ci(quality): move hydra-gates-ref v1.0.1 -> v1.3.0, and switch the coverage control back on

[rubenvdlinde]

One line: hydra-gates-ref: v1.0.1 -> v1.3.0.

This repo's CI is red right now, and it is not this repo's fault

At 2026-08-05T13:52Z, ConductionNL/.github commit f7eaf2a (#164) flipped hydra-gates-require-full-coverage to default true in the shared quality.yml. Every repo references that workflow at @main, so the flip went live everywhere at once. But the flag requires a gate to declare itself not-applicable — and that vocabulary ships in the pinned package:

	_skip calls
v1.0.1 (this repo's pin)	0
v1.3.0	36

A pin with no _skip calls cannot say "not applicable". So every gate without subject matter here — 4 (composer-audit, correctly diff-scoped out per ADR-020), 24 (integration-parity), 33 (axe-core, whose producer enable-axe is deliberately off) — became DID NOT RUN and failed the job.

The red is fleet-wide, dated, and caused by a shared-workflow flag meeting a pinned script that predates the vocabulary it needs. It is not a code defect and not anything a PR author did. The control that settles it: decidesk#407 is PHPMD-only with zero npm changes and shows the identical failure, and it passed on pre-13:52Z base runs — the base is a different vintage of the shared workflow, not of the code.

The pin was also four fixes stale

v1.0.1 is f4d9756 (2026-08-03). Every Hydra Gates run this repo has ever made executed a script in which:

PR	what it fixed	in v1.0.1?
#147	16 gates reported PASS when their helper never ran	❌
#148	gate-33 had no axe report to read, and never said so	❌
#149	gates 6 and 7 reported PASS on an empty scope	❌
#162	gate-5 reported a resolution failure as a security finding	❌

A gate that reports PASS without running emits a tick identical to a real one, which is why nothing in this repo's history shows the difference. Tracked in .github#159.

Measured before opening this PR

Diff-scoped against origin/development, exactly as CI scopes it. Each run in its own mount namespace with a private tmpfs — the runner writes ~50 detail logs to hardcoded /tmp/hydra-gate-<name>.log paths and reads its verdicts back out of them, so two concurrent runs on one host silently corrupt each other's counts (.github#158 item 6). Another agent was running the gates unisolated on the same host during this work, so that is not hypothetical.

v1.0.1   exit 98   FAIL — "GATES THAT DID NOT RUN: 24 33"
v1.3.0   exit 0    PASS — ALL 58 APPLICABLE GATES PASSED, and all 58 ran
                          NOT APPLICABLE: 4 6 7 24 33 — each with a reason

Verified not merely that the job is green but that gates 4, 24 and 33 each name themselves not-applicable and say why. A green that came from somewhere else would not be the fix landing.

Independently confirmed end-to-end by doriath#160, which changed this same single line and nothing else: Hydra Gates went failure -> success.

v1.3.0 is f7eaf2a = .github@main at the time it was cut.

Refs ConductionNL/.github#159

---

Also removes hydra-gates-require-full-coverage: false

This repo had that override added earlier today when the shared default flipped, on the reasoning that it "cannot honestly satisfy it yet" because gate-33 and gate-4 did not report. Neither is a coverage gap — gate-33's producer (enable-axe) is deliberately off and gate-4 is correctly diff-scoped out per ADR-020. They are NOT APPLICABLE, and saying so out loud is exactly the vocabulary v1.0.1 lacked (0 _skip calls, versus 36 in v1.3.0).

So the override was switching off a control to work around a stale pin. Moving the pin removes the need for it, measured on this branch at v1.3.0, diff-scoped, run with --require-full-coverage — i.e. precisely the condition the line existed to avoid:

exit 0 — ALL 59 APPLICABLE GATES PASSED, and all 59 of them ran.
NOT APPLICABLE: 4 6 7 33 — each naming itself and its reason.

The requirement is satisfied, so the control goes back on. A switched-off control is worth less than a loud one, and this one no longer has anything to be loud about.

[github-actions]

Quality Report — ConductionNL/openregister @ 21cbb13

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 713/713
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-05 18:16 UTC

Download the full PDF report from the workflow artifacts.