retrofit: reverse-spec openregister-app-manifest partial (5 REQs / 9 methods, 100 deferred)

[rubenvdlinde]

Summary

Reverse-engineer the PHP backend half of the openregister-app-manifest capability into 5 cohesive requirements (MAN-012..MAN-016) and annotate the 9 in-scope methods. No behaviour change — this is a Bucket 2a retrofit per ADR-008.

The existing capability spec (MAN-001..MAN-011 from openregister-adopt-app-manifest) covers Vue-side adoption only and explicitly defers the backend /api/manifest endpoint in MAN-009. That endpoint subsequently shipped under an orphan @spec reference (openspec/changes/manifest-user-context/tasks.md does not exist on disk). This retrofit folds the shipped behaviour into the canonical capability spec.

What's added

• REQ-OR-MAN-012 — /api/manifest/{appId} endpoint contract (status codes, app-id validation, failure modes)
• REQ-OR-MAN-013 — Enrichment no-op without currentUserSchema; anonymous request returns runtime.user = null
• REQ-OR-MAN-014 — Schema-slug validation (length ≤ 128, charset [A-Za-z0-9_-], fail-closed)
• REQ-OR-MAN-015 — Profile resolution by ncUserId filter with RBAC + multitenancy preserved
• REQ-OR-MAN-016 — runtime.user populated from explicit allowlist + non-materialised calculations (never raw payload merge)

Annotated methods (9)

• lib/Controller/ManifestController.php — index, loadBundledManifest
• lib/Service/ManifestService.php — getEnrichedManifest, resolveUserProfile, buildUserContext, getCalculations, resolveAllowedFieldNames, loadFieldAllowlist, serialise

Deferred (100)

The batch JSON listed 109 methods across 45 files. After triage, only ~8% (9 methods) are genuinely in scope for openregister-app-manifest. The rest are FPs from token overlap on Register* / Schema* / *Manifest* substrings — Registers/Schemas CRUD, schema cache handlers, GraphQL generation, Vue components. All 100 are enumerated in tasks.md §3 as future-pass:next so a downstream coverage-scan can recluster them into the right capability buckets.

Notes

• MAN-009 drift. The pre-existing MAN-009 says the backend endpoint is "deferred". That deferral was historically accurate but the endpoint subsequently shipped. MAN-012 supersedes it. A separate cleanup pass can soften the MAN-009 language without changing behaviour.
• Orphan class-level @spec tags (pointing at the non-existent manifest-user-context change) are left in place at the class docblock layer pending a separate cleanup pass; per-method @spec tags are the canonical reference going forward.
• No drifts detected.

Test plan

• Spec validates with openspec validate retrofit-2026-05-24-openregister-app-manifest --strict
• No behaviour change; existing tests still pass
• Reviewer confirms the 5 REQs match observed code and the 100-method deferral list is complete

[github-actions]

Quality Report — ConductionNL/openregister @ 1e5b103

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
composer			✅	✅ 162/162
npm			✅	✅ 532/532
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-05-24 19:11 UTC

Download the full PDF report from the workflow artifacts.