chore(openspec): rewrite publication-clearance-via-anonymise as event-driven

[rjzondervan]

Summary

Rewrites openspec/changes/publication-clearance-via-anonymise to use the event-driven EntityRelationDecisionUpdatedEvent from OpenRegister PR #1503's amend as the consent-creation trigger, instead of the originally-proposed unredactedEntities[] field on the anonymise endpoint.

Why the rewrite was needed. Two flaws in the original proposal:

1. Two decision channels for the same operator decision. Wave 1.3 (entity-relation-grondslagen) already gives operators a per-entity primitive via skipAnonymization on the EntityRelation row. Operationally "publish this entity unredacted" IS skipAnonymization: true; a parallel unredactedEntities[] array just duplicated the surface.
2. 422-on-every-first-anonymise for WOO-pending entities. Putting consent creation at anonymise time meant every entity needing the standard 28-day WOO workflow would 422 on first try, leaving operators unable to run anonymise without first running anonymise. The 28-day clock has to start at decision time, not at anonymise time.

New design

• The trigger is OCA\OpenRegister\Event\EntityRelationDecisionUpdatedEvent (added in OR PR #1503's amend). DocuDesk's listener catches skipAnonymization: false → true and calls ConsentService::createConsentRequest() synchronously.
• PolicyMatchService inside createConsentRequest handles all three outcomes — standing-consent match auto-resolves to consent_given; no-match starts the 28-day clock at decision time with pending; prohibition match throws PolicyRejectedException, which the listener handles by reversing the PATCH and dispatching a Nextcloud notification to the acting user.
• The anonymise endpoint shape is unchanged. It gains a defensive runtime check that returns 422 only when a skip-marked relation has a pending consent whose objection window is still open. Closed-window and auto-resolved cases proceed normally — no more 422-on-every-first-anonymise.
• createConsentRequest becomes idempotent on (documentId, entityKey) for scope: "document" records, so multiple relations for the same entity (multiple text positions of one person) collapse to one consent record.
• Two new typed exceptions: PolicyRejectedException (consent service → listener, signals prohibition) and BlockingConsentException (service → controller, drives the 422 mapping).

Files

Five spec files rewritten:

• proposal.md — new framing; out-of-scope list updated.
• design.md — 7 decision sections (event-driven trigger; idempotency; three PolicyMatchService outcomes; PATCH reversal + notification for prohibition matches; defensive anonymise-time check with blocking-state truth table; widget client-side prohibition pre-check; notification dispatch stays stubbed).
• tasks.md — restructured around the new architecture.
• specs/anonymization/spec.md — slimmed to just the defensive runtime check with the full blocking-state truth table.
• specs/consent-management/spec.md — six new requirements covering listener subscription, idempotency, the typed exception, PATCH reversal, generic-failure handling, notification stub.

Dependencies

• Hard: OpenRegister PR #1503 + the amend (Implement entity-relation-grondslagen — decision-metadata PATCH endpoint (#1435) openregister#1503) — provides the EntityRelationDecisionUpdatedEvent class.
• Hard: DocuDesk PR feat: entity-level publication policy layer (#112) #147 (entity-publication-policies) — provides PolicyMatchService.
• No code change yet. Implementation lands when both deps merge.

Test plan

• openspec validate publication-clearance-via-anonymise clean.
• Spec text cross-references the correct OR event class + DD service names (EntityRelationDecisionUpdatedEvent, EntityRelationMapper::updateDecisionMetadata, PolicyMatchService::match, ConsentService::createConsentRequest).
• Architect / reviewer confirms the event-driven trigger story addresses the 422-on-every-first-anonymise concern and the duplicate-decision-channel concern from the original review.

[github-actions]

Quality Report — ConductionNL/docudesk @ 45e590d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
composer			✅	✅ 108/108
npm			❌	❌
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-05-15 09:26 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/docudesk @ cf88439

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 108/108
npm			✅	✅ 529/529
PHPUnit					✅
Newman					⏭️
Playwright					⏭️

Coverage: 0% (0/10 statements)

---

Quality workflow — 2026-05-19 03:23 UTC

Download the full PDF report from the workflow artifacts.