Migrate repository context to rabbit.ci and upgrade Worker

.rabbit/README.md

@@ -1,41 +1,34 @@
 # Rabbit CI
 
-This directory owns Rabbit-facing repo context for `udx/worker-php`.
+`worker-php` publishes the PHP Worker runtime image. It does not own tenant
+Rabbit lifecycle manifests, environment configuration, or deployment secrets.
 
-`worker-php` is a runtime image repo. It publishes the Docker image that PHP
-Worker-based applications can consume, but it does not own tenant-specific
-Rabbit lifecycle manifests or environment config.
+## Repository resolution
 
-## Entry Points
+[`repo.yaml`](./repo.yaml) is generated by `rabbit.ci`. It records the
+repository's observable GitHub delivery shape: branch rules, GitHub Environments,
+workflow triggers, and configured secret and variable names. It never includes
+secret or variable values.
 
-- Generated repo context: [`context.yaml`](./context.yaml)
-- Image release workflow: [`../.github/workflows/docker-ops.yml`](../.github/workflows/docker-ops.yml)
-- Worker config contract: [`../worker.yaml`](../worker.yaml)
-- Worker config reference: [`../docs/worker-config.md`](../docs/worker-config.md)
-- Runtime image contract: [`../Dockerfile`](../Dockerfile)
+Regenerate the resolution after changing a GitHub workflow, branch protection,
+Environment, or configured secret or variable name:
 
-## Rabbit Delivery Path
-
-1. Changes to `Dockerfile`, `bin/**`, `ci/**`, `etc/**`, `src/**`, or the
-   Docker workflow run the Docker operations workflow.
-2. The workflow delegates image build, scan, release, and publish behavior to
-   `udx/reusable-workflows`.
-3. The `latest` branch is the release branch for published `worker-php` images.
-4. Tenant repos reference the published image from their own Rabbit lifecycle
-   manifests or deployment config.
-5. Tenant runtime values and secrets belong in the tenant repo or target
-   platform. Image-level defaults and secret references belong in
-   [`../worker.yaml`](../worker.yaml).
+```bash
+rabbit.ci
+```
 
-## Repo Context
+Review and commit the resulting diff with the source change. Do not edit
+`repo.yaml` manually.
 
-[`context.yaml`](./context.yaml) is generated by `dev.kit repo`. Do not edit it
-manually. Refresh it after changing repo-owned docs, manifests, workflows, or
-runtime contracts:
+## Delivery entry points
 
-```bash
-dev.kit repo
-```
+- Image release workflow: [`../.github/workflows/docker-ops.yml`](../.github/workflows/docker-ops.yml)
+- Worker config contract: [`../worker.yaml`](../worker.yaml)
+- Worker config reference: [`../docs/worker-config.md`](../docs/worker-config.md)
+- Runtime image contract: [`../Dockerfile`](../Dockerfile)
 
-Review the generated context before relying on it in an agent session or Rabbit
-CI workflow.
+Changes to `Dockerfile`, `bin/**`, `ci/**`, `etc/**`, `src/**`, or the Docker
+workflow run the Docker operations workflow. It delegates image build, scan,
+release, and publishing to `udx/reusable-workflows`; `latest` is the release
+branch. Tenant repositories consume the published image from their own Rabbit
+manifests or deployment configuration.

.rabbit/repo.yaml

@@ -0,0 +1,85 @@
+kind: repo
+version: udx.dev/rabbit.ci/repo/v1
+repository:
+  name: worker-php
+  owner: udx
+  default_branch: latest
+branches:
+  - name: chore/rabbit-ci-worker-0.52.0
+    rules: {}
+  - name: latest
+    rules:
+      allow_deletions: false
+      allow_force_pushes: false
+      pull_request:
+        approvals: 1
+        code_owner_review: true
+        stale_reviews: true
+        last_push_approval: false
+        conversation_resolution: true
+        merge_methods:
+          - merge
+          - squash
+          - rebase
+      copilot_review:
+        on_push: true
+        drafts: false
+configuration:
+  secrets:
+    organization:
+      - BITBUCKET_TOKEN
+      - CONTEXT7_API_KEY
+      - DEPENDABOT_REVIEWER_TOKEN
+    repository:
+      - DOCKER_TOKEN
+      - GH_TOKEN
+  variables:
+    organization:
+      - DOCKER_LOGIN
+      - DOCKER_ORG
+      - GCP_PROJECT_ID
+      - GCP_REGION
+      - GCP_WORKLOAD_IDENTITY_PROVIDER
+      - GH_SERVICE_ACCOUNT_EMAIL
+    repository:
+      - DOCKER_REPO
+environments:
+  - name: copilot
+    branches:
+      - "*"
+    approvals: []
+    wait_minutes: 0
+    admin_bypass: true
+    secrets: []
+    variables: []
+workflows:
+  - path: .github/workflows/codeql-analysis.yml
+    triggers:
+      push: {}
+    permissions:
+      contents: read
+  - path: .github/workflows/docker-dependency-updater.yml
+    triggers:
+      schedule:
+        - cron: 0 5 * * 1
+      workflow_dispatch: {}
+    permissions:
+      contents: read
+  - path: .github/workflows/docker-ops.yml
+    triggers:
+      push:
+        paths:
+          - .github/workflows/docker-ops.yml
+          - bin/**
+          - Dockerfile
+          - etc/**
+          - ci/**
+          - src/**
+          - LICENSE
+      workflow_dispatch: {}
+  - path: .github/workflows/tests.yml
+    triggers:
+      push: {}
+      pull_request: {}
+    permissions:
+      contents: read

Dockerfile

@@ -1,5 +1,5 @@
 # Use the UDX worker as the base image
-FROM usabilitydynamics/udx-worker:0.48.0
+FROM usabilitydynamics/udx-worker:0.52.0
 
 # Add metadata labels
 LABEL maintainer="UDX"

README.md

@@ -118,9 +118,9 @@ References:
 
 ## Rabbit CI
 
-Rabbit-facing repo context lives in [`.rabbit/`](.rabbit/). This image repo publishes the `worker-php` Docker image; it does not own tenant-specific Rabbit lifecycle manifests.
+Rabbit CI records this repository's GitHub delivery shape in [`.rabbit/repo.yaml`](.rabbit/repo.yaml). This image repo publishes the `worker-php` Docker image; it does not own tenant-specific Rabbit lifecycle manifests.
 
-See [`.rabbit/README.md`](.rabbit/README.md) for Rabbit CI entry points, delivery notes, and generated repo context handling.
+Run `rabbit.ci` after changing the repository's GitHub delivery configuration, including workflows, branch protection, Environments, or configured secret and variable names. Review and commit the generated resolution with the source change. See [`.rabbit/README.md`](.rabbit/README.md) for the resolution boundary and delivery entry points.
 
 ## Resources
 

docs/worker-config.md

@@ -28,11 +28,9 @@ Validate the manifest syntax before opening a PR:
 yq e '.' worker.yaml
 ```
 
-Refresh generated repo context after changing `worker.yaml` or this reference:
-
-```bash
-dev.kit repo
-```
+`worker.yaml` is an image-runtime contract. It is not part of the Rabbit CI
+repository resolution; regenerate `.rabbit/repo.yaml` only when the repository's
+GitHub delivery shape changes.
 
 ## Deployment Behavior