sync: dev -> master - #5

Tracked .serena/project.yml and .mcp.json, uniform across the
MinSpec org, so every checkout and worktree of this repository is a
Serena-served agent workspace with identical scope. The PHP backend
is Phpactor (PHAR-managed, no Node). Mate is deliberately absent:
it is application-scoped by nature and lives in minspec/workbench,
the org's application host.

Source: owner 2026-09-01
Source: original
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ

docs: state the Raddy runtime supersession

repo: register Serena for agent sessions

CI on pull requests and on pushes to dev and the stable branch:
JSON and YAML validity as the sanity floor; real checks grow with
the repo's content. Public repo: GitHub-hosted runners are free;
the check name "ci" is the required context the dev ruleset pins.

Source: owner 2026-09-01
Source: original
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ

repo: real CI — the ci workflow on dev

A pinned Gitea (1.24) as the org's local forge/CI muscle, ports
offset (+300) to coexist with the maintainer's other local lane;
an act_runner (0.2.13) behind the runner profile so the base up
starts Gitea alone and the runner joins only after its registration
token exists — the two-step the House lane taught. GitHub remains
canonical; this is muscle, not authority.

Source: owner 2026-09-01
Source: original
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ

Findings applied from the independent audit (CHANGES verdict):
workflow-level permissions contents:read; persist-credentials false
on checkout; every action pinned to a reviewed commit SHA with its
tag in a comment; Serena pinned in .mcp.json to the audited git
commit instead of floating uvx resolution.

Finding: [P1] workflows ran with default token permissions
Finding: [P1] .mcp.json launched unversioned uvx serena
Finding: [P2] mutable action tags across all repositories
Verified: python yaml.safe_load + json.load on the changed files

Source: original
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reviewed-by: GPT-5 Codex <noreply@openai.com>
Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ

repo: workflow and MCP hardening from the security audit

Add the organisation's term wall to the `ci` job, right after
checkout, pinned to the commit under review in minspec/.github#8.
The step reads its pattern from the repository variable TERM_WALL
and refuses when that is unset, so an unconfigured repository fails
instead of passing.

Source: original
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY
Apply-Push-Job: 20260901T230943Z-apply-push-7fbc6a
Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6

repo: run the term wall in CI

`pull_request` without `types` fires on opened, synchronize and
reopened only, so a title or body edited after the checks passed
reached the merge unscanned. Name the types and add `edited`; the
wall then runs against the current text.

Source: original
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY
Apply-Push-Job: 20260901T234706Z-apply-push-623006
Patch-SHA256: 5bd4712af8c79fee62fd38b617467cd3bc0c814a188db1a96af657736a143c67

repo: scan a pull request again when its text is edited

minspec/.github#10 pins the content surface to every tracked blob,
read from the object store, bytewise, symlinks never followed. Point
the wall step at that merge.

Source: original
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY
Apply-Push-Job: 20260902T004100Z-apply-push-167d53
Patch-SHA256: 12e1e77943a5566f4eae02f325f05a8e1363f3b0b7769ef98d99b87e7b1955bd

repo: move the wall to the object-store scan