fix(headers): correct email + add SPDX + @spec example

[rubenvdlinde]

Summary

• Fix @author email typo: dev@conductio.nl → info@conduction.nl across 9 template PHP files
• Add SPDX-FileCopyrightText + SPDX-License-Identifier after the main docblock, consistent placement across all files (previously some had // SPDX-License-Identifier before the docblock, most had nothing)
• Bump @copyright year: 2024 → 2026
• Add file-level @spec openspec/changes/{change-name}/tasks.md#task-N example in Application.php with explanation comment — ADR-003 mandates this for every class and public method, and having the example in the template is what propagates the convention to new app scaffolds

Why this matters

This template is copied into every Conduction app at scaffold time, which means the dev@conductio.nl typo has propagated into 988 occurrences across 927 files org-wide. Fixing it here is the root-cause fix; the downstream sweep follows.

Similarly, @spec coverage is currently near-zero outside decidesk because the template never shows builders what the tag looks like.

Test plan

• composer install + ./vendor/bin/phpcs clean on template
• Scaffold a new app from this template and verify generated headers are correct

[rubenvdlinde]

ADR audit follow-up — PR #20

Did a full audit of this template against every MUST/SHALL/REQUIRED rule in the 17 org-wide ADRs. Findings + minimal fixes are in #20 (stacked on top of this branch).

Snapshot of the gaps found:

Gap	ADR	Status
No seed data in app_template_register.json	ADR-001	fixed — 3 @self objects added
MetricsController missing (route declared, 500 on call)	ADR-006	fixed — new controller with {app}_health_status + {app}_info
HealthController missing (route declared, 500 on call)	ADR-006	fixed — new public JSON controller
No CORS OPTIONS on public endpoints	ADR-002	fixed on /api/health
SettingsService::loadConfiguration returns $e->getMessage() to client	ADR-005	fixed — static generic message, real error logged
SettingsController never try/catches	ADR-005	fixed
Raw fetch() in settings store	ADR-004	fixed — @nextcloud/axios
5 Vue files import directly from @nextcloud/vue	ADR-004	fixed — all via @conduction/nextcloud-vue
window.confirm() in ItemDetail.vue	ADR-004	fixed — NcDialog
Deep link URL uses hash format	ADR-004	fixed — path format
@spec only on Application.php	ADR-003	fixed — file + method level on every class in lib/
No error-path unit test	ADR-008	fixed — testIndexReturnsGenericErrorOnServiceException

Full table (56 rules, 13 fixed, 5 partial with documented exceptions, 6 N/A): docs/adr-audit.md in #20.

Follow-ups flagged but not fixed (to keep this diff scoped): @license → @licence sweep (ADR-014 says UK spelling but PHPCS defaults to US), private readonly on DI constructors, SettingsServiceTest (≥3 methods per ADR-008), first domain-mutation endpoint with per-object auth check (ADR-005), pagination example with _page/_limit/total response shape (ADR-002).

[github-actions]

Quality Report — ConductionNL/nextcloud-app-template @ 9933e0d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
composer			✅	✅ 100/100
npm			❌	❌
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-04-20 06:32 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Superseded by #61. This branch predated the manifest-renderer refactor (hydra ADR-024) and could not be merged without reverting it (it would re-add the deleted Dashboard.vue/ItemDetail.vue/old store modules and revert webpack). The unique intent — fixing the dev@conductio.nl → info@conduction.nl typo across all 10 template PHP files, bumping @copyright to 2026, adding SPDX tags inside the docblock, and the file-level @spec example in Application.php — has been reapplied verbatim on current development in #61. No work lost.