Add application skeleton and developer tooling

.gitattributes

@@ -0,0 +1,2 @@
+# Package licences intentionally mirror root LICENSE.md byte-for-byte.
+packages/*/LICENSE.md -whitespace

.github/workflows/quality.yml

@@ -44,6 +44,9 @@ jobs:
       - name: Run release package split validation
         run: composer release:split:validate
 
+      - name: Run application skeleton create-project validation
+        run: composer release:skeleton:validate
+
       - name: Run root supply-chain checks
         run: composer supply-chain
 

.php-cs-fixer.dist.php

@@ -8,6 +8,8 @@
         'packages/contracts/tests',
         'packages/core/src',
         'packages/core/tests',
+        'packages/dev-tools/src',
+        'packages/dev-tools/tests',
         'packages/http/src',
         'packages/http/tests',
         'packages/module/src',
@@ -16,6 +18,8 @@
         'packages/plugin/tests',
         'packages/testing/src',
         'packages/testing/tests',
+        'skeleton/bootstrap',
+        'skeleton/config',
     ]);
 
 return (new PhpCsFixer\Config())

DEVELOPMENT.md

@@ -2,7 +2,7 @@
 
 The repository root is the canonical EvolvePHP 2 Composer development root for the modular monorepo.
 
-The root resolves local packages, owns development tooling and runs EvolvePHP 2 package quality checks. It is not a seventh release package, a publishable framework package, an application skeleton, runtime framework code, a Composer plugin or a production deployment artifact.
+The root resolves local packages, owns development tooling and runs EvolvePHP 2 package quality checks. It is not a release package, a publishable framework package, an application skeleton, runtime framework code, a Composer plugin or a production deployment artifact.
 
 The preserved EvolvePHP 1 runtime and the former legacy root suite remain preserved on `master` and in Git history. The EvolvePHP 2 root suite now runs from this repository root.
 
@@ -28,6 +28,7 @@ The root maps each initial package explicitly to `2.0.x-dev` inside the path rep
 
 - `evolvephp/contracts`
 - `evolvephp/core`
+- `evolvephp/dev-tools`
 - `evolvephp/http`
 - `evolvephp/module`
 - `evolvephp/plugin`
@@ -78,6 +79,7 @@ Run individual package suites:
 ```bash
 composer test:contracts
 composer test:core
+composer test:dev-tools
 composer test:http
 composer test:module
 composer test:plugin
@@ -116,6 +118,16 @@ composer quality
 
 `quality` runs `architecture`, `analyse`, `style:check` and `test`, in that order. `style:fix` remains separate because it is mutating.
 
+## Application Skeleton
+
+The `skeleton/` directory is the initial end-user application template for `evolvephp/skeleton`. It is separate from the framework monorepo root, and the root remains the EvolvePHP development workspace rather than an application project.
+
+The skeleton uses `App\ => src/` as its application namespace convention. The application CLI composition is explicit: `skeleton/bin/evolve` loads the generated project's Composer autoloader, then uses the public experimental Core runtime APIs `CliApplication` and `StreamCommandOutput` with `CommandRegistry`, `CommandRunner`, `ServiceRegistry` and `ExecutionOrchestrator`. Core remains independent of HTTP, while the application-owned shell explicitly registers the Core Doctor command and the HTTP `route:list` adapter.
+
+The initial route configuration is explicit and empty through `skeleton/config/routes.php`, which returns a `RouteCollection`. There is no route discovery, filesystem scanning, application boot magic or automatic command discovery in this skeleton slice. Doctor uses the current accepted runtime and Composer-extension checks only: `PhpVersionCheck` and `ComposerRequiredExtensionsCheck` against the generated application's own `composer.json`.
+
+The skeleton installs `evolvephp/dev-tools`, `evolvephp/testing` and PHPUnit as development dependencies. `config/commands.php` registers `module:new` and `plugin:new` only when the DevTools classes exist, so a production `composer install --no-dev` keeps `doctor` and `route:list` available without requiring DevTools. The generator commands derive all output paths from the application root and a single ASCII StudlyCase name token; they do not edit Composer manifests, execute generated PHP, run Composer, run Git, auto-enable generated components or perform automatic discovery.
+
 ## Release Validation
 
 Run deterministic/offline package release-readiness validation:
@@ -124,7 +136,7 @@ Run deterministic/offline package release-readiness validation:
 composer release:validate
 ```
 
-Phase 2.10A keeps the six packages mapped explicitly in `release-packages.json`. The processing order is dependency-compatible: contracts, core, module, plugin, http and testing. Package-local README and licence files exist so future split roots carry consumer documentation and legal text naturally. Package-local licences must remain identical to root `LICENSE.md`.
+Phase 2.10A keeps the release packages mapped explicitly in `release-packages.json`. Phase 6.4E extends that dependency-compatible map to seven packages by appending DevTools after the existing six-package order: contracts, core, module, plugin, http, testing and dev-tools. Package-local README and licence files exist so future split roots carry consumer documentation and legal text naturally. Package-local licences must remain identical to root `LICENSE.md`.
 
 No package is being published by this command. No remote repositories are contacted, no tags/releases are created, and no split repositories are synchronized. Package Composer manifests remain authoritative for package metadata.
 
@@ -150,6 +162,18 @@ composer release:consumer:validate
 
 `release:consumer:validate` creates temporary local VCS package repositories from generated split roots, creates disposable alpha/stable tags only, disables Packagist, disables Composer network access, validates expected success and expected failure cases, and uses disposable lockfiles. It is not currently a required CI step and is intended for pre-release/manual validation.
 
+### Application Skeleton Create-Project Validation
+
+Run the local prerelease application skeleton create-project validation:
+
+```bash
+composer release:skeleton:validate
+```
+
+`release:skeleton:validate` exercises the real Composer `create-project` command for `evolvephp/skeleton` using repository-injected local package evidence. It creates validator-owned temporary paths, disables Packagist, sets `COMPOSER_DISABLE_NETWORK=1`, installs into a previously absent generated-project directory, validates the generated Composer manifest, confirms first-party packages are copied rather than symlinked to the source monorepo, runs `php bin/evolve doctor`, verifies `php bin/evolve route:list` emits `No routes are configured.`, generates `module:new Billing` and `plugin:new Cache` in the development install, verifies the generated application tests pass, verifies repeat generation refuses overwrites, verifies invalid/path-traversal names create nothing outside the application, verifies a `composer install --no-dev` production install still supports `doctor` and `route:list`, verifies Core missing-command and unknown-command usage errors, and confirms source repository state is preserved.
+
+Public Packagist create-project availability is not yet claimed. Do not document `composer create-project evolvephp/skeleton ...` as generally available until publication is explicitly opened.
+
 For an EvolvePHP 2 alpha consumer, the recommended root consumer settings are:
 
 ```json
@@ -163,9 +187,9 @@ These are root consumer settings. First-party package manifests must not add alp
 
 In prose: set `minimum-stability: alpha` and `prefer-stable: true` only in the root alpha consumer.
 
-No package is published by `release:validate`, `release:split:validate` or `release:consumer:validate`. Remote package repositories, remote synchronization, Packagist registration, tags and releases remain deferred.
+No package is published by `release:validate`, `release:split:validate`, `release:consumer:validate` or `release:skeleton:validate`. Remote package repositories, remote synchronization, Packagist registration, tags and releases remain deferred.
 
-`release:validate` remains metadata/package-boundary validation. `release:split:validate` validates generated split history/root content. `release:consumer:validate` validates package-resolution semantics. `supply-chain` remains network-dependent security/licence validation. `quality` remains ordinary root quality.
+`release:validate` remains metadata/package-boundary validation. `release:split:validate` validates generated split history/root content. `release:consumer:validate` validates package-resolution semantics. `release:skeleton:validate` validates local prerelease create-project behavior. `supply-chain` remains network-dependent security/licence validation. `quality` remains ordinary root quality.
 
 ## Supply-Chain Security
 
@@ -251,6 +275,7 @@ It bootstraps through `vendor/autoload.php` and defines one named suite for each
 | --- | --- |
 | `contracts` | `packages/contracts/tests` |
 | `core` | `packages/core/tests` |
+| `dev-tools` | `packages/dev-tools/tests` |
 | `http` | `packages/http/tests` |
 | `module` | `packages/module/tests` |
 | `plugin` | `packages/plugin/tests` |
@@ -268,13 +293,15 @@ The distributable PHPStan configuration lives at:
 phpstan.neon.dist
 ```
 
-The initial PHPStan level is `6`. PHPStan analyzes all six package `src` and `tests` directories:
+The initial PHPStan level is `6`. PHPStan analyzes all seven package `src` and `tests` directories:
 
 ```text
 packages/contracts/src
 packages/contracts/tests
 packages/core/src
 packages/core/tests
+packages/dev-tools/src
+packages/dev-tools/tests
 packages/http/src
 packages/http/tests
 packages/module/src
@@ -304,6 +331,7 @@ Deptrac analyzes production source directories only:
 ```text
 packages/contracts/src
 packages/core/src
+packages/dev-tools/src
 packages/http/src
 packages/module/src
 packages/plugin/src
@@ -315,6 +343,7 @@ Package tests are excluded from Phase 2.5 Deptrac boundary analysis so test depe
 ```text
 Contracts -> packages/contracts/src/.* -> Evolve\Contracts\
 Core      -> packages/core/src/.*      -> Evolve\Core\
+DevTools  -> packages/dev-tools/src/.* -> Evolve\DevTools\
 Http      -> packages/http/src/.*      -> Evolve\Http\
 Module    -> packages/module/src/.*    -> Evolve\Module\
 Plugin    -> packages/plugin/src/.*    -> Evolve\Plugin\
@@ -326,13 +355,14 @@ The accepted dependency matrix is:
 ```text
 Contracts -> none
 Core      -> Contracts
+DevTools  -> Contracts, Core, Module, Plugin
 Http      -> Contracts, Core
 Module    -> Contracts
 Plugin    -> Contracts
 Testing   -> Contracts, Core, Http, Module, Plugin
 ```
 
-There is no production dependency on Testing. Testing may depend on all five production packages.
+There is no production dependency on Testing. DevTools is development tooling and may depend on Contracts, Core, Module and Plugin. Testing may depend on all five production packages.
 
 The root also models deliberate external standard layers:
 
@@ -364,7 +394,7 @@ PHP-CS-Fixer is the root coding-standard engine. The distributable configuration
 
 The project style is based on PHP-FIG PER Coding Style 3.0 through PHP-CS-Fixer's `@PER-CS3x0` rule set. The floating `@PER-CS` alias is not used. The project explicitly enables alphabetical `ordered_imports` and `no_unused_imports`.
 
-PHP-CS-Fixer checks only the six package `src` and `tests` directories. The root architecture tests, root documentation tests, RFCs, `vendor/` and generated caches are excluded.
+PHP-CS-Fixer checks the seven package `src` and `tests` directories plus the committed skeleton PHP config/bootstrap files. The extensionless skeleton executable is protected by syntax and create-project validation rather than distorting the Finder. The root architecture tests, root documentation tests, RFCs, `vendor/` and generated caches are excluded.
 
 Risky rules are disabled. The `declare_strict_types` fixer is not enabled; strict-types policy for EvolvePHP 2 package PHP files is enforced by architecture tests.
 
@@ -388,7 +418,7 @@ It runs for pull requests targeting `2.x`, pushes to `2.x` and manual dispatch.
 
 All jobs run on the explicit Ubuntu 24.04 runner, using the `ubuntu-24.04` label. The workflow has no initial dependency cache.
 
-The policy job runs on PHP 8.4. The `Policy (PHP 8.4)` job validates the root Composer manifest and lockfile before installation, installs root dependencies from the committed lockfile with `composer install`, runs package split validation, runs supply-chain checks and runs the root Architecture and Documentation policy tests through root PHPUnit 13:
+The policy job runs on PHP 8.4. The `Policy (PHP 8.4)` job validates the root Composer manifest and lockfile before installation, installs root dependencies from the committed lockfile with `composer install`, runs package split validation, runs skeleton create-project validation, runs supply-chain checks and runs the root Architecture and Documentation policy tests through root PHPUnit 13:
 
 ```bash
 php vendor/bin/phpunit --configuration phpunit.xml.dist tests/Architecture tests/Documentation
@@ -428,3 +458,5 @@ The following work remains deferred:
 - package publication, tags and GitHub releases
 - Runtime framework implementation beyond the completed Phase 4 HTTP package foundation
 - Phase 5 module/plugin runtime work
+- broader developer tooling beyond `module:new` and `plugin:new`
+- Phase 6.4F broader Testing utilities beyond the command-output recorder

README.md

@@ -6,7 +6,7 @@
 
 EvolvePHP 2 is a separate redesign, not an in-place refactor, replacement or rewrite of the EvolvePHP 1 runtime history.
 
-Phase 4.7 promoted the EvolvePHP 2 Composer, PHPUnit, PHPStan, PHP-CS-Fixer, Deptrac, release-validation and supply-chain development root from `workspace/` to the repository root. The root project is not a seventh release package. That root cutover does not delete `master`, does not delete history and does not change the preserved EvolvePHP 1 line.
+Phase 4.7 promoted the EvolvePHP 2 Composer, PHPUnit, PHPStan, PHP-CS-Fixer, Deptrac, release-validation and supply-chain development root from `workspace/` to the repository root. The root project is not a release package. That root cutover does not delete `master`, does not delete history and does not change the preserved EvolvePHP 1 line.
 
 ## Project Overview
 

composer.json

@@ -33,6 +33,7 @@
                 "versions": {
                     "evolvephp/contracts": "2.0.x-dev",
                     "evolvephp/core": "2.0.x-dev",
+                    "evolvephp/dev-tools": "2.0.x-dev",
                     "evolvephp/http": "2.0.x-dev",
                     "evolvephp/module": "2.0.x-dev",
                     "evolvephp/plugin": "2.0.x-dev",
@@ -52,6 +53,7 @@
     },
     "require-dev": {
         "deptrac/deptrac": "^4.7",
+        "evolvephp/dev-tools": "^2.0@dev",
         "evolvephp/testing": "^2.0@dev",
         "friendsofphp/php-cs-fixer": "^3.95",
         "phpstan/phpstan": "^2.2",
@@ -69,6 +71,7 @@
             "@test"
         ],
         "release:consumer:validate": "@php tools/validate-prerelease-consumers.php",
+        "release:skeleton:validate": "@php tools/validate-skeleton-project.php",
         "release:split:validate": "@php tools/validate-package-splits.php",
         "release:validate": "@php tools/validate-release-packages.php",
         "security:audit": "@composer audit --locked --abandoned=fail",
@@ -81,6 +84,7 @@
         "test": "@php vendor/bin/phpunit --configuration phpunit.xml.dist",
         "test:contracts": "@php vendor/bin/phpunit --configuration phpunit.xml.dist --testsuite contracts",
         "test:core": "@php vendor/bin/phpunit --configuration phpunit.xml.dist --testsuite core",
+        "test:dev-tools": "@php vendor/bin/phpunit --configuration phpunit.xml.dist --testsuite dev-tools",
         "test:http": "@php vendor/bin/phpunit --configuration phpunit.xml.dist --testsuite http",
         "test:module": "@php vendor/bin/phpunit --configuration phpunit.xml.dist --testsuite module",
         "test:plugin": "@php vendor/bin/phpunit --configuration phpunit.xml.dist --testsuite plugin",