Release: merge beta into main

.coverage-baseline

@@ -0,0 +1 @@
+49.47

.editorconfig

@@ -0,0 +1,36 @@
+# https://editorconfig.org
+
+# SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = tab
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size = 2
+indent_style = space
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.svg]
+insert_final_newline = false
+
+[package*.json]
+indent_size = 2
+indent_style = space
+
+[build/psalm-baseline.xml]
+indent_size = 2
+indent_style = space
+
+[config/*config.php]
+indent_size = 2
+indent_style = space

.git-blame-ignore-revs

@@ -1,2 +1,16 @@
-# Retrofit annotation commit (opsx-annotate, 2026-05-24)
-21a8c1f6ecf3a3b2346ed631bb469a8cd3b65e01
+# Revisions to skip in `git blame`.
+#
+# Enable locally, once:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# GitHub reads this file automatically. Your terminal does not, until you run
+# the line above.
+#
+# Only ever add commits that change formatting and NOTHING else. A commit listed
+# here becomes invisible to blame, so a behaviour change hidden inside one would
+# be very hard to find later.
+
+# style: reformat with nextcloud/coding-standard — whitespace only
+# The fleet-wide move from a PEAR-derived PHPCS ruleset (4 spaces, next-line
+# braces) to Nextcloud's own standard (tabs, same-line braces).
+46e028e7046485d8e28cbc3bc786b7d577c83f51

.githooks/pre-commit

@@ -0,0 +1,38 @@
+#!/bin/sh
+# Committed pre-commit hook (activated via `git config core.hooksPath .githooks`,
+# which `npm install` / `composer install` set automatically — see package.json
+# "prepare" and composer.json "post-install-cmd").
+#
+# Regenerates docs/features.json whenever staged changes touch openspec/specs/
+# or the features overlay, so the commercial capability list can never go
+# stale. CI (features-check / features-extract) only VERIFIES — generation
+# happens here, before the commit, never in the pipeline.
+#
+# Best-effort by design: any failure only warns and never blocks the commit —
+# the CI gate is the enforcement backstop.
+
+if git diff --cached --name-only | grep -qE "^openspec/(specs/|features\.overlay\.json)"; then
+  CACHE=".git/extract-features.py"
+  # Fetch the canonical script (single source of truth in ConductionNL/.github);
+  # fall back to a previously cached copy when offline.
+  curl -sf --max-time 10 \
+    https://raw.githubusercontent.com/ConductionNL/.github/main/scripts/extract-features.py \
+    -o "$CACHE" 2>/dev/null || true
+
+  if [ -f "$CACHE" ]; then
+    if command -v python3 >/dev/null 2>&1; then PY="python3";
+    elif command -v py >/dev/null 2>&1; then PY="py -3";
+    else PY="python"; fi
+
+    if $PY "$CACHE" --app-root . >/dev/null 2>&1; then
+      git add docs/features.json
+      echo "pre-commit: docs/features.json regenerated from openspec/specs/."
+    else
+      echo "pre-commit: WARNING — could not regenerate docs/features.json (python or pyyaml missing?). CI features-check will verify." >&2
+    fi
+  else
+    echo "pre-commit: WARNING — could not fetch extract-features.py (offline?). CI features-check will verify." >&2
+  fi
+fi
+
+exit 0

.github/workflows/branch-protection.yml

@@ -2,10 +2,10 @@ name: Branch Protection
 
 on:
   pull_request:
-    branches:
-      - main
-      - beta
+    branches: [main, beta]
+
+permissions: {}
 
 jobs:
-  check:
+  branch-protection:
     uses: ConductionNL/.github/.github/workflows/branch-protection.yml@main