v1.10.0: PHP 8.2, Laravel Boost, and a calibrated doctor

Truss now installs on PHP 8.2, down from 8.3, which is what Laravel 12 itself requires. Projects that pin config.platform.php to 8.2.0 were excluded by a floor Truss never needed, and four real applications could not install it for that reason alone. This release also ships Laravel Boost guidelines and a skill, and narrows TRUSS-INT-007 after measuring it against real schemas.

It now installs, boots and runs on 20 real Laravel applications totalling 861 tables, four of which could not install it at all before this release: October CMS, BookStack, Pterodactyl and Azuriom.

Added

• Truss now ships Laravel Boost guidelines and a skill inside the package, so an agent set up through Boost knows Truss is installed and reaches for your real schema instead of guessing at columns. Run php artisan boost:install and tick albertoarena/laravel-truss (guidelines, skills) in the third-party list; nothing third-party is selected by default, so it stays your call, and Boost remembers it for later boost:update runs. The guideline is short and always in context: what Truss is, the commands that ground a task in the real structure, and the boundary. The skill is longer and loads only when a task is actually about the database: read the structure, check it with truss:doctor, make the change, confirm it with truss:diff. This is additive and adds nothing to your dependencies. Boost becomes a third way in alongside the MCP server, which stays the richer surface, and truss:export for CI and any CLI-capable agent. Boost has no mechanism for a package to register an MCP server, so it does not install the Truss MCP server for you, and the two paths stay independent. Turn either off from your own config/boost.php: guidelines.exclude takes albertoarena/laravel-truss/truss, skills.exclude takes truss-schema. Prompted by the Laravel Daily video review of Truss, which made the case that Boost is where many developers now expect an agent to get its Laravel context.

Changed

• TRUSS-INT-007 no longer calls every table with two foreign keys a pivot. Two single-column foreign keys is now necessary but not sufficient: the table must also carry its key pair and little else. Pointed at the twelve real Laravel applications that could run both versions, the old rule fired 69 times and 56 of those were wrong, which was 47% of everything the default recommended preset reported. One of them advised a unique constraint that would have limited a user to a single budget. It now fires 14 times on the same schemas, which are also the schemas the new rule was tuned on. Some true positives are lost on purpose: a genuine pivot carrying two payload columns escapes, because a missed finding costs you nothing and a wrong one costs you a destructive migration. See docs/adr/0003-pivot-detection.md.
• This changes the default preset's output, so a CI job running truss:doctor --fail-on=error may see a different result on an unchanged schema. That is why this is a minor release rather than a patch.
• The minimum PHP version is now 8.2, down from 8.3, which is what Laravel 12 itself requires. Truss previously excluded projects that pin config.platform.php to 8.2.0, which is careful practice rather than a mistake, and BookStack could not install Truss for exactly that reason. See docs/adr/0001-php-82-minimum.md.

Fixed

• Every label in the diagram lost its last character in Firefox on Windows: table names, column names and column types alike, cut in proportion to their length. Reported by @diboma in #59. Mermaid sizes each label box to the text it measures and leaves no slack at all (measured: about 0.002px), so the box is only ever correct for the face it was measured in. The diagram was rendered without waiting for IBM Plex Mono, so with font-display: swap the labels could be measured in the system fallback and then repainted in the real face. Where that fallback is metric-compatible nothing shows, which is why macOS, Linux and CI never saw it and why Chrome on the same Windows machine was fine: it won the race. Windows falls back to Consolas at roughly 0.55em against IBM Plex Mono's 0.60em, so every label painted about 9 percent wider than its box. Measured on the reporter's machine at 78 of 78 labels clipped, median ratio 1.0904, against 1.0909 predicted from the two advance widths. The render now waits for the two weights the diagram actually paints before measuring, and the Blade shell preloads the face so that wait is usually over before it starts. A slow connection is not made to stare at a blank canvas: the diagram is drawn in the fallback after a short timeout and redrawn once the real face arrives. The label-geometry spec now runs in Firefox as well as Chromium, since no other engine reproduced this.
• TRUSS-INT-002 asked for a foreign key on polymorphic columns, contradicting TRUSS-INT-009 inside the same report. Morph columns are now excluded.
• Truss no longer resolves the Gate contract while booting. An application that ships its own authentication and binds no Gate, as October CMS does, could not run any artisan command with Truss installed, including truss:doctor, which never consults the gate and is documented as safe for CI. The gate is now defined when a request needs it. See docs/adr/0002-defer-gate-registration.md.
• The dashboard returns 404 rather than an error when the host application binds no Gate at all, so a route that cannot be authorised stays invisible instead of confirming it exists.
• TRUSS-INT-007 claimed that duplicate pairs were possible on a table where one of the two foreign keys already carried a single-column unique index. A unique user_id makes (user_id, insurance_plan_id) unique by itself, so the finding was not merely noisy, it was false, and the composite unique key it recommended would have been redundant. The rule now accepts a unique index over any part of the pair, provided those columns are NOT NULL, since most engines allow repeated NULLs in a unique index. Unlike the narrowing above, this cannot cost a true positive: it is arithmetic rather than a heuristic. Reported by @belabiedredouane.

Thanks

Both bugs fixed here were found by people outside the project. @diboma reported the Firefox label clipping in #59, down to the machine it reproduced on, which is what made it measurable rather than guesswork. @belabiedredouane reported the TRUSS-INT-007 false positive in #58, on a table where the rule was not merely noisy but wrong. Thank you both.

Full changelog: v1.9.1...v1.10.0