path by @rubenvdlinde in #272
• fix(export): find an application's agents in hermiq's register too by @rubenvdlinde in #267
• fix(gate-61): bound the automation scan two listeners run per write by @rubenvdlinde in #273
• fix(e2e): assert the icon section inside the retry that guards the sidebar race by @rubenvdlinde in #274
• chore(deps): take hydra-gates v1.8.1 — the contract v1.8.0 shipped broken by @rubenvdlinde in #275
• chore(release): 0.6.1-unstable.20260819215516 by @github-actions[bot] in #266
• style(phpcs): terminate the match-expression end comment (unblocks the phpcs 4 bump) by @rubenvdlinde in #276
• build(deps-dev): bump stylelint to 17 as one coupled upgrade by @rubenvdlinde in #277
• build(deps): bump @nextcloud/axios from 2.5.2 to 2.6.0 by @dependabot[bot] in #247
• build(deps-dev): bump squizlabs/php_codesniffer from 3.13.6 to 4.0.4 by @dependabot[bot] in #240
• chore(deps): take @conduction/nextcloud-vue 2.8.2 (was 2.8.0) by @rubenvdlinde in #278
• Release: merge development into beta for the fleet-wide beta checkup by @rubenvdlinde in #279
• Release: merge development into beta by @github-actions[bot] in #79
• chore(quality): migrate to PHPStan 2 and clear the 11 residual errors by @rubenvdlinde in #280
• build(deps-dev): bump jsdom from 24.1.3 to 30.0.1 by @dependabot[bot] in #287
• build(deps): bump diff from 5.2.2 to 9.0.0 by @dependabot[bot] in #283
• chore(ci): refresh coverage-guard.php to the canonical deletion-neutral copy by @rubenvdlinde in #292
• chore(deps): @nextcloud/router 2 -> 3, and complete 33 incomplete test mocks by @rubenvdlinde in #296
• chore(deps): drop @nextcloud/files — it is declared but never imported by @rubenvdlinde in #297
• chore(deps): vitest 1 -> 4 as one coupled upgrade (supersedes #284, #288) by @rubenvdlinde in #298
• chore(deps): refresh the shared Conduction locks by @rubenvdlinde in #302
• chore(deps): refresh the shared Conduction locks by @rubenvdlinde in #304
• fix(tests): opt into the OpenRegister contract instead of relying on a claimed prefix by @rubenvdlinde in #306
• chore: repoint shipped URLs from Codeberg to GitHub by @rubenvdlinde in #307
• chore(deps): refresh the shared Conduction locks by @rubenvdlinde in #309
• fix(e2e): "templates ready" must not mean "both creates returned 500" by @rubenvdlinde in #329
• fix(templates): scaffolded pages must declare a page type the renderer resolves by @rubenvdlinde in #328
• fix(l10n): ship the browser catalogue, so the translations actually render by @rubenvdlinde in #332
• feat: rename the app id from openbuild to buildiq by @rubenvdlinde in #334
• fix(copy): run the voice sweep over the walkthrough, landing page and intro by @rubenvdlinde in #426
• fix(shop): a malformed 200 from GitHub is a failure, not an empty result by @rubenvdlinde in #428
• feat(register): rename the register slug openbuild -> buildiq by @rubenvdlinde in #423
• test(e2e): pin the browser-catalogue contract from the browser's side by @rubenvdlinde in #424
• test(l10n): ratchet the untranslated schema strings by @rubenvdlinde in #425
• fix(shop): accept the legacy discovery topic, so the App store is not empty by @rubenvdlinde in #434
• chore(deps): refresh the shared Conduction locks by @rubenvdlinde in #435
• chore(release): 0.6.1-unstable.20260824071900 by @github-actions[bot] in #438
• docs: explain what an app is before explaining the manifest by @rubenvdlinde in #436
• chore(release): 0.6.1-unstable.20260824075808 by @github-actions[bot] in #440
• feat(repair): move openbuild schemas onto the buildiq application id by @rubenvdlinde in #441
• fix(docs): publish the documentation from development, not a stale branch by @rubenvdlinde in #443
• docs: repoint stale Codeberg URLs to GitHub by @rubenvdlinde in #442
• feat(app-page): show pages, menu, schemas and flows on the app detail page by @rubenvdlinde in #439
• feat: port issue templates to GitHub Issue Forms by @rubenvdlinde in #450
• fix(docs): pass secrets to the reusable documentation workflow by @rubenvdlinde in #447
• chore(deps): raise @conduction/nextcloud-vue floor to ^2.15.0 for the Vue Flow canvas by @rubenvdlinde in #449
• fix(docs): map the Cloudflare secrets from the names that actually exist by @rubenvdlinde in #454
• chore(ci): remove dead Forgejo/Codeberg CI configuration by @rubenvdlinde in #455
• feat(app-page): add the Support & donation editor to the app page by @rubenvdlinde in #453
• fix(e2e): a scheduled fixture flow must name the identity it runs as by @rubenvdlinde in #461
• chore(release): 0.6.1-unstable.20260824223511 by @github-actions[bot] in #458
• chore: untrack sbom.cdx.json and ignore it by @rubenvdlinde in #460
• spec(runtime): REQ-OBR-002/003 described an architecture the app abandoned by @rubenvdlinde in #459
• chore(release): 0.6.1-unstable.20260825093143 by @github-actions[bot] in #464
• chore: ignore agent/test scratch and untrack generated files by @rubenvdlinde in #465
• chore(release): 0.6.2-beta.20260820211351 by @github-actions[bot] in #281
• fix(docs): pin patched transitive deps via npm overrides by @rubenvdlinde in #467
• fix(templates): remove dead sourceUrl links from the four seeded templates by @rubenvdlinde in #466
• chore(release): 0.6.1-unstable.20260826085824 by @github-actions[bot] in #468
• fix(l10n): translate the 36 untranslated manifest strings by @rubenvdlinde in #471
• chore(release): 0.6.1-unstable.20260827002152 by @github-actions[bot] in #472
• feat(deps): nextcloud-vue 2.15.1 -> 2.19.0, and show the KPI error it enables by @rubenvdlinde in #475
• docs(gate-16): document onSettingsOpen's lazy flow load by @rubenvdlinde in #480
• chore(ci): take the canonical coverage-guard from ConductionNL/.github by @rubenvdlinde in #478
• fix(clean-env): point the vendored skill at a script that exists by @rubenvdlinde in #481
• Release: merge development into beta by @rubenvdlinde in #476
• fix(deps): development cannot npm install by @rubenvdlinde in #486
• perf(ci): one Code Quality run per commit, not two by @rubenvdlinde in #491
• feat(nav): give buildiq a settings section with Flows by @rubenvdlinde in #485
• fix(release): name openbuild as this app's previous App Store id by @rubenvdlinde in #489
• fix(l10n): translate the Flow label #485 added by @rubenvdlinde in #493
• chore(deps): hydra-gates 1.10, so the E2E skip-discipline gate can run by @rubenvdlinde in #510
• feat(demo): generated demo data for every schema (ADR-111) by @rubenvdlinde in #488
• feat(walkthrough): show where flows live, without making anyone build one by @rubenvdlinde in #513
• refactor(manifest): the flow pages are an index and a flow by @rubenvdlinde in #495
• docs: add a local demo environment (buildiq-compose.yaml + setup page) by @rubenvdlinde in #517
• fix(e2e): 26 skips carried their reason in a comment the report never saw by @rubenvdlinde in #516
• docs: make the demo verification command actually pass by @rubenvdlinde in #518
• test(e2e): exercise the ADR-111 demo-data step against a running instance by @rubenvdlinde in #520
• fix(e2e): close the setup wizard by marking every step, not the completion key by @rubenvdlinde in #523
• fix(e2e): a real demo-data import needs more than the 60s default by @rubenvdlinde in #528
• chore(deps): @conduction/nextcloud-vue 2.21.0 -> 2.22.1 by @rubenvdlinde in #532
• ci(docs): publish from development, and retire the old hostname by @rubenvdlinde in #533
• test(e2e): seed the walkthrough marker in every stored session by @rubenvdlinde in #537
• fix(l10n): drop eight locale bundles that ship another language's text by @rubenvdlinde in #539
• style(e2e): wrap the seeded setItem call to satisfy prettier by @rubenvdlinde in #542
• build(deps): bump dompurify from 3.4.13 to 3.4.14 by @dependabot[bot] in #505
• build(deps): bump gridstack from 12.6.0 to 13.2.0 by @dependabot[bot] in #497
• chore(deps): @conduction/nextcloud-vue 2.22.1 -> 2.24.1 by @rubenvdlinde in #545
• chore(deps): @conduction/nextcloud-vue 2.24.1 -> 2.24.2 by @rubenvdlinde in #547
• build(deps-dev): bump sass from 1.102.0 to 1.103.1 by @dependabot[bot] in #499
• build(deps): bump @nextcloud/initial-state from 2.2.0 to 3.0.0 by @dependabot[bot] in #501
• build(deps-dev): bump @typescript-eslint/parser from 8.67.0 to 8.68.0 by @dependabot[bot] in #503
• build(deps): bump @nextcloud/dialogs from 7.4.1 to 7.5.0 by @dependabot[bot] in #507
• build(deps-dev): bump vite from 7.3.6 to 8.2.2 by @dependabot[bot] in #508
• chore(release): 0.6.2-unstable.20260830073026 by @github-actions[bot] in #553
• build(deps-dev): bump @babel/core from 7.29.7 to 8.0.1 by @dependabot[bot] in #506
• build(deps-dev): bump stylelint-config-html from 1.1.0 to 2.0.0 by @dependabot[bot] in #504
• build(deps-dev): bump phpstan/phpstan from 2.2.8 to 2.2.9 by @dependabot[bot] in #502
• chore(sync): carry beta back into development by @rubenvdlinde in #555
• chore(sync): record beta's ancestry on development by @rubenvdlinde in #556
• fix(deps): restore installable @babel/core and stylelint-config-html constraints by @rubenvdlinde in #554
• fix(deps): regenerate the lockfile so npm ci resolves again by @rubenvdlinde in #557
• Release: merge development into beta by @github-actions[bot] in #477
• chore(sync): carry beta back into development by @rubenvdlinde in #563
• Release: merge development into beta by @rubenvdlinde in #564
• chore(sync): carry beta back into development by @rubenvdlinde in #568

New Contributors

• @dependabot[bot] made their first contribution in #235

Full Changelog: v0.6.1...v0.6.2