Chiron

laravelui5/chiron is a free, dev-only package that teaches your coding agent this stack. It ships the guidelines and Agent Skills for laravelui5/odata, laravelui5/core and laravelui5/sdk, and Laravel Boost hands them to whatever agent you work with.

Without it an agent guesses, and it guesses plausibly: it invents an artisan command that does not exist, writes through OData, picks the wrong handler contract, leaves an entity set ungated. With it the rules are in the session before the first line is written.

It is named after the centaur who taught Achilles, Jason and Asclepius — the one who never fought a battle himself and trained everyone who did.

Install

composer require laravelui5/chiron --dev
php artisan boost:install

Tick the box, or nothing is installed

When the installer asks "Which third-party AI guidelines/skills would you like to install?", select laravelui5/chiron. Third-party material is opt-in: Boost records your answer in the application's boost.json and installs nothing from a third-party package until it is recorded there.

The failure mode is silent. A scripted boost:install --no-interaction reports success and installs nothing at all. Answer the prompt once by hand, or seed boost.json first:

{
    "packages": ["laravelui5/chiron"]
}

Verified against laravel/boost v2.9.1.

There is nothing else to wire. The package contains no PHP — no service provider, no classes, not one line that runs. Boost reads resources/boost/ straight out of your vendor directory, so Chiron is prose and nothing but prose. That is also why it declares no require of its own: you can install it before you install the stack, which is one of the moments it is most useful.

What it contains

One guideline file, loaded at the start of every session, and nine skills, loaded by the agent when the task calls for one.

The guideline carries the two rules that prevent most of the damage — OData is read-only, every write is a Ui5Action and Core is stateless about the organisation — followed by one section per package: the OData never-dos and the row-count performance gate, Core's Composer bracket and two-step registration, the SDK's migrate → sync → cache deploy contract and Authz = f(App, Actor, Time).

Skill	What it covers
laravelui5-odata-modeling	The five-step modelling decision tree and the row-count performance gate
laravelui5-modules	Creating and wiring a module: scaffolding, the namespace single-source rule, registration, the two places a UI5 library must be declared
laravelui5-artifacts	Choosing and authoring an artifact, and the three different provider contracts
laravelui5-actions	Authoring a Ui5Action: the Action + Handler + FormRequest triad, #[Parameter], the frontend call path
laravelui5-security	The four ability types, the role-first declaration rule, the capability mini-app cut
laravelui5-settings	Setting · Slot · Customizing — the three mechanisms that look alike, and how to choose
laravelui5-partners	The one identity the SDK authorizes, the users.partner_id bridge, the four things called "role"
laravelui5-shell	LeanShell: the five things that must be true for an app to get chrome, intent dispatch, value helps
laravelui5-dialogs	Global dialogs as shell-dispatched artifacts

It adapts to what you installed

Every file is Blade-rendered, and what your agent reads depends on what your application actually has.

The guideline renders only the sections for packages that are present. More importantly, laravelui5-actions teaches one handler contract, never both: with the SDK installed it teaches the typed SdkActionHandlerInterface and the transaction the dispatcher opens; on a Core-only host it teaches Core's marker ActionHandlerInterface and the fact that Core's dispatcher does not wrap the call in a transaction, so atomicity is yours to arrange. An agent handed the wrong contract writes code that does not type-check.

Skills cannot be installed conditionally, so the five SDK skills carry a Core-only branch: instead of their body they render a short, factual note — what Core offers in its place, and why the absence is a deliberate refusal rather than a gap. A Core-only host therefore gets four full skills and five such notes; a host with the SDK gets all nine in full.

With nothing installed at all you still get the overview, which is the point when you are evaluating the stack rather than running it.

Keeping it current

php artisan boost:update            # refresh what is already published
php artisan boost:update --discover # also pick up newly installed packages

To have that happen on every composer update, add it to your application's scripts:

{
    "scripts": {
        "post-update-cmd": ["@php artisan boost:update --ansi"]
    }
}

Chiron is versioned on its own line, independently of the packages it describes — that independence is the reason it is a separate package. Guidelines want to be rewritten the week you learn what an agent confuses; runtime packages move on strict SemVer. Each release names the majors it was written against, and guidance that holds for only one major says so inline.

The other half: UI5 itself

Chiron teaches your agent this stack. It does not teach it OpenUI5 — the control APIs, the manifest schema, the linter. That half is covered by the UI5 MCP server, maintained by the UI5 organisation and equally free:

{
  "mcpServers": {
    "@ui5/mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@ui5/mcp-server"]
    }
  }
}

It brings get_api_reference, get_guidelines, run_manifest_validation, run_ui5_linter, create_ui5_app and more.

The two halves meet in a single, very ordinary failure. Chiron's laravelui5-modules skill tells your agent that a UI5 library must be declared in two places — manifest.json and ui5.yaml — because missing one fails at runtime with failed to load 'library.js'. The MCP server's run_manifest_validation and run_ui5_linter are what notice when the agent forgets anyway. Instruction plus verification: the two halves of an agent loop that actually closes.

Links

• Source — github.com/laravelui5/chiron
• Licence — MIT. The packages it describes are licensed separately: laravelui5/odata MIT, laravelui5/core under BSL 1.1 with production use granted, laravelui5/sdk commercially.