[coisa]

Use the same skill-source configuration as the Fast Forward libraries: fast-forward/* replaces the explicit Composer trust list, auto-sync: true remains enabled, and the package's own payload is sourced from resources/skills without a package override. Discover Changelog skills from its Composer metadata without a redundant allowlist and resolve stable 0.4.x releases through ^0.4.0. Pin the schema to the verified installer release and add a patch fragment.

Validation

composer validate --strict passed. composer skills:update synchronized the local consumer skill and Changelog successfully; fragment and whitespace checks passed. Both php tests/generate-fixture.php and php tests/verify-consumer-skill.php passed with phpDocumentor 3.10.0; the prepared PHAR's signature was verified.

No merge or release is included.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7abb81f7-2b59-4d54-8ef1-95cd32257769

Commits

Reviewing files that changed from the base of the PR and between ba61e26 and d075c3a.

Files selected for processing: 2

• .changelog/consistent-skill-sources.md
• skills.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Summary

Summary by CodeRabbit

• New Features
  • Bundled local skills are now synchronized automatically.
  • Fast Forward Composer skills from matching sources are trusted, and trusted replacements are enabled.
  • Changelog contributor skills now resolve from stable 0.4.x releases without an explicit skill list.

The skills configuration now uses the 1.15.0 schema, trusts fast-forward/* Composer packages, and adds a local directory source. The Changelog source uses the ^0.4.0 release range without an explicit skills list. A changelog entry records these changes.

Changes: Skill source configuration

Layer / File(s)	Summary
Configure skill sources .changelog/consistent-skill-sources.md, skills.json	skills.json uses the 1.15.0 schema, trusts fast-forward/* Composer packages with trusted replacement enabled, and adds resources/skills as a directory source. The Changelog source ref changes to ^0.4.0, and its explicit skills list is removed. The changelog entry records the local skill source, donor trust pattern, and stable Changelog release range.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related issues

• php-fast-forward/dev-tools issue 195: The configuration uses resources/skills, trusts fast-forward/* packages, and resolves the Changelog skill from Composer metadata.
• php-fast-forward/dev-tools issue 384: The configuration uses trusted Composer sources and a versioned skills schema.
• php-fast-forward/dev-tools issue 240: The configuration adds local skill discovery and sets a stable Changelog release range.
• php-fast-forward/code-standards issue 1: The configuration uses the existing skills setup for local and Composer-based skill sources.

Merge Risk: Minimal · up to d075c

No actionable merge-blocking risk was identified in the reviewed configuration changes.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly summarizes the main change: aligning automatic Fast Forward skill-source configuration.
Description check		The description directly explains the skill-source configuration changes and reports validation results related to the changeset.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the source list twice
A local skill hops into view
Trusted donors join the trail
Changelog follows 0.4.x
The schema keeps its numbers neat
And off the rabbit bounds with cheer}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T11:50:47.906318Z	d075c3a	PR opened
🔒 Security Review	✅ Completed 2026-10-24T11:52:21.560908Z	d075c3a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Changelog

✅ Contribution check passed.

Head: d075c3ac5413c2a61bdb08403a7fd243efde8e3f

Base: ba61e26a56d7c75dd5f5568cee5c6a862b763e9d

Contribution: 1 new valid fragment(s). Policy: ordinary.

• consistent-skill-sources.md — changed, patch

  Synchronize the bundled local skill automatically and trust Fast Forward Composer skill donors through `fast-forward/*`. Resolve Changelog contributor skills from stable `0.4.x` releases without a redundant skill allowlist.