[rubenvdlinde]

REVIEW (contacts). Held for the reviewer.

What changes

A contact person is turned into an account in its organisation by the contact sync, and an existing account named by its e-mail address gets its role group reset. This PR checks who writes the contact person, before OpenRegister saves it:

• New ContactPersonOrganisationListener on OpenRegister's creating and updating events, for the contact person schema only. It refuses the write with a generic message unless ContactPersonOrganisationGuard allows it.
• The guard allows an administrator, or a member of the contact's OpenRegister organisation who is in gebruik-beheerder or aanbod-beheerder (the same groups the convert-to-user endpoint accepts). A contact person may name an existing account other than the caller's own only when that account already belongs to the organisation.
• A contact for an organisation that has no OpenRegister organisation yet (a registration still under review) is accepted when it names no existing account.
• An update is checked again only when it changes the organisation or the e-mail address, so editing a name keeps working.
• Writes from the command line (occ, cron, the sync itself) are not checked.
• Spec: REQ-003 in openspec/specs/contactpersoon-sync/spec.md.
• Test stubs: OpenRegister's ObjectUpdatingEvent copied from development, and hasUser() on the organisation stub.

Contacts that were saved before this change are not re-checked.

How it was verified

• ContactPersonOrganisationListenerTest: 18 tests with the real guard. On development they fail (the listener is not there and not registered).
• 21 capped mutants over the guard, the listener and the registration (allow all, no membership check, no group check, no existing-account check, admin ignored, update never re-checked, organisation or e-mail change ignored, organization key ignored, modified data ignored, no stop, command line checked, updating event ignored, schema ignored, not registered): all killed; the no-op control survives.
• Full unit suite under pcov with --fail-on-risky on ff47e1a: 1768 tests, 8 skipped, exit 0. The later commit only reshapes the two new classes; their tests re-ran green.
• phpcs, phpmd, phpstan and psalm on the changed files: 0 findings. Hydra gates (--scope-to-diff --base origin/development): 41 of 41 applicable gates ran, exit 0. Gate 122 ratchet on the final commit: 0 findings, 1 inherited (Application::registerDomainServices size).

Review fixes

• The guard reads every key the sync reads (organisation, organization, email, e-mailadres) on its own, refuses a contact whose two organisation keys or two e-mail keys disagree, and re-checks an update when any of them or username changes. Values are trimmed and compared case-insensitively.
• username may name only the caller's own account, unless the caller is an administrator. A member may still change the e-mail address of their own contact in the same organisation.
• The name sync writes the address under email first, the same key the contact sync uses as the account name.
• The listener no longer skips every command line write. It skips only writes marked through the new SystemContactWrites, which the contact sync job and the contact migration repair step use.
• Verified: 36 listener and job tests plus a name-sync test; 7 of the new tests fail on the previous head; 20 capped mutants killed, no-op control survives. Full unit suite under pcov with --fail-on-risky on eb8c1e8: 1805 tests, exit 0. phpcs, phpmd, phpstan, psalm: exit 0. Hydra gates (--scope-to-diff): 42 of 42 applicable ran, exit 0. Gate 122 ratchet: 0 new findings.

Assisted-by: ClaudeCode:claude-opus-5-5

[github-actions]

Quality Report — ConductionNL/stackiq @ de3108d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		❌
check-l10n-js		✅
composer			✅	✅ 127/127
npm			❌	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1805/1805
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-11-04 15:01 UTC

Download the full PDF report from the workflow artifacts.