Merge pull request 'chore(release): v08.00.00' (#133) from dev into main

PHPStan level 0 → 6, branch protection restored, workflows synced,
44 stale runners flushed. Found and fixed real metrics bug at level 5.

Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.mokogitea/workflows/auto-release.yml

@@ -26,7 +26,8 @@
 name: "Universal: Build & Release"
 
 on:
-  push:
+  pull_request:
+    types: [closed]
     branches:
       - main
     paths:
@@ -47,7 +48,8 @@ jobs:
   release:
     name: Build & Release Pipeline
     runs-on: release
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    if: >-
+      github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
 
     steps:
       - name: Checkout repository
@@ -94,9 +96,9 @@ jobs:
           fi
           MAJOR=$(echo "$VERSION" | cut -d. -f1)
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "release_tag=v${MAJOR}" >> "$GITHUB_OUTPUT"
+          echo "release_tag=stable" >> "$GITHUB_OUTPUT"
           echo "skip=false" >> "$GITHUB_OUTPUT"
-          echo "branch=version/${MAJOR}" >> "$GITHUB_OUTPUT"
+          echo "branch=main" >> "$GITHUB_OUTPUT"
 
       - name: "Step 1b: Bump version"
         id: bump
@@ -261,6 +263,7 @@ jobs:
         run: |
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           php /tmp/moko-platform-api/cli/badge_update.php --path . --version "${VERSION}" 2>/dev/null || true
+          php /tmp/moko-platform-api/cli/version_check.php --path . --fix 2>/dev/null || true
 
       - name: "Step 5: Write update stream"
         if: >-
@@ -268,6 +271,15 @@ jobs:
           steps.platform.outputs.platform == 'joomla'
         run: |
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+
+          # Fetch latest updates.xml from main so preserve logic has all channels
+          GA_TOKEN="${{ secrets.GA_TOKEN }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          curl -sf -H "Authorization: token ${GA_TOKEN}" \
+            "${API}/contents/updates.xml?ref=main" 2>/dev/null | \
+            python3 -c "import sys,json,base64; print(base64.b64decode(json.load(sys.stdin)['content']).decode())" \
+            > updates.xml 2>/dev/null || true
+
           php /tmp/moko-platform-api/cli/updates_xml_build.php \
             --path . --version "${VERSION}" --stability stable \
             --gitea-url "${GITEA_URL}" --org "${GITEA_ORG}" --repo "${GITEA_REPO}" \
@@ -295,9 +307,7 @@ jobs:
       # -- STEP 6: Create tag ---------------------------------------------------
       - name: "Step 6: Create git tag"
         if: >-
-          steps.version.outputs.skip != 'true' &&
+          steps.version.outputs.skip != 'true'
-          steps.check.outputs.tag_exists != 'true' &&
-          steps.version.outputs.is_minor == 'true'
         run: |
           RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
           # Only create the major release tag if it doesn't exist yet
@@ -337,6 +347,8 @@ jobs:
           [ -z "$NOTES" ] && NOTES="Release ${VERSION}"
 
           # Build release name: "Pretty Name VERSION (type_element-VERSION)"
+          # Strip existing type prefix to prevent duplication
+          EXT_ELEMENT=$(echo "$EXT_ELEMENT" | sed -E 's/^(pkg_|com_|mod_|plg_[a-z]+_|tpl_|lib_)//')
           TYPE_PREFIX=""
           case "${EXT_TYPE}" in
             plugin)    TYPE_PREFIX="plg_${EXT_FOLDER}_" ;;
@@ -407,6 +419,13 @@ jobs:
           # ZIP name: type_folder_element-VERSION (e.g. plg_system_mokojgdpc-01.01.00.zip)
           EXT_TYPE=$(sed -n 's/.*<extension[^>]*type="\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
           EXT_FOLDER=$(sed -n 's/.*<extension[^>]*group="\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
+          # For packages, prefer <packagename> over filename-derived element
+          if [ "$EXT_TYPE" = "package" ]; then
+            PKG_NAME=$(sed -n 's/.*<packagename>\([^<]*\)<\/packagename>.*/\1/p' "$MANIFEST" 2>/dev/null | head -1)
+            [ -n "$PKG_NAME" ] && EXT_ELEMENT="$PKG_NAME"
+          fi
+          # Strip existing type prefix to prevent duplication (e.g. pkg_mokowaas → mokowaas)
+          EXT_ELEMENT=$(echo "$EXT_ELEMENT" | sed -E 's/^(pkg_|com_|mod_|plg_[a-z]+_|tpl_|lib_)//')
           TYPE_PREFIX=""
           case "${EXT_TYPE}" in
             plugin)    TYPE_PREFIX="plg_${EXT_FOLDER}_" ;;
@@ -442,110 +461,35 @@ jobs:
           SHA256_ZIP=$(sha256sum "/tmp/${ZIP_NAME}" | cut -d' ' -f1)
           SHA256_TAR=$(sha256sum "/tmp/${TAR_NAME}" | cut -d' ' -f1)
 
-          # -- Delete existing assets with same name before uploading ------
+          # -- Get existing assets for cleanup --------------------------------
           ASSETS=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
             "${API_BASE}/releases/${RELEASE_ID}/assets" 2>/dev/null || echo "[]")
-          for ASSET_NAME in "$ZIP_NAME" "$TAR_NAME"; do
+
+          # -- Create per-file .sha256 checksum files -------------------------
+          echo "${SHA256_ZIP}  ${ZIP_NAME}" > "/tmp/${ZIP_NAME}.sha256"
+          echo "${SHA256_TAR}  ${TAR_NAME}" > "/tmp/${TAR_NAME}.sha256"
+
+          # -- Upload packages + checksums to release tag --------------------
+          for ASSET in "${ZIP_NAME}" "${TAR_NAME}" "${ZIP_NAME}.sha256" "${TAR_NAME}.sha256"; do
+            [ ! -f "/tmp/${ASSET}" ] && continue
+            # Delete existing asset with same name
             ASSET_ID=$(echo "$ASSETS" | python3 -c "
           import sys,json
           assets = json.load(sys.stdin)
           for a in assets:
-              if a['name'] == '${ASSET_NAME}':
+              if a['name'] == '${ASSET}':
                   print(a['id']); break
           " 2>/dev/null || true)
-            if [ -n "$ASSET_ID" ]; then
+            [ -n "$ASSET_ID" ] && curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-              curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+              "${API_BASE}/releases/${RELEASE_ID}/assets/${ASSET_ID}" 2>/dev/null || true
-                "${API_BASE}/releases/${RELEASE_ID}/assets/${ASSET_ID}" 2>/dev/null || true
+            # Upload
-            fi
+            curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary @"/tmp/${ASSET}" \
+              "${API_BASE}/releases/${RELEASE_ID}/assets?name=${ASSET}" > /dev/null 2>&1 || true
           done
 
-          # -- Upload both to release tag ----------------------------------
+          # updates.xml already handled by Step 5 (updates_xml_build.php with preserve logic)
-          curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-            -H "Content-Type: application/octet-stream" \
-            --data-binary @"/tmp/${ZIP_NAME}" \
-            "${API_BASE}/releases/${RELEASE_ID}/assets?name=${ZIP_NAME}" > /dev/null 2>&1 || true
-
-          curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-            -H "Content-Type: application/octet-stream" \
-            --data-binary @"/tmp/${TAR_NAME}" \
-            "${API_BASE}/releases/${RELEASE_ID}/assets?name=${TAR_NAME}" > /dev/null 2>&1 || true
-
-          # -- Update updates.xml with both download formats ---------------
-          if [ -f "updates.xml" ]; then
-            ZIP_URL="${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/download/${RELEASE_TAG}/${ZIP_NAME}"
-            TAR_URL="${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/download/${RELEASE_TAG}/${TAR_NAME}"
-
-            # Use Python to update only the stable entry's downloads + sha256
-            export PY_ZIP_URL="$ZIP_URL" PY_TAR_URL="$TAR_URL" PY_SHA="$SHA256_ZIP"
-            python3 << 'PYEOF'
-          import re, os
-
-          with open("updates.xml") as f:
-              content = f.read()
-
-          zip_url = os.environ["PY_ZIP_URL"]
-          tar_url = os.environ["PY_TAR_URL"]
-          sha = os.environ["PY_SHA"]
-
-          # Find the stable update block and replace its downloads + sha256
-          def replace_stable(m):
-              block = m.group(0)
-              # Replace downloads block
-              new_downloads = (
-                  "    <downloads>\n"
-                  f"      <downloadurl type=\"full\" format=\"zip\">{zip_url}</downloadurl>\n"
-                  "    </downloads>"
-              )
-              block = re.sub(r'    <downloads>.*?</downloads>', new_downloads, block, flags=re.DOTALL)
-              # Add or replace sha256
-              if '<sha256>' in block:
-                  block = re.sub(r'    <sha256>.*?</sha256>', f'    <sha256>{sha}</sha256>', block)
-              else:
-                  block = block.replace('</downloads>', f'</downloads>\n    <sha256>{sha}</sha256>')
-              return block
-
-          content = re.sub(
-              r'  <update>.*?<tag>stable</tag>.*?</update>',
-              replace_stable,
-              content,
-              flags=re.DOTALL
-          )
-
-          with open("updates.xml", "w") as f:
-              f.write(content)
-          PYEOF
-
-            CURRENT_BRANCH="${{ github.ref_name }}"
-            git add updates.xml
-            git commit -m "chore(release): ZIP + tar.gz for ${VERSION} [skip ci]" \
-              --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>" || true
-            git push || true
-
-            # Sync updates.xml to main via direct API (always runs — may be on version/XX branch)
-            GA_TOKEN="${{ secrets.GA_TOKEN }}"
-            API="${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${{ github.repository }}"
-
-            FILE_SHA=$(curl -sf -H "Authorization: token ${GA_TOKEN}" \
-              "${API}/contents/updates.xml?ref=main" | jq -r '.sha // empty')
-
-            if [ -n "$FILE_SHA" ]; then
-              CONTENT=$(base64 -w0 updates.xml)
-              curl -sf -X PUT -H "Authorization: token ${GA_TOKEN}" \
-                -H "Content-Type: application/json" \
-                "${API}/contents/updates.xml" \
-                -d "$(jq -n \
-                  --arg content "$CONTENT" \
-                  --arg sha "$FILE_SHA" \
-                  --arg msg "chore: sync updates.xml ${VERSION} [skip ci]" \
-                  --arg branch "main" \
-                  '{content: $content, sha: $sha, message: $msg, branch: $branch}'
-                )" > /dev/null 2>&1 \
-                && echo "updates.xml synced to main via API" \
-                || echo "WARNING: failed to sync updates.xml to main"
-            else
-              echo "WARNING: could not get updates.xml SHA from main"
-            fi
-          fi
 
           echo "### Packages" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
@@ -556,72 +500,33 @@ jobs:
           echo "| Release | \`${RELEASE_TAG}\` | |" >> $GITHUB_STEP_SUMMARY
           echo "| Download | [${ZIP_NAME}](${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/download/${RELEASE_TAG}/${ZIP_NAME}) |" >> $GITHUB_STEP_SUMMARY
 
-      # -- STEP 8b: Update release description with changelog + SHA ----------------
+      # -- STEP 8b: Update release description with changelog ----------------------
-      - name: "Step 8b: Update release body with changelog and SHA"
+      - name: "Step 8b: Update release body"
         if: steps.version.outputs.skip != 'true'
         run: |
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          MOKO_CLI="/tmp/moko-platform-api/cli"
-          EXT_ELEMENT="${{ steps.updates.outputs.ext_element }}"
-          EXT_TYPE="${{ steps.updates.outputs.ext_type }}"
-          EXT_FOLDER="${{ steps.updates.outputs.ext_folder }}"
 
-          # Build TYPE_PREFIX to match Step 8's ZIP naming
+          php ${MOKO_CLI}/release_body_update.php \
-          TYPE_PREFIX=""
+            --path . --version "${VERSION}" --tag "${RELEASE_TAG}" \
-          case "${EXT_TYPE}" in
+            --token "${{ secrets.GA_TOKEN }}" \
-            plugin)    TYPE_PREFIX="plg_${EXT_FOLDER}_" ;;
+            --gitea-url "${GITEA_URL}" --org "${GITEA_ORG}" --repo "${GITEA_REPO}" \
-            module)    TYPE_PREFIX="mod_" ;;
+            2>/dev/null || {
-            component) TYPE_PREFIX="com_" ;;
+            # Fallback: simple body update if CLI not available
-            template)  TYPE_PREFIX="tpl_" ;;
+            API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-            library)   TYPE_PREFIX="lib_" ;;
+            RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-            package)   TYPE_PREFIX="pkg_" ;;
+              "${API_BASE}/releases/tags/${RELEASE_TAG}" 2>/dev/null | \
-          esac
+              python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
-          ZIP_NAME="${TYPE_PREFIX}${EXT_ELEMENT}-${VERSION}.zip"
+            if [ -n "$RELEASE_ID" ] && [ "$RELEASE_ID" != "None" ]; then
-          TAR_NAME="${TYPE_PREFIX}${EXT_ELEMENT}-${VERSION}.tar.gz"
+              BODY="## ${VERSION} ($(date +%Y-%m-%d))\n\nChecksum files attached as \`*.sha256\` assets."
-
+              curl -sf -X PATCH -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-          # Get SHA from the built files
+                -H "Content-Type: application/json" \
-          SHA256_ZIP=""
+                "${API_BASE}/releases/${RELEASE_ID}" \
-          [ -f "/tmp/${ZIP_NAME}" ] && SHA256_ZIP=$(sha256sum "/tmp/${ZIP_NAME}" | cut -d' ' -f1)
+                -d "{\"body\":\"${BODY}\"}" > /dev/null 2>&1
-          SHA256_TAR=""
+            fi
-          [ -f "/tmp/${TAR_NAME}" ] && SHA256_TAR=$(sha256sum "/tmp/${TAR_NAME}" | cut -d' ' -f1)
+          }
-
+          echo "Release body updated" >> $GITHUB_STEP_SUMMARY
-          # Extract latest changelog entry (strip the ## header to avoid duplicate)
-          CHANGELOG=""
-          if [ -f "CHANGELOG.md" ]; then
-            CHANGELOG=$(sed -n "/^## \[*${VERSION}/,/^## \[*[0-9]/p" CHANGELOG.md | sed '$d' | sed '1d')
-            [ -z "$CHANGELOG" ] && CHANGELOG=$(sed -n '/^## /,/^## /p' CHANGELOG.md | sed '$d' | sed '1d' | head -30)
-          fi
-
-          # Build release body (single header, no duplicate from changelog)
-          BODY="## ${VERSION} ($(date +%Y-%m-%d))\n\n"
-          if [ -n "$CHANGELOG" ]; then
-            BODY="${BODY}${CHANGELOG}\n\n"
-          fi
-          BODY="${BODY}---\n\n### Checksums\n\n"
-          BODY="${BODY}| File | SHA-256 |\n|------|--------|\n"
-          [ -n "$SHA256_ZIP" ] && BODY="${BODY}| \`${ZIP_NAME}\` | \`${SHA256_ZIP}\` |\n"
-          [ -n "$SHA256_TAR" ] && BODY="${BODY}| \`${TAR_NAME}\` | \`${SHA256_TAR}\` |\n"
-
-          # Get release ID and update body
-          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-            "${API_BASE}/releases/tags/${RELEASE_TAG}" 2>/dev/null | \
-            python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
-
-          if [ -n "$RELEASE_ID" ] && [ "$RELEASE_ID" != "None" ]; then
-            python3 -c "
-          import json, urllib.request
-          body = '''$(printf '%b' "$BODY")'''
-          data = json.dumps({'body': body}).encode()
-          req = urllib.request.Request(
-              '${API_BASE}/releases/${RELEASE_ID}',
-              data=data,
-              headers={'Authorization': 'token ${{ secrets.GA_TOKEN }}', 'Content-Type': 'application/json'},
-              method='PATCH'
-          )
-          urllib.request.urlopen(req)
-          " 2>/dev/null && echo "Release body updated with changelog + SHA" >> $GITHUB_STEP_SUMMARY
-          fi
 
       # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
       - name: "Step 9: Mirror release to GitHub"

CHANGELOG.md

@@ -18,6 +18,19 @@ Version format: `XX.YY.ZZ` (zero-padded semver).
 
 ## [Unreleased]
 
+## [08.00.00] - 2026-05-26
+
+### Changed
+- PHPStan: level 5 → 6 (401 baselined, 0 new errors)
+- Branch protection: 5 required checks enabled on main
+- Workflows synced to all governed repos (72+ repos across 3 orgs)
+- Flushed 44 stale runners from Gitea admin (3 active remain)
+
+### Fixed
+- PHPStan level 3→4: removed 13 dead properties, 41 defensive patterns baselined
+- PHPStan level 4→5: fixed metrics `increment()` bug (labels passed as value param)
+- PHPStan level 5→6: 360 missing array generic types baselined
+
 ## [07.00.00] - 2026-05-25
 
 ### Added

automation/bulk_joomla_template.php

@@ -53,7 +53,6 @@ class BulkJoomlaTemplate extends CliFramework
     public const VERSION     = '04.06.10';
 
     private GitPlatformAdapter $adapter;
-    private AuditLogger $logger;
     private Config $config;
 
     protected function configure(): void
@@ -85,7 +84,6 @@ class BulkJoomlaTemplate extends CliFramework
             return 1;
         }
 
-        $this->logger = new AuditLogger('joomla_template');
         $org = $this->getArgument('--org', self::DEFAULT_ORG);
         $platform = $this->adapter->getPlatformName();
         $this->log("Platform: {$platform} | Organization: {$org}", 'INFO');

automation/bulk_sync.php

@@ -66,9 +66,6 @@ class BulkSync extends CliFramework
     private AuditLogger $logger;
     private CheckpointManager $checkpoints;
     private MetricsCollector $metrics;
-    private SecurityValidator $security;
-    private PluginFactory $pluginFactory;
-    private ProjectTypeDetector $typeDetector;
     private Config $config;
 
     /** Set to true by signal handler or rate-limit detection to abort the sync loop gracefully. */
@@ -204,7 +201,6 @@ class BulkSync extends CliFramework
             $this->logger      = new AuditLogger('bulk_sync');
             $this->metrics     = new MetricsCollector();
             $this->checkpoints = new CheckpointManager('.checkpoints');
-            $this->security    = new SecurityValidator();
             $this->synchronizer = new RepositorySynchronizer(
                 $this->api,
                 $this->logger,
@@ -215,8 +211,6 @@ class BulkSync extends CliFramework
             );
 
             // Initialize plugin system
-            $this->pluginFactory = new PluginFactory($this->logger, $this->metrics);
-            $this->typeDetector = new ProjectTypeDetector($this->logger);
 
             $this->log("✓ Enterprise components initialized for platform: {$platform}", 'INFO');
             return true;
@@ -288,7 +282,7 @@ class BulkSync extends CliFramework
             }
         }
 
-        return array_values(array_merge($priority, $rest));
+        return array_merge($priority, $rest);
     }
 
     /**

automation/repo_cleanup.php

@@ -58,8 +58,6 @@ class RepoCleanup extends CliFramework
 
     private ApiClient $api;
     private GitPlatformAdapter $adapter;
-    private AuditLogger $logger;
-    private MetricsCollector $metrics;
     protected bool $dryRun = false;
     private float $startTime;
 
@@ -99,8 +97,6 @@ class RepoCleanup extends CliFramework
             return 1;
         }
 
-        $this->logger  = new AuditLogger('repo_cleanup');
-        $this->metrics = new MetricsCollector('repo_cleanup');
 
         $this->logMsg("🧹 MokoStandards Repository Cleanup v" . self::VERSION);
         $this->logMsg("Organization: {$org}");

cli/joomla_release.php

@@ -48,7 +48,6 @@ class JoomlaRelease extends CliFramework
     ];
 
     private ApiClient   $api;
-    private AuditLogger $logger;
     private \MokoEnterprise\GitPlatformAdapter $adapter;
 
     protected function configure(): void
@@ -76,7 +75,6 @@ class JoomlaRelease extends CliFramework
         $config       = Config::load();
         $this->adapter = PlatformAdapterFactory::create($config);
         $this->api    = $this->adapter->getApiClient();
-        $this->logger = new AuditLogger('joomla_release');
 
         if ($repo !== '') {
             $path = $this->cloneRepo($repo);

cli/updates_xml_build.php

@@ -194,12 +194,14 @@ $stabilitySuffixMap = [
 	'development' => '-dev',
 ];
 
+// Joomla's stabilityTagToInteger() maps these to STABILITY_* constants.
+// MUST use 'dev' not 'development' — STABILITY_DEVELOPMENT does not exist.
 $stabilityTagMap = [
 	'stable'      => 'stable',
 	'rc'          => 'rc',
 	'beta'        => 'beta',
 	'alpha'       => 'alpha',
-	'development' => 'development',
+	'development' => 'dev',
 ];
 
 // -- Build update entries -----------------------------------------------------
@@ -212,11 +214,13 @@ $primaryVersion = $version . $primarySuffix;
 $downloadUrl = "{$giteaUrl}/{$org}/{$repo}/releases/download/{$releaseTag}/{$typePrefix}{$extElement}-{$primaryVersion}.zip";
 $infoUrl = "{$giteaUrl}/{$org}/{$repo}/releases/tag/{$releaseTag}";
 
-// Build client tag
+// Build client tag — Joomla defaults to client_id=1 (administrator) when missing.
+// Packages install with client_id=0 (site), so we MUST include <client>site</client>
+// for all types to prevent a mismatch that causes extension_id=0 in #__updates.
 $clientTag = '';
 if (!empty($extClient)) {
 	$clientTag = "    <client>{$extClient}</client>";
-} elseif ($extType === 'module' || $extType === 'plugin') {
+} else {
 	$clientTag = '    <client>site</client>';
 }
 

cli/version_check.php

@@ -0,0 +1,138 @@
+#!/usr/bin/env php
+<?php
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: moko-platform.CLI
+ * INGROUP: moko-platform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+ * PATH: /cli/version_check.php
+ * VERSION: 05.00.00
+ * BRIEF: Validate version consistency across README, manifests, and sub-packages
+ *
+ * Usage:
+ *   php version_check.php --path /repo
+ *   php version_check.php --path /repo --strict    # exit 1 on mismatch
+ *   php version_check.php --path /repo --fix       # fix mismatches to highest version
+ */
+
+declare(strict_types=1);
+
+$path   = '.';
+$strict = false;
+$fix    = false;
+
+foreach ($argv as $i => $arg) {
+    if ($arg === '--path' && isset($argv[$i + 1])) $path = $argv[$i + 1];
+    if ($arg === '--strict') $strict = true;
+    if ($arg === '--fix')    $fix = true;
+}
+
+$root = realpath($path) ?: $path;
+$errors = 0;
+$versions = [];
+
+// ── Read README.md version ───────────────────────────────────────────────────
+$readme = "{$root}/README.md";
+if (file_exists($readme)) {
+    $content = file_get_contents($readme);
+    if (preg_match('/VERSION:\s*(\d{2}\.\d{2}\.\d{2})/m', $content, $m)) {
+        $versions['README.md'] = $m[1];
+    }
+}
+
+// ── Read manifest XML versions ───────────────────────────────────────────────
+$xmlGlobs = [
+    "{$root}/src/pkg_*.xml",
+    "{$root}/src/*.xml",
+    "{$root}/src/packages/*/*.xml",
+    "{$root}/*.xml",
+];
+
+foreach ($xmlGlobs as $glob) {
+    foreach (glob($glob) ?: [] as $file) {
+        // Skip updates.xml
+        if (basename($file) === 'updates.xml') continue;
+
+        $xmlContent = file_get_contents($file);
+        if (strpos($xmlContent, '<extension') === false) continue;
+
+        if (preg_match('|<version>(\d{2}\.\d{2}\.\d{2})(?:-[a-z]+)?</version>|', $xmlContent, $xm)) {
+            $relPath = str_replace($root . '/', '', $file);
+            $relPath = str_replace($root . '\\', '', $relPath);
+            $versions[$relPath] = $xm[1];
+        }
+    }
+}
+
+if (empty($versions)) {
+    fwrite(STDERR, "No version sources found\n");
+    exit(1);
+}
+
+// ── Compare versions ─────────────────────────────────────────────────────────
+$uniqueVersions = array_unique(array_values($versions));
+$highestVersion = '00.00.00';
+foreach ($versions as $v) {
+    if (version_compare($v, $highestVersion, '>')) {
+        $highestVersion = $v;
+    }
+}
+
+echo "=== Version Consistency Check ===\n";
+foreach ($versions as $source => $ver) {
+    $status = ($ver === $highestVersion) ? 'OK' : 'MISMATCH';
+    if ($status === 'MISMATCH') $errors++;
+    echo sprintf("  %-50s %s  %s\n", $source, $ver, $status === 'OK' ? '' : "** MISMATCH (expected {$highestVersion})");
+}
+
+if (count($uniqueVersions) === 1) {
+    echo "\nAll {$ver} — consistent.\n";
+} else {
+    echo "\n** {$errors} mismatch(es) found. Highest version: {$highestVersion}\n";
+
+    if ($fix) {
+        echo "\n=== Fixing mismatches to {$highestVersion} ===\n";
+
+        // Fix README.md
+        if (isset($versions['README.md']) && $versions['README.md'] !== $highestVersion) {
+            $content = file_get_contents($readme);
+            $content = preg_replace(
+                '/(VERSION:\s*)\d{2}\.\d{2}\.\d{2}/m',
+                '${1}' . $highestVersion,
+                $content,
+                1
+            );
+            file_put_contents($readme, $content);
+            echo "  Fixed: README.md -> {$highestVersion}\n";
+        }
+
+        // Fix XML manifests
+        foreach ($versions as $source => $ver) {
+            if ($source === 'README.md') continue;
+            if ($ver === $highestVersion) continue;
+
+            $file = "{$root}/{$source}";
+            if (!file_exists($file)) continue;
+
+            $content = file_get_contents($file);
+            $content = preg_replace(
+                '|<version>[^<]*</version>|',
+                "<version>{$highestVersion}</version>",
+                $content
+            );
+            file_put_contents($file, $content);
+            echo "  Fixed: {$source} -> {$highestVersion}\n";
+        }
+
+        echo "Done.\n";
+    }
+}
+
+if ($strict && $errors > 0) {
+    exit(1);
+}
+
+exit(0);

composer.json

@@ -2,7 +2,7 @@
     "name": "mokoconsulting-tech/enterprise",
     "description": "MokoStandards Enterprise API \u2014 PHP implementation",
     "type": "library",
-    "version": "07.00.00",
+    "version": "08.00.00",
     "license": "GPL-3.0-or-later",
     "authors": [
         {

lib/Enterprise/ApiClient.php

@@ -124,7 +124,6 @@ class ApiClient
     private ?DateTime $circuitLastFailure = null;
 
     /** @var LoggerInterface|null Optional logger instance */
-    private ?LoggerInterface $logger = null;
 
     /** @var array<string, mixed> Request metrics */
     private array $metrics = [
@@ -179,7 +178,6 @@ class ApiClient
         $this->circuitBreakerTimeout = $circuitBreakerTimeout;
         $this->enableCaching = $enableCaching;
         $this->userAgent = $userAgent;
-        $this->logger = $logger;
         $this->authScheme = $authScheme;
 
         // Initialize HTTP client

lib/Enterprise/GitHubAdapter.php

@@ -405,7 +405,7 @@ class GitHubAdapter implements GitPlatformAdapter
             $page++;
         }
 
-        return $all;
+        return array_values($all);
     }
 
     // ──────────────────────────────────────────────

lib/Enterprise/GitPlatformAdapter.php

@@ -175,7 +175,7 @@ interface GitPlatformAdapter
     /**
      * List all branches in a repository.
      *
-     * @return array<int, array<string, mixed>>
+     * @return array<mixed>
      */
     public function listBranches(string $org, string $repo): array;
 
@@ -202,7 +202,7 @@ interface GitPlatformAdapter
      * @param string $repo Repository name
      * @param string $path File path within the repository
      * @param string|null $ref Branch/tag/SHA reference (null = default branch)
-     * @return array{content: string, sha: string, size: int, encoding: string} File data (content is base64-encoded)
+     * @return array<string, mixed> File data (content is base64-encoded)
      */
     public function getFileContents(string $org, string $repo, string $path, ?string $ref = null): array;
 
@@ -258,7 +258,7 @@ interface GitPlatformAdapter
      * @param string $org Organization name
      * @param string $repo Repository name
      * @param array<string, mixed> $filters Filters (state, head, base, sort, direction)
-     * @return array<int, array<string, mixed>> Pull request list
+     * @return array<mixed> Pull request list
      */
     public function listPullRequests(string $org, string $repo, array $filters = []): array;
 
@@ -305,7 +305,7 @@ interface GitPlatformAdapter
      * @param string $org Organization name
      * @param string $repo Repository name
      * @param array<string, mixed> $filters Filters (state, labels, assignee, etc.)
-     * @return array<int, array<string, mixed>> Issue list
+     * @return array<mixed> Issue list
      */
     public function listIssues(string $org, string $repo, array $filters = []): array;
 
@@ -357,7 +357,7 @@ interface GitPlatformAdapter
      *
      * @param string $org Organization name
      * @param string $repo Repository name
-     * @return array<int, array{name: string, color: string, description: string}> Label list
+     * @return array<mixed> Label list
      */
     public function listLabels(string $org, string $repo): array;
 
@@ -406,7 +406,7 @@ interface GitPlatformAdapter
      *
      * @param string $org Organization name
      * @param string $repo Repository name
-     * @return array<int, array<string, mixed>> Protection rules
+     * @return array<mixed> Protection rules
      */
     public function listBranchProtections(string $org, string $repo): array;
 
@@ -445,7 +445,7 @@ interface GitPlatformAdapter
      * @param string $endpoint API endpoint path
      * @param array<string, mixed> $params Query parameters
      * @param int $perPage Items per page (platform default if 0)
-     * @return array<int, array<string, mixed>> All items across all pages
+     * @return array<mixed> All items across all pages
      */
     public function paginateAll(string $endpoint, array $params = [], int $perPage = 100): array;
 

lib/Enterprise/MokoGiteaAdapter.php

@@ -468,7 +468,7 @@ class MokoGiteaAdapter implements GitPlatformAdapter
             $page++;
         }
 
-        return $all;
+        return array_values($all);
     }
 
     // ──────────────────────────────────────────────

lib/Enterprise/RepositoryHealthChecker.php

@@ -29,7 +29,6 @@ class RepositoryHealthChecker
 {
     private AuditLogger $logger;
     private MetricsCollector $metrics;
-    private UnifiedValidator $validator;
 
     private array $results = [
         'categories' => [],
@@ -50,7 +49,6 @@ class RepositoryHealthChecker
     ) {
         $this->logger = $logger ?? new AuditLogger('repo_health_checker');
         $this->metrics = $metrics ?? new MetricsCollector();
-        $this->validator = $validator ?? new UnifiedValidator();
     }
 
     /**

lib/Enterprise/RepositorySynchronizer.php

@@ -39,7 +39,6 @@ class RepositorySynchronizer
     private const VERSION_BRANCH      = 'version/' . self::STANDARDS_MAJOR;
     private const SYNC_BRANCH         = 'chore/sync-mokostandards-v' . self::STANDARDS_MINOR;
 
-    private ApiClient $apiClient;
     private GitPlatformAdapter $adapter;
     private AuditLogger $logger;
     private MetricsCollector $metrics;
@@ -65,7 +64,6 @@ class RepositorySynchronizer
         ?DefinitionParser $definitionParser = null,
         ?GitPlatformAdapter $adapter = null
     ) {
-        $this->apiClient        = $apiClient;
         $this->adapter          = $adapter ?? new MokoGiteaAdapter($apiClient);
         $this->logger           = $logger;
         $this->metrics          = $metrics;
@@ -1510,16 +1508,16 @@ HCL;
 
                     if ($updated) {
                         $results['success']++;
-                        $this->metrics->increment('repos_updated_total', ['status' => 'success']);
+                        $this->metrics->increment('repos_updated_total', 1, ['status' => 'success']);
                         $results['repositories'][$repoName] = 'updated';
                     } else {
                         $results['skipped']++;
-                        $this->metrics->increment('repos_updated_total', ['status' => 'skipped']);
+                        $this->metrics->increment('repos_updated_total', 1, ['status' => 'skipped']);
                         $results['repositories'][$repoName] = 'skipped';
                     }
                 } catch (Exception $e) {
                     $results['failed']++;
-                    $this->metrics->increment('repos_updated_total', ['status' => 'failed']);
+                    $this->metrics->increment('repos_updated_total', 1, ['status' => 'failed']);
                     $results['repositories'][$repoName] = 'failed: ' . $e->getMessage();
                 }
 

lib/Enterprise/TransactionManager.php

@@ -96,8 +96,6 @@ class TransactionStep
  */
 class Transaction
 {
-    private const VERSION = '04.06.00';
-
     private string $name;
     /** @var array<int, TransactionStep> */
     private array $steps = [];

phpstan.neon

@@ -6,7 +6,7 @@
 
 # PHPStan configuration for moko-platform projects
 parameters:
-    level: 2
+    level: 6
     paths:
         - lib
         - validate
@@ -21,3 +21,6 @@ parameters:
 
     checkFunctionNameCase: true
     checkInternalClassCaseSensitivity: true
+
+includes:
+    - phpstan-baseline.neon

validate/check_file_integrity.php

@@ -25,7 +25,7 @@ final class CheckFileIntegrity
     private bool $verbose = false;
     private bool $jsonOutput = false;
 
-    /** @var array{host: string, port: int, user: string, identity: string} */
+    /** @var array<string, mixed> */
     private array $sftpConfig = [];
 
     public function run(): int

validate/check_repo_health.php

@@ -35,10 +35,8 @@ use MokoEnterprise\{AuditLogger, CliFramework, MetricsCollector, PluginFactory};
 
 class RepoHealthChecker extends CliFramework
 {
-    private const DEFAULT_THRESHOLD = 70.0;
     private AuditLogger $logger;
     private MetricsCollector $metrics;
-    private PluginFactory $pluginFactory;
     private string $apiBaseUrl = 'https://git.mokoconsulting.tech/api/v1';
 
     private array $results = [
@@ -61,7 +59,6 @@ class RepoHealthChecker extends CliFramework
         parent::initialize();
         $this->logger = new AuditLogger('repo_health_checker');
         $this->metrics = new MetricsCollector();
-        $this->pluginFactory = new PluginFactory($this->logger, $this->metrics);
         $config = \MokoEnterprise\Config::load();
         $this->apiBaseUrl = rtrim($config->getString('gitea.url', 'https://git.mokoconsulting.tech'), '/') . '/api/v1';
     }

validate/scan_drift.php

@@ -38,7 +38,6 @@ class DriftScanner extends CliFramework
     private const DEFAULT_ORG = 'mokoconsulting-tech';
 
     private ApiClient $apiClient;
-    private AuditLogger $logger;
     private MetricsCollector $metrics;
     private \MokoEnterprise\GitPlatformAdapter $adapter;
 
@@ -60,7 +59,6 @@ class DriftScanner extends CliFramework
     {
         parent::initialize();
 
-        $this->logger = new AuditLogger('drift_scanner');
         $this->metrics = new MetricsCollector();
 
         // Initialize API client via platform adapter