chore(openspec): archive github-provider-code-search after the live harvest

[WilcoLouwerse]

What

Archives the OpenSpec change github-provider-code-search (#4233). Only task 2.4 was still open, the authenticated harvest against real GitHub, and it is now done.

The harvest ran on the WOO-585 test rig against real github.com, brokered through the github credential github-publiccode: 24 of 24 shards, 698 components on 2026-10-01 and 902 on 2026-10-13. Every brokered GET /search/code call went through the rule this change added. The credential holds Wilco's own GitHub token.

Changes

• tasks.md: 2.4 ticked, with the evidence on the line.
• The requirement "GitHub code search allow-rule" and its three scenarios are appended to openspec/specs/credential-broker/spec.md. One THEN is corrected in both copies: a refused call gets the static 403 Request not permitted; no allow-rule matches is the logged reason, never returned.
• The change moves to openspec/changes/archive/2026-10-15-github-provider-code-search/.
• The @spec tag in GithubCodeSearchRuleTest points at the main spec. Its anchor is unchanged.

No behaviour changes.

openspec validate credential-broker --type spec already fails on development, on requirements 2 and 3, which lack a SHALL or MUST. This PR adds no new error.

Part of the close-out of Jira WOO-585. The integriq counterpart is ConductionNL/integriq#2679.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openregister @ 3579fa6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			❌	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 26198/26198 · 25 skipped
Newman					✅ 714/714
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-15 10:44 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

Description updated to match 0ff6ac71e: the appended requirement is no longer "unchanged" — its refusal THEN now names the static 403 Request not permitted — and the token is named (Wilco's own GitHub token) instead of "not recorded".

[github-actions]

Quality Report — ConductionNL/openregister @ 6d47d3b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			❌	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 26198/26198 · 25 skipped
Newman					✅ 714/714
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-15 11:01 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

Verdict: APPROVE (Strict) — self-review posted as COMMENT (GitHub blocks self-APPROVE)

Both findings were fixed on the branch before posting, and an adversarial pre-push check on the fix found nothing; the archive move itself checks out. The only red required check, quality / Hydra Gates, fails on gate 4 composer-audit, which is red on development as well.

✅ Fixed before posting (2)

• Refusal scenario promised a response text the broker never returns — openspec/specs/credential-broker/spec.md:555. no allow-rule matches is the logged reason; the caller gets the static 403 Request not permitted (CredentialController.php:730). Fixed in 0ff6ac71e, in the main spec and the archived delta.
• Ticked task 2.4 still said "no token exists yet" — openspec/changes/archive/2026-10-15-github-provider-code-search/tasks.md:11. The line contradicted its own verification note; it now names the token the harvest used. Fixed in 0ff6ac71e.

✅ Verified clean

• The appended requirement block is byte-identical to the archived delta, after the fix as well.
• openspec validate credential-broker --type spec gives the same two errors (requirements 2 and 3, no SHALL/MUST) on development and on the head: no new error.
• Every request in the refusal scenario's WHEN falls through to deny() → 403; GET /search/code is the only code-search rule (credential-providers.json:235).
• The @spec tag in GithubCodeSearchRuleTest.php resolves to #requirement-github-code-search-allow-rule; no live reference to changes/github-provider-code-search remains.
• No delta header leaked into the main spec; the requirement name is unique.

Gates: CI quality / Hydra Gates ❌ on 0ff6ac7: 83 of 83 applicable gates ran, 1 failed — gate 4 composer-audit (Symfony advisories). Pre-existing: the same check and quality / Security (composer) are red on development; this PR touches no composer files.
Persistence audit: run on the head; no vector introduced by this PR. Its two diff-authored points are the two fixed findings above. Pre-existing broker observations (raw vs normalised path in rule matching, no log line for successful brokered calls, no credential expiry/owner inventory) are outside this archive and not filed here.
Jira context: WOO-585 — Als Gemeente Rotterdam wil ik dat OpenCatalogi GitHub uitleest (publiccode.yml-harvest via integriq) (status: Beoordelen)

[github-actions]

Quality Report — ConductionNL/openregister @ 41d91e7

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 26198/26198 · 25 skipped
Newman					✅ 714/714
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-15 11:58 UTC

Download the full PDF report from the workflow artifacts.