php-package-scaffoldlisted

# PHP Package Scaffold (Composer / Packagist) > "A library is a contract. Once published, every breaking change is someone else's incident." > "Make it work, make it right, make it releasable." ## Core Philosophy This skill produces a **publishable Composer library** — not an application. The deliverable is a package that a stranger can `composer require vendor/package`, that installs cleanly across a matrix of supported PHP versions, that passes static analysis and style checks in CI, and that publishes to Packagist automatically on a semver git tag. Packagist serves whatever a tag points at, so the **tag is the release** — discipline lives in the tag and in CI, not in a manual upload step. A library is a long-lived contract. Semantic versioning is mandatory: `MAJOR.MINOR.PATCH`, where a MAJOR bump is the only place a breaking change is allowed. The public API surface is everything not marked `@internal`; treat it as frozen within a major version. **Non-Negotiable Constraints:** 1. **Valid `composer.json`** — `composer validate --strict` passes 2. **PSR-4 autoloading** — `src/` mapped to a vendor namespace; tests in a separate `autoload-dev` 3. **`declare(strict_types=1)`** in every `src/` file 4. **Semver discipline** — tags are `vX.Y.Z`; breaking changes only on MAJOR 5. **CI gate before publish** — tests + PHPStan + style must pass on the tag 6. **Declared, bounded dependency constraints** — caret ranges, no `dev-master`, no unbounded `*` The full domain principles