fix(gates): gate-57 1→0 (retire groupfolder storage, closes #87), gate-16 84→0, CVE-2026-65954

[rubenvdlinde]

Takes launchpad's Hydra Gates job from three red gates to one. gate-19 is untouched and is the only remaining failure.

Starting point, measured not assumed

From the failing development → beta run 31516037194 at e24334b6 (job log pulled via gh api …/jobs/93866053044/logs, 101,235 bytes), reproduced locally byte-for-byte on a detached worktree with a freshly cloned canonical ConductionNL/.github@57bcb2b and HYDRA_GATE_BASE_REF=origin/beta:

[hydra-gates] COVERAGE: 59 of 64 declared gates reported a result
              (5 not applicable; 59 of 59 applicable gates ran).
[gate-16] spec-coverage:              FAIL — 84
[gate-19] e2e-coverage:               FAIL — 77
[gate-57] orphaned-write-capability:  FAIL — 1

Hydra Gates is the only red job — every other job is green and Quality Report is the pure aggregator.

⚠️ gate-19 at CI scope is 77, not the 128 quoted in the round-3 handover. Both are correct measurements of different things: 128 is unscoped whole-tree, 77 is the development → beta diff scope CI actually gates on. Do not read the two as a regression or a win.

What this PR does

gate	before	after
gate-16 spec-coverage	84	0
gate-57 orphaned-write-capability	1	0
gate-19 e2e-coverage	77	77 (untouched)

1. CVE-2026-65954 (phpcsstandards/phpcsutils 1.2.2 → 1.2.3)

Lock-only. composer audit --locked exit 1 → exit 0. Exercised by running phpcs against the new library on PHP 8.4 (0 ERRORS AND 468 WARNINGS IN 211 FILES, exit 0), not merely locked. The Security (composer) job passed at 17:25Z only because it ran before the advisory landed; the next run would have gone red with no diff to explain it.

2. gate-57 → 0 — retire the inert groupfolder-storage-backend capability (closes #87)

The finding was DashboardService::writeDashboardContent, and the real scope was the whole capability. Task 5 of the original change — the wiring — was ticked in tasks.md but never performed. Every absence claim below was taken with a positive control (the same search resolves callers for getUserDashboards and ->findByUuid):

symbol	callers
writeDashboardContent / readDashboardContent / deleteDashboardContent	0 each
DashboardContentStorageFactory::getStorage()	0 (only the three above)
DashboardApiController::storageUnavailableResponse()	0
DashboardMapper::findAll()	1 — the migration command, retired here

Version002009Date20260811000000 drops the content and locale columns. That loses no data: the only writer was reachable solely through the orphaned facade methods, so the columns were NULL on every row of every install. The step is hasColumn-guarded and idempotent. Version002001Date20260603000000 and DashboardTableBuilder::addContentStorageColumns() are deliberately kept — a shipped migration is part of the version ledger.

Deliberately NOT removed, tracked as Task 8 on #87: launchpad.content_storage, AdminSettingKey::CONTENT_STORAGE, SetupWizardService::{get,set}ContentStorage/hasGroupfolderApp, AdminController::setWizardStorage and setup-wizard step 2. Those belong to the setup-wizard capability, which writes the setting; this one was the reader. The setting was already inert, so removing the reader does not make it worse, and retiring the wizard step edits a different spec and deserves its own review.

The spec is marked withdrawn rather than deleted. That also retires its 16 @e2e exclude markers, whose reasons cited DbContentStorageTest.php — a file this PR deletes, which would otherwise have left sixteen exemptions resting on a class that no longer exists.

3. gate-16 → 0 — annotate the 84 changed frontend methods

All 84 were in src/; zero were PHP. That the PHP side is genuinely clean rather than unscanned was established with a positive control (273 lib/**/*.php files in the same diff; WeatherService.php carries 2 tags, HealthPingController.php 3).

Closed with 84 real @spec anchors and exactly 2 reason-bearing exclusions, both verified against the source:

• ClockWidget.vue::pointOnCircle — pure polar-to-cartesian trigonometry; body reads neither this.now nor this.content. Verified its only two callers are tickCoords/handCoords, both carrying REQ-CLOCK-003.
• useTileClickTracking.js::__resetTileClickTrackingForTest — test-only harness hook; verified its only importer in the repo is useTileClickTracking.spec.js.

Both reasons name a concrete artifact rather than a state of the world. This diff is comment-only and provably so: 0 added and 0 removed lines fall outside a docblock, so no runtime behaviour can change.

Verification

Every number below was produced by the canonical checker on this branch.

gate-16   84 -> 0     negative control (committed, per the gate's own
                      changed-method-from-history semantics):
                      0 -> 1 naming ClockWidget.vue::tickCoords -> 0
gate-57    1 -> 0     planted true positive: a tracked post* write method with
                      no caller. 0 -> 1 naming exactly the plant -> 0.
                      post* deliberately: WRITE_VERB_PREFIXES excludes delete*
gate-19   77 -> 77    unchanged, as intended
PHPUnit   1570 tests, 4032 assertions, 0 failures, 3 pre-existing skips
phpcs     0 errors, 468 warnings, 211 files — identical to the pre-change baseline
anchors   check_spec_anchors.py: 0 dangling across lib/ AND src/

No gate was weakened: no baseline, no allowlist widening, no @e2e exclude added, no skipped or deleted test other than the five PHPUnit classes covering deleted production code.

⚠️ A near-miss worth recording: deleting the longest @param type from the DashboardService constructor docblock broke PEAR's param-alignment sniff across all 22 remaining params — 44 phpcs errors into a file that had zero. Caught only by re-measuring against the pre-change baseline. It was fixed with the repo's own phpcbf, not by adjusting the standard.

Not addressed here

• gate-19 (77) — 68 are closeable with tests (four widget specs have no e2e file at all); 9 are hard-blocked by No conditional-visibility EXCLUDE rule can be created: isInclude=false is a boolean bound into a smallint column (400 on PostgreSQL = the CI default) #96/conditional-visibility editor: the group picker is always empty — Views.vue never passes available-groups, so group rules cannot be built or previewed in the UI #97/Conditional visibility is never enforced: checkRulesForPlacement() has no render-time caller, so preview says Hidden and the dashboard shows the widget anyway #98. None sits in an unimplemented spec, and there is no @e2e exclude anywhere in the six affected specs, so the 77 is honest debt rather than an artifact of .github#345.
• No conditional-visibility EXCLUDE rule can be created: isInclude=false is a boolean bound into a smallint column (400 on PostgreSQL = the CI default) #96 — a warning for whoever takes it: the obvious fix (copying WidgetPlacement's int + addType('integer') precedent over the identical SMALLINT column) compiles, passes, and silently disables the feature. Three PHP consumers use getIsInclude() === true and the editor uses !== false; 1 === true is false in PHP and 0 !== false is true in JS. The precedent is safe there because its consumers use truthiness. The honest fix is a column type change plus data migration.
• Pre-existing: tools/check-spec-annotations.php fails on 12 PHP methods (TileClickMapper, WidgetPlacement, TileClick, ImportLaunchpadRegister, Version002007). Unchanged by this PR, none in a file it touches, and not run by any CI job.

[github-actions]

Quality Report — ConductionNL/launchpad @ 237fb1e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
composer			✅	✅ 102/102
npm			✅	✅ 548/548
PHPUnit					❌
Newman					❌
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-11 21:06 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/launchpad @ 46fad76

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
composer			✅	✅ 102/102
npm			✅	✅ 548/548
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-11 21:24 UTC

Download the full PDF report from the workflow artifacts.