fix(mcp): match toolWhitelist per function, not per registered tool

.forgejo/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## Summary
+
+<!-- Describe what was implemented and why (2–5 sentences) -->
+
+## Changes
+
+<!-- List modified files and what changed -->
+- `path/to/file` — what changed and why
+
+## Test Coverage
+
+<!-- Describe what tests cover the changes -->
+- `tests/Unit/...` — what is covered
+
+## Quality checklist
+
+- [ ] `composer check:strict` passes locally (phpcs + phpmd + phpstan + psalm + tests)
+- [ ] Hydra gates clean: `/hydra-gates` shows zero `FAIL` lines
+- [ ] New `lib/**/*.php` classes have a matching `tests/Unit/**/*Test.php`
+- [ ] Burn-down PR? Cite cluster + before/after counts: phpcs __ → __, phpmd __ → __, phpstan __ → __

.forgejo/issue_template/bug-report.yml

@@ -0,0 +1,92 @@
+name: "🐛 Bug Report"
+description: "Iets werkt niet zoals verwacht"
+title: "[BUG] "
+labels: ["bug", "needs-triage"]
+assignees: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Bug Report
+        Beschrijf het probleem zo concreet mogelijk zodat het reproduceerbaar is.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: "Beschrijving"
+      description: "Wat gaat er mis?"
+      placeholder: "Bij het uploaden van een PDF groter dan 10MB crasht de anonymizer."
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: "Stappen om te reproduceren"
+      value: |
+        1. Ga naar ...
+        2. Doe ...
+        3. Zie fout ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: "Verwacht gedrag"
+      placeholder: "Het document wordt anonimiseerd en gedownload."
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: "Werkelijk gedrag"
+      placeholder: "HTTP 500 na ~30 seconden, geen output."
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: "Omgeving"
+      value: |
+        - Namespace/omgeving: 
+        - Versie/image tag: 
+        - Browser (indien van toepassing): 
+    validations:
+      required: false
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: "Logs / Screenshots"
+      description: "Plak relevante logs of voeg screenshots toe"
+      render: shell
+    validations:
+      required: false
+
+  - type: textarea
+    id: acceptance-criteria
+    attributes:
+      label: "Acceptatiecriteria (fix)"
+      value: |
+        - [ ] Bug is niet meer reproduceerbaar
+        - [ ] Regressietest toegevoegd
+        - [ ] Fix getest in acceptatieomgeving
+        - [ ] Geen nieuwe security findings
+        - [ ] Code gereviewd (4-eyes)
+    validations:
+      required: true
+
+  - type: dropdown
+    id: severity
+    attributes:
+      label: "Severity"
+      options:
+        - "🔴 Critical — productie ligt plat"
+        - "🟠 High — grote impact, workaround aanwezig"
+        - "🟡 Medium — beperkte impact"
+        - "🟢 Low — cosmetic / minor"
+    validations:
+      required: true

.forgejo/issue_template/feature-request.yml

@@ -0,0 +1,125 @@
+name: "✨ Feature request"
+description: "Suggest a feature or improvement. Fields below feed a draft OpenSpec proposal."
+title: "[FEATURE] "
+labels: ["enhancement", "feature", "needs-triage"]
+type: "Feature"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Suggest a feature
+
+        Thanks for telling us what you need. **Triage happens within 24 hours.**
+
+        The fields below feed an OpenSpec proposal directly if the suggestion
+        is accepted. The more concrete you are, the faster it ships.
+
+        Prefer Dutch? Vul de velden in het Nederlands in — that's fine, we triage in both.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: "Problem"
+      description: "What can't you do today? What's the friction? Write it from your perspective — one or two sentences is plenty."
+      placeholder: "I want to filter contacts by last interaction date but the list view doesn't support it. I end up exporting to CSV and sorting in a spreadsheet."
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed-solution
+    attributes:
+      label: "Proposed solution"
+      description: "How would you like it to work? Sketches, links, references welcome. \"I'm not sure\" is also a valid answer — we'll figure it out together."
+      placeholder: "A date-range filter in the contacts list sidebar, defaulting to last 30 days, persisted per user."
+    validations:
+      required: true
+
+  - type: textarea
+    id: who-benefits
+    attributes:
+      label: "Who benefits"
+      description: "Which user role or workflow does this serve? Be specific."
+      placeholder: "Account managers tracking client engagement, especially before renewal conversations."
+    validations:
+      required: true
+
+  - type: dropdown
+    id: priority-to-you
+    attributes:
+      label: "How important is this to you?"
+      description: "Honest self-assessment. Helps us prioritise."
+      options:
+        - "Nice to have"
+        - "Would use weekly"
+        - "Would use daily"
+        - "Blocking me right now"
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: "Anything else?"
+      description: "Edge cases, alternatives you've considered, things to avoid, related capabilities, anything that didn't fit in the boxes above."
+      placeholder: "Out of scope: per-team default filter (could be later). Avoid: hiding the filter behind a settings page — needs to be one click from the list."
+
+  - type: markdown
+    attributes:
+      value: |
+        ### Context
+
+        The fields below are auto-filled when you suggest a feature from inside
+        the app. They capture where you were when the idea hit so we can scope
+        the spec without a second round of questions.
+
+        **We show them to you here on purpose**: you can see exactly what we
+        send and edit or clear any field before you submit. Leave them blank if
+        you're filing directly from GitHub — we'll still triage it.
+
+  - type: input
+    id: app
+    attributes:
+      label: "App"
+      description: "Auto-filled by the in-product modal. The Nextcloud app you were using."
+      placeholder: "pipelinq"
+
+  - type: input
+    id: page
+    attributes:
+      label: "Page"
+      description: "Auto-filled. The manifest page id + route you were on when you opened the modal."
+      placeholder: "clients-detail (/clients/abc-123)"
+
+  - type: input
+    id: surface
+    attributes:
+      label: "Modal or widget"
+      description: "Auto-filled. Any modal, dialog, dashboard widget, or sidebar tab open at the moment the modal launched. Helps us pinpoint UI-attached suggestions."
+      placeholder: "edit-client-modal · or · dashboard widget: open-leads"
+
+  - type: input
+    id: object
+    attributes:
+      label: "Object in focus"
+      description: "Auto-filled. The OpenRegister register + schema + UUID the page was viewing, if any. Lets us trace the suggestion to a real data shape."
+      placeholder: "pipelinq · Client · 2f9d-…-abc"
+
+  - type: input
+    id: spec-ref
+    attributes:
+      label: "Related capability"
+      description: "Auto-filled if the page or widget declares a `specRef`. Connects the suggestion to the existing OpenSpec for that capability."
+      placeholder: "client-management"
+
+  - type: markdown
+    attributes:
+      value: |
+        ---
+
+        ### What happens next
+
+        1. **Within 24 hours**: a maintainer reads this and replies with one of `ready-to-build`, `needs-design`, `parking-lot`, or `wont-build` (with a reason).
+        2. **If `ready-to-build`**: an OpenSpec proposal is auto-drafted from these fields. Hydra picks it up and opens a draft PR within days.
+        3. **When it ships**: you're credited on the spec, you get a `Co-Authored-By:` trailer on the merge commit, and you appear on the app's contributors page.
+
+        Read the full flow at the [Users are the moat](https://docs.conduction.nl/strategy/users-are-the-moat) strategy doc.

.forgejo/issue_template/technical-task.yml

@@ -0,0 +1,92 @@
+name: "⚙️ Technische Taak"
+description: "Infra, refactor, technische schuld of ops-werk"
+title: "[TECH] "
+labels: ["technical", "needs-refinement"]
+assignees: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Technische Taak
+        Gebruik dit template voor infra-wijzigingen, refactoring, technische schuld of operationeel werk zonder directe gebruikerswaarde.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: "Beschrijving"
+      description: "Wat moet er gedaan worden en waarom?"
+      placeholder: "Migreer de WOO-platform PVC's naar S3 primary storage op Fuga Cloud."
+    validations:
+      required: true
+
+  - type: textarea
+    id: motivation
+    attributes:
+      label: "Motivatie / Aanleiding"
+      description: "Welk probleem lost dit op? Waarom nu?"
+      placeholder: "Huidige lokale PVC's lopen vol en zijn niet HA. Zie ook issue #123."
+    validations:
+      required: false
+
+  - type: textarea
+    id: approach
+    attributes:
+      label: "Aanpak (globaal)"
+      description: "Hoe gaan we dit oplossen? Welke keuzes zijn al gemaakt?"
+      placeholder: |
+        1. Backup bestaande data
+        2. S3 bucket aanmaken op Fuga Cloud
+        3. Nextcloud occ storage:update uitvoeren
+        4. Smoke test per namespace
+    validations:
+      required: false
+
+  - type: textarea
+    id: acceptance-criteria
+    attributes:
+      label: "Acceptatiecriteria"
+      value: |
+        - [ ] Taak uitvoerbaar via Ansible/Terraform (geen handmatige stappen)
+        - [ ] Gedocumenteerd in runbook of ADR
+        - [ ] Getest in acceptatieomgeving vóór productie
+        - [ ] Rollback-procedure beschreven
+        - [ ] Geen downtime buiten afgesproken window
+        - [ ] Gereviewd (4-eyes)
+        - [ ] Geen nieuwe security findings
+    validations:
+      required: true
+
+  - type: textarea
+    id: risks
+    attributes:
+      label: "Risico's / Afhankelijkheden"
+      placeholder: "Afhankelijk van beschikbaarheid acceptatieomgeving. Risico: dataverlies bij fout in migratiescript."
+    validations:
+      required: false
+
+  - type: dropdown
+    id: category
+    attributes:
+      label: "Categorie"
+      options:
+        - "Infra / ops"
+        - "Refactor"
+        - "Technische schuld"
+        - "Security"
+        - "Performance"
+        - "CI/CD"
+        - "Documentatie"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: priority
+    attributes:
+      label: "Prioriteit"
+      options:
+        - "🔴 Critical"
+        - "🟠 High"
+        - "🟡 Medium"
+        - "🟢 Low"
+    validations:
+      required: true