chore(license): normalise licence declarations to EUPL-1.2

[rubenvdlinde]

Brings every licence declaration in procest into agreement on EUPL-1.2 — the licence already declared by composer.json, package.json, appinfo/info.xml and LICENSE.

Changed (32 files)

Category	Count	Detail
SPDX-License-Identifier: AGPL-3.0-or-later → EUPL-1.2	30	all under tests/e2e/ — our own Playwright specs + helpers
prose licence claim AGPL → EUPL-1.2	2 files (3 lines)	project.md, docs/Technical/government-compliance.md
@license PHPDoc tags	0	lib/**.php was already 100% EUPL-1.2 (597/597)
metadata files	0	composer.json / package.json / appinfo/info.xml / LICENSE already EUPL-1.2

Every touched file carries our own copyright (SPDX-FileCopyrightText: 2026 Procest Contributors or Conduction B.V.). No @copyright / SPDX-FileCopyrightText line was altered — holders and years are untouched.

The two prose fixes are mandated by this repo's own canonical spec, openspec/specs/app-metadata-claims/spec.md: "THEN no free-text statement MUST claim the app is AGPL-licensed".

Deliberately NOT changed

• LICENSE line 177 — GNU Affero General Public License (AGPL) v. 3 is part of the EUPL's own compatible-licences appendix. It is the EUPL text itself.
• README.md line 284 — lists EUPL-compatible copyleft licences. Correct as written.
• license-report-composer/*, license-report-npm/* — generated dependency-licence reports. The AGPL rows are third-party packages (nextcloud/ocp, @nextcloud/vue, @nextcloud/files); the report already records procest itself as EUPL-1.2.
• composer.lock, package-lock.json — third-party dependency metadata.
• openspec/specs/app-metadata-claims/spec.md and the archived 2026-07-06-align-claims-and-licence change — the word AGPL appears there as the thing being prohibited. Changing it would invert the requirement.

Verification

	before	after
phpunit (PHP 8.5 container)	1692 tests, 5643→5659 assertions, 0 failures, exit 0	identical: 1692 / 5659 / 0, exit 0
vitest	32 files, 330 tests passed, exit 0	identical
gate-28 license-triangle	PASS	PASS

Host PHP is 8.2 and the repo pins php: ^8.3, so a host phpunit run exits 255 (VOID). Both runs above were done in a PHP 8.5 container, identically conditioned.

gate-28 was already passing for procest before this PR — the sweep worklist attributed 19 failing lib/Service/{File,Object}/*.php files to procest, but those files do not exist in this repo; they are openregister's (cross-repo attribution error in the worklist generator). procest's lib/ is 597/597 EUPL-1.2. gate-28's ability to fail was confirmed with a positive control (temporarily flipping one @license to AGPL made it report FAIL; reverted).

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/procest @ 0536c1f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-05 18:49 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/procest @ 0536c1f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-05 19:28 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/procest @ 1f49e8d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-05 20:08 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Held, not merged — blocked by a repo-wide gate-24 wiring failure, not by anything in this PR.

Hydra Gates is red here, but the failure is "a gate did not run", not "a gate found something":

[hydra-gates] GATES THAT DID NOT RUN: 24
[hydra-gates] RESULT: ALL GATES PASSED — EXCEPT GATES 24, WHICH DID NOT RUN.

hydra-gates-require-full-coverage is set on this repo, so a gate whose subject matter exists but which fails to report is a hard failure. That is the correct behaviour — a gate that did not run is not a gate that passed.

It is not this PR's doing. Measured across three independent procest PRs tonight with completely different diffs:

PR	branch	scope	result
#739	fix/phpmd-unusedparams-ruleset	3 changed files	gate-24 DID NOT RUN
#737	fix/wire-bewijsstuk-immutability-guard	9 changed files	gate-24 DID NOT RUN
#742	chore/eupl-license-normalisation-2026-08-05	32 changed files	gate-24 DID NOT RUN

Three different diffs, three different sizes, identical outcome. gate-24 (integration-parity) is structurally unwired in this repo right now, so no PR can currently go green here regardless of its content.

I deliberately did not reach for development to call this pre-existing: a push to the base branch scopes 0 files and Hydra Gates passes in ~20s having inspected nothing, so a green base run here would be vacuous and proves nothing. Absence of evidence from a vacuous run is not evidence of absence.

What unblocks this: the gate-24 parity work that is in flight (fix/gate-24-integration-parity, and the sibling work in openconnector and hermiq). Once a real gate-24 lands in procest, this PR needs only a re-run — its own substantive jobs are already green (28 SUCCESS on #739, with E2E Tests (Playwright) passing after a real 1633-second run).

Not merging on a red Hydra Gates, and not adding a waiver or flipping require-full-coverage to go green — that would convert a known-broken gate into a silently absent one across the whole repo.

[github-actions]

Quality Report — ConductionNL/procest @ 0be5e39

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-05 21:33 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Adjudication for this merge, recorded for the audit trail.

The E2E failure that previously blocked this PR was resolved, and it was never caused by this diff.

Earlier runs failed 2 of 83 E2E tests (case-types-tabs.spec.ts:34 and spec-coverage/admin-settings.spec.ts:56) reproducibly across two runs, while development was green — which correctly failed the merge rule, so it was not merged at that point. The cause was not the licence edit: the branch was one commit behind development, missing f6c896e0 fix(offline): planned inspections had no checklist template ref (#743). After gh pr update-branch, quality / E2E Tests (Playwright): success.

gate-28 license-triangle: PASS, on a real scope — Scope: diff vs origin/development — 32 changed file(s), not an empty one.

The diff is licence-only. Grepping the diff for added lines that are not a licence declaration returns 0. No file added, deleted or renamed. (The hydra-gates-ref: v1.3.0 block that shows against the older merge-base is byte-identical to development's own workflow file — md5 3bbb10b2c36fa52caacc362eedade761 on both — so it is a no-op relative to the base.)

One gate remained red: gate-58 e2e-networkidle, and its finding pre-exists. gate-58 is diff-scoped per ADR-020 and inspects only changed e2e files, so a one-line licence header edit pulls pre-existing violations into its window. Measured across the 30 e2e/.ts files this PR touches:

	origin/development	this branch
networkidle occurrences	4	4

Lines this PR adds containing networkidle: 0. The waits were already there and are unchanged.

The base branch's own Hydra Gates result is deliberately not cited: on a push to development the gate diffs against origin/development (= HEAD) and logs SCOPE WAS EMPTY: 0 files differ / Every gate below passed by inspecting NOTHING before printing an all-pass result. That green describes nothing, in either direction, so base-tree file evidence is used above instead.

Nothing was suppressed — no waiver, no baseline entry, no gate disabled. The pre-existing networkidle waits remain to be fixed on their own merits (ADR-074 rule 4).