Implement: openbuilt-application-register Specification

[rubenvdlinde]

Spec

See openspec/changes/openbuilt-application-register/ on branch spec/openbuilt-application-register.

Hydra build expectations

Manifest-first per ADR-022/024/031:

• Schema declarations in lib/Settings/openbuilt_register.json (or equivalent)
• src/manifest.json updates for any new pages/widgets
• Tests for any net-new behaviour
• Minimal-to-zero new PHP service classes (domain logic in x-openregister-lifecycle rules)
• Consume from OpenRegister (RBAC, workflow, audit, approval) — do not reimplement

Read before building

• openspec/changes/openbuilt-application-register/proposal.md — motivation + scope
• openspec/changes/openbuilt-application-register/design.md — design decisions
• openspec/changes/openbuilt-application-register/tasks.md — implementation tasks

Spec preview

---
kind: mixed
depends_on: []
---

## Why

The `openbuilt-application-register` capability — the two foundational OpenRegister schemas
(`Application` and `BuiltAppRoute`) that underpin every virtual app in the OpenBuilt stack —
has been modified across four successive chain specs: `bootstrap-openbuilt` (spec #1)
introduced the original schemas and declarative lifecycle; `openbuilt-versioning` added a
`currentVersion` field and a snapshot-on-publish writeback action; `openbuilt-rbac` added the
`permissions` block and a permissions-population migration; and `openbuilt-versioning-model`
retired `currentVersion`, `manifest`, `version`, and `status` from `Application` in favour of
the two-object versioned model (ADR-002). All four specs are now archived.

This spec is the **authoritative, current-state specification** of the
`openbuilt-application-register` capability. It consolidates every prior modification into a
single coherent register declaration, resolves a requirement-numbering collision (two competing
`REQ-OBA-006` / `REQ-OBA-007` entries that accumulated in the context-brief — the
`currentVersion` and snapshot entries are formally retired per ADR-002), and ships the
permissions-population migration that the `openbuilt-rbac` chain spec defined but whose
implementation status requires verification. It also provides the seed data, declarative
decisions, and test coverage that this capability's spec has been missing since the chain began.

## What Changes

- **`Application` schema** (`lib/Settings/openbuilt_register.json`) reaches its
  ADR-002-aligned current shape: `uuid`, `slug` (kebab-case, required), `name`
  (required), `description` (optional), `permissions` (optional object with
  `owners`, `editors`, `viewers` arrays of Nextcloud group IDs), and `productionVersion`
  (optional relation → `ApplicationVersion`). The properties `manifest`, `version`,
  `status`, and `currentVersion` are **absent** — they moved to `ApplicationVersion` per
  ADR-002. The Application schema's `x-openregister-lifecycle` block carries **no**
  `states` or `transitions` (lifecycle is per-version now); it may retain cross-row
  integrity guards only.

- **`BuiltAppRoute` schema** (`lib/Settings/openbuilt_register.json`) retains its original
  shape: `slug` (kebab-case, required, unique per organisation) and `applicationUuid`
  (UUID-format, required). Its maintenance — the upsert on publish and removal on archive
  — is driven by `ApplicationVersion.x-openregister-lifecycle`, not `Application`'s, per
  the relocation confirmed in `openbuilt-versioning-model`.

- **`permissions` property** on the `Application` schema is formally declared with
  `additionalProperties: false` and three optional `string[]` arrays (`owners`, `editors`,
  `viewers`). Default on creation: caller's primary Nextcloud group → `owners`; `editors`
  and `viewers` empty. The declaration is schema-declarative per ADR-031 — no
  `AuthorizationService` or `PermissionsService` PHP class.

- **`PopulateApplicationPermissions` repair step**