Runtime-manifest (GET /api/manifest) output fails v2 validation against the pinned lib schema — silent fallback to the bundled stub

[rubenvdlinde]

Found in the 2026-07-06 manifest fleet audit (e2e T4): [useAppManifest] Resolved manifest failed schema validation; keeping the unresolved bundled manifest. The per-user manifest assembled by lib/Controller/ManifestController.php::buildManifest() never actually replaces the stub — mydash/OpenBuild introspection consumers see the stub, not the user's dashboards.

Two causes:

1. Pinned @conduction/nextcloud-vue is beta.102 — its bundled v2 schema predates the top-level runtime key the controller emits (additionalProperties:false → reject). Fleet-wide pin refresh is audit item 21; launchpad needs it for this feature to work at all.
2. Widget-entry shape: pages[].widgets is filled from the dashboard store's placement rows (widgetId/gridX/…); the v2 widgetEntry requires widgetKey (+ slot). buildManifest() needs a mapping when the pin is bumped, or the resolved manifest will keep failing on entry shape.

Also: SCHEMA_URL in the controller still points at raw.githubusercontent.com — switch to the pinned Codeberg URL (audit item 7).

Bundled-stub v2 migration landed separately in PR #127. Ref: apps-extra/MANIFEST-AUDIT-2026-07-06.md items 3/7/21.

---

Gemigreerd van Codeberg — oorspronkelijk Conduction/launchpad#128, geopend door rubenvdlinde op 2026-07-06.

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue