sync: dev -> master - #5
Merged
Merged
Conversation
The README no longer presents FrankenPHP as the runtime identity: the PHP server runtime is migrating to Raddy by maintainer decision (2026-09-01). FrankenPHP remains in the tree until that migration lands, stated honestly rather than edited away — the replacement is engineering work scheduled with the runtime pilot, not a docs pass. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
Tracked .serena/project.yml and .mcp.json, uniform across the MinSpec org, so every checkout and worktree of this repository is a Serena-served agent workspace with identical scope. The PHP backend is Phpactor (PHAR-managed, no Node). Mate is deliberately absent: it is application-scoped by nature and lives in minspec/workbench, the org's application host. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
docs: state the Raddy runtime supersession
repo: register Serena for agent sessions
CI on pull requests and on pushes to dev and the stable branch: JSON and YAML validity as the sanity floor; real checks grow with the repo's content. Public repo: GitHub-hosted runners are free; the check name "ci" is the required context the dev ruleset pins. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
repo: real CI — the ci workflow on dev
A pinned Gitea (1.24) as the org's local forge/CI muscle, ports offset (+300) to coexist with the maintainer's other local lane; an act_runner (0.2.13) behind the runner profile so the base up starts Gitea alone and the runner joins only after its registration token exists — the two-step the House lane taught. GitHub remains canonical; this is muscle, not authority. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
infra: the local forge lane — Gitea, runner behind a profile
Findings applied from the independent audit (CHANGES verdict): workflow-level permissions contents:read; persist-credentials false on checkout; every action pinned to a reviewed commit SHA with its tag in a comment; Serena pinned in .mcp.json to the audited git commit instead of floating uvx resolution. Finding: [P1] workflows ran with default token permissions Finding: [P1] .mcp.json launched unversioned uvx serena Finding: [P2] mutable action tags across all repositories Verified: python yaml.safe_load + json.load on the changed files Source: original Co-Authored-By: GPT-5 Codex <noreply@openai.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Reviewed-by: GPT-5 Codex <noreply@openai.com> Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
repo: workflow and MCP hardening from the security audit
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230943Z-apply-push-7fbc6a Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6
repo: run the term wall in CI
`pull_request` without `types` fires on opened, synchronize and reopened only, so a title or body edited after the checks passed reached the merge unscanned. Name the types and add `edited`; the wall then runs against the current text. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T234706Z-apply-push-623006 Patch-SHA256: 5bd4712af8c79fee62fd38b617467cd3bc0c814a188db1a96af657736a143c67
repo: scan a pull request again when its text is edited
minspec/.github#10 pins the content surface to every tracked blob, read from the object store, bytewise, symlinks never followed. Point the wall step at that merge. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260902T004100Z-apply-push-167d53 Patch-SHA256: 12e1e77943a5566f4eae02f325f05a8e1363f3b0b7769ef98d99b87e7b1955bd
repo: move the wall to the object-store scan
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stable sync per the master-through-dev topology (owner order, 2026-09-01): master receives dev's merged state by PR, never by direct push.
🤖 Generated with Claude Code
https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ