[rubenvdlinde]

REVIEW (tenancy). Held for the reviewer. Depends on openregister#5459 and openregister#5460.

What changes

With openregister#5459 every read rule keeps the caller's organisation filter unless it says crossOrganisation: true (Ruben's decision of 3 November). This PR adds the marker to the 32 read rules of stackiq that are meant to read other organisations' rows: the provider and consumer reads (a row field bound to the caller's organisation or membership) and the public catalogue reads.

The plain group rules narrow to the caller's organisation, as decided. Two of them are open questions in #5459: vng-raadpleger and software-catalog-admins. Until someone decides otherwise they narrow too.

Nothing else changes. Release this with openregister#5459: a public rule written as {"group": "public", "crossOrganisation": true} is read differently by an older OpenRegister in its schema and register lookups.

How it was verified

• The stackiq unit suite on this branch fails exactly as on development: the same failures, none new.
• The tests that pin the register shape are updated to the marked rules.
• Hydra gates (current .github main runner, --scope-to-diff --base origin/development): exit 0, all 37 applicable gates green and all 37 ran.

Merge together with openregister#5459 and #5460.

Assisted by Claude Code (claude-opus-5-5).

[github-actions]

Quality Report — ConductionNL/stackiq @ c1e501a

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		❌
check-l10n-js		✅
composer			✅	✅ 127/127
npm			❌	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1552/1552 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-11-03 23:39 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/stackiq @ f0fac09

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		❌
check-l10n-js		✅
composer			✅	✅ 127/127
npm			❌	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1770/1770
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-11-04 14:48 UTC

Download the full PDF report from the workflow artifacts.