v1.0.0

package-boost-php is now SemVer-stable. The public surface declared in
PUBLIC_API.md
is locked for the 1.x line:

• the AutoSync composer-hook façade (run / runWithSummary),
• the bin/package-boost-php CLI contract (the gitattributes / lean
  command names, their options, and exit codes),
• the # >>> package-boost (managed) >>> managed-block marker format.

Everything marked @internal remains free to change.

Breaking

• sandermuller/boost-core constraint narrowed to ^1.0 (from
  ^0.20 || ^0.21 || ^0.22 || ^0.23), dropping the boost-core 0.x line.
  boost-core 1.0.0 is a drop-in over 0.23.3 (no API break), so the bump is
  mechanical — composer require sandermuller/boost-core:^1.0. The
  surfaces this package consumes (the BoostAutoSync hooks, the
  BoostBaseCommand @api helpers, the boost.php authoring API) are
  frozen and unchanged. See
  UPGRADING.md.

No source/behavior changes — the package's runtime behavior is identical to
0.20.x. This release formalizes the API surface and aligns the dependency
floor with boost-core's own 1.0 freeze.

Full Changelog: 0.20.0...1.0.0

v0.20.0

Changed

• Skill sources moved to directory form (<name>/SKILL.md) — the
  shape boost-core emits and the reference catalogs all use. The three
  shipped skills (lean-dist, skill-authoring, writing-file-emitter)
  are now authored as directories; guidelines stay flat. No consumer
  impact — boost-core discovers skills by name and the emitted SKILL.md
  content is unchanged; this is authoring uniformity, and boost-core
  accepts both forms.
• skill-authoring skill now documents the directory-form rule, and
  its frontmatter name guidance is corrected for directory-form skills
  (the name matches the skill's directory, not the literal SKILL
  filename).

Non-breaking — skill-source layout + authoring guidance. The set of
shipped skills, their names, and their emitted output are unchanged.

Full Changelog: 0.19.1...0.20.0

v0.19.1

Changed

• Widened the sandermuller/boost-core constraint to admit ^0.23
  (now ^0.20 || ^0.21 || ^0.22 || ^0.23). boost-core 0.23 is a pre-1.0
  additive minor — the surfaces this package consumes (the BoostAutoSync
  composer hooks, the BoostBaseCommand-derived CLI commands, and the
  boost.php authoring API) are unchanged. Verified on 0.23.0: config
  loads, boost doctor clean, both CLI commands succeed, suite green;
  --prefer-lowest still resolves boost-core 0.20.0.

Non-breaking — a constraint widen. Consumers already on boost-core 0.20–0.22
need no change; those on 0.23 can now install this package.

Full Changelog: 0.19.0...0.19.1

v0.19.0

Added

• PUBLIC_API.md — declares the package's semver-protected surface
  ahead of the eventual 1.0 freeze. The stable surface is the AutoSync
  composer-hook façade (run / runWithSummary), the
  bin/package-boost-php CLI contract (the gitattributes / lean
  command names, their --check / --working-dir options, and the
  0 ok / 1 failure exit codes), and the # >>> package-boost (managed) >>>
  managed-block marker format. Everything else is @internal.

Changed

• Surface markers added in source: @api on AutoSync; @internal
  on ManagedBlockWriter and the two CLI command classes. These document
  intent — the CLI invocation and the marker format are the contract, not
  the PHP classes. No behavior change.

Non-breaking — documentation and PHPDoc annotations only. Prepares the
package to tag 1.0.0 in lockstep with boost-core's 1.0 freeze (at which
point the surface above locks for the 1.x line).

Full Changelog: 0.18.1...0.19.0

v0.18.1

Changed

• Widened the sandermuller/boost-core constraint from ^0.20 to
  ^0.20 || ^0.21 || ^0.22. boost-core 0.21 and 0.22 are additive over
  0.20 for this package's surface — the BoostAutoSync composer hooks, the
  two BoostBaseCommand-derived CLI commands, and the boost.php
  authoring API are unchanged (and frozen @api as of boost-core 0.22).
  Verified on 0.22.0: config loads, boost doctor clean, both CLI commands
  succeed, suite green; --prefer-lowest still resolves boost-core 0.20.0.

Non-breaking — a constraint widen only. Consumers already on boost-core
0.20 need no change; those on 0.21/0.22 can now install this package.

Full Changelog: 0.18.0...0.18.1

v0.18.0

Breaking — sandermuller/boost-core floor raised to ^0.20

The sandermuller/boost-core constraint narrows from ^0.18 || ^0.19
to ^0.20, dropping support for boost-core 0.18 and 0.19.

boost-core 0.20 makes the BoostConfig builder methods array-typed. The
withTags() variadic form fatals on 0.20, and the new array form fatals
on 0.18/0.19 — the two styles cannot be expressed compatibly in a single
boost.php, so the floor moves to 0.20 in lockstep.

If your composer.json requires boost-core below ^0.20, bump it:

composer require sandermuller/boost-core:^0.20

withTags() is now array-typed

Update your boost.php (or .config/boost.php) to pass an array:

-    ->withTags(
-        Tag::Php,
-        'release-automation',
-    );
+    ->withTags([
+        Tag::Php,
+        'release-automation',
+    ]);

Only withTags() callers using the variadic form need the change —
withAgents(), withAllowedVendors(), withExcludedSkills(),
withRemoteSkills(), and withConventions() already took arrays. See
UPGRADING.md
for the full note.

Changed

• minimum-stability set to stable (was dev), with
  prefer-stable: true unchanged. No dependency requires dev stability.

No source/API changes — the package's public surface is unchanged. This
release is constraint and configuration only.

Full Changelog: 0.17.0...0.18.0

v0.17.0

Breaking — sandermuller/boost-core floor raised to ^0.18

The sandermuller/boost-core constraint narrows from
^0.16 || ^0.17 || ^0.18 to ^0.18 || ^0.19, dropping support for
boost-core 0.16 and 0.17.

This package now uses boost-core's .config/ layout — config at
.config/boost.php, sync manifest under .config/boost/. Config-path
resolution arrived in boost-core 0.17, but the manifest relocation from
root .boost/ to .config/boost/ only landed in 0.18, so 0.18 is the
floor where the .config/ layout is fully consistent.

If your composer.json requires boost-core below ^0.18, bump it:

composer require sandermuller/boost-core:^0.18

Already on boost-core ^0.18 or later? No action needed. See
UPGRADING.md
for the full migration note.

Changed

• Dogfood config moved to .config/boost.php. This repo's own boost
  config now lives under .config/ instead of the repo root, demonstrating
  the layout boost-core 0.18+ supports. boost-core resolves either location
  (root boost.php or .config/boost.php) — but not both at once, or it
  fails loud. Consumers may relocate their own config the same way; a root
  boost.php keeps working unchanged.
• stolt/lean-package-validator widened to ^5.7 || ^6.0, allowing
  consumers to resolve the 6.x line.

No source/API changes — the package's public surface is unchanged. This
release is constraint and configuration-layout only.

Full Changelog: 0.16.3...0.17.0

v0.16.3

0.16.3

A dependency-constraint widen. No code, API, or behavior change in this package.

Changed

• sandermuller/boost-core constraint widened to ^0.16 || ^0.17 || ^0.18. Both new boost-core minors are additive and backward-safe — 0.17 adds the .config/ config layout, 0.18 adds sync/doctor/validate observability and groups runtime state under .config/boost/. Neither touches an API this package depends on, so the widen is non-breaking and ships as a patch. Consumers can now resolve boost-core 0.17 or 0.18 alongside package-boost-php without a floor move.

Full Changelog: 0.16.2...0.16.3

v0.16.2

⚠️ Correction (post-release): 0.16.2 also narrowed the sandermuller/boost-core constraint from ^0.13 || ^0.14 || ^0.15 || ^0.16 to ^0.16 — dropping support for boost-core 0.13–0.15. That is a breaking change and warranted a 0.17.0 bump, not a patch; the original "non-breaking" wording below was inaccurate. The family had already converged on boost-core ^0.16, so no current consumer is affected; consumers pinned to boost-core < 0.16 must upgrade it. See UPGRADING (0.16.1 → 0.16.2).

---

Fixed — .gitattributes managed-block writer

Edge-case correctness fixes to the block the gitattributes command maintains:

• Malformed-block recovery is now self-healing. A block with an opening marker but no closing marker previously caused the next sync to append a second block, leaving successive syncs unstable. The writer now collapses the region into a single clean block, and sync() is idempotent for any input (sync(sync(x)) === sync(x)).
• The file's dominant line ending is preserved. A CRLF-authored .gitattributes stays CRLF instead of being rewritten to LF; a mostly-LF file with a stray CRLF line settles to LF rather than churning every line.
• Whitespace-variant canonical rules are recognised, not duplicated. A managed export-ignore entry written with different padding is treated as managed instead of being kept (and re-emitted) as a "foreign" line.
• Repeated foreign lines inside the block are de-duplicated.

Added

• Test coverage for the lean and gitattributes CLI commands — exit codes, --check no-write behaviour, foreign-line preservation end-to-end, and validator-binary resolution are now pinned. The test suite grows from 8 to 21.

Changed

• lean-dist skill now points at the live managed block and .lpv as the source of truth for export-ignore entries, replacing a hard-coded list that had drifted from what the tool actually writes.
• README: removed stale version pins (version-agnostic restatements).
• Internal: removed an unreachable validator-binary fallback in the lean command.

Patch release — non-breaking. The public API is unchanged; the writer simply behaves correctly on the edge cases above.

Full Changelog: 0.16.1...0.16.2

v0.16.1

sandermuller/boost-core widened to accept ^0.16

0.16.1 widens the boost-core constraint from ^0.13 || ^0.14 || ^0.15 to ^0.13 || ^0.14 || ^0.15 || ^0.16 — a non-breaking "track latest" bump that absorbs boost-core 0.16.0 without dropping support for 0.13–0.15.

boost-core 0.16.0 adds conventions-token leak detection (boost sync / boost doctor / boost validate --strict surface an unresolved <!--boost:conv--> token that would otherwise land verbatim in an emitted agent file). It is non-load-bearing for package-boost-php — this package ships zero convention tokens and declares no withConventions([...]), so the detector has nothing to scan here. Dogfood output is byte-identical to boost-core 0.15.

No code, public-API, or skill changes. If you stay on boost-core ^0.13–^0.15, no action is required.

Full Changelog: 0.16.0...0.16.1