feat(signing): migrate the signing bridge onto OR task sequences

[rubenvdlinde]

Why

openregister#3302 (flow-approval-consolidation) removes the approval-chain surface with no alias. That covers the four ApprovalStep events, the ApprovalChain and ApprovalStep entities and mappers, ApprovalService, and the approval HTTP routes. filinq is the only consumer. Without this change the signing bridge dies the moment #3302 deploys.

This PR must merge in the same train as openregister#3302. Neither side ships alone: the retired classes disappear there, the replacements are consumed here.

What changed

Openspec change: migrate-signing-to-or-tasks (proposal, design, spec delta and tasks included).

Every touchpoint, old to new:

Retired	Replacement
registerEventListener(ApprovalStep*Event::class, …) x4 in SigningEventRegistrar	one SigningTaskListener on TaskTransitionedEvent, TaskTerminalEvent and TaskSequenceCompletedEvent, registered by FQN string literal
ApprovalStepListener (chain slug filter, typed OR event handling)	SigningTaskListener: class-string routing, duck-typed reads, ownership by resolving the anchor object in the configured signingRequest register/schema
ApprovalStepInitiatedEvent consumption	committed TaskTransitionedEvent with state enabled
ApprovalStepApprovedEvent / ApprovalStepRejectedEvent	committed TaskTerminalEvent, state completed, split on the rejecting outcome vocabulary
ApprovalStepCompletedEvent	TaskSequenceCompletedEvent
Signer*Event payloads carrying ApprovalChain/ApprovalStep types	scalars only: sequence uuid, task uuid, position, actor, comment, object uuid
docblock and register-JSON references to ApprovalService::approveStep/rejectStep	TaskService::complete() with an approving or rejecting outcome

No compatibility shim. The app loads with OpenRegister older, newer or absent. It follows the dossiq dual-namespace pattern, adapted to filinq's bootstrap-order rule: string literals and no class_exists() at register() time.

Boot proof

tests/scripts/boot-without-openregister.php runs in a separate process. Its autoloader serves filinq's lib/ and the Nextcloud stubs only, no OpenRegister stub. It asserts all ten retired classes are unresolvable, force-links every signing-surface class, and runs SigningEventRegistrar::register(). RetiredApprovalSurfaceTest execs it and also sweeps lib/ and both register JSONs for every retired FQCN and route. Zero references remain.

Checks

• PHPUnit: 1755 tests, 0 failures (3 pre-existing environment skips)
• phpcs: 0 errors on the diff
• PHPMD (both rulesets, per subdirectory): clean
• Psalm: 0 errors. PHPStan: 0 errors
• hydra gates --scope-to-diff --base origin/development: 38 of 38 applicable gates, 0 FAIL
• Manual mutation check on the ownership filter: 13 mutants, all killed
• No JS or TS touched, so eslint and prettier were not in scope

Notes for the reviewer

• filinq ships no x-openregister-approval-chains declaration, so there was no declarative block to migrate. Verified against both register JSONs.
• The reply path (TaskService::complete()) has no live filinq call site. The archived change deferred the write-path rewrite (D1.x) and SigningService still drives the bespoke object rows. The spec delta pins the future rewrite to the task verbs so nobody rebuilds it against the retired names.
• gate-53 fails under the pinned hydra-gates v1.10.0 because its schema predates the flow page type. CI and the current .github checkout pass it. Pre-existing, manifest untouched here.
• The commit is authored as the release bot. The repo clone carried that as local git config and the guard hooks block a rewrite of the pushed branch. If sole authorship matters for the merge, rebase with --reset-author before squashing.

[rubenvdlinde]

Superseded by #988: identical tree, corrected authorship (the branch commits carried a stale bot identity and force-rewrites are guard-blocked).

[github-actions]

Quality Report — ConductionNL/filinq @ ae4313d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
test		✅
test-unit		✅
check-manifest		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 118/118
npm			✅	✅ 631/631
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-09-01 20:23 UTC

Download the full PDF report from the workflow artifacts.