Use the separately versioned shared core dependency

.github/workflows/ci.yml

@@ -28,3 +28,7 @@ jobs:
           composer install --no-interaction --prefer-dist --no-progress
       - name: Lint executable
         run: php -l bin/mybb
+      - name: Verify the separately resolved core dependency
+        run: |
+          php -r 'require "vendor/autoload.php"; if (MyBB\Tooling\CoreRuntime::PACKAGE !== "mybb-tooling-core" || is_dir("packages/mybb-tooling")) exit(1);'
+          php bin/mybb --help

.gitignore

@@ -0,0 +1,3 @@
+/vendor/
+/dist/
+/composer.local.*

README.md

@@ -1,8 +1,6 @@
 # mybb-cli
 
-The standalone repository includes `packages/mybb-tooling`, a source snapshot of the shared package. In the coordinated workspace, `src/` is canonical; `php tools/sync-shared-package.php` refreshes the snapshot before release, and CI verifies it matches.
-
-For local development or a standalone checkout, use `composer install` in this project; its shared tooling dependency is included under `packages/mybb-tooling/`. The coordinated workspace builds `mybb-cli.phar` together with the installer using `php -d phar.readonly=0 tools/build-phars.php VERSION [OUTPUT_DIR]` from the workspace root. Each PHAR embeds the shared library, has PHP's internal SHA-256 archive signature, and is accompanied by a SHA-256 sidecar for transfer-integrity checks. The sidecar is not an authenticity signature; only distribute a release after attaching artifacts to the project's trusted, provenance-verified release channel. V1 host support is PHP 8.2–8.4 on Ubuntu 24.04 x86_64, macOS 15 Intel, and macOS 15 Apple Silicon; Windows support is not claimed.
+The shared library is a normal Composer dependency, `mybbresources/mybb-tooling >=0.1.0 <1.0.0`, resolved from its public Git repository. Run `composer install` in a standalone checkout. Composer owns the ignored `vendor/` directory; no library source snapshot is tracked here. In the coordinated core checkout, `php tools/install-component-dependencies.php` uses a temporary path repository pointing directly to canonical `src/`. The coordinated workspace builds `mybb-cli.phar` together with the installer using `php -d phar.readonly=0 tools/build-phars.php VERSION [OUTPUT_DIR]` from the workspace root. Each PHAR embeds the shared library, has PHP's internal SHA-256 archive signature, and is accompanied by a SHA-256 sidecar for transfer-integrity checks. The sidecar is not an authenticity signature; only distribute a release after attaching artifacts to the project's trusted, provenance-verified release channel. V1 host support is PHP 8.2–8.4 on Ubuntu 24.04 x86_64, macOS 15 Intel, and macOS 15 Apple Silicon; Windows support is not claimed.
 
 WP-CLI-style command line interface prototype for an installed MyBB site. It discovers the site root, validates the installation, and exposes safe administrative tasks without requiring routine manual edits or database queries.
 
@@ -29,7 +27,7 @@ Exit codes are `0` for success, `1` for operation failure, `2` for invalid usage
 
 `plugin install` and `plugin update` first validate and preview the signed package without changing site files or creating package state. Review the returned file map, then use the returned `next_arguments` with `--yes` to apply that exact release and site. If the plan reports destination conflicts, those files remain untouched unless you deliberately repeat with both `--force --yes`; the output lists existing files that the forced update may replace. Catalog releases are fetched and verified again on the apply invocation, and immutable signed release metadata binds the package digest and version.
 
-The CLI updates itself through its signed `mybb-toolchain` package, which owns the installed executable and shared library. Preview with `mybb plugin update mybb-toolchain [VERSION]`, review the file plan, then apply the returned command with `--yes`. The package manager stages, backs up, and transactionally replaces the running CLI files; the current PHP process finishes using its already-loaded code, and later invocations use the updated code. No separate self-updater or independent trust path is required. The catalog must publish a `mybb-toolchain` release, or an operator can supply a locally built signed manifest and archive through the standard package update form.
+The CLI updates itself through its signed `mybb-tooling-core` package, which owns the installed executable and shared library. Preview with `mybb plugin update mybb-toolchain [VERSION]`, review the file plan, then apply the returned command with `--yes`. The package manager stages, backs up, and transactionally replaces the running CLI files; the current PHP process finishes using its already-loaded code, and later invocations use the updated code. No separate self-updater or independent trust path is required. The catalog must publish a `mybb-toolchain` release, or an operator can supply a locally built signed manifest and archive through the standard package update form.
 
 `plugin activate SLUG_OR_CODENAME` and `plugin deactivate SLUG_OR_CODENAME` first display a confirmation plan. Apply with `--yes`. Managed plugin files must still match their ownership-ledger digest; a directly installed plugin can be targeted by its top-level PHP codename. The confirmed operation loads MyBB's `global.php` runtime and invokes the standard plugin compatibility and lifecycle callbacks, which may change database-backed settings, templates, or plugin data. It then updates MyBB's plugin cache and the managed package's activation snapshot. Deactivation does not uninstall the plugin or delete data. Review plugin callbacks before confirming because lifecycle callbacks execute PHP code.
 
@@ -39,4 +37,6 @@ Plugin activation and deactivation always load MyBB's runtime after explicit con
 
 **Current limits:** Database diagnostics and backups support MyBB's `mysqli` driver only; SQLite, PostgreSQL, and other adapters fail with a clear unsupported-driver error. `db check`, `db backup`, signed package update, transactional self-update of the installed CLI/toolchain, and plugin lifecycle have passed against a disposable MyBB 1.8.41 + MariaDB 11.4 site. Database restore is not implemented. Plugin search/info and install/update can use the catalog; local manifest and ZIP installs are also supported. External third-party callback behavior is not verified because no upstream plugin is included. The current latest-version fixture resolved to 1.8.41, the same as the supported floor; repeat the matrix against the next supported patch after it is released.
 
-The distribution reference map pins production key `catalog-2026`. The signed toolchain alone owns the installed central trust ring; Admin CP reads that ring. A public pin does not authenticate a PHAR download or complete publication. See [release readiness](https://github.com/mybbresources/mybb-tooling-core/blob/main/RELEASING.md) for the fingerprint, rotation process, private candidate verification, and remaining release gates.
+The distribution reference map pins production key `catalog-2026`. The signed core package alone owns the installed central trust ring; Admin CP reads that ring. A public pin does not authenticate a PHAR download or complete publication. See [release readiness](https://github.com/mybbresources/mybb-tooling-core/blob/main/RELEASING.md) for the fingerprint, rotation process, private candidate verification, and remaining release gates.
+
+Installed site CLI packages require the separately installed `mybb-tooling-core >=0.1.0 <1.0.0`; core integrity is checked before site commands. Composer installations and portable PHARs can also bootstrap or repair a site. See the [core dependency and legacy migration contract](https://github.com/mybbresources/mybb-tooling-core/blob/main/docs/SHARED-CONTRACTS.md#separate-core-dependency-manifest-schema-v2) for `--migrate-toolchain` and `core recover-migration --journal=PATH`.