Release: merge development into beta

.coverage-baseline

@@ -0,0 +1 @@
+49.47

.forgejo/workflows/pre-merge-check-strict.yaml

@@ -1,8 +1,14 @@
-# Pre-merge quality gate — runs composer check:strict + all 19 Hydra gates on every PR.
-# Configured as a required status check in branch protection on `development`
-# to keep the merge button disabled until this workflow passes.
+# Pre-merge quality gate — enforced lint + phpcs + all Hydra gates on every PR.
+# Required status check on protected branches.
 #
-# Diff-scoped per ADR-020 so legacy debt never blocks a PR — only new failures fail.
+# Runner/container mirror the proven release-semrel workflow: codeberg-medium +
+# official php:8.3-cli + a base-tooling step. The old code.forgejo.org/oci/ci-php:8.3
+# image 404s ("manifest unknown"), which fast-failed every run at container-pull.
+#
+# The gate runs `composer lint` + `composer phpcs` directly: check:strict's
+# psalm/phpstan/phpmd/test:all are wrapped in `|| echo skipping` so they never
+# affect pass/fail (ADR-022 parks static analysis), and running them on the medium
+# runner OOMs it. lint+phpcs is the identical enforced gate, fast and deterministic.
 
 name: pre-merge-check-strict
 
@@ -15,67 +21,50 @@ on:
 
 jobs:
   quality-gates:
-    runs-on: codeberg-small
+    runs-on: codeberg-medium
     container:
-      # Docker Hub php:8.3-cli (Debian, ships bash) is reliably pullable on the
-      # Codeberg runner; the previous code.forgejo.org/oci/ci-php:8.3 image could
-      # not be pulled, so this job failed at setup on every PR and never ran.
       image: php:8.3-cli
+    timeout-minutes: 15
     steps:
-      - name: Install toolchain (git, unzip, composer, php-ext, node, python3)
+      - name: Install base tooling
         run: |
-          set -eu
           apt-get update
-          # nodejs is required by the JS-based actions/checkout that runs next;
-          # php:8.3-cli ships no node, so without this the checkout step exits 127.
-          apt-get install -y --no-install-recommends git unzip python3 nodejs curl ca-certificates
-          # Precompiled PHP extensions (seconds) instead of docker-php-ext-install,
-          # which compiles from source (~1m) and overran the tiny runner's time limit.
-          # ext-xsl is required by the edgedesign/phpqa dev dependency in composer.lock.
-          curl -sSLf -o /usr/local/bin/install-php-extensions \
-            https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions
-          chmod +x /usr/local/bin/install-php-extensions
-          install-php-extensions zip mbstring xsl
+          apt-get install -y --no-install-recommends \
+            git curl ca-certificates gnupg jq unzip zip \
+            libzip-dev libpng-dev python3
+          # Node is required by actions/checkout@v4 (a JS action) which runs
+          # inside this php:8.3-cli container; the stock image ships no node.
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y --no-install-recommends nodejs
+          docker-php-ext-install -j"$(nproc)" zip gd
           curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
-          composer --version
-          php -v | head -1
-          node --version
 
       - name: Checkout PR
-        uses: https://code.forgejo.org/actions/checkout@v4
+        uses: https://github.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Install composer deps
-        run: composer install --no-interaction --no-progress --prefer-dist
+        run: composer install --no-interaction --no-progress --prefer-dist --ignore-platform-reqs
 
-      - name: Run composer check:strict
-        run: composer check:strict
+      - name: Run lint + phpcs (the enforced gate)
+        run: |
+          composer lint
+          composer phpcs
 
       - name: Clone Hydra (for gate runner)
-        uses: https://code.forgejo.org/actions/checkout@v4
+        uses: https://github.com/actions/checkout@v4
         with:
           repository: Conduction/hydra
           ref: development
           path: .hydra
 
-      - name: Run all 19 Hydra gates (diff-scoped per ADR-020)
-        env:
-          BASE_REF: ${{ github.base_ref }}
+      - name: Run all Hydra gates (diff-scoped per ADR-020)
         run: |
-          git fetch origin "$BASE_REF":"$BASE_REF" || true
-          bash .hydra/scripts/run-hydra-gates.sh --scope-to-diff --base "origin/$BASE_REF" .
+          git fetch origin ${{ github.base_ref }}:${{ github.base_ref }} || true
+          bash .hydra/scripts/run-hydra-gates.sh --scope-to-diff --base origin/${{ github.base_ref }} .
 
       - name: Gate-19 e2e coverage report (informational)
         if: always()
         run: |
           python3 .hydra/scripts/lib/check_e2e_coverage.py . --mode report || true
-
-  js-lint:
-    runs-on: codeberg-small
-    container:
-      image: node:20-alpine
-    steps:
-      - name: Checkout PR
-        uses: https://code.forgejo.org/actions/checkout@v4
-
-      - name: Run initial-state JS lint guard (REQ-INIT-003)
-        run: node ./scripts/lint-initial-state.js

.githooks/pre-commit

@@ -0,0 +1,38 @@
+#!/bin/sh
+# Committed pre-commit hook (activated via `git config core.hooksPath .githooks`,
+# which `npm install` / `composer install` set automatically — see package.json
+# "prepare" and composer.json "post-install-cmd").
+#
+# Regenerates docs/features.json whenever staged changes touch openspec/specs/
+# or the features overlay, so the commercial capability list can never go
+# stale. CI (features-check / features-extract) only VERIFIES — generation
+# happens here, before the commit, never in the pipeline.
+#
+# Best-effort by design: any failure only warns and never blocks the commit —
+# the CI gate is the enforcement backstop.
+
+if git diff --cached --name-only | grep -qE "^openspec/(specs/|features\.overlay\.json)"; then
+  CACHE=".git/extract-features.py"
+  # Fetch the canonical script (single source of truth in ConductionNL/.github);
+  # fall back to a previously cached copy when offline.
+  curl -sf --max-time 10 \
+    https://raw.githubusercontent.com/ConductionNL/.github/main/scripts/extract-features.py \
+    -o "$CACHE" 2>/dev/null || true
+
+  if [ -f "$CACHE" ]; then
+    if command -v python3 >/dev/null 2>&1; then PY="python3";
+    elif command -v py >/dev/null 2>&1; then PY="py -3";
+    else PY="python"; fi
+
+    if $PY "$CACHE" --app-root . >/dev/null 2>&1; then
+      git add docs/features.json
+      echo "pre-commit: docs/features.json regenerated from openspec/specs/."
+    else
+      echo "pre-commit: WARNING — could not regenerate docs/features.json (python or pyyaml missing?). CI features-check will verify." >&2
+    fi
+  else
+    echo "pre-commit: WARNING — could not fetch extract-features.py (offline?). CI features-check will verify." >&2
+  fi
+fi
+
+exit 0

.github/workflows/branch-policy.yml

@@ -8,6 +8,8 @@ jobs:
   check-source-branch:
     name: Branch Policy Check
     runs-on: ubuntu-latest
+    # Observed over 31 runs: max 0.1 min.
+    timeout-minutes: 10
     steps:
       - name: Verify source branch
         run: |

.github/workflows/branch-protection.yml

@@ -2,10 +2,10 @@ name: Branch Protection
 
 on:
   pull_request:
-    branches:
-      - main
-      - beta
+    branches: [main, beta]
+
+permissions: {}
 
 jobs:
-  check:
-    uses: Conduction/.github/.github/workflows/branch-protection.yml@main
+  branch-protection:
+    uses: ConductionNL/.github/.github/workflows/branch-protection.yml@main