[rubenvdlinde]

What gate 121 checks

OpenRegister reads a schema's access rules from authorization and its administered checks from x-openregister-validations. Three other keys look like they do the same job and are read by nothing: x-openregister-rbac, x-rbac-role, and the singular x-openregister-validation. A schema that carries them looks protected in review and is open to anyone who reaches the register.

Gate 121 register-auth-dialect reads every register document under lib/Settings: *register*.json at the top level (mocks included), register.d/*.json, and packages/**.json.

• Blocking: a dead key anywhere inside a schema body fails, one finding per key, naming the file and the JSON path (a lifecycle transition's x-rbac-role included). A property that is merely named like a dead key is not judged.
• Report-only: a schema without a non-empty authorization block is counted, and the run prints authorization coverage: X of Y. The census deep-merges the base document and register.d the way RegisterDocumentLoader does, so a fragment that closes a base schema counts. Mocks are left out and packages are counted on their own. Setting HYDRA_GATE_REGISTER_AUTHORIZATION_BLOCKING=1 turns the census into a failure for a repo that has closed every schema.
• No register document means NOT APPLICABLE, a document that is not JSON means SKIPPED (wiring), and a crash is never read as a finding.

Files: scripts/lib/check_register_auth_dialect.py (helper), its runner block in run-hydra-gates.sh, test_check_register_auth_dialect.py (14 rule-by-rule tests), test_gate121_register_auth_dialect_scope.sh (6 arms through the real runner, with a planted x-openregister-rbac), and a row in COVERED-ELSEWHERE.md.

Fleet run

development of every app in fleet-apps.json, shallow clones, run on 2026-10-21 at full scope.

App	Verdict	x-openregister-rbac	x-rbac-role	x-openregister-validation	Authorization coverage (report-only)
buildiq	FAIL	0	0	2	15 of 18
decidiq	PASS	0	0	0	46 of 120
dossiq	PASS	0	0	0	34 of 180
filinq	PASS	0	0	0	54 of 54
hermiq	PASS	0	0	0	38 of 38
humaniq	PASS	0	0	0	7 of 97
integriq	PASS	0	0	0	30 of 79
keepiq	not applicable				no register document
larpinq	PASS	0	0	0	23 of 23
launchpad	PASS	0	0	0	0 of 1
learniq	PASS	0	0	0	115 of 164
nextcloud-app-template	PASS	0	0	0	1 of 1
opencatalogi	PASS	0	0	0	18 of 34
openregister	PASS	0	0	0	6 of 19
pipelinq	PASS	0	0	0	21 of 133
planninq	PASS	0	0	0	21 of 21
portaliq	PASS	0	0	0	63 of 63
shillinq	FAIL	333	2	3	0 of 528
stackiq	PASS	0	0	0	22 of 22
thematiq	not applicable				no register document
versioniq	not applicable				no register document

Fleet total: 514 of 1,595 schemas declare an authorization block. Commits read: buildiq f439295, decidiq 70a4c46, dossiq b30bea8, filinq 2e9d492, hermiq 0b42c8e, humaniq 7f8c7ca, integriq 25dc7ff, keepiq 0fd2f13, larpinq 410f14c, launchpad c5a4490, learniq c6d6754, nextcloud-app-template d42dfce, opencatalogi cd3e575, openregister d9a2f9d, pipelinq 3ca4fb5, planninq 91d84ce, portaliq d95a5db, shillinq 2186503, stackiq a6a28fa, thematiq 505956d, versioniq ab57692.

shillinq fails as expected until SH-S0a/S0b land. Its 528 schemas have no authorization block at all.

buildiq also fails: lib/Settings/openbuild_register.json puts the singular x-openregister-validation on Application and ApplicationVersion, so the hybrid-requires-baseRef rule and its sibling are never run. That is a real dead key, not a false positive, and it needs a buildiq fix (rename to x-openregister-validations, checking the rule shape against what OpenRegister accepts) before or alongside this merge.

Every other app passes the dead-key check. keepiq, thematiq and versioniq ship no register document and are NOT APPLICABLE.

Verified

• python3 hydra-gates/scripts/lib/test_check_register_auth_dialect.py: 14 tests OK
• bash hydra-gates/scripts/lib/test_gate121_register_auth_dialect_scope.sh: all 6 arms pass
• MATRIX_LINE
• bash -n on the runner, and shellcheck -S warning on the new suite

Not in this PR

The hydra hydra-gates skill's gate table lives in ConductionNL/hydra and is not updated here.

AI assistance: written with Claude Code (claude-opus-5-5), and reviewed by the merging maintainer.

🤖 Generated with Claude Code