fix(newman): decidesk#443 was a cookie jar, and it hid five real defects (#447)

* fix(newman): decidesk#443 was a cookie jar, and it hid five real defects

All 13 Newman collections now run 310 assertions with 0 failures, measured on
a disposable NC 32.0.12 + openregister instance that first reproduced CI's 22
failures exactly (same collections, same counts).

decidesk#443 — NOT an authorization hole
  The four "non-admin gets 200 on an AuthorizedAdminSetting endpoint"
  assertions were true observations of a false premise. Newman keeps ONE cookie
  jar per host; Nextcloud resolves a logged-in session from that jar BEFORE it
  reads the Basic auth header, so a request carrying both runs as whoever
  authenticated last. Measured, not inferred: an inserted GET /ocs/v2.php/cloud/user
  on the same request chain answered id="admin", groups=["admin"]. Clearing the
  jar first turns the same request into 403 and the identity read into
  "decidesk-admset-nonadmin". The attributes were always enforced.

  Fixed by a collection-level jar clear in the four collections that assert on
  WHO is calling, plus an "Identity guard" request in each that asserts the
  probe really is the non-admin. Removing the clear turns the guard red first,
  so this cannot silently come back.

  The same jar also disarmed the IDOR guard decidesk-security-flow-e2e exists to
  prove: "register on behalf of an unrelated grantor" and "revoke by an
  unrelated participant" were running as the GRANTOR. They now genuinely 403.

Five product defects the false green was sitting on
  1. board-proxy schema never existed. ProxyVoteService wrote proxy rows into
     the `vote` schema, whose required value/castAt are not part of a
     delegation, so EVERY POST /api/proxies returned 422 "Failed to register
     proxy." Added the BoardProxy schema the service and both collections were
     already written against.
  2. governance-report schema never existed. persistReport() swallowed
     "Schema not found", so generate() returned 201 with no id and
     /api/governance-reports/{id}/export could never be addressed. Added
     GovernanceReport.
  3. The per-holder proxy cap never counted anything. ObjectService reads its
     register/schema context from filters.register / filters.schema; a TOP-LEVEL
     'register'/'schema' key is silently ignored and findAll() returns []
     without throwing. forMeeting() used the top-level shape, so a third proxy
     was accepted at a cap of 2. Live: now 422 with the maximum-reached message,
     and a different holder still registers.
  4. Anonymous ORI show returned 500, not 404. OpenRegister's published-predicate
     RBAC hides a future-dated payload by making find() THROW, so the not-live
     404 branch was unreachable and the blanket Throwable catch produced a 500 —
     itself a disclosure, since it separates "exists but hidden" from "unknown".
  5. Meeting close could never complete. openedAt/closedAt/meetingCost were
     declared readOnly, which OpenRegister enforces as immutable-after-create
     for every writer including MeetingService, so opened -> closed failed with
     "Cannot modify readOnly property: closedAt" (422). A meeting is created
     before it is opened, so a readOnly stamp can never be written.

Seed data: 8 objects were silently skipped on every install
  Five seed slugs exceeded 36 characters and were referenced by other objects;
  the relation column is varchar(36), so the write truncated and ImportHandler
  skipped the object. Shortened the five slugs and their references (and the
  openspec design/tasks tables that quote them). Locally: 8 skipped -> 0.

Test-side changes
  - decidesk-motion-amendment now seeds a real governance body + chair
    participant + meeting. VotingController::open() authorizes before it
    validates (correct order), so the placeholder meetingId 'meeting-x' meant
    the subjectType contract was never reached — the test only ever saw the 403.
  - ProxyVoteServiceTest's ObjectService mock treated every filter key as a row
    field, so a caller using the broken top-level shape still got rows: the mock
    could not tell a working call from one that returns [] in production. It now
    models the real contract and returns [] without register/schema context.
    Reverting forMeeting() to the old shape turns 3 tests red.
  - RegisterJsonTest schema-count ratchet 37 -> 39 with the reason.

Both directions proven per fix, one mutation at a time: swapping
AuthorizedAdminSetting for NoAdminRequired on MemberImportController::groups and
on ProcessTemplateController::index each turned exactly one assertion red;
removing the security-flow jar clear turned the identity guard red; reverting
forMeeting() turned the unit suite red. (Note: opcache.revalidate_freq=60 made
one mutation run look green — the probe instance now runs revalidate_freq=0.)

Left red and not touched here: 17 Playwright specs (95 pass) and the systemic
findAll config shape — ~50 call sites across lib/ still pass register/schema at
the top level and therefore read nothing. Filed separately; only the call site
covered by a red assertion is fixed here.

* fix(gates): close gate-54 and the coverage ratchet this branch opened

Two jobs went red on #447 that the first commit caused, both real:

quality / PHPUnit — coverage ratchet
  The new `catch (DoesNotExistException)` branch in OriController::show() added
  4 statements with no test, so coverage fell against the merge base
  (8866/15168 -> 8868/15172). Added the missing unit test: find() throwing
  DoesNotExistException must produce 404, not 500. It is the case the existing
  testShowFutureDatedPayloadIs404 never covered — that one hands the controller
  a row and exercises the not-live branch, while on a real instance the
  anonymous caller never gets the row at all. Swapping the catch to
  \LogicException turns the new test red with "500 is identical to 404".

quality / Hydra Gates — gate-54 relation-dialect, 4 findings
  Renaming the over-36-character seed slugs pulled two register fragments into
  the gate's diff scope and exposed four properties that declare
  `format: uuid` + `$ref` at a schema that does not exist in this register:
  Fractie and SchriftelijkeVraag are owned by the unlanded
  fractievoorzitter-fractie-koppeling change, and ArchivalDossier by
  records-management-archiving.

  The pair is unsatisfiable while the target is absent — keeping the $ref is a
  dangling target, dropping it while keeping format:uuid is a relation-shaped
  property with no $ref. Until the owning change lands these are plain string
  placeholders (the descriptions already say they are seeded as nil-UUID
  placeholders), so they are now declared as plain strings, each carrying the
  instruction to restore format:uuid + $ref in the same commit that introduces
  the schema. No waiver, no baseline: gate-54 goes from 4 findings to 0 in the
  files this branch touches.

  (One finding remains repo-wide: ConsultationRequest.achterbanraadpleging in
  47-works-council-consultation.json, a file this branch does not touch and
  which the gate's ADR-020 diff scoping therefore excludes.)

Re-verified after the register edits: all 13 Newman collections, 310 assertions,
0 failures; unit suite 831 tests green.

---------

Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>

Author: rubenvdlinde

lib/Controller/OriController.php

@@ -30,6 +30,7 @@
 use OCA\Decidesk\AppInfo\Application;
 use OCA\Decidesk\Service\OriSerializer;
 use OCP\AppFramework\Controller;
+use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
 use OCP\AppFramework\Http\Attribute\PublicPage;
@@ -323,6 +324,15 @@ public function show(string $resource, string $id): JSONResponse
             }
 
             $object = $this->narrowToDecisionType(resource: $resource, object: $object);
+        } catch (DoesNotExistException $e) {
+            // OpenRegister's published-predicate RBAC hides a future-dated or
+            // depublished payload from an anonymous caller by making find() THROW,
+            // not by returning null — so the not-live 404 branch below was never
+            // reached and the blanket Throwable catch turned it into a 500. A 500
+            // is itself a disclosure (it separates "exists but hidden" from
+            // "unknown id"), which is exactly what this endpoint must not do.
+            // An id we cannot read is not-found, full stop.
+            return $this->errorResponse(message: 'Not found', status: Http::STATUS_NOT_FOUND);
         } catch (Throwable $e) {
             $this->logger->error(message: 'OriController show failed', context: ['resource' => $resource, 'id' => $id, 'exception' => $e]);
             return $this->errorResponse(message: 'Internal server error', status: Http::STATUS_INTERNAL_SERVER_ERROR);

lib/Service/ProxyVoteService.php

@@ -7,9 +7,12 @@
  * suspended when the grantor joins the meeting remotely, and revoked either
  * at meeting close or by secretary action.
  *
- * Proxy rows are persisted on the unified `vote` schema
- * (`voteMethod=proxy`, `proxyHolder` set, additional `proxyStatus` field)
- * so the audit log always shows the cast trail (ADR-006).
+ * Proxy rows are persisted on the `board-proxy` schema (meetingKoppeling /
+ * grantorKoppeling / holderKoppeling / proxyStatus), which is what this service
+ * has always written. It previously pointed at the `vote` schema, whose required
+ * `value` + `castAt` are not part of a delegation, so every registration threw
+ * and returned 422; `board-proxy` is the schema the row actually describes.
+ * Every transition is mirrored to the audit log (ADR-006).
  *
  * @category Service
  * @package  OCA\Decidesk\Service
@@ -54,7 +57,7 @@ class ProxyVoteService
      *
      * @var string
      */
-    public const SCHEMA = 'vote';
+    public const SCHEMA = 'board-proxy';
 
     /**
      * App config key holding the per-holder per-meeting ACTIVE-proxy cap.
@@ -397,12 +400,21 @@ public function forMeeting(string $meetingId, ?string $status=null): array
     {
         try {
             $objectService = $this->container->get('OCA\OpenRegister\Service\ObjectService');
-            $rows          = $objectService->findAll(
+            // ObjectService::prepareFindAllConfig() only reads the register/schema
+            // context from filters.register / filters.schema — a TOP-LEVEL
+            // 'register'/'schema' key is silently ignored, findAll() then runs with
+            // no register/schema context and returns an empty array. It does not
+            // throw, so the caller cannot tell "no proxies" from "never looked",
+            // and the per-holder cap below counted 0 every time (decidesk#443
+            // follow-up: a third proxy was accepted at a cap of 2).
+            $rows = $objectService->findAll(
                 [
-                    'register' => 'decidesk',
-                    'schema'   => self::SCHEMA,
-                    'filters'  => ['meetingKoppeling' => $meetingId],
-                    'limit'    => 1000,
+                    'filters' => [
+                        'register'         => 'decidesk',
+                        'schema'           => self::SCHEMA,
+                        'meetingKoppeling' => $meetingId,
+                    ],
+                    'limit'   => 1000,
                 ]
             );
         } catch (\Throwable $e) {

lib/Settings/decidesk_register.json

@@ -1158,7 +1158,7 @@
         ],
         "evaluation-template": [
           {
-            "slug": "template-bestuurlijke-effectiviteit-nl-cgc",
+            "slug": "template-bestuurlijke-effectiviteit",
             "title": "Board effectiveness self-evaluation (NL Corporate Governance Code)",
             "description": "Default reusable annual board self-evaluation (zelfevaluatie) covering the five standard effectiveness dimensions. Editable per body.",
             "dimensions": [
@@ -1265,7 +1265,7 @@
             "secretaryUserId": "jan.devries",
             "scoreSummary": "{\"overallScore\":3.6,\"respondentCount\":2,\"invitedMemberCount\":3,\"minRespondentThreshold\":3,\"thresholdMet\":false,\"suppressed\":true,\"dimensionScores\":null,\"themes\":null,\"computedAt\":\"2025-12-20T17:05:00Z\"}",
             "governanceBody": "rvc-waterschap-amstel",
-            "template": "template-bestuurlijke-effectiviteit-nl-cgc"
+            "template": "template-bestuurlijke-effectiviteit"
           },
           {
             "slug": "evaluatie-acme-rvc-2026",
@@ -1289,7 +1289,7 @@
             "chairUserId": "acme.chair",
             "secretaryUserId": "acme.secretary",
             "governanceBody": "raad-van-commissarissen-acme-bv",
-            "template": "template-bestuurlijke-effectiviteit-nl-cgc"
+            "template": "template-bestuurlijke-effectiviteit"
           }
         ],
         "evaluation-response": [
@@ -1394,6 +1394,7 @@
           "agenda-item",
           "bevoegdheidstoedeling",
           "board-evaluation",
+          "board-proxy",
           "body-participation",
           "budget-proposal",
           "citizen-panel",
@@ -1415,6 +1416,7 @@
           "geheimhouding-grond",
           "geschenk",
           "governance-body",
+          "governance-report",
           "governing-document",
           "governing-document-versie",
           "ingekomen-stuk",
@@ -2207,21 +2209,18 @@
             "title": "Opened at",
             "type": "string",
             "format": "date-time",
-            "description": "Timestamp of the first 'open' lifecycle transition, stamped server-side by MeetingService (meeting-efficiency). Basis for the live cost calculator and duration analytics.",
-            "readOnly": true
+            "description": "Timestamp of the first 'open' lifecycle transition, stamped server-side by MeetingService (meeting-efficiency). Basis for the live cost calculator and duration analytics. NOT readOnly: OpenRegister reads readOnly as immutable-after-create and rejects the UPDATE for every writer, including MeetingService itself — a meeting is created before it is opened, so a readOnly stamp can never be written."
           },
           "closedAt": {
             "title": "Closed at",
             "type": "string",
             "format": "date-time",
-            "description": "Timestamp of the 'close' lifecycle transition, stamped server-side by MeetingService (meeting-efficiency).",
-            "readOnly": true
+            "description": "Timestamp of the 'close' lifecycle transition, stamped server-side by MeetingService (meeting-efficiency). NOT readOnly — see openedAt: readOnly made every opened -> closed transition fail with 'Cannot modify readOnly property: closedAt' (422)."
           },
           "meetingCost": {
             "title": "Meeting cost",
             "type": "number",
-            "description": "Total meeting cost in EUR, computed server-side on close from elapsed time x attendee count x the governance body's hourlyRate (meeting-efficiency). Schema.org MonetaryAmount value.",
-            "readOnly": true
+            "description": "Total meeting cost in EUR, computed server-side on close from elapsed time x attendee count x the governance body's hourlyRate (meeting-efficiency). Schema.org MonetaryAmount value. NOT readOnly — see openedAt: it is stamped on close, i.e. always after create."
           }
         },
         "x-openregister-aggregations": {
@@ -2704,6 +2703,149 @@
           }
         }
       },
+      "GovernanceReport": {
+        "slug": "governance-report",
+        "icon": "ChartBoxOutline",
+        "version": "0.1.0",
+        "title": "GovernanceReport",
+        "description": "A generated annual governance report for one board and year (meeting/resolution counts, vote tally, independence ratio, attendance rate, conflict count and the compliance flags derived from them). This is the row GovernanceReportingService persists so /api/governance-reports/{id} and /{id}/export/{format} have something to address.",
+        "type": "object",
+        "x-openregister": {
+          "schemaType": "custom:GovernanceReport",
+          "active": true,
+          "hardDelete": false,
+          "searchable": false,
+          "mailEnabled": false
+        },
+        "required": [
+          "boardKoppeling",
+          "year"
+        ],
+        "properties": {
+          "boardKoppeling": {
+            "title": "Board",
+            "type": "string",
+            "description": "Identifier of the governance body the report covers."
+          },
+          "year": {
+            "title": "Year",
+            "type": "integer",
+            "description": "Calendar year the report covers.",
+            "example": 2026
+          },
+          "meetingCount": {
+            "title": "Meeting count",
+            "type": "integer",
+            "description": "Number of meetings held in the reporting year."
+          },
+          "resolutionCount": {
+            "title": "Resolution count",
+            "type": "integer",
+            "description": "Number of resolutions taken in the reporting year."
+          },
+          "voteTally": {
+            "title": "Vote tally",
+            "type": "object",
+            "description": "Votes cast in the reporting year, counted per outcome (in-favor, against, abstain, absent, recused-due-to-conflict)."
+          },
+          "memberCount": {
+            "title": "Member count",
+            "type": "integer",
+            "description": "Number of board members in the reporting year."
+          },
+          "independenceRatio": {
+            "title": "Independence ratio",
+            "type": "number",
+            "description": "Share of board members classified as independent."
+          },
+          "attendanceRate": {
+            "title": "Attendance rate",
+            "type": "number",
+            "description": "Share of possible member-meeting attendances actually recorded."
+          },
+          "conflictCount": {
+            "title": "Conflict count",
+            "type": "integer",
+            "description": "Number of conflict-of-interest declarations in the reporting year."
+          },
+          "flags": {
+            "title": "Compliance flags",
+            "type": "object",
+            "description": "Compliance verdict for the report: whether every threshold passed, plus the list of thresholds that did not."
+          },
+          "generatedAt": {
+            "title": "Generated at",
+            "type": "string",
+            "description": "Moment the report was generated."
+          }
+        }
+      },
+      "BoardProxy": {
+        "slug": "board-proxy",
+        "icon": "AccountArrowRightOutline",
+        "version": "0.1.0",
+        "title": "BoardProxy",
+        "description": "A proxy (volmacht) granted by one board member to another for a single meeting. This is the row ProxyVoteService writes through /api/proxies and the row the per-holder proxy cap counts; the signed-document side of a volmacht lives on ProxyAuthorization.",
+        "type": "object",
+        "x-openregister": {
+          "schemaType": "custom:BoardProxy",
+          "active": true,
+          "hardDelete": false,
+          "searchable": false,
+          "mailEnabled": false
+        },
+        "required": [
+          "meetingKoppeling",
+          "grantorKoppeling",
+          "holderKoppeling",
+          "proxyStatus"
+        ],
+        "properties": {
+          "meetingKoppeling": {
+            "title": "Meeting",
+            "type": "string",
+            "description": "Identifier of the meeting this proxy applies to. The per-holder cap is counted per meeting."
+          },
+          "grantorKoppeling": {
+            "title": "Grantor",
+            "type": "string",
+            "description": "Identifier of the participant delegating their vote (the volmachtgever)."
+          },
+          "holderKoppeling": {
+            "title": "Holder",
+            "type": "string",
+            "description": "Identifier of the participant receiving the delegation (the gevolmachtigde)."
+          },
+          "scope": {
+            "title": "Scope",
+            "type": "string",
+            "description": "Which resolutions the delegation covers.",
+            "example": "all-resolutions"
+          },
+          "expiresAt": {
+            "title": "Expires at",
+            "type": "string",
+            "description": "Optional moment the delegation lapses. Empty when the proxy runs for the whole meeting."
+          },
+          "proxyStatus": {
+            "title": "Proxy status",
+            "type": "string",
+            "description": "Lifecycle state of the delegation. A freshly registered proxy starts pending-approval; only active proxies count toward the per-holder cap.",
+            "enum": [
+              "pending-approval",
+              "active",
+              "suspended",
+              "revoked"
+            ],
+            "example": "pending-approval"
+          },
+          "registeredAt": {
+            "title": "Registered at",
+            "type": "string",
+            "description": "Moment the delegation was registered."
+          }
+        }
+      },
       "Vote": {
         "slug": "vote",
         "icon": "ThumbUpOutline",

lib/Settings/register.d/49-vragenuur-interpellatie.json

@@ -91,7 +91,7 @@
             "lifecycle": "behandeld",
             "raadsbesluitDatum": "2026-05-12",
             "behandeldIn": "raadsvergadering-2025-01-15",
-            "agendaItem": "interpellatie-stationsgebied-2025-01-15",
+            "agendaItem": "interpellatie-stationsgebied-2025",
             "behandelingVerslag": "Interpellatiedebat gevoerd; wethouder zegt extern onderzoek toe naar de veiligheidssituatie en informeert de raad per raadsbrief voor het zomerreces."
           },
           {
@@ -144,7 +144,7 @@
             "meeting": "raadsvergadering-2025-01-15"
           },
           {
-            "slug": "interpellatie-stationsgebied-2025-01-15",
+            "slug": "interpellatie-stationsgebied-2025",
             "title": "Interpellatie: veiligheid stationsgebied",
             "itemType": "discussion",
             "orderNumber": 7,
@@ -388,9 +388,7 @@
           "fractie": {
             "title": "Fraction",
             "type": "string",
-            "format": "uuid",
-            "$ref": "Fractie",
-            "description": "Reference to the submitter's Fractie (fractievoorzitter-fractie-koppeling — hard depends_on, that change owns the schema). Required. Seeded as a nil-UUID placeholder until that change lands (design D6)."
+            "description": "Reference to the submitter's Fractie (fractievoorzitter-fractie-koppeling — hard depends_on, that change owns the schema). Required. Seeded as a nil-UUID placeholder until that change lands (design D6). Declared as a PLAIN STRING, not format:uuid + $ref: the Fractie schema does not exist in this register yet, so a $ref to it is a dangling target (ADR-062 rule f) while dropping the $ref but keeping format:uuid is a relation-shaped property with no $ref (rule 7) — the pair is unsatisfiable until that change lands. Restore format:uuid + $ref: Fractie in the same commit that introduces the schema."
           },
           "onderwerp": {
             "title": "Subject",
@@ -481,16 +479,12 @@
           "vervolgSchriftelijkeVraag": {
             "title": "Follow-up written question",
             "type": "string",
-            "format": "uuid",
-            "$ref": "SchriftelijkeVraag",
-            "description": "Optional reference to a follow-up SchriftelijkeVraag (fractievoorzitter-fractie-koppeling) created from a niet-behandeld or beantwoord oral question. Its answering workflow stays in that change (REQ-VRI-006)."
+            "description": "Optional reference to a follow-up SchriftelijkeVraag (fractievoorzitter-fractie-koppeling) created from a niet-behandeld or beantwoord oral question. Its answering workflow stays in that change (REQ-VRI-006). Declared as a PLAIN STRING — see the note on MondelingeVraag.fractie: the SchriftelijkeVraag schema does not exist in this register yet. Restore format:uuid + $ref in the commit that introduces it."
           },
           "bronSchriftelijkeVraag": {
             "title": "Source written question",
             "type": "string",
-            "format": "uuid",
-            "$ref": "SchriftelijkeVraag",
-            "description": "Optional reference to the SchriftelijkeVraag this oral question escalates from (fractievoorzitter-fractie-koppeling). Set on written → oral escalation; when the oral question reaches beantwoord, OralQuestionService sets the linked SV to 'vervallen-door-mondelinge-beantwoording' via a PUT-semantic save carrying all other SV fields forward (design D6, REQ-VRI-006). No field mirroring or shared lifecycle."
+            "description": "Declared as a PLAIN STRING — see the note on MondelingeVraag.fractie: the SchriftelijkeVraag schema does not exist in this register yet. Restore format:uuid + $ref in the commit that introduces it. Optional reference to the SchriftelijkeVraag this oral question escalates from (fractievoorzitter-fractie-koppeling). Set on written → oral escalation; when the oral question reaches beantwoord, OralQuestionService sets the linked SV to 'vervallen-door-mondelinge-beantwoording' via a PUT-semantic save carrying all other SV fields forward (design D6, REQ-VRI-006). No field mirroring or shared lifecycle."
           }
         }
       },
@@ -701,9 +695,7 @@
           "fractie": {
             "title": "Fraction",
             "type": "string",
-            "format": "uuid",
-            "$ref": "Fractie",
-            "description": "Reference to the requester's Fractie (fractievoorzitter-fractie-koppeling — hard depends_on). Required. Seeded as a nil-UUID placeholder until that change lands (design D6)."
+            "description": "Reference to the requester's Fractie (fractievoorzitter-fractie-koppeling — hard depends_on). Required. Seeded as a nil-UUID placeholder until that change lands (design D6). Declared as a PLAIN STRING — see the note on MondelingeVraag.fractie: the Fractie schema does not exist in this register yet. Restore format:uuid + $ref: Fractie in the commit that introduces it."
           },
           "onderwerp": {
             "title": "Subject",