From 9f6fe7bc3161d4800c9a64b2214ef80b1d588397 Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 12:07:33 -0400 Subject: [PATCH 1/8] docs: state the Raddy runtime supersession MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README no longer presents FrankenPHP as the runtime identity: the PHP server runtime is migrating to Raddy by maintainer decision (2026-09-01). FrankenPHP remains in the tree until that migration lands, stated honestly rather than edited away — the replacement is engineering work scheduled with the runtime pilot, not a docs pass. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index cc9659b..4b50ccf 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,4 @@ # docker -Official Docker, FrankenPHP, Caddy, and Mercure runtime wrapper for MinSpec applications. +Official Docker, Caddy, and Mercure runtime wrapper for MinSpec applications. + +The PHP server runtime is migrating to Raddy by maintainer decision (2026-09-01). FrankenPHP remains in this tree until that migration lands; new work should not deepen the FrankenPHP coupling. From e6827c4bd1092a74b242a25450b516f3cbdc6223 Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 12:39:28 -0400 Subject: [PATCH 2/8] repo: register Serena for agent sessions Tracked .serena/project.yml and .mcp.json, uniform across the MinSpec org, so every checkout and worktree of this repository is a Serena-served agent workspace with identical scope. The PHP backend is Phpactor (PHAR-managed, no Node). Mate is deliberately absent: it is application-scoped by nature and lives in minspec/workbench, the org's application host. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- .mcp.json | 8 ++++++++ .serena/project.yml | 11 +++++++++++ 2 files changed, 19 insertions(+) create mode 100644 .mcp.json create mode 100644 .serena/project.yml diff --git a/.mcp.json b/.mcp.json new file mode 100644 index 0000000..e16128b --- /dev/null +++ b/.mcp.json @@ -0,0 +1,8 @@ +{ + "mcpServers": { + "serena": { + "command": "uvx", + "args": ["serena", "start-mcp-server", "--context", "claude-code", "--project", "."] + } + } +} diff --git a/.serena/project.yml b/.serena/project.yml new file mode 100644 index 0000000..4d6f4cc --- /dev/null +++ b/.serena/project.yml @@ -0,0 +1,11 @@ +# Serena project config for minspec/docker — tracked, so every worktree and +# session resolves the same scope. Uniform across the MinSpec org; the +# PHP backend is Phpactor (PHAR, PHP >= 8.1, no Node). +project_name: "minspec-docker" +languages: ["php_phpactor"] +encoding: "utf-8" +ignore_all_files_in_gitignore: true +ignored_paths: + - "var/**" + - "vendor/**" +read_only: false From 5d762cd0e14bb43c9aa74c63bfb6411eb2ec111b Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:16:54 -0400 Subject: [PATCH 3/8] =?UTF-8?q?repo:=20real=20CI=20=E2=80=94=20the=20ci=20?= =?UTF-8?q?workflow=20on=20dev?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI on pull requests and on pushes to dev and the stable branch: JSON and YAML validity as the sanity floor; real checks grow with the repo's content. Public repo: GitHub-hosted runners are free; the check name "ci" is the required context the dev ruleset pins. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- .github/workflows/ci.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..2ee7ec5 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,14 @@ +name: ci +on: + pull_request: + push: + branches: [dev, master] +jobs: + ci: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: JSON validity + run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty + - name: YAML validity + run: python3 -c "import glob,yaml; [list(yaml.safe_load_all(open(p))) for g in ('**/*.yml','**/*.yaml') for p in glob.glob(g,recursive=True) if '/.git/' not in p]" From 4a860a5191b1f810a54044ac89d307041148d5c0 Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:18:10 -0400 Subject: [PATCH 4/8] =?UTF-8?q?infra:=20the=20local=20forge=20lane=20?= =?UTF-8?q?=E2=80=94=20Gitea,=20runner=20behind=20a=20profile?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A pinned Gitea (1.24) as the org's local forge/CI muscle, ports offset (+300) to coexist with the maintainer's other local lane; an act_runner (0.2.13) behind the runner profile so the base up starts Gitea alone and the runner joins only after its registration token exists — the two-step the House lane taught. GitHub remains canonical; this is muscle, not authority. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- compose.yaml | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 compose.yaml diff --git a/compose.yaml b/compose.yaml new file mode 100644 index 0000000..dcb4f1e --- /dev/null +++ b/compose.yaml @@ -0,0 +1,46 @@ +# MinSpec local forge lane: Gitea, with an act_runner behind a profile. +# +# This starts the local CI muscle first; the application runtime wrapper +# (Caddy, Mercure, the Raddy migration) arrives separately. Images are +# version-pinned — bump deliberately, never track latest. +# +# Ports are offset (+300/+3300) so this lane coexists with the +# maintainer's other local Gitea lane. +# +# docker compose up -d # Gitea only, http://localhost:3300 +# # then: Gitea admin -> Actions -> Runners -> create registration token +# export GITEA_RUNNER_REGISTRATION_TOKEN=... +# docker compose --profile runner up -d +services: + gitea: + image: gitea/gitea:1.24 + environment: + - USER_UID=1000 + - USER_GID=1000 + - GITEA__server__ROOT_URL=http://localhost:3300/ + volumes: + - gitea-data:/data + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + ports: + - "3300:3000" + - "3322:22" + restart: unless-stopped + + runner: + image: gitea/act_runner:0.2.13 + profiles: [runner] + depends_on: + - gitea + environment: + - GITEA_INSTANCE_URL=http://gitea:3000 + - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN:-} + - GITEA_RUNNER_NAME=minspec-local + volumes: + - runner-data:/data + - /var/run/docker.sock:/var/run/docker.sock + restart: unless-stopped + +volumes: + gitea-data: + runner-data: From d69f6c22c024a8132f22ee93dc437be46c595eaa Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:43:37 -0400 Subject: [PATCH 5/8] repo: workflow and MCP hardening from the security audit Findings applied from the independent audit (CHANGES verdict): workflow-level permissions contents:read; persist-credentials false on checkout; every action pinned to a reviewed commit SHA with its tag in a comment; Serena pinned in .mcp.json to the audited git commit instead of floating uvx resolution. Finding: [P1] workflows ran with default token permissions Finding: [P1] .mcp.json launched unversioned uvx serena Finding: [P2] mutable action tags across all repositories Verified: python yaml.safe_load + json.load on the changed files Source: original Co-Authored-By: GPT-5 Codex Co-Authored-By: Claude Fable 5 Reviewed-by: GPT-5 Codex Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- .github/workflows/ci.yml | 6 +++++- .mcp.json | 11 ++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2ee7ec5..b05d4a6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,11 +3,15 @@ on: pull_request: push: branches: [dev, master] +permissions: + contents: read jobs: ci: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: JSON validity run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty - name: YAML validity diff --git a/.mcp.json b/.mcp.json index e16128b..7a030cd 100644 --- a/.mcp.json +++ b/.mcp.json @@ -2,7 +2,16 @@ "mcpServers": { "serena": { "command": "uvx", - "args": ["serena", "start-mcp-server", "--context", "claude-code", "--project", "."] + "args": [ + "--from", + "git+https://github.com/oraios/serena@43ae0211d7f3bba4101cd0552707fa21d37f4c84", + "serena", + "start-mcp-server", + "--context", + "claude-code", + "--project", + "." + ] } } } From 4f3b13c41f9786f17e7b7e08e433fd086f279f03 Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 19:09:44 -0400 Subject: [PATCH 6/8] repo: run the term wall in CI Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230943Z-apply-push-7fbc6a Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6 --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b05d4a6..5003b7e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,10 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false + - name: term wall + uses: minspec/.github/.github/actions/term-wall@6175b67bd0df4710dd0bb8b79df413b452265c6c # minspec/.github#8 + env: + TERM_WALL: ${{ vars.TERM_WALL }} - name: JSON validity run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty - name: YAML validity From 20d95669a9569b078738390c2c3f0f3745346c8b Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 19:47:06 -0400 Subject: [PATCH 7/8] repo: scan a pull request again when its text is edited `pull_request` without `types` fires on opened, synchronize and reopened only, so a title or body edited after the checks passed reached the merge unscanned. Name the types and add `edited`; the wall then runs against the current text. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T234706Z-apply-push-623006 Patch-SHA256: 5bd4712af8c79fee62fd38b617467cd3bc0c814a188db1a96af657736a143c67 --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5003b7e..27620d0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,7 @@ name: ci on: pull_request: + types: [opened, synchronize, reopened, edited] push: branches: [dev, master] permissions: From e9cd5e57850c72907bf6cfa5cf50c9b52667c899 Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 20:41:00 -0400 Subject: [PATCH 8/8] repo: move the wall to the object-store scan minspec/.github#10 pins the content surface to every tracked blob, read from the object store, bytewise, symlinks never followed. Point the wall step at that merge. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260902T004100Z-apply-push-167d53 Patch-SHA256: 12e1e77943a5566f4eae02f325f05a8e1363f3b0b7769ef98d99b87e7b1955bd --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27620d0..51e8847 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ jobs: with: persist-credentials: false - name: term wall - uses: minspec/.github/.github/actions/term-wall@6175b67bd0df4710dd0bb8b79df413b452265c6c # minspec/.github#8 + uses: minspec/.github/.github/actions/term-wall@a5d88bb5b9bb744cf23c8829436e32f03d58c79d # minspec/.github#10 env: TERM_WALL: ${{ vars.TERM_WALL }} - name: JSON validity