v0.5.0

Added

• Conditional skill filtering by tags. A skill declares tags in its SKILL.md frontmatter under the Agent Skills standard's sanctioned metadata extension point — metadata.boost-tags, a space-delimited string. A project declares the tags it wants in boost.php via ->withTags(Tag::Php, 'jira', ...). During project-scope boost:sync a vendor skill is fanned out only when every tag it declares is among the project's tags, so a project never receives — and the AI agent's skill-selection index never even sees the description of — skills irrelevant to it. Untagged skills always ship. A malformed metadata.boost-tags fails closed (the skill ships nowhere) rather than silently becoming untagged and leaking. When a skill stops shipping, its previously-synced agent-directory output is pruned — safely: only directories boost-core itself wrote, never through symlinks; boost:sync --check reports the would-be deletion as drift without performing it.
• ->withExcludedSkills(['vendor/package:skill-name']) — a per-skill deny-list that drops specific vendor skills regardless of tags, for when you want a vendor's bundle minus one entry.
• SanderMuller\BoostCore\Enums\Tag enum — a non-authoritative convenience enum giving boost.php authors autocomplete for common tags without closing the (open, free-string) tag vocabulary: ->withTags() accepts both Tag cases and raw strings.
• composer boost:doctor tag report. A new section reports the project's declared tags, the runtime union of tags across installed allowlisted skills, per-skill tag status (eligible / filtered / excluded / invalid), and likely-typo hints for near-duplicate tags.
• boost-core now distributes a boost-config-shape skill (resources/boost/skills/) — installing boost-core gives downstream AI agents a skill describing boost.php's structure, including the new withTags() / withExcludedSkills() calls.

Changed

• BoostConfigWriter is now format-preserving. When boost.php is rewritten (e.g. boost:install re-running against an existing file), comments, blank-line layout, and unrelated formatting are preserved instead of being normalised away — the writer mutates only the nodes it must, via PHP-Parser's printFormatPreserving printer.
• The Agent enum is emitted in short form (Agent::CLAUDE_CODE, not \SanderMuller\BoostCore\Enums\Agent::CLAUDE_CODE) when the boost.php being written already imports the enum, so generated config matches hand-written style.

Fixed

• No more spurious self-collision warning during composer global operations. boost-core's own dev-main branch-alias surfaced the root package as a Composer AliasPackage, which runGlobalSync then iterated a second time — tripping the basename-collision guard against boost-core itself. Alias entries are now skipped during global sync, and the stale dev-main → 0.3.x-dev branch-alias has been dropped from composer.json entirely (a regularly-tagged plugin gains nothing from it).

Internal

• New SkillTagFilter, SkillTagDiagnostics, FilteredSkillPruner, Enums\Tag, and Config\BoostConfigPrinter classes carry the feature; the tag filter runs in SyncEngine::resolveSkills() before collision resolution so only shippable skills enter resolution.

Upgrade notes

composer require sandermuller/boost-core:^0.5.0. The upgrade is hands-off — there is no migration and no behaviour change for existing installs. Tag filtering stays inert until a skill declares metadata.boost-tags and a project declares ->withTags(); until then every skill ships exactly as before. Bundle packages (sandermuller/project-boost, sandermuller/package-boost-php, sandermuller/package-boost-laravel) roll the new boost-core through transitively as they re-tag.

Note for skill publishers: tagging a skill that consumers already receive is a consumer-visible change — a project that has not declared the matching tag will stop receiving that skill on its next sync. Tag skills from the start, or treat adding a tag to a shipped skill as a breaking change for that package.

Full changelog: 0.4.0...0.5.0