[rubenvdlinde]

The last-known-good, pin and policy stores each carried their own copy of the same steps: read one JSON record from app config, list all records under a prefix, write one, and decode it with a logged warning for malformed JSON or an invalid payload. Those steps now live once in the AppConfigJsonRecords trait. Each store keeps its key prefix, JSON depth (16, 16, 8) and its exact log messages as constants, and its public methods are unchanged, except PinStore::markDrift, which now takes the observed drift as one PinDrift value (its only caller, PinDriftHandler, is updated).

SIG numbers (gate 122, five-star profile, PHP, against development 82474e1 / 3e6e4b8)

check	before	after	5-star	4-star
duplication	3.87% (389 lines)	3.25% (327 lines)	2.8%	5.6%
params >=3	22.93%	22.83%	7.5%	15.0%
size >15	54.69%	53.50%	23.6%	47.1%
McCabe >5	40.01%	39.78%	10.1%	20.2%
size >30	22.64%	22.79%	11.6%	23.1% (still met)
McCabe >10	15.75%	15.85%	3.7%	7.3%
params >=5	6.84%	6.89%	1.65%	3.3%

The last three rise only because the measured PHP code shrank by about 60 lines; no unit in those bands changed. versioniq stays 36/44 at 4-star (30/44 at 5-star with #565). Every touched or new unit is within the 5-star unit bounds (at most 14 LOC, McCabe 5, 2 params). Gate 122 ratchet: 0 findings (1 inherited, PinDriftHandler::__construct). Gate 123 against the #564 floor: 36 held.

Verification

• Golden JsonRecordStoresGoldenTest: 113 cases over every public method of the three stores (empty, valid, malformed, too deep, non-array and invalid records, unfiltered listings), comparing results and every app config, logger and audit call. Recorded on the old code; plain re-run green on old and new (the 26 markDrift cases were recorded with the old signature and replay through the new one).
• Capped mutants against the golden only: trait 19 of 19 killed after two golden cases were added for the survivors (a continue turned into break, the prefix check); PinStore 7 of 7; no-op control survived each round.
• Full unit-only suite under pcov with --fail-on-risky: OK (882 tests). psalm on the whole project: no errors. php-cs-fixer: only the inherited RemoveRetiredCronJobs pair. Hydra gates --scope-to-diff --base origin/development: exit 0.

Inherited: php-cs-fixer flags lib/Repair/RemoveRetiredCronJobs.php and its test (aligned @param columns), on development too.

AI assisted (Claude Code); reviewed against the golden before opening.

[github-actions]

Quality Report — ConductionNL/versioniq @ c2d4380

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 32/32
npm			❌	✅ 302/302
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 875/875 · 7 skipped (8 legs)
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-11-02 21:55 UTC

Download the full PDF report from the workflow artifacts.