Lint debt cleanup post-canonical-sync (Phase 2 fleet rollout)

[rubenvdlinde]

Context

OpenBuilt synced to the fleetwide canonical root configs (nextcloud-app-template). The directive is no per-app validation rules — exceptions are fleetwide or they don't exist. The canonical phpcs.xml and phpstan.neon now exclude lib/Resources/template/* (the verbatim template snapshot, which OpenBuilt itself drove); phpmd.xml and psalm.xml do not, so debt inside that snapshot is captured here too.

This issue captures the per-app code-level debt that the canonical sync unmasked.

phpstan errors (2, baselined)

Captured in phpstan-baseline.neon so CI stays green; fix and remove from baseline:

• lib/Repair/MigrateToVersionedModel.php:56 — VERSIONED_SCHEMA constant is unused. Drop, or wire into the repair step.
• lib/Service/IconService.php:93 — Access to static property $SERVERROOT on an unknown class OC. Use \OC::$SERVERROOT via an injected constant or refactor to dependency injection.

psalm errors (20)

UndefinedClass against OR types (11) — psalm cannot resolve OR classes referenced in @param annotations even though they exist at runtime (OR's Composer autoload is not visible to psalm here):

• lib/Controller/ApplicationsController.php:87, 702, 1190, 1241, 1299 — OCA\OpenRegister\Db\AuditTrailMapper / OCA\OpenRegister\Db\Register.
• lib/Service/ApplicationInsightsService.php:111, 684, 773 — OCA\OpenRegister\Db\AuditTrailMapper.
• lib/Service/ApplicationVersionService.php:717 — OCA\OpenRegister\Db\Register.
• lib/Resources/template/phpcs-custom-sniffs/CustomSniffs/Sniffs/Functions/NamedParametersSniff.php:36 — PHP_CodeSniffer\Sniffs\Sniff.
• lib/Resources/template/tests/bootstrap.php:35 — OC_App (legacy Nextcloud).

MissingFile (6) — all in the verbatim template snapshot, where vendor/ is intentionally not vendored:

• lib/Resources/template/phpstan-bootstrap.php:17 — vendor/autoload.php.
• lib/Resources/template/tests/bootstrap-unit.php:23, 28 — vendor/autoload.php and lib/base.php.
• lib/Resources/template/tests/bootstrap.php:23, 28, 32 — vendor/autoload.php, lib/base.php, tests/autoload.php.

UndefinedMethod / UndefinedFunction (3) — also in the template snapshot:

• lib/Resources/template/tests/unit/Controller/SettingsControllerTest.php:121, 147 — stdClass::offsetGet (mock not strictly typed).
• lib/Resources/template/templates/settings/admin.php:22 — function p (Nextcloud template helper).

The template-snapshot psalm noise is a fleet-level question (psalm scope vs phpstan scope); resolve by adding lib/Resources/template to canonical psalm.xml ignoreFiles.

phpmd violations (37 architectural — out of scope for canonical sync)

Architectural smells that the canonical phpmd rules surface. Each requires real refactor — separate from canonical sync per fleet directive.

ExcessiveClassComplexity (9):

• lib/Controller/ApplicationVersionsController.php:61 — complexity 66 (threshold 50).
• lib/Controller/ApplicationsController.php:62 — complexity 131.
• lib/Mcp/OpenBuiltToolProvider.php:56 — complexity 136.
• lib/Service/ApplicationCreationService.php:62 — complexity 82.
• lib/Service/ApplicationInsightsService.php:63 — complexity 100.
• lib/Service/ApplicationVersionService.php:60 — complexity 65.
• lib/Service/ManifestResolverService.php:54 — complexity 63.
• lib/Service/VersionPromotionService.php:59 — complexity 80.
• lib/Resources/template/phpcs-custom-sniffs/CustomSniffs/Sniffs/Functions/NamedParametersSniff.php:36 — complexity 65 (in template snapshot).

CyclomaticComplexity + NPathComplexity (8 method pairs):

• lib/Mcp/OpenBuiltToolProvider.php:454 (handlePromoteVersion), :526 (handleUpsertSchema), :644 (handleUpsertPage), :751 (handleAddWidget), :842 (handleUpsertMenuItem).
• lib/Service/ApplicationCreationService.php:125 (createApplication), :844 (substituteVersionContext).
• lib/Resources/template/phpcs-custom-sniffs/CustomSniffs/Sniffs/Functions/NamedParametersSniff.php:327 (hasUnnamedArguments).

ExcessiveMethodLength (2):

• lib/Mcp/OpenBuiltToolProvider.php:526 — handleUpsertSchema 110 lines.
• lib/Service/ApplicationCreationService.php:125 — createApplication 281 lines.

ExcessiveClassLength (2):

• lib/Controller/ApplicationsController.php:62 — 1387 lines.
• lib/Mcp/OpenBuiltToolProvider.php:56 — 1158 lines.

CouplingBetweenObjects (3):

• lib/Controller/ApplicationVersionsController.php:61 — 14 deps.
• lib/Controller/ApplicationsController.php:62 — 19 deps.
• lib/Controller/VersionPromotionController.php:58 — 16 deps.

TooManyMethods (1):

• lib/Controller/ApplicationsController.php:62 — 27 non-getter methods.

BooleanArgumentFlag (1):

• lib/Resources/template/lib/Service/SettingsService.php:131 — loadConfiguration(...bool $force). In template snapshot.

Naming (3):

• lib/Service/ApplicationCreationService.php:357 — LongVariable $applicationFullPayload.
• lib/Resources/template/phpcs-custom-sniffs/CustomSniffs/Sniffs/Functions/NamedParametersSniff.php:259, 294 — ShortVariable $j (in template snapshot).

Done in the sync PR

• ✅ 13 mechanical phpmd violations fixed (11 ElseExpression refactored to two-if pattern; 2 unused $preset locals dropped).
• ✅ Canonical phpcs.xml / phpmd.xml / psalm.xml / phpstan.neon / phpstan-bootstrap.php / phpstan-baseline.neon adopted.
• ✅ Cosmetic naming restored (AppTemplate → OpenBuilt in phpcs.xml and phpmd.xml).
• ✅ Custom sniffs SpecTagSniff + NoLegacyServerAccessorsSniff pulled in from canonical.

Drives the Phase 2 fleet rollout of the root-config consolidation.