THROWAWAY: bundle truncation control for the E2E floor — DO NOT MERGE

[rubenvdlinde]

Do not merge. Do not approve. This branch exists to be measured, then deleted.

What it does

Adds an npm postbuild script that truncates every js/*.js to zero bytes in place, immediately after webpack writes them.

Truncation, not deletion, on purpose: a delete-based control is defeated by an existsSync-guarded rebuild — that is how one repo in this fleet scored 82/82 green with the bundle "deleted". Truncating leaves the file present, so any existence check still passes and the file is genuinely empty.

What it is measuring

openregister's E2E gate is a deliberate 6-test floor (playwright-test-path: tests/e2e/ci, 3 spec files) against 61 spec files in the repo. It goes green in about 4 minutes.

Fast and small is not the same as hollow — but it is consistent with hollow, and the two are indistinguishable from the outside. This run settles it:

• E2E goes red → the floor genuinely drives the mounted SPA. The green is real, and growing the floor is the right next move.
• E2E stays green → the 6 tests pass without the application's JavaScript ever loading. The floor proves nothing and must be replaced, not extended.

Note that an empty bundle produces no 404 anywhere: Nextcloud serves its HTML error page as HTTP 200 text/html, so no status-code check in the pipeline can see this. Only the specs can.

[github-actions]

Quality Report — ConductionNL/openregister @ 1e8b873

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 173/173
npm			✅	✅ 713/713
PHPUnit					✅
Newman					✅
Playwright					❌

---

Quality workflow — 2026-08-04 05:17 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Result: the floor is genuine. 7 failed / 4 passed (8.2 min) vs an all-green 3m57s baseline.

The control actually fired

> openregister@1.0.0 postbuild
TRUNCATION CONTROL: emptied 50 bundle(s) in js/ IN PLACE     ← Frontend Build job
Restored 52 file(s) from the frontend-build artifact          ← E2E job

The E2E job took the bundle from the frontend-build artifact, so the emptied files are what the specs actually ran against. Worth stating explicitly, because a control that silently did not apply is indistinguishable from a suite that ignores the bundle — and truncating (not deleting) is what stops an existsSync-guarded rebuild from quietly restoring it.

It discriminates — which is the real evidence

This is stronger than a blanket red would have been. The split falls exactly on whether a test needs the mounted SPA:

Failed — every browser-driven test (each burning ~35 s on selector timeouts):

• smoke-boot.spec.ts › boot smoke: app root mounts
• smoke-boot.spec.ts › boot smoke: registers mounts
• object-shares-tab.spec.ts › the Shares tab, driven through the browser › the tab renders the live access surface, not an empty panel
• …› clicking Private in the UI hides the object from another user
• …› granting in the UI restores access, and revoking in the UI removes it
• …› granting to a GROUP in the UI reaches a member of that group
• …› a link created in the UI resolves with no credentials, and dies when revoked

Passed — every API-only test, correctly unaffected (442 ms – 2.4 s):

• object-sharing.spec.ts › object sharing over HTTP › an owner can make their own object private…
• …› inviting a user restores their access, and revoking removes it again
• …› a share link resolves anonymously, and stops when revoked
• …› a non-owner cannot change the scope of somebody else's object

If the floor were hollow, emptying the bundle would have changed nothing. Instead it killed precisely the tests that drive the UI and spared precisely the tests that only speak HTTP.

Conclusion

openregister's E2E green is real. The tests/e2e/ci floor genuinely exercises the mounted application, and it additionally carries four API-level assertions that legitimately do not depend on the bundle. Growing the floor is a sound next step; replacing it is not needed.

For the record, a truncated bundle produced no 404 anywhere — Nextcloud serves its HTML error page as HTTP 200 text/html, so nothing else in the pipeline noticed. Only the specs did.

Closing — this branch existed to be measured, and it has been. The branch is left in place (not deleted) if anyone wants to inspect the run.