[rubenvdlinde]

What this does

Change search-ai-prefix-shortcuts (archived in this PR at openspec/changes/archive/2026-09-30-search-ai-prefix-shortcuts). Stacked on #784 (feat/launcher-tile-sorting): this branch contains every PR below it. Land the stack in order, or land the top PR with a merge commit and the ones below close with it.

• Administrators define up to 30 search shortcuts on a new "Search shortcuts" admin tab: a prefix (! and 1 to 10 letters or digits, unique), a name, and an https address with {query}. The server refuses anything else ("Use an https address that contains {query}"). GET/PUT /api/admin/search-shortcuts, admin only.
• The list reaches every page through the workspace initial state (searchShortcuts, optional key).
• In a search widget, a query whose first word is a known prefix shows one result, "Search TOPdesk for printer 3e verdieping", and Enter opens the address with the encoded rest in a new tab (noopener). An unknown prefix filters tiles as before. ! or ? lists the shortcuts; Enter on one types its prefix.

Rows moved to built: d-search-prefix (built.change = openspec/changes/archive/2026-09-30-search-ai-prefix-shortcuts). The spec delta is folded into the main spec; the design records what the build corrected.

Tests (red first)

• tests/Unit/Service/SearchShortcutServiceTest.php (prefix pattern, uniqueness, https template, limit, stale stored list); red run: 11 errors
• tests/Unit/Service/InitialStateBuilderTest.php (the list reaches the workspace)
• src/components/__tests__/RuntimeShellSearch.shortcuts.spec.js, src/components/admin/tabs/__tests__/SearchShortcutsTab.spec.js

Playwright tasks are not written; the specs carry @e2e exclude naming these files.

Verified

• The stack now contains origin/development 5288399 (merged into feat(people): find colleagues by expertise and show extra profile fields #743 and up the stack; l10n catalogues merged per key, info.xml 1.1.7-unstable.20261005190000 for the whole stack, one migration Version002012).
• Full local mirror of the required CI jobs on the stack top (feat/launcher-tile-internal-address): npm lint, format, check:manifest, check:schema-l10n, l10n-parity and Vitest (963 of 963) all 0 on 7579477; the later source changes are three @spec comments (eslint 0 on those files). composer check:strict (lint, phpcs, phpmd, psalm, phpstan, PHPUnit 1948 tests, 14 skipped database tests that run in CI) and phpmetrics: 0 on 4a17769, after fixing six phpmd findings the stack introduced: BookmarkImportController coupling and static access (4e44727), PageController::index() length and TileUpdater complexity (4a17769).
• Hydra gates at CI's version (hydra-gates@main 4de7693, full scope, --require-full-coverage) on b2005d8: 85 of 86 applicable gates pass. Gate 16 found four untagged hooks, fixed where they were introduced (tile sorting, shortcuts, bookmarks). Gate 23 fails with the one match development itself has (PermissionService, RoleFeaturePermissionService, rule consume-or-rbac-fleet-wide); inherited, not touched here, and waiting on a decision.
• No local production build; CI's Frontend Build is the check.

Live check

Admin settings, LaunchPad, "Search shortcuts": add !t, "TOPdesk", https://topdesk.example.nl/search?q={query}, save. In a search widget type !t printer 3e verdieping: one result, Enter opens ...?q=printer%203e%20verdieping in a new tab. Type ?: the shortcuts are listed. An http:// address is refused on save.

[github-actions]

Quality Report — ConductionNL/launchpad @ 1712dd1

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 104/104
npm			✅	✅ 636/636
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-05 18:06 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/launchpad @ 8c1358b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
format		❌
check-schema-l10n		✅
composer			✅	✅ 107/107
npm			❌	✅ 636/636
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌
Newman					❌
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-23 05:24 UTC

Download the full PDF report from the workflow artifacts.