feat(store): give decidiq a store that exchanges governance configuration

[rubenvdlinde]

Draft: blocked on a release. check:manifest validates against the schema shipped in @conduction/nextcloud-vue, and the store.types key lands in ConductionNL/nextcloud-vue#976. This turns green once that merges and releases. The engine behind it is ConductionNL/openregister#3386.

Why

Decidiq is six of seven on the ADR-114 bottom-left chrome. Documentation, Reports, Features & roadmap and Flows are all there, plus the two settings entries CnAppNav prepends. Only Store is missing, and dossiq has all seven.

What the store offers

Not rows. A configuration set: the registers, schemas, objects, views, flows, sources and mappings that make one way of governing work together. A council with its committees and factions, an association with its members' meeting, the flows that move a decision through them.

types selects that path. An app that declares none keeps the remote objects API, and decidiq never had one.

The catalogue was already written

The four example sets in lib/Settings/profiles/ are named as built-in items:

set	what it is
Municipality	A council with committees and factions. Motions, commitments, information letters and a regulations register.
Association or VvE	A members' meeting with a board. House rules, weighted votes, audit statements and annual accounts.
Company board	A supervisory board, an executive board and a management team. Terms, conflicts of interest and evaluations.
Works council	A works council inside a company. Advice requests, consent requests and staff consultation.

SeedProfileService already imports one on request. They were configuration sets with a different file extension. Naming them here means the store states what decidiq ships instead of rendering blank when no registry is configured.

One decision to veto

No installable allowlist. A set exists to introduce schemas the instance does not have yet, so a list of schemas decidiq already owns would refuse exactly the sets worth installing. The trust boundary for a bundle is its publisher, enforced by the engine's source allowlist and trusted-key check.

Diff

53 added lines in src/manifest.json, nothing removed: the store block, one page, one menu entry at footer 92. Plus the @conduction/nextcloud-vue bump, which decidiq needs anyway since CnStorePage does not exist in the 2.34 it pins today.

[github-actions]

Quality Report — ConductionNL/decidiq @ a5beef5

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		❌
check-nav-ceiling		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 104/104
npm			✅	✅ 537/537
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					❌

---

Quality workflow — 2026-09-03 19:41 UTC

Download the full PDF report from the workflow artifacts.