v0.10.0

Adopts the boost-core 0.23 line and locks the package's @api/@internal surface ahead of 1.0.

Breaking

• Requires sandermuller/boost-core ^0.23 (was ^0.22), alongside sandermuller/package-boost-laravel ^0.15 and sandermuller/boost-skills ^2.1. Most apps only bump this package — boost-core resolves transitively:

  composer require "sandermuller/project-boost-laravel:^0.10"

  If you require any boost package directly, move them to the 0.23 line together. Running against boost-core < 0.23 no longer resolves.

Fixed

• A malformed metadata.boost-tags now fails closed. laravel/boost skills are tag-filtered against your withTags(). Previously a malformed (non-string) boost-tags value was treated as "untagged" and shipped to every agent — the opposite of the engine's fail-closed contract. The package now tokenizes and validates tags through boost-core's canonical BoostTags, so a malformed value ships nowhere, matching boost's own behaviour. (An explicitly-empty boost-tags is untagged on purpose — no sidecar-manifest fallback.)

Internal

• Locked the @api/@internal surface for 1.0, documented in the new PUBLIC_API.md. This package exposes no @api PHP classes — it's an artisan/CLI-driven wrapper, so its semver-protected contract is its CLI commands, config keys, and documented behaviour, not a class API. An architecture test fails if any src/ class is added without an explicit @api/@internal mark.

Full Changelog: 0.9.1...0.10.0