build: prepare stable QA 0.1.0 dependencies

README.md

@@ -16,6 +16,11 @@ composer require --dev sympress/qa
 
 The package intentionally keeps PHPCS, PHPStan, PHPUnit and their extensions in `require`. Downstream packages install `sympress/qa` as a dev dependency and receive the complete QA toolchain transitively.
 
+PHP 8.5 is required. The toolchain uses stable SymPress Coding Standards 1.1
+releases and permits PHPUnit 10.5, 11.5 or 13, according to the consumer's
+constraints. See the [0.1.0 release preparation](docs/releases/0.1.0.md) for
+the verified dependency set and remaining publication steps.
+
 ## Composer Scripts
 
 Recommended package scripts:

composer.json

@@ -21,7 +21,7 @@
         "symfony/filesystem": "^8.0",
         "symfony/process": "^8.0",
         "szepeviktor/phpstan-wordpress": "^2.0",
-        "sympress/coding-standards": "^1.0 || dev-main"
+        "sympress/coding-standards": "^1.1"
     },
     "autoload": {
         "psr-4": {
@@ -71,5 +71,6 @@
         "sort-packages": true,
         "optimize-autoloader": true
     },
+    "minimum-stability": "stable",
     "prefer-stable": true
 }

docs/releases/0.1.0.md

@@ -0,0 +1,37 @@
+# QA 0.1.0 release preparation
+
+Status: candidate; the tag and release have not been published.
+
+The first tagged release provides the existing `qa` commands, strict gate
+verification and adoption schema version 1. It requires PHP 8.5 and retains
+PHPUnit `^10.5 || ^11.5 || ^13.0` support. No command or skip behavior changes.
+
+The Coding Standards requirement is now `^1.1`, without a development-branch
+alternative. The package explicitly uses stable minimum stability and needs
+no custom Composer repository. Consumers can retain their own stable policy.
+
+## Verification on 2026-09-30
+
+Using PHP 8.5.9 and Composer 2.10.3 with an isolated Composer home:
+
+- A fresh `composer update --no-scripts --prefer-dist --no-interaction`
+  resolved 56 packages from Packagist, all with stable versions and none using
+  a path repository. The result included Coding Standards 1.1.0, PHPUnit
+  13.3.6, PHPStan 2.2.16 and PHPCompatibility 9.3.5.
+- `composer validate --strict` passed.
+- `composer qa` passed strict doctor, coding standards, static analysis and
+  15 tests with 68 assertions. No QA gate was skipped.
+- Composer reported no security vulnerability advisories for this resolution.
+
+The generated development lock remains untracked under the existing library
+policy. This verification describes the tested resolution, not a frozen
+transitive dependency set for every future install. PHPUnit 10.5 and 11.5 were
+not rerun as part of this dependency-only preparation.
+
+## Publication
+
+After PR checks and review pass, publish the reviewed commit as tag `0.1.0`,
+verify its signature, and confirm that Packagist lists the stable version.
+Run the consuming Runtime package's full checks against that published version
+before declaring the Runtime release ready. Replace the candidate status above
+with the published release reference when publication is complete.