Release: merge development into beta

.github/workflows/code-quality.yml

@@ -118,38 +118,52 @@ jobs:
       app-name: keepiq
       php-version: "8.3"
       php-test-versions: '["8.3", "8.4"]'
-      # Order matters: the PHPUnit matrix uses the whole list, but the E2E
-      # (Playwright), Newman and Journeydoc jobs all check out
-      # `fromJSON(nextcloud-test-refs)[0]` as their single server. That server
-      # has to be one OpenRegister can load, because `additional-apps` below
-      # installs it and keepiq's AppHost integration delegates to it —
-      # OpenRegister's lib/ContextChat/ContentProvider.php implements
-      # `OCP\ContextChat\IContentProvider`, which exists in stable32 and NOT in
-      # stable31 (verified: raw.githubusercontent.com returns 404 for the
-      # stable31 path). On stable31 every `occ` invocation printed
+      # NO `nextcloud-test-refs` HERE, DELIBERATELY. The shared workflow derives
+      # the matrix from appinfo/info.xml when this input is unset, and a derived
+      # matrix cannot disagree with the declared range. The override that used to
+      # sit here is exactly how the two came apart: it read
+      # `["stable34", "stable32", "stable33"]` while this branch moved info.xml to
+      # `<nextcloud min-version="32" max-version="35"/>`, so NC 35 was advertised
+      # to the App Store with no job touching it — not known-broken, unmeasured.
+      # gate-65 rule 11 is what caught it. Re-adding stable35 by hand fixes today
+      # and leaves the next bump to be remembered in two files; deriving deletes
+      # the second file.
+      #
+      # WHAT THE OVERRIDE WAS PROTECTING, AND WHY IT NO LONGER HAS TO.
+      # Its ORDER carried meaning: E2E (Playwright), Newman and journeydoc-capture
+      # each ran against `fromJSON(nextcloud-test-refs)[0]`, so stable34 had to
+      # lead to keep them off a server OpenRegister cannot load — OpenRegister's
+      # lib/ContextChat/ContentProvider.php implements
+      # `OCP\ContextChat\IContentProvider`, which does not exist before stable32,
+      # and on stable31 every `occ` invocation printed
       # `Interface "OCP\ContextChat\IContentProvider" not found` while loading
       # commands from openregister's info.xml.
       #
-      # The earlier reorder fixed the FIRST-entry problem for E2E/Newman/Journeydoc
-      # but left "stable31 is still covered by the PHPUnit matrix" — and that leg
-      # is broken by the same fact. The phpunit job ALSO installs `additional-apps`
-      # (shared quality.yml, "Checkout additional apps" + "Enabling app: …"), and
-      # its `occ app:enable openregister` failure is only a ::warning::, so the
-      # stable31 leg ran on without OpenRegister loaded. openregister has since
-      # made the floor explicit — `<nextcloud min-version="32"/>`, 8d5181f7a — so
-      # NC31 is now a configuration this fixture cannot produce at all.
+      # Those four jobs no longer read a meaning off a position. The shared
+      # workflow computes a `single-server` output — the numerically HIGHEST
+      # stable branch in the resolved set, and for the derived path the matrix
+      # action's own `branches-max` — and they consume that. The action's
+      # `branches` output is OLDEST-first, so a positional read would have moved
+      # all four onto stable32 silently. List order is now inert, and the one
+      # thing the override bought is structural instead.
+      #
+      # THIS ADDS A stable35 LEG. It was RED BEFORE IT WAS GREEN, deliberately.
+      # `additional-apps` below installs openregister and integriq, and when this
+      # branch was opened (2026-09-15) BOTH still declared `max-version="34"` on
+      # `development`. The shared workflow aborts the job when `occ app:enable`
+      # fails for an additional app — that was once only a ::warning::, which is
+      # how a leg previously ran on WITHOUT OpenRegister loaded and reported
+      # nothing — so the stable35 legs failed at the fixture, not in the tests.
       #
-      # Removing stable31 corrects an impossible configuration; it does not reduce
-      # coverage, because nothing was being covered on that leg.
+      # RESOLVED 2026-09-24: both dependencies now declare
+      # `<nextcloud min-version="32" max-version="35"/>` on `development`, which
+      # is the ref this file pins. Verified by parsing each appinfo/info.xml
+      # rather than grepping, because both files carry comments that quote OTHER
+      # apps' ranges and a grep matches those first.
       #
-      # THE LIST IS THE WHOLE DECLARED RANGE. appinfo/info.xml declares
-      # <nextcloud min-version="32" max-version="34"/>, so 32, 33 and 34 each get
-      # a leg. Adopting NC 34 by REPLACING the list left 32 and 33 advertised to
-      # the App Store with no job touching them — the declared floor became the
-      # untested end, which is the same drift as never testing 34, reversed.
-      # stable34 leads because newman, playwright and journeydoc-capture all read
-      # `fromJSON(inputs.nextcloud-test-refs)[0]` as their single server.
-      nextcloud-test-refs: '["stable34", "stable32", "stable33"]'
+      # The point of deriving the matrix from info.xml stands: the red was the
+      # honest state of NC 35 support while the gap existed, and nothing here
+      # could hide it. Leave it derived.
       enable-psalm: true
       enable-phpstan: true
       enable-phpmetrics: true
@@ -172,7 +186,14 @@ jobs:
       # which reads as an auth problem rather than a typo. Six fleet repos hit
       # this; in pipelinq it killed all four PHPUnit legs and the E2E job at the
       # clone step, so those gates had never executed a single test.
-      additional-apps: '[{"repo":"ConductionNL/openregister","app":"openregister","ref":"development"}]'
+      #
+      # integriq is here because the Integrations page reads integriq's
+      # `app_connection` rows (adopt-connection-registry). Without it the page
+      # shows the missing-dependency screen and
+      # `tests/e2e/workflows/integrations-page.spec.ts` fails on every run.
+      # `app` is `integriq`, verified in its appinfo/info.xml on `development`
+      # on 2026-09-15.
+      additional-apps: '[{"repo":"ConductionNL/openregister","app":"openregister","ref":"development"},{"repo":"ConductionNL/integriq","app":"integriq","ref":"development"}]'
       enable-sbom: true
 
       # ── Licensing ────────────────────────────────────────────────────────
@@ -234,9 +255,8 @@ jobs:
       # formatter failure mode that made the old `.prettierrc` worth deleting.
       # Centralising the config never stopped drift; the gate does.
       # Measured on this tree before enabling: PASSES, 294 of 310 tracked
-      # frontend files in scope. This repo has TWO documentation trees and both
-      # are excluded by .prettierignore — `docs/` and the separate `docusaurus/`
-      # site, which has its own package.json and its own toolchain.
+      # frontend files in scope. The documentation site in `docs/` is excluded
+      # by .prettierignore: it has its own package.json and its own toolchain.
       # `check:l10n-js` regenerates l10n/<locale>.js from the JSON catalogue and
       # fails when the committed file is stale. Nextcloud serves ONLY the JS half
       # to a browser — raw JSON out of an app directory is a 404 — so a catalogue

.gitignore

@@ -12,8 +12,6 @@
 .phpunit.cache/
 
 /node_modules/
-/website/node_modules/
-/website/.docusaurus/
 /js/
 # Host-side apps dir bind-mounted by docker-compose.yml; App Store installs
 # land here. Only the placeholder that keeps the directory is tracked.
@@ -87,9 +85,9 @@ docker/dolphin/models/
 !issues/
 !issues/**
 
-/docusaurus/node_modules/
-/docusaurus/build/
-/docusaurus/.docusaurus/
+# Docusaurus writes its build cache here, with absolute paths from the machine
+# that built it. It was committed once; never again.
+.docusaurus/
 # Test screenshots — images generated by browser test commands (test-app, run-test-scenario)
 # Only images are ignored; markdown reports and scenario files are kept in git.
 test-results/**/*.png

.prettierignore

@@ -9,11 +9,9 @@ coverage-vitest/
 playwright-report/
 test-results/
 *.min.*
-# This repo carries TWO Docusaurus trees, `docs/` and `docusaurus/`. Both are
-# documentation sites with their own conventions (their CSS is space-indented
-# by Docusaurus' own scaffolding), and both are built by a separate toolchain.
+# `docs/` is the Docusaurus documentation site. It has its own conventions (its
+# CSS is space-indented by Docusaurus' own scaffolding) and its own toolchain.
 docs/
-docusaurus/
 # Written by the translation workflow — a formatter here would fight its own
 # generator on every run.
 l10n/

CONTRIBUTING.md

@@ -209,12 +209,12 @@ Each release automatically:
 
 ## Documentation Release Process
 
-Documentation is built with [Docusaurus](https://docusaurus.io/) and deployed to GitHub Pages.
+Documentation is built with [Docusaurus](https://docusaurus.io/) and served by a Cloudflare Worker.
 
-1. Documentation source lives in the `docs/` (or `docusaurus/`) folder on any branch
-2. Push or merge to the `documentation` branch triggers the build
+1. Documentation source lives in the `docs/` folder
+2. A push or merge to `development` triggers the build (`.github/workflows/documentation.yml`)
 3. Docusaurus builds the static site
-4. The site is deployed to GitHub Pages with a custom domain (e.g., `openregister.app`)
+4. The site is published to [keepiq.conduction.nl](https://keepiq.conduction.nl)
 
 Each app has its own documentation site — see the app's README for its URL.
 

README.md

@@ -101,11 +101,10 @@ keepiq/
 │   ├── architecture/           # App-specific Architectural Decision Records
 │   ├── ROADMAP.md              # Product roadmap
 │   └── changes/                # OpenSpec change directories (created on first change)
-├── docs/                       # Design documentation
+├── docs/                       # Documentation site (Docusaurus) and design documentation
 │   ├── ARCHITECTURE.md         # Standards, data model, integrations
 │   ├── FEATURES.md             # Competitive analysis, feature matrix
 │   └── DESIGN-REFERENCES.md    # Design patterns, ASCII wireframes
-├── docusaurus/                 # Documentation site
 ├── tests/                      # Unit and integration tests
 ├── l10n/                       # Translations — 36 locales, <locale>.json + generated <locale>.js
 ├── .github/workflows/          # CI/CD pipelines

appinfo/info.xml

@@ -36,7 +36,7 @@ Vrij en open source onder de EUPL-1.2-licentie.
 
 **Ondersteuning:** Voor ondersteuning, neem contact op via [email protected].
     ]]></description>
-    <version>0.3.2-unstable.20260910105221</version>
+    <version>0.3.4-unstable.20260912202807</version>
     <licence>EUPL-1.2</licence>
     <author mail="[email protected]" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>Keepiq</namespace>
@@ -94,17 +94,19 @@ Vrij en open source onder de EUPL-1.2-licentie.
         <!--
             Floor is 32, fleet-wide, so PHP 8.3 is guaranteed by the platform.
 
-            31 was never actually deliverable: the CI matrix already tests only
-            stable32 (see nextcloud-test-refs in .github/workflows/
-            code-quality.yml), because OpenRegister — which this app builds on —
-            declares `<nextcloud min-version="32" max-version="34"/>` itself. Advertising 31 in
-            the App Store promised a range no test leg covered and no dependency
-            could satisfy.
-
-            max-version stays 34, which is the fleet-wide value everywhere
-            except openconnector (35).
+            31 was never actually deliverable: the CI matrix is derived from
+            this `<nextcloud>` range (no leg below 32), because OpenRegister —
+            which this app builds on — declares `min-version="32"` itself.
+            Advertising 31 in the App Store promised a range no test leg covered
+            and no dependency could satisfy.
+
+            max-version is 35 as of 2026-09-15: verified against Nextcloud 35
+            (35.0.0 dev) on the shared dev instance — keepiq enabled, its DB
+            migrations ran cleanly under `occ upgrade`, and the log showed no
+            deprecations or errors. Dependencies openregister and integriq also
+            declare 35 on development (verified 2026-09-24).
         -->
-        <nextcloud min-version="32" max-version="34"/>
+        <nextcloud min-version="32" max-version="35"/>
     </dependencies>
 
     <background-jobs>

appinfo/routes.php

@@ -37,8 +37,10 @@
     ['name' => 'encryptionSuite#create',            'url' => '/api/v1/suites',                          'verb' => 'POST'],
     ['name' => 'encryptionSuite#updatePrivateKey',  'url' => '/api/v1/suites/{id}/private-key',         'verb' => 'PUT'],
     ['name' => 'encryptionSuite#revoke',            'url' => '/api/v1/suites/{id}/revoke',              'verb' => 'POST'],
+    ['name' => 'encryptionSuite#forceRevoke',       'url' => '/api/v1/suites/{id}/force-revoke',        'verb' => 'POST'],
     ['name' => 'encryptionSuite#reinstate',         'url' => '/api/v1/suites/{id}/reinstate',           'verb' => 'POST'],
     ['name' => 'encryptionSuite#compromiseRecovery','url' => '/api/v1/suites/compromise-recovery',      'verb' => 'POST'],
+    ['name' => 'encryptionSuite#proofChallenge',    'url' => '/api/v1/suites/{id}/proof-challenge',     'verb' => 'GET'],
 
     // CA management (admin-only).
     ['name' => 'cACertificate#getStatus',          'url' => '/api/v1/ca/status',                      'verb' => 'GET'],
@@ -49,6 +51,7 @@
     // Migration tracking.
     ['name' => 'migration#getStatus',                'url' => '/api/v1/migrations/status',               'verb' => 'GET'],
     ['name' => 'migration#complete',                 'url' => '/api/v1/migrations/{id}/complete',        'verb' => 'POST'],
+    ['name' => 'migration#abort',                    'url' => '/api/v1/migrations/{id}/abort',           'verb' => 'POST'],
 
     // Compromise-recovery migration work loop. One record per request: the
     // browser decrypts with the old private key, re-encrypts under the new one,
@@ -59,6 +62,10 @@
     ['name' => 'migration#reEncryptSecret',          'url' => '/api/v1/migrations/{id}/secrets/{secretId}', 'verb' => 'POST'],
     ['name' => 'migration#reEncryptVersion',         'url' => '/api/v1/migrations/{id}/versions/{versionId}', 'verb' => 'POST'],
     ['name' => 'migration#reEncryptAttachmentGrant', 'url' => '/api/v1/migrations/{id}/attachment-grants/{grantId}', 'verb' => 'POST'],
+    // Emergency contacts migrate too, but off the gate: the browser mints a fresh
+    // envelope escrowing the new key and re-points the contact here. A contact it
+    // cannot carry is left for the completion sweep to invalidate.
+    ['name' => 'migration#reEnvelopeEmergencyContact', 'url' => '/api/v1/migrations/{id}/emergency-contacts/{contactId}', 'verb' => 'POST'],
 
     // Key generator endpoint (stateless, authenticated).
     ['name' => 'keyGenerator#generate', 'url' => '/api/v1/generate-key', 'verb' => 'POST'],

cli/ci.go

@@ -56,16 +56,17 @@ func ciSetup() (c *client.Client, key *rsa.PrivateKey, disc *client.Discovery, b
 }
 
 // fetchDecrypt fetches an application secret by name and decrypts its envelope
-// with the application private key (§4.2). Returns the plaintext value.
+// with the application private key (§4.2). Returns the plaintext value, which
+// the server sends as `ciphertext.key` under the scheme in `encryption.scheme`.
 func fetchDecrypt(c *client.Client, key *rsa.PrivateKey, name, bearer string) (string, error) {
 	env, err := c.FetchByName(name, bearer)
 	if err != nil {
 		return "", err
 	}
-	if env.Scheme != "rsa-oaep-sha256-chunked-v1" {
-		return "", fmt.Errorf("unexpected envelope scheme %q", env.Scheme)
+	if env.Encryption.Scheme != "rsa-oaep-sha256-chunked-v1" {
+		return "", fmt.Errorf("unexpected envelope scheme %q", env.Encryption.Scheme)
 	}
-	return dcrypto.DecryptField(env.Payload.Value, key)
+	return dcrypto.DecryptField(env.Ciphertext.Key, key)
 }
 
 func cmdCIFetch(args []string) error {