[OpenSpec] outbound-call-log-investigation-window #2538

⚠️ OpenSpec-managed issue — this content is automatically synced
from the openspec/ directory. Manual edits will be overwritten on next sync.

Artifacts

• ✅ Metadata
• ✅ Proposal
• ✅ Specs
• 🔲 Design
• ✅ Tasks
• 🔲 Plan
• 🔲 Review

Summary

Store the bodies of outgoing calls only while an administrator has opened a bounded investigation window on that source, keep a failed call replayable, and age captured bodies out.

• Rows: Woo row 13.23 "Outgoing request logging can be switched on for an investigation and switches itself off again" (not statutory). The row closes when the second part lands too.
• Wave: 1.
• Depends on: nothing. The second part, integriq/outbound-call-log-investigation-window-page-and-allowlist, depends on this one and builds item 6 of "What changes" (the code allowlist) and the source page.
• Decision: D5 (2026-10-05), the row wins over REQ-OCD-001: body capture is opt-in and time-boxed.

Build rules: openspec/woo-build-rules.md

Specs

• 📄 outbound-call-log

Tasks

• Implement. Every route carries its Nextcloud auth attribute; the controller checks admin itself (no #[NoAdminRequired] with a body that needs admin).
• Test: PHPUnit tests/Unit/Controller/BodyCaptureControllerTest.php (testAnAdministratorOpensAWindowWithAReason, testMoreHoursThanTheMaximumIsRefused, testAReaderCannotOpenAWindow, testClosingEarlyIsAudited)
• Wiring: a route test that resolves both routes in appinfo/routes.php to existing controller methods (gate route-reachability covers this; run it)
• Implement
• Test: PHPUnit tests/Unit/Service/CallServiceBodyCaptureTest.php (testAFailureOutsideAWindowStoresNoBody, testASuccessInsideAWindowStoresBothBodies, testACallAfterTheWindowEndsStoresNoBody, testABrokenSettingsReadStoresNoBody, testBufferedRecordsFollowTheSameRule). Assert on the array handed to ObjectService::saveObject(). Double OpenRegister's ObjectService with environmentAwareDouble, after reading its real saveObject() signature; do not hand-roll a stub.
• The first test, testAFailureOutsideAWindowStoresNoBody, must be shown failing on development before the change. Paste the failing line in the PR body.
• Implement
• Test: PHPUnit CallReplayServiceTest::testASuccessfulReplayRemovesTheReplayRequest, CallLogControllerTest::testTheReplayRequestIsHiddenFromAReader; the existing replay tests stay green
• Implement
• Test: PHPUnit tests/Unit/BackgroundJob/LogCleanUpTaskTest.php (testExpiredBodiesAreStrippedAndTheRecordKept, testReplayRequestEndsWithTheErrorRetention)
• Wiring: assert the task is still registered in appinfo/info.xml <background-jobs> and runs the new step from run()
• Own clone, git checkout --no-track -b <branch> origin/development, TMPDIR a sibling outside the clone.
• PHPUnit judged by the Tests: line, or with --no-coverage; a green suite exits 1 without a coverage driver.
• run-hydra-gates.sh --base origin/development, counting the gates that ran.
• Once before push: COMPOSER_PROCESS_TIMEOUT=0 composer check:strict, npm run lint, npm run format, npm run check:l10n, npm run check:l10n-js, npm run check:manifest, npm run check:schema-l10n.
• CI runs the gates on the full tree; the coverage guard needs a test for every added statement.
• openspec validate outbound-call-log-investigation-window --type change --strict passes.
• One PR, --base development; merge development in, never rebase; no Co-Authored-By trailer.
• Done means merged on development with CI green. Row 13.23 is production only once a store release carries it.

Synced from openspec/changes/outbound-call-log-investigation-window by OpenSpec workflow
App: integriq