ShipKit 3.0.0

Requires shipwithian/shipkit-core 3.0.

• Short frontend files: pages stay at or under 200 lines and other frontend files at or under 400, checked by shipkit-core's FrontendFileLengthTest, so a page composes partials instead of growing into one large file.

shipwithian/shipkit-core 3.0.0

A major release because a new check can fail a project that passed 2.x. UPGRADE.md has the fix.

• Checks: FrontendFileLengthTest fails when a page in resources/js/pages is over 200 lines or any other frontend file is over 400, so pages stay a list of partials instead of growing into thousand-line files. The vendored components/ui primitives are exempt, and shipkit.architecture.long_frontend_files records deliberate exceptions with their reasons.
• Guidance: the js rule says how to split a file before it reaches the limit.
• Internals: ProjectLayout::frontendFiles() lists the project's own TypeScript sources, shared by both frontend checks.

Upgrading

Existing projects update the package with composer require shipwithian/shipkit-core:^3.0 and follow the 3.0 upgrade notes. Template changes are not applied to existing projects: compare the release tags and copy what you want.

ShipKit 2.0.0

Requires shipwithian/shipkit-core 2.0.

• Assign roles to users: a paginated Users page, gated by the new assign roles system permission, sets the roles each user holds. SyncUserRolesAction refuses to add or remove a role holding a permission the actor lacks, so nobody can grant themselves super-admin or strip it from someone with more access, and the last super admin still cannot lose the role.

shipwithian/shipkit-core 2.0.0

A major release because a new system permission makes a 1.0 project's seeder test fail. UPGRADE.md has the fix.

• Access Control records: SystemPermission::AssignRoles (assign roles), the permission to put roles on users, reserved because nobody could otherwise change who holds which role. The bootstrap creates it protected and gives it to super-admin; existing projects run php artisan db:seed --class=AccessControlSeeder again.

Upgrading

Existing projects update the package with composer require shipwithian/shipkit-core:^2.0 and follow the 2.0 upgrade notes. Template changes are not applied to existing projects: compare the release tags and copy what you want.

ShipKit 1.0.0

The first release that lets agents implement features unattended: the rules that protect the application's invariants are enforced by code, tests, and CI instead of by review, and they ship in a versioned package that updates with composer update.

There is no upgrade path from 0.x. ShipKit had no users before 1.0.0, so nothing in this release carries compatibility code. Create new projects from 1.0.0.

Enforcement moves into shipwithian/shipkit-core

• The guard traits, domain exception base class, architecture checks, guarded-table and cascade checks, make:context, and the system roles and permissions live in the package, not in your project. composer update brings improved checks to a project that already exists.
• config/shipkit.php maps the project's Role, Permission, and User models. The application refuses to boot when a mapped model does not use GuardsInvariants.
• php artisan shipkit:verify runs in composer ci:check and fails when core's testsuite is not registered in phpunit.xml, so deleting one line cannot silently turn the checks off.
• The shared .ai rules, skills, and guidelines come from the package through Boost (php artisan boost:update) instead of being copied into each project.

Guarded writes fail closed

• Every query-builder write on a guarded model throws, even for one row, and so do the inherited ones (increment, decrement, touch, forceDelete, updateOrInsert, and the rest). Every Eloquent builder method is classified as guarded, rejected, or safe, and a test fails when a Laravel release adds one that is unclassified.
• is_protected cannot change after a record is created, in either direction. One Access Control bootstrap Action, called by the seeder, is the only code that creates protected records, and a source check fails on any other file that writes the flag.
• The last-super-admin guard is proven under real contention on MySQL and Postgres, in addition to the SQLite suite.

The frontend contract is generated from PHP

• Every Inertia page and the shared props are typed PHP classes. composer types:generate writes the TypeScript types to resources/js/types/generated.ts, and composer ci:check fails when the committed file differs. This adds the spatie/laravel-typescript-transformer dependency.
• Pages receive abilities computed with the Gate from the policy abilities their controllers authorize (can.create, a can on each row, auth.can for navigation). The UI no longer reads permission names, auth.permissions is no longer shared, and a core check fails on permissions.includes(...) in resources/js.

Agent workflow

• .github/CODEOWNERS assigns the maintainer to the checks and to the places their exceptions are recorded. The implement and review-diff skills state the evidence an agent needs to merge project-owned code: a regression test shown failing without the change, a green composer ci:check, and an independent review. docs/branch-protection.md records the repository rules that enforce the split.
• A CI job creates a project from the installer archive with the package from the same commit and runs composer ci:check in it, including the two cases that must fail.

Also since 0.1.0

• Code is organized into DDD-lite bounded contexts (AccessControl, Settings, Authentication) with make:context to add more, enforced by architecture tests.
• API token management endpoints for Sanctum.
• Agent skills are generated when a project is created, and the verify-app skill drives an isolated copy of the app.
• league/commonmark is updated for two security advisories.