[coisa]

Applications need a complete integration procedure for fast-forward/framework. Bundle resources/skills/fast-forward-framework with a supported ^1.5 contract, MIT license, executable examples and optional project/global installation guidance. Declare Composer discovery metadata and suggest llm/skills without adding a runtime installer; link the canonical source from README and the root AGENTS contract.

Raise runtime minimums to current compatible Packagist releases and move DevTools from dev-main to stable ^1.26. Dependabot checks Composer/Actions daily, permits 20 open version PRs, increases manifest minimums and groups compatible Fast Forward updates. DEPENDENCIES.md explains application lockfiles and the already-transitive HTTP components. Keep framework PR #15's trust list unchanged until donor merges and published distributions are available.

Validation:

• Official skills-ref 0.1.0 at agentskills/agentskills@69ef37e validates the finished package.
• Strict Composer metadata and committed Changelog contribution checks pass. Changelog was checked through the existing CLI source at e75a9be, using --since=origin/main --source=tags.
• Git archive preserves the entire skill payload. Disposable Composer consumers install the candidate archive, and llm/skills 1.15.0 automatically copies only the narrowly trusted donor. Every payload file is compared byte for byte.
• The complete PHPUnit suite passes on PHP 8.5.11: 3 tests / 80 assertions. Inline first-use instructions and packaged examples run on PHP 8.3.35 in a disposable CLI environment; Fork uses PCNTL/POSIX.
• The full composer --no-plugins dev-tools pipeline passes with an isolated Composer home and project-local DevTools configuration. Documentation, metrics, refactoring, PHPDoc, style and PHPUnit checks complete.

The declared minimum describes the release introducing the skill. Disposable path repositories label the exact candidate source with that version solely for validation; no release/tag is claimed or created. New integration/docs text is original, guided by source/tests; LICENSE uses the maintainer's established MIT terms. Native host discovery, session activation and fresh-model task performance remain unverified. No global host skills are installed. No merge or release is performed.

Additional lifecycle checks: automatic synchronization with --no-scripts, explicit update, auto-sync:false, installed-plugin suppression with --no-plugins, same-path overwrite, extra/unrelated-file retention and donor/plugin removal were exercised in disposable consumers. Guarded project and isolated-global copies refuse existing targets; update backup and rollback were tested. The pinned Skills CLI project add/list route works, but its removal can leave the canonical .agents/skills copy; the installation guide now documents that observed limitation. Final archive/installed/manager copies match the finished payload byte for byte.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T20:00:06.525499Z	a5cc0ef	PR opened
🔒 Security Review	✅ Completed 2026-10-20T20:01:16.831555Z	a5cc0ef	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 76204b5c-32de-40e5-833e-63d6570bf273

📥 Commits

Reviewing files that changed from the base of the PR and between 29948a7 and a5cc0ef.

📒 Files selected for processing: 12

• .changelog/bundled-consumer-skill.md
• .changelog/dependency-freshness.md
• .github/dependabot.yml
• AGENTS.md
• DEPENDENCIES.md
• README.md
• composer.json
• resources/skills/fast-forward-framework/LICENSE
• resources/skills/fast-forward-framework/SKILL.md
• resources/skills/fast-forward-framework/examples/integration.php
• resources/skills/fast-forward-framework/references/installation.md
• tests/ConsumerSkillTest.php

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Summary

Summary by CodeRabbit

• New Features
  • Added a bundled consumer skill with executable integration examples and optional installation guidance.
  • Added support for skill discovery and optional installation through Composer.
• Documentation
  • Added guidance for framework integration, installation, dependency freshness, lifecycle management, and verification.
• Dependency Updates
  • Updated compatible framework packages and adopted a stable development-tools release.
• Automation
  • Dependabot now checks Composer and GitHub Actions dependencies daily.
• Tests
  • Added automated verification for the bundled integration example and expected service behavior.

The pull request updates Fast Forward dependency constraints and Dependabot schedules. It adds dependency policy documentation and bundles a Fast Forward consumer skill with installation guidance, an executable integration example, and a PHPUnit test.

Changes: Consumer skill and dependencies

Layer / File(s)	Summary
Dependency baseline and freshness composer.json, .github/dependabot.yml, DEPENDENCIES.md, .changelog/dependency-freshness.md	Composer constraints and Dependabot settings now use updated Fast Forward versions and daily checks. Dependency documentation describes lockfile ownership, update policies, and compatibility constraints. Composer also declares the skills source and optional llm/skills package.
Skill contract and installation guidance resources/skills/fast-forward-framework/LICENSE, resources/skills/fast-forward-framework/SKILL.md, resources/skills/fast-forward-framework/references/installation.md, README.md, AGENTS.md, .changelog/bundled-consumer-skill.md	The repository adds a licensed consumer skill for Fast Forward Framework ^1.5 and PHP ^8.3. The skill describes service composition and failure handling. Installation guidance covers Composer synchronization, guarded manual copying, cleanup, and optional Skills CLI use. The README and contributor guidance describe compatibility and maintenance boundaries.
Executable integration verification resources/skills/fast-forward-framework/examples/integration.php, tests/ConsumerSkillTest.php	The example configures the framework container, checks response, clock, and event-dispatcher services, and verifies missing-service behavior. The PHPUnit test runs the example and checks its success marker.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant ConsumerSkillTest
  participant integration_php as integration.php
  participant ComposerAutoloader
  participant Container
  participant FrameworkServiceProvider
  ConsumerSkillTest->>integration_php: Run with PHP and project autoloader
  integration_php->>ComposerAutoloader: Load configured autoloader
  integration_php->>Container: Configure framework container
  Container->>FrameworkServiceProvider: Compose framework services
  integration_php->>Container: Resolve response, clock, and event-dispatcher services
  integration_php->>ConsumerSkillTest: Return success marker

Loading

Suggested reviewers: php-fast-forward

Merge Risk: ⚪ Minimal · up to a5cc0

The documented integration path is consistent with the test, and no merge-blocking issue is established. Merge after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly summarizes the two main changes: bundling the framework skill and refreshing dependency update configuration.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (10 skipped: 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The pull request description directly matches the changeset. It covers the bundled framework skill, Composer metadata, installation guidance, dependency updates, Dependabot configuration, documentatio…

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (10 skipped: 10 unsupported.)

Full details: Description check

Explanation

The pull request description directly matches the changeset. It covers the bundled framework skill, Composer metadata, installation guidance, dependency updates, Dependabot configuration, documentation, validation, and stated limitations.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the framework trail,
With clock and events in a tidy mail.
The container answers, services appear,
A success mark hops into the clear.
Fresh carrots for the skill bundle here!}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Changelog

✅ Contribution check passed.

Head: 714e3cc789a8043e971d198bf161a01f457ae03f

Base: 29948a715caa3a1ccd5937ad9ca3b5aca0e185f0

Contribution: 2 new valid fragment(s). Policy: ordinary.

• bundled-consumer-skill.md — added, minor

  Bundle the fast-forward-framework consumer skill with executable examples, optional installation guidance and Composer discovery metadata.

• dependency-freshness.md — changed, patch

  Raise compatible Fast Forward dependency minimums to current stable releases, use stable DevTools and check Composer and Actions updates daily through Dependabot.

[github-actions]

🚀 Preview is available for this pull request.

• Docs: https://php-fast-forward.github.io/framework/previews/pr-16/
• Coverage: https://php-fast-forward.github.io/framework/previews/pr-16/coverage/
• Metrics: https://php-fast-forward.github.io/framework/previews/pr-16/metrics/