[coisa]

Replace the committed Changelog skill with Composer-managed development instructions. Add llm/skills:^1.15 to require-dev, explicitly allow its plugin and register php-fast-forward/changelog through composer skills:add. The generated skills.json selects the upstream ^0.3.0 source; normal development composer install recreates the skill under ignored .agents/skills.

Remove the old payload and receipt, exclude skills.json from Composer archives, and retire the CI/fixer exceptions needed only by the versioned skill. Update contribution/release guidance and add one patch fragment. Runtime dependencies, PHP compatibility, the bundled coisa-error-handler consumer skill and release-workflow configuration stay unchanged.

Explicitly trust the installed Composer packages fast-forward/container and fast-forward/config as skill donors, including transitive Config. The instructions therefore match the resolved package versions; no duplicate GitHub source or wildcard trust is added. A normal composer install was verified to synchronize all three skills.

Validation: Composer manifest validation; full Composer check (380 tests / 1776 assertions, formatter, PHPCS and maximum configured PHPStan); an actual clean-clone composer install with automatic skill synchronization and clean Git status; a verified 85-file Composer archive excluding agent instructions and development configuration. No Composer lockfile or generated skill is committed.

Repeated composer install passed the post-install hook; all three installed skills were verified, with Container/Config bytes matching their resolved Composer donors. The guide also corrects the reviewed synchronization controls: --no-scripts alone does not disable plugin listeners; use --no-plugins or auto-sync: false for that purpose. PHP CI, documentation and Changelog validation passed for a907ec9947c17f7a187cb5e1223de0361fcf84fd, with 22 successful checks/statuses and no failures.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T17:28:57.750295Z	f4eb454	New commits
🔒 Security Review	✅ Completed 2026-10-20T17:30:50.809220Z	f4eb454	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Code Coverage Report: Only Changed Files listed

Package	Base Coverage	New Coverage	Difference
Overall Coverage	🟢 97.16%	🟢 97.16%	⚪ 0%

Minimum allowed coverage is 80%, this run produced 97.16%

Head: a907ec9. Tested commit: c0bc15f. PHP CI run.

[github-actions]

Changelog

✅ Contribution check passed.

Head: a907ec9947c17f7a187cb5e1223de0361fcf84fd

Base: 09a82e343f76e84023a0865e3ec3b6207944ba0f

Contribution: 1 new valid fragment(s). Policy: ordinary.

• composer-managed-changelog-skill.md — changed, patch

  Install the Changelog agent skill through the development-only `llm/skills` Composer plugin and the committed skill-source configuration. Keep generated agent instructions out of Git and Composer distributions instead of maintaining a versioned copy of the upstream skill. Also synchronize the Container and Config skills from their installed Composer packages.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69aadab1a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".