fix: make the consumer skill independently distributable

.changelog/portable-consumer-skill-license.md

@@ -0,0 +1,7 @@
+---
+category: fixed
+type: patch
+---
+
+Ship the portable consumer skill with its MIT license and a self-contained
+check/fix procedure, qualifying optional refactoring against the installed CLI.

resources/skills/fast-forward-code-standards/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Felipe Sayao Lobato Abreu <github@mentordosnerds.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

resources/skills/fast-forward-code-standards/SKILL.md

@@ -2,18 +2,62 @@
 name: fast-forward-code-standards
 description: Check or explicitly fix PHP formatting and syntax using Fast Forward Code Standards, including changed-file PR workflow adoption and review of local ECS overrides.
 license: MIT
+compatibility: Check/fix baseline fast-forward/code-standards 0.3.2, PHP ^8.3 and Composer runtime API ^2.2. Qualify optional commands against the installed CLI help.
 metadata:
+  api-baseline: fast-forward/code-standards 0.3.2 (check/fix)
   repository: https://github.com/php-fast-forward/code-standards
 ---
 
 # Fast Forward Code Standards
 
+The check/fix baseline is `fast-forward/code-standards` 0.3.2 with PHP `^8.3`
+and Composer runtime API `^2.2`. Earlier releases are outside this skill's
+validated baseline. Inspect the installed version and help before choosing a route;
+this baseline is not an instruction to change a consumer's dependency constraint.
+
+## Ordinary check/fix route
+
+This entrypoint is sufficient when only the skill payload is available. Repository
+guides are optional references, not prerequisites for ordinary formatting.
+When installation is requested and the package is absent, use normal Composer
+resolution; preserve an existing consumer constraint instead of silently upgrading:
+
+```sh
+composer require --dev fast-forward/code-standards
+composer show fast-forward/code-standards
+vendor/bin/code-standards --help
+vendor/bin/code-standards check --all
+```
+
+Run from the consumer's Git checkout root. A check selects tracked PHP files,
+parses their syntax and reports ECS violations without changing source. Exit 0
+means the selected checks passed; a nonzero status requires inspecting diagnostics,
+not assuming every failure is a formatting difference. The formatter's executing
+PHP version does not certify the consumer's minimum supported PHP version.
+
+For an explicitly requested local fix:
+
+```sh
+vendor/bin/code-standards fix --all
+git diff --check
+git diff
+vendor/bin/code-standards check --all
+```
+
+Fix may be partial on failure. Preserve unrelated edits, review changed syntax
+against the consumer's PHP requirements and run affected tests before accepting it.
+If the dependency graph cannot support the tool runtime, stop instead of changing
+the consumer's PHP platform or dependency constraints implicitly.
+
+## Configuration and optional routes
+
 1. Read consumer AGENTS, Git status, PHP requirements and existing style config.
    Preserve local edits. Do not replace another preset or migrate consumers
    without an explicit request and a fixture-backed policy comparison.
-2. Inspect the selected reviewed release/ref's README, workflow and CLI `help`.
-   Before the first release use a reviewed commit or local path trial, never an
-   invented version. A verified GitHub v0 channel is the selected workflow policy;
+2. Select a published version or reviewed commit and inspect its installed version
+   and CLI `help`; never invent a version. Inspect that ref's workflow when CI
+   adoption is requested. A verified GitHub v0 channel
+   is the selected workflow policy;
    the runtime stays bound to the actual executing workflow commit. GitHub v0
    is not a Composer/CPX version constraint.
 3. Use `code-standards check --all` for a full tracked scan. For a clean PR head,
@@ -24,12 +68,25 @@ metadata:
    privileged token or on a privileged target event. No incidental dependency update.
 5. Only when fixing is requested run `code-standards fix --all`, inspect the diff
    and rerun check. Do not commit/push automatically. Semantic migrations need a
-   separate reviewed procedure: the opt-in `refactor` command requires explicit
-   native Rector configuration, an explicit consumer PHP target and reviewed
-   rules. Native cache configuration is optional; Rector may use memory in CI.
+   separate reviewed procedure. First confirm that the selected CLI's `help`
+   lists `refactor`; the 0.3.2 baseline has only check/fix. If absent, stop this
+   route without silently upgrading the consumer. When available, `refactor` requires explicit
+   native Rector configuration, an explicit consumer PHP target, source paths and
+   reviewed rules. Native cache configuration is optional; Rector may use memory in CI.
    Preview is default; only explicit `--apply` grants semantic writes.
-   Read `docs/rector.md` for executable-config/autoload limits. Never substitute
-   this command for ordinary formatting `fix` or automatically migrate consumers.
+   Use only trusted, deterministic native configuration: preview runs one
+   inventory and one processing invocation; successful apply adds verification.
+   Rector can evaluate configuration repeatedly within each invocation. Changing
+   targets or rules between evaluations can defeat preflight validation.
+   Dry-run is not a sandbox: configuration, Composer autoload files, custom rules
+   and bootstraps can execute code and mutate files. Never use these with secrets,
+   privileged events or untrusted consumers. The child process does not isolate
+   namespaces: audit class origins against the consumer checkout and qualify
+   tool/consumer autoload/bootstrap compatibility; fail on collisions rather than
+   accepting a false clean result. Review semantic diffs and run affected consumer
+   tests; zero status alone does not prove semantic safety. The same ref's
+   `docs/rector.md` is an optional detailed guide. Never substitute this command
+   for ordinary formatting `fix` or automatically migrate consumers.
 6. For requested CI adoption copy `resources/workflows/code-standards.yml` from
    the selected ref after v0 points to a confirmed 0.x release, and use `pull_request` with
    read-only permissions and a hosted runner. No secrets/inherit, write token,

tests/Distribution/ArchiveTest.php

@@ -22,6 +22,7 @@ protected function setUp(): void
         $root = dirname(__DIR__, 2);
         $paths = explode("\0", $this->execute(['git', 'ls-files', '-z'], $root));
         $paths[] = '.gitattributes';
+        $paths[] = 'resources/skills/fast-forward-code-standards/LICENSE';
 
         foreach (array_unique($paths) as $path) {
             if ('' === $path || !is_file($root . '/' . $path)) {
@@ -69,9 +70,12 @@ public function testGitAndComposerExportTheSamePackageFiles(): void
         self::assertSame($git, $composer);
         foreach (['bin/code-standards', 'config/ecs.php', 'composer.lock', 'README.md', 'CHANGELOG.md', 'LICENSE',
             '.github/actions/check/action.yml', 'resources/workflows/code-standards.yml',
-            'resources/skills/fast-forward-code-standards/SKILL.md', 'docs/_static/mascot-banner.png'] as $path) {
+            'resources/skills/fast-forward-code-standards/SKILL.md',
+            'resources/skills/fast-forward-code-standards/LICENSE', 'docs/_static/mascot-banner.png'] as $path) {
             self::assertArrayHasKey($path, $git);
         }
+        self::assertSame(hash_file('sha256', dirname(__DIR__, 2) . '/LICENSE'), $git['resources/skills/fast-forward-code-standards/LICENSE']);
+        self::assertSame(hash_file('sha256', dirname(__DIR__, 2) . '/resources/skills/fast-forward-code-standards/SKILL.md'), $git['resources/skills/fast-forward-code-standards/SKILL.md']);
         foreach (array_keys($git) as $path) {
             self::assertDoesNotMatchRegularExpression('~^(?:vendor|\.agents|\.build|\.phpunit\.cache|tests|\.github/workflows)/~', $path);
         }