Audit: softwarecatalog done-spec semantic verification (2026-07-16)
Part of the fleet done-spec semantic audit (six defect shapes). softwarecatalog was audited across all 38 archived/done changes. Bottom line: healthy. Mechanical gates (orphaned-write-capability, register-handler-resolution) clean; no fabricated passes, no phantom handler refs, no inert x-openregister declarations detected. Two non-critical vestigial orphaned-write capabilities found (dead code, NOT live holes — underlying capability reachable via other wired paths):
-
SoftwareCatalogueService::createUserForContactIfNotExists() (lib/Service/SoftwareCatalogueService.php:850) — no-op stub (only logs, creates no user), zero production callers. The real contact->user path runs through ContactpersoonService::processContactpersoon() via SoftwareCatalogEventListener. SoftwareCatalogEventListenerTest mocks this method but the production listener never calls it (test-fake drift). Recommend: remove the stub + its test expectations, or implement+wire if user-provisioning-from-contact is still desired.
-
FederationService::publishEntryForFederation() (lib/Service/Federation/FederationService.php:240) — orphaned delegation wrapper over PublicationService::publish(). Zero production callers; the background FederationSyncJob calls announce()/pullAllPeers(), not this. The underlying publish IS live via PublicationController::publish. tasks.md (2026-06-14-federated-catalog-sync 2.2/2.3) honestly ticks only the delegation method + its unit test — it never claimed a caller. Recommend: wire it into the announce path, or drop the wrapper.
Neither is a security/money/data-integrity hole, so filed rather than force-fixed. Coverage caveat: verification was code-path + gate based (grep callers, indirect-seam proof, supersession check), not full live UI exercise of every one of the 38 changes.
Gemigreerd van Codeberg — oorspronkelijk Conduction/softwarecatalog#94, geopend door rubenvdlinde op 2026-07-16.
Audit: softwarecatalog done-spec semantic verification (2026-07-16)
Part of the fleet done-spec semantic audit (six defect shapes). softwarecatalog was audited across all 38 archived/done changes. Bottom line: healthy. Mechanical gates (orphaned-write-capability, register-handler-resolution) clean; no fabricated passes, no phantom handler refs, no inert x-openregister declarations detected. Two non-critical vestigial orphaned-write capabilities found (dead code, NOT live holes — underlying capability reachable via other wired paths):
SoftwareCatalogueService::createUserForContactIfNotExists()(lib/Service/SoftwareCatalogueService.php:850) — no-op stub (only logs, creates no user), zero production callers. The real contact->user path runs throughContactpersoonService::processContactpersoon()viaSoftwareCatalogEventListener.SoftwareCatalogEventListenerTestmocks this method but the production listener never calls it (test-fake drift). Recommend: remove the stub + its test expectations, or implement+wire if user-provisioning-from-contact is still desired.FederationService::publishEntryForFederation()(lib/Service/Federation/FederationService.php:240) — orphaned delegation wrapper overPublicationService::publish(). Zero production callers; the backgroundFederationSyncJobcallsannounce()/pullAllPeers(), not this. The underlying publish IS live viaPublicationController::publish. tasks.md (2026-06-14-federated-catalog-sync 2.2/2.3) honestly ticks only the delegation method + its unit test — it never claimed a caller. Recommend: wire it into the announce path, or drop the wrapper.Neither is a security/money/data-integrity hole, so filed rather than force-fixed. Coverage caveat: verification was code-path + gate based (grep callers, indirect-seam proof, supersession check), not full live UI exercise of every one of the 38 changes.
Gemigreerd van Codeberg — oorspronkelijk Conduction/softwarecatalog#94, geopend door
rubenvdlindeop 2026-07-16.