2.3.0

Two new skills, and the production lessons behind them folded into the existing ones.

Added

• project-status — TLDR + table status report that cross-checks a project's planning tree against live GitHub issues and the code, on the rule that a planning document's claim is never status until the code confirms it. An open issue is very often already built.
• deploy-app — deploy a Kickoff app via bin/deploy over SSH: the verification checklist, a recovery path per failure mode, and the production traps (DB-backed settings overriding .env, host SMTP port blocks, unattended prompts exiting 0, APP_KEY rotation).
• docs/02-development/06-laravel-boost-coexistence.md — which skill names Laravel Boost owns, why a collision between the two is silent, and how to check a project for one.

Changed

• pest-testing renamed to kickoff-pest-testing (migration entry included, so install.sh cleans up the old ~/.claude/skills/pest-testing). Boost's boost:install --skills writes its own pest-testing into the same directory and had already overwritten the toolkit's copy in a live project, undetected. The two are complementary — Boost covers Pest syntax; this covers scaffolding, the Kickoff arch-test baseline and suite performance. The installer only ever touches $HOME, so a project-level Boost skill is never removed by a migration.
• kickoff-pest-testing — new sections on what a green suite does not prove (Alpine, Flux custom elements, deferred wire:model) and on suite performance: seeder placement in $seeder rather than beforeEach (96s → 43s on a 1400-test suite), XDEBUG_MODE pinning, and Test Impact Analysis with pcov.
• livewire-flux — client-side gotchas that ship green: Flux renders <ui-checkbox> not a native input (so every input[type=checkbox] selector matches zero), x-cloak is inert without its CSS rule, a double quote anywhere in an Alpine attribute un-Alpines the whole subtree, and description:trailing for field help text.
• project-laravel — access-control.md gains a tenancy section (a passing policy is not proof of row ownership; scoped finders; per-tenant uniqueness resets; pinning the guard on non-web surfaces). database-conventions.md gains engine portability (MySQL leading-column FK indexes, non-transactional DDL, unreliable hasIndex(), the migrate → rollback → migrate round trip). model-conventions.md gains silent failure modes (undefined relations resolving to null, Traitify's user_id auto-fill, seeder unguarded(), factory visibility branches).
• code-quality — Larastan blind spots: a class docblock must sit above the PHP attributes or it is silently ignored, casts declared via casts() are invisible to it, and generic relation annotations churn the baseline.
• project-conventions — lessons belong in CLAUDE.md and tracking on GitHub, never in a local tasks/todo.md or lessons.md; the multi-repo workspace two-CLAUDE.md pattern; and the repository housekeeping Claude depends on (/.claude/worktrees/ in .gitignore).
• kickoff-patch — records the Kickoff 1.38.0 composer-script change (TIA no longer the default test), the new build/php-ini test tooling, PASSKEYS_USER_HANDLE_SECRET, and the worktrees ignore rule; restores laravel/doctor in the package baseline.

Roster is now 31 skills, 20 agents, 10 commands.

Full Changelog: 2.2.0...2.3.0