fix(gate-28): license-triangle reported PASS on repos with no lib/, having opened zero files

[rubenvdlinde]

The defect

_pass 28 was called unconditionally, after a comparison that only runs inside:

if [ -n "${_composer_lic}" ] && [ -d lib ]; then

So a repo with no lib/ printed

[gate-28] license-triangle: PASS

having opened zero files — and the coverage accounting counted it as a gate that reported a result. A PASS and a no-op were byte-identical in the output. That is the falsely-GREEN shape the coverage block exists to make impossible, appearing inside the thing meant to detect it.

Not hypothetical. Four Python ExApp sidecars in the fleet — valtimo, openklant, opentalk, openzaak — have no lib/ at all (their application is a single ex_app/lib/main.py; the only PHP is phpcs-custom-sniffs/). All four report gate-28 PASS on a --full scan of their entire tree.

The fix

Count the files actually compared, and route on that. The na / structural vocabulary already exists — this gate just wasn't using it.

condition	before	after
a file's @license ∉ composer.json's set	FAIL	FAIL (untouched)
≥ 1 file really compared, all agree	PASS	PASS (untouched)
no lib/ at all	PASS	NOT APPLICABLE
lib/ exists, composer.json declares no license	PASS	SKIPPED (structural)
lib/ exists, 0 in-scope file carried an @license tag	PASS	SKIPPED (structural)

Three controls — measured, not asserted

A — no lib/ (valtimo, --full):

was:  [gate-28] license-triangle: PASS
now:  [gate-28] license-triangle: NOT APPLICABLE — this repo has no lib/ directory, so there
      are no per-file @license PHPDoc tags for composer.json's license to be compared
      against. Nothing was inspected and nothing could be. ...

COVERAGE: 29 of 63  ->  28 of 63 reported (30 not applicable; 28 of 33 applicable gates ran)

B — lib/ present, licences agree (openbuild, --full): PASS → PASS, COVERAGE: 61 of 63. Unchanged.

C — lib/ present, one file drifting (fixture: composer.json EUPL-1.2, one file @license AGPL-3.0-or-later):

old script:  [gate-28] license-triangle: FAIL — 1 file(s) with @license != composer.json
new script:  [gate-28] license-triangle: FAIL — 1 file(s) with @license != composer.json

Control C was run against both the old and the new script on the same fixture, deliberately: it shows this removes a false green without weakening the real assertion. No waiver, no threshold change, no continue-on-error.

Also: the header comment oversold the gate

It described "the three locations a Conduction app declares its license", naming appinfo/info.xml — but the code never reads info.xml. It compares two locations: composer.json .license and per-file @license tags under lib/. The comment now says so, so nothing here can be read as a verdict on <licence>.

🔴 Related, and deliberately NOT resolved here

That same comment cites ADR-014, which says appinfo/info.xml MUST use <licence>agpl</licence> because "Nextcloud app store does not recognise EUPL".

That rationale is factually false. The live appstore schema — https://apps.nextcloud.com/schema/apps/info.xsd — enumerates EUPL-1.2 as an allowed <licence> value. (It does not enumerate eupl.)

And the fleet already contradicts the ADR: openregister, opencatalogi, openconnector, docudesk, nldesign, softwarecatalog, larpingapp, pipelinq, procest, openbuild, decidesk, portaliq — 12 of 12 checked declare EUPL-1.2.

Amending an ADR that six repos mirror and this gate cites is a decision, not a cleanup. Written up with the evidence in ConductionNL/openbuild#135; no ADR is touched by this PR.