sync: dev -> master

.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: ci
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+  push:
+    branches: [dev, master]
+permissions:
+  contents: read
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: term wall
+        uses: minspec/.github/.github/actions/term-wall@a5d88bb5b9bb744cf23c8829436e32f03d58c79d # minspec/.github#10
+        env:
+          TERM_WALL: ${{ vars.TERM_WALL }}
+      - name: JSON validity
+        run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty
+      - name: YAML validity
+        run: python3 -c "import glob,yaml; [list(yaml.safe_load_all(open(p))) for g in ('**/*.yml','**/*.yaml') for p in glob.glob(g,recursive=True) if '/.git/' not in p]"

.mcp.json

@@ -0,0 +1,17 @@
+{
+  "mcpServers": {
+    "serena": {
+      "command": "uvx",
+      "args": [
+        "--from",
+        "git+https://github.com/oraios/serena@43ae0211d7f3bba4101cd0552707fa21d37f4c84",
+        "serena",
+        "start-mcp-server",
+        "--context",
+        "claude-code",
+        "--project",
+        "."
+      ]
+    }
+  }
+}

.serena/project.yml

@@ -0,0 +1,11 @@
+# Serena project config for minspec/docker — tracked, so every worktree and
+# session resolves the same scope. Uniform across the MinSpec org; the
+# PHP backend is Phpactor (PHAR, PHP >= 8.1, no Node).
+project_name: "minspec-docker"
+languages: ["php_phpactor"]
+encoding: "utf-8"
+ignore_all_files_in_gitignore: true
+ignored_paths:
+  - "var/**"
+  - "vendor/**"
+read_only: false

README.md

@@ -1,2 +1,4 @@
 # docker
-Official Docker, FrankenPHP, Caddy, and Mercure runtime wrapper for MinSpec applications.
+Official Docker, Caddy, and Mercure runtime wrapper for MinSpec applications.
+
+The PHP server runtime is migrating to Raddy by maintainer decision (2026-09-01). FrankenPHP remains in this tree until that migration lands; new work should not deepen the FrankenPHP coupling.

compose.yaml

@@ -0,0 +1,46 @@
+# MinSpec local forge lane: Gitea, with an act_runner behind a profile.
+#
+# This starts the local CI muscle first; the application runtime wrapper
+# (Caddy, Mercure, the Raddy migration) arrives separately. Images are
+# version-pinned — bump deliberately, never track latest.
+#
+# Ports are offset (+300/+3300) so this lane coexists with the
+# maintainer's other local Gitea lane.
+#
+#   docker compose up -d                # Gitea only, http://localhost:3300
+#   # then: Gitea admin -> Actions -> Runners -> create registration token
+#   export GITEA_RUNNER_REGISTRATION_TOKEN=...
+#   docker compose --profile runner up -d
+services:
+  gitea:
+    image: gitea/gitea:1.24
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__server__ROOT_URL=http://localhost:3300/
+    volumes:
+      - gitea-data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "3300:3000"
+      - "3322:22"
+    restart: unless-stopped
+
+  runner:
+    image: gitea/act_runner:0.2.13
+    profiles: [runner]
+    depends_on:
+      - gitea
+    environment:
+      - GITEA_INSTANCE_URL=http://gitea:3000
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN:-}
+      - GITEA_RUNNER_NAME=minspec-local
+    volumes:
+      - runner-data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    restart: unless-stopped
+
+volumes:
+  gitea-data:
+  runner-data: