diff --git a/.gitattributes b/.gitattributes
index 5d2a6d7ff2..14ee0d161a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -16,6 +16,7 @@
 /.* export-ignore
 /.phpstorm.meta.php -export-ignore
 /addons/ export-ignore
+/project/ export-ignore
 /tests/ export-ignore
 /docker-compose.yml export-ignore
 /phpstan.dist.neon export-ignore
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index f35b36f066..adfbb6b635 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -205,9 +205,9 @@ jobs:
                 run: |
                     sudo /etc/init.d/mysql start
                     mysql -uroot -h127.0.0.1 -proot -e 'create database redaxo6;'
-                    php .tools/bin/console setup:run -n --lang=de_de --db-host=127.0.0.1 --db-name=redaxo6 --db-password=root --db-createdb=no --db-setup=normal --admin-username=admin --admin-password=adminpassword --error-email=test@redaxo.invalid --ansi -v
-                    php .tools/bin/console config:set --type boolean debug.enabled true -v
-                    php .tools/bin/console config:set --type boolean debug.throw_always_exception true -v
+                    php project/bin/console setup:run -n --lang=de_de --db-host=127.0.0.1 --db-name=redaxo6 --db-password=root --db-createdb=no --db-setup=normal --admin-username=admin --admin-password=adminpassword --error-email=test@redaxo.invalid --ansi -v
+                    php project/bin/console config:set --type boolean debug.enabled true -v
+                    php project/bin/console config:set --type boolean debug.throw_always_exception true -v
 
             -   name: Run phpstan analysis
                 if: github.event_name != 'repository_dispatch'
diff --git a/.github/workflows/styles-compile.yml b/.github/workflows/styles-compile.yml
index b21174646e..a9e280cb09 100644
--- a/.github/workflows/styles-compile.yml
+++ b/.github/workflows/styles-compile.yml
@@ -71,12 +71,12 @@ jobs:
                 run: |
                     sudo /etc/init.d/mysql start
                     mysql -uroot -h127.0.0.1 -proot -e 'create database redaxo6;'
-                    php .tools/bin/console setup:run -n --lang=de_de --db-host=127.0.0.1 --db-name=redaxo6 --db-password=root --db-createdb=no --db-setup=normal --admin-username=admin --admin-password=adminpassword --error-email=test@redaxo.invalid --ansi -v
-                    php .tools/bin/console config:set --type boolean debug.enabled true -v
-                    php .tools/bin/console config:set --type boolean debug.throw_always_exception true -v
+                    php project/bin/console setup:run -n --lang=de_de --db-host=127.0.0.1 --db-name=redaxo6 --db-password=root --db-createdb=no --db-setup=normal --admin-username=admin --admin-password=adminpassword --error-email=test@redaxo.invalid --ansi -v
+                    php project/bin/console config:set --type boolean debug.enabled true -v
+                    php project/bin/console config:set --type boolean debug.throw_always_exception true -v
 
             -   name: Compile styles
-                run: php .tools/bin/console assets:compile-styles --ansi -v
+                run: php project/bin/console assets:compile-styles --ansi -v
 
             -   name: Commit changed files
                 uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
@@ -92,4 +92,4 @@ jobs:
                 if: env.writable == 0
                 run: |
                     # check if compiling the scss lead to uncommitted changes
-                    git diff HEAD --exit-code --output=/dev/null || (echo "::error::It seems you missed to commit the compiled css files, run '.tools/bin/console assets:compile-styles' and push the changes." && exit 1)
+                    git diff HEAD --exit-code --output=/dev/null || (echo "::error::It seems you missed to commit the compiled css files, run 'project/bin/console assets:compile-styles' and push the changes." && exit 1)
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 7feaf57576..ff19cb0e41 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -74,11 +74,11 @@ jobs:
             -   name: Setup REDAXO
                 run: |
                     mysql -uroot -h127.0.0.1 -proot -e 'create database redaxo6;'
-                    php .tools/bin/console setup:run -n --lang=de_de --db-host=127.0.0.1 --db-name=redaxo6 --db-password=root --db-createdb=no --db-setup=normal --admin-username=admin --admin-password=adminpassword --error-email=test@redaxo.invalid --ansi -v
-                    php .tools/bin/console config:set --type boolean debug.enabled true -v
-                    php .tools/bin/console config:set --type boolean debug.throw_always_exception true -v
-                    .tools/bin/console addon:install test -v
-                    .tools/bin/console system:report -v
+                    php project/bin/console setup:run -n --lang=de_de --db-host=127.0.0.1 --db-name=redaxo6 --db-password=root --db-createdb=no --db-setup=normal --admin-username=admin --admin-password=adminpassword --error-email=test@redaxo.invalid --ansi -v
+                    php project/bin/console config:set --type boolean debug.enabled true -v
+                    php project/bin/console config:set --type boolean debug.throw_always_exception true -v
+                    project/bin/console addon:install test -v
+                    project/bin/console system:report -v
 
             -   name: Run phpunit
                 run: vendor/bin/phpunit --colors=always
diff --git a/.github/workflows/visual-tests.yml b/.github/workflows/visual-tests.yml
index 4bf38bb616..3aa559e8fe 100644
--- a/.github/workflows/visual-tests.yml
+++ b/.github/workflows/visual-tests.yml
@@ -94,37 +94,37 @@ jobs:
                 run: |
                     sudo /etc/init.d/mysql start
                     mysql -uroot -h127.0.0.1 -proot -e 'create database redaxo6;'
-                    php .tools/bin/console setup:run -n --lang=de_de --db-host=127.0.0.1 --db-name=redaxo6 --db-password=root --db-createdb=no --db-setup=normal --admin-username=admin --admin-password=adminpassword --error-email=test@redaxo.invalid --ansi -v
-                    php .tools/bin/console config:set --type boolean debug.enabled true -v
-                    php .tools/bin/console config:set --type boolean debug.throw_always_exception true -v
-                    php .tools/bin/console addon:install test -v
+                    php project/bin/console setup:run -n --lang=de_de --db-host=127.0.0.1 --db-name=redaxo6 --db-password=root --db-createdb=no --db-setup=normal --admin-username=admin --admin-password=adminpassword --error-email=test@redaxo.invalid --ansi -v
+                    php project/bin/console config:set --type boolean debug.enabled true -v
+                    php project/bin/console config:set --type boolean debug.throw_always_exception true -v
+                    php project/bin/console addon:install test -v
 
             -   name: Import mock data
                 run: |
-                    mkdir -p $GITHUB_WORKSPACE/.tools/project/var/data/core/backup && cp -r .tools/visual-tests/fixtures/initial-content.sql $GITHUB_WORKSPACE/.tools/project/var/data/core/backup/
-                    cp -r .tools/visual-tests/fixtures/media/* $GITHUB_WORKSPACE/.tools/project/public/media/
+                    mkdir -p $GITHUB_WORKSPACE/project/var/data/core/backup && cp -r .tools/visual-tests/fixtures/initial-content.sql $GITHUB_WORKSPACE/project/var/data/core/backup/
+                    cp -r .tools/visual-tests/fixtures/media/* $GITHUB_WORKSPACE/project/public/media/
                     cp -f .tools/visual-tests/fixtures/README.md $GITHUB_WORKSPACE/addons/test/README.de.md
-                    php .tools/bin/console setup:run -n --lang=de_de --db-password=root --db-setup=import --db-import=initial-content --admin-username=myusername --admin-password=mypassword --ansi -v
+                    php project/bin/console setup:run -n --lang=de_de --db-password=root --db-setup=import --db-import=initial-content --admin-username=myusername --admin-password=mypassword --ansi -v
             -   name: Install packages
                 run: |
-                    php .tools/bin/console addon:install debug --ansi -v
+                    php project/bin/console addon:install debug --ansi -v
 
             -   name: Start php server
                 run: |
-                    cat <<EOF > .tools/project/public/router.php
+                    cat <<EOF > project/public/router.php
                     <?php
                     if (preg_match('@redaxo/(?:bin|data|cache|src)@', \$_SERVER['REQUEST_URI'])) http_response_code(403);
                     else return false;
                     EOF
-                    PHP_CLI_SERVER_WORKERS=4 php -S localhost:8080 -t .tools/project/public/ .tools/project/public/router.php &
+                    PHP_CLI_SERVER_WORKERS=4 php -S localhost:8080 -t project/public/ project/public/router.php &
 
             -   name: Take screenshots (differential)
                 run: |
-                    php .tools/bin/console config:set setup true -t boolean --ansi -v
-                    php .tools/bin/console cache:clear --ansi -v
+                    php project/bin/console config:set setup true -t boolean --ansi -v
+                    php project/bin/console cache:clear --ansi -v
                     node .tools/visual-tests/visual-record.js setup
-                    php .tools/bin/console config:set setup false -t boolean --ansi -v
-                    php .tools/bin/console cache:clear --ansi -v
+                    php project/bin/console config:set setup false -t boolean --ansi -v
+                    php project/bin/console cache:clear --ansi -v
                     node .tools/visual-tests/visual-record.js
                     git add .tools/visual-tests/screenshots/
                     git diff --cached --exit-code --name-only .tools/visual-tests/screenshots/
diff --git a/.gitignore b/.gitignore
index 5a491106fa..6dc9c73218 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,14 +3,6 @@
 /node_modules/
 /vendor/
 
-# Local project for testing
-/.tools/project/*
-!/.tools/project/public/
-/.tools/project/public/*
-!/.tools/project/public/index.php
-!/.tools/project/public/redaxo/
-!/.tools/project/src/
-
 # PhpStorm setting
 /.idea/*
 !/.idea/encodings.xml
diff --git a/.idea/jsonSchemas.xml b/.idea/jsonSchemas.xml
index 8fcbb5a86e..116e2039db 100644
--- a/.idea/jsonSchemas.xml
+++ b/.idea/jsonSchemas.xml
@@ -12,7 +12,7 @@
               <option name="patterns">
                 <list>
                   <Item>
-                    <option name="path" value=".tools/project/var/data/core/config.yml" />
+                    <option name="path" value="project/var/data/core/config.yml" />
                   </Item>
                   <Item>
                     <option name="path" value="setup/default.config.yml" />
diff --git a/.php-cs-fixer.dist.php b/.php-cs-fixer.dist.php
index 010703cca1..9575f8401e 100644
--- a/.php-cs-fixer.dist.php
+++ b/.php-cs-fixer.dist.php
@@ -10,17 +10,18 @@
         __DIR__ . '/boot',
         __DIR__ . '/fragments',
         __DIR__ . '/pages',
+        __DIR__ . '/project',
         __DIR__ . '/setup',
         __DIR__ . '/src',
         __DIR__ . '/tests',
     ])
     ->exclude([
-        'project/var',
+        'var',
+        'vendor',
     ])
     ->append([
         __FILE__,
-        __DIR__ . '/.tools/bin/console',
-        __DIR__ . '/.tools/bin/update-root-composer',
+        __DIR__ . '/project/bin/console',
         __DIR__ . '/assets_src/vendor_files.php',
         __DIR__ . '/rector.php',
     ])
diff --git a/.tools/bin/init-project b/.tools/bin/init-project
new file mode 100755
index 0000000000..024cdf9655
--- /dev/null
+++ b/.tools/bin/init-project
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+# Initializes the local project instance (project/) for development in this monorepo. The skeleton runs against the
+# monorepo's root vendor/ instead of a project-local one, so we generate a gitignored
+# project/vendor/autoload_runtime.php shim that delegates to the root runtime (in a created project, symfony/runtime
+# provides this file).
+
+set -e
+
+mkdir -p project/vendor
+
+cat > project/vendor/autoload_runtime.php <<'PHP'
+<?php
+
+// @generated by .tools/bin/init-project — not part of the project skeleton.
+return require dirname(__DIR__, 2) . '/vendor/autoload_runtime.php';
+PHP
diff --git a/.tools/bin/merge-5x b/.tools/bin/merge-5x
index 5501be7c26..86f7d2e612 100755
--- a/.tools/bin/merge-5x
+++ b/.tools/bin/merge-5x
@@ -61,7 +61,7 @@ fi
 
 git commit --no-edit -m "Merge branch '5.x' into 6.x"
 
-.tools/bin/console assets:compile-styles
+project/bin/console assets:compile-styles
 composer cs-fixer
 composer sa
 
diff --git a/.tools/bin/refresh b/.tools/bin/refresh
index d9de02e2c9..5eb1d3a132 100755
--- a/.tools/bin/refresh
+++ b/.tools/bin/refresh
@@ -3,19 +3,19 @@
 # refreshes the redaxo installation.
 # most of the time this is required when working on the REDAXO sources after checking out a Pull Request via GitHub.com
 
-mkdir -p .tools/project/public/assets/core
-cp -R assets/* .tools/project/public/assets/core/
-php -r 'foreach (require "assets_src/vendor_files.php" as $src => $dst) { $dst = ".tools/project/public/assets/core/" . $dst; @mkdir(dirname($dst), 0775, true); copy("assets_src/" . $src, $dst); }'
+mkdir -p project/public/assets/core
+cp -R assets/* project/public/assets/core/
+php -r 'foreach (require "assets_src/vendor_files.php" as $src => $dst) { $dst = "project/public/assets/core/" . $dst; @mkdir(dirname($dst), 0775, true); copy("assets_src/" . $src, $dst); }'
 
-if [ "true" = $(.tools/bin/console config:get setup) ]; then
-    .tools/bin/console cache:clear --ansi
+if [ "true" = $(project/bin/console config:get setup) ]; then
+    project/bin/console cache:clear --ansi
 
     echo "Core/Addons can not be re-installed, because the REDAXO setup is not done yet."
 
     exit
 fi
 
-.tools/bin/console migrate --ansi
-.tools/bin/console cache:clear --ansi
+project/bin/console migrate --ansi
+project/bin/console cache:clear --ansi
 
 composer update --ansi # update dev-tools
diff --git a/.tools/bin/update-all b/.tools/bin/update-all
index 7525363a78..d02881d61f 100755
--- a/.tools/bin/update-all
+++ b/.tools/bin/update-all
@@ -12,7 +12,7 @@ curl -# https://cdn.jsdelivr.net/gh/jquery/jquery@3/dist/jquery.min.map > assets
 #printf "\nUpdate assets/jquery-pjax.min.js\n"
 #curl -#d output_info=compiled_code -d compilation_level=SIMPLE_OPTIMIZATIONS -d code_url=https://github.com/defunkt/jquery-pjax/raw/master/jquery.pjax.js https://closure-compiler.appspot.com/compile > assets/jquery-pjax.min.js
 
-cp assets/jquery-pjax.min.js .tools/project/public/assets/core
-cp assets/jquery.js .tools/project/public/assets/core
-cp assets/jquery.min.js .tools/project/public/assets/core
-cp assets/jquery.min.map .tools/project/public/assets/core
+cp assets/jquery-pjax.min.js project/public/assets/core
+cp assets/jquery.js project/public/assets/core
+cp assets/jquery.min.js project/public/assets/core
+cp assets/jquery.min.map project/public/assets/core
diff --git a/.tools/project/src/Module/TestModule1.php b/.tools/fixtures/TestModule1.php
similarity index 93%
rename from .tools/project/src/Module/TestModule1.php
rename to .tools/fixtures/TestModule1.php
index 09bec60d6d..f936494a20 100644
--- a/.tools/project/src/Module/TestModule1.php
+++ b/.tools/fixtures/TestModule1.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Project\Module;
+namespace Redaxo\Core\Fixtures;
 
 use Override;
 use Redaxo\Core\Content\ArticleSlice;
diff --git a/.tools/project/src/Template/DefaultTemplate.php b/.tools/fixtures/TestTemplate.php
similarity index 76%
rename from .tools/project/src/Template/DefaultTemplate.php
rename to .tools/fixtures/TestTemplate.php
index 2934a01db0..3f4373e852 100644
--- a/.tools/project/src/Template/DefaultTemplate.php
+++ b/.tools/fixtures/TestTemplate.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Project\Template;
+namespace Redaxo\Core\Fixtures;
 
 use Override;
 use Redaxo\Core\Content\ArticleContent;
@@ -8,8 +8,8 @@
 use Redaxo\Core\Content\ContentSection;
 use Redaxo\Core\Content\Template;
 
-#[AsTemplate('default', 'Default')]
-final class DefaultTemplate extends Template
+#[AsTemplate('test', 'Test')]
+final class TestTemplate extends Template
 {
     #[Override]
     public function render(ArticleContent $content): string
@@ -17,6 +17,7 @@ public function render(ArticleContent $content): string
         return $content->renderContent();
     }
 
+    /** @return non-empty-list<ContentSection> */
     #[Override]
     public function getContentSections(): array
     {
diff --git a/.tools/project/src/Project.php b/.tools/project/src/Project.php
deleted file mode 100644
index afc5a8a784..0000000000
--- a/.tools/project/src/Project.php
+++ /dev/null
@@ -1,14 +0,0 @@
-<?php
-
-namespace Project;
-
-use Redaxo\Core\AbstractProject;
-
-final class Project extends AbstractProject
-{
-    /** @var non-empty-string */
-    public string $projectPath = __DIR__ . '/..';
-
-    /** @var non-empty-string */
-    public string $corePath = __DIR__ . '/../../..';
-}
diff --git a/.tools/visual-tests/fixtures/initial-content.sql b/.tools/visual-tests/fixtures/initial-content.sql
index 864606d6d0..0236149a3b 100644
--- a/.tools/visual-tests/fixtures/initial-content.sql
+++ b/.tools/visual-tests/fixtures/initial-content.sql
@@ -2,8 +2,8 @@
 ## Prefix rex_
 
 INSERT IGNORE INTO `rex_article` VALUES
-(1,1,0,'test category','test category',1,1,1,'|',1,'default',1,'2021-01-01 11:37:20','myusername','2021-01-01 11:37:20','myusername'),
-(2,2,0,'test article','',0,0,1,'|',0,'default',1,'2021-01-01 11:37:20','myusername','2021-01-01 11:37:20','myusername');
+(1,1,0,'test category','test category',1,1,1,'|',1,'test',1,'2021-01-01 11:37:20','myusername','2021-01-01 11:37:20','myusername'),
+(2,2,0,'test article','',0,0,1,'|',0,'test',1,'2021-01-01 11:37:20','myusername','2021-01-01 11:37:20','myusername');
 
 INSERT IGNORE INTO `rex_article_slice` VALUES
 (1,1,1,1,'testmodule1',0,1,1,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'2021-01-01 11:37:20','myusername','2021-01-01 11:37:20','myusername'),
diff --git a/.tools/visual-tests/screenshots/cronjob_cronjobs_add--dark.png b/.tools/visual-tests/screenshots/cronjob_cronjobs_add--dark.png
index 1180f3cc74..f43bfedc4b 100644
Binary files a/.tools/visual-tests/screenshots/cronjob_cronjobs_add--dark.png and b/.tools/visual-tests/screenshots/cronjob_cronjobs_add--dark.png differ
diff --git a/.tools/visual-tests/screenshots/cronjob_cronjobs_add.png b/.tools/visual-tests/screenshots/cronjob_cronjobs_add.png
index 740a50ec00..cb7eeeb679 100644
Binary files a/.tools/visual-tests/screenshots/cronjob_cronjobs_add.png and b/.tools/visual-tests/screenshots/cronjob_cronjobs_add.png differ
diff --git a/.tools/visual-tests/screenshots/index--dark.png b/.tools/visual-tests/screenshots/index--dark.png
index ae5aff118c..7a23147555 100644
Binary files a/.tools/visual-tests/screenshots/index--dark.png and b/.tools/visual-tests/screenshots/index--dark.png differ
diff --git a/.tools/visual-tests/screenshots/index.png b/.tools/visual-tests/screenshots/index.png
index 0515939a17..d34eb5f568 100644
Binary files a/.tools/visual-tests/screenshots/index.png and b/.tools/visual-tests/screenshots/index.png differ
diff --git a/.tools/visual-tests/screenshots/setup_3--dark.png b/.tools/visual-tests/screenshots/setup_3--dark.png
index 7c91e435e9..df2f846d08 100644
Binary files a/.tools/visual-tests/screenshots/setup_3--dark.png and b/.tools/visual-tests/screenshots/setup_3--dark.png differ
diff --git a/.tools/visual-tests/screenshots/setup_3.png b/.tools/visual-tests/screenshots/setup_3.png
index d6592bd66b..2b307461d1 100644
Binary files a/.tools/visual-tests/screenshots/setup_3.png and b/.tools/visual-tests/screenshots/setup_3.png differ
diff --git a/.tools/visual-tests/screenshots/structure_category_edit--dark.png b/.tools/visual-tests/screenshots/structure_category_edit--dark.png
index 658fa577f9..a2dae1c66a 100644
Binary files a/.tools/visual-tests/screenshots/structure_category_edit--dark.png and b/.tools/visual-tests/screenshots/structure_category_edit--dark.png differ
diff --git a/.tools/visual-tests/screenshots/structure_category_edit.png b/.tools/visual-tests/screenshots/structure_category_edit.png
index d0d9833b54..5d3da05fed 100644
Binary files a/.tools/visual-tests/screenshots/structure_category_edit.png and b/.tools/visual-tests/screenshots/structure_category_edit.png differ
diff --git a/.tools/visual-tests/screenshots/system_log--dark.png b/.tools/visual-tests/screenshots/system_log--dark.png
index 8e05bef9a1..1fadc80c90 100644
Binary files a/.tools/visual-tests/screenshots/system_log--dark.png and b/.tools/visual-tests/screenshots/system_log--dark.png differ
diff --git a/.tools/visual-tests/screenshots/system_log.png b/.tools/visual-tests/screenshots/system_log.png
index 99c633a0bb..1fde16148a 100644
Binary files a/.tools/visual-tests/screenshots/system_log.png and b/.tools/visual-tests/screenshots/system_log.png differ
diff --git a/AGENTS.md b/AGENTS.md
index 4a1862583a..7c1120ad73 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -41,9 +41,9 @@ vendor/bin/phpunit tests/Database/SqlTest.php
 
 ### Console & Docker
 ```bash
-php .tools/bin/console                      # List all CLI commands (Symfony Console)
-php .tools/bin/console setup:run            # Run setup
-php .tools/bin/console migrate              # Sync DB schema with core + addons after a code update
+php project/bin/console                      # List all CLI commands (Symfony Console)
+php project/bin/console setup:run            # Run setup
+php project/bin/console migrate              # Sync DB schema with core + addons after a code update
 docker-compose up -d                        # Start (port 80)
 REDAXO_PORT=8080 docker-compose up -d       # Start on custom port
 ```
@@ -51,14 +51,19 @@ REDAXO_PORT=8080 docker-compose up -d       # Start on custom port
 ## Architecture
 
 ### What belongs to this repo
-This repository contains the **REDAXO core** under `src/` (`Redaxo\Core\`), backend pages (`pages/`), templates (`fragments/`), translations (`lang/`), setup (`setup/`) and assets (`assets/`, `assets_src/`). Two **dev-only addons** live under `addons/`: `debug` and `test`.
+This repository **is** the `redaxo/core` package — the package is the whole repository root, not a subdirectory. Everything in the root ships as core except the dev-only paths excluded from the dist via `.gitattributes` `export-ignore` (notably `addons/`, `project/`, `tests/`, the dotfiles and the analysis configs). Core's PHP classes (`Redaxo\Core\`) live in `src/`, but core equally comprises the boot sequence (`boot/`), backend pages (`pages/`), fragment templates (`fragments/`), translations (`lang/`), setup (`setup/`), DB schemas (`schemas/`) and assets (`assets/`, `assets_src/`).
+
+Two addons live under `addons/`, but they are different in nature: **`debug`** is the `redaxo/debug` package — a real, published addon that is split out into a standalone repository via git subtree split and required here only as a dev dependency. **`test`** is an internal helper used solely within this repo for testing and is *not* published.
+
+The **`project/` skeleton** is the `redaxo/project` package — published standalone via git subtree split and used with `composer create-project` — which also doubles as this repo's local development instance (see *Local dev instance* below). Visual-test fixtures (modules/templates) live under `.tools/fixtures/` (namespace `Redaxo\Core\Fixtures`), so they stay out of the shipped skeleton.
 
 ### Key concepts
 - **`Core` static class** (`src/Core.php`) — central application registry for paths, config, request, current user.
 - **Addon system** — `Addon` / `AddonManager` (`src/Addon/`). Each addon is a subclass of `Addon`, registered via composer.json `extra.redaxo.addon-class`. Metadata comes from composer.json; integration happens through overridable hooks — `boot()` (runtime init), `install()`/`uninstall()` (schema/data setup — must be idempotent, runs on every `console migrate`), `getPages()` (backend pages) — plus the `$load` and `$defaultConfig` properties.
 - **Extension points** — REDAXO's hook/event system: register listeners with `Extension::register('NAME', ...)`, fire points with `Extension::dispatch(new ExtensionPoint(...))`. Classes live under `Redaxo\Core\ExtensionPoint`. This is the primary integration mechanism for addons.
 - **Fragments** (`fragments/`) — template snippets rendered via `Fragment` (`src/View/Fragment.php`).
-- **Boot flow** — `AbstractProject` (Symfony `RuntimeInterface`) drives boot via `boot/core.php` → `boot/addons.php` → environment entry (`boot/backend.php`, `boot/frontend.php`, `boot/console.php`).
+- **Boot flow** — `AbstractProject` (Symfony `RuntimeInterface`) drives boot via `boot/core.php` → `boot/addons.php` → environment entry (`boot/backend.php`, `boot/frontend.php`, `boot/console.php`). The entry points live in the project (`project/public/index.php`, `project/public/redaxo/index.php`, `project/bin/console`).
+- **Local dev instance** — `project/` is loaded as a Composer path repo and symlinked into `vendor/redaxo/project`. `composer install`/`update` runs `.tools/bin/init-project`, which writes the gitignored `project/vendor/autoload_runtime.php` shim (delegating to the root autoloader). Run the app via `project/bin/console` and the `project/public/` document root; runtime data lives in `project/var/` (gitignored).
 
 ### Class naming
 All core classes live in the `Redaxo\Core\` namespace, mapped to `src/`. Tests live under `tests/` mirroring the `src/` layout, namespace `Redaxo\Core\Tests`, files named `*Test.php`.
diff --git a/composer.json b/composer.json
index 215829037b..56bff5e55c 100644
--- a/composer.json
+++ b/composer.json
@@ -60,6 +60,7 @@
         "rector/rector": "2.4.5",
         "redaxo/debug": "^2.0@dev",
         "redaxo/php-cs-fixer-config": "3.1.0",
+        "redaxo/project": "^6.0@dev",
         "redaxo/psalm-plugin": "2.2.0",
         "redaxo/test": "^1.0@dev",
         "shipmonk/phpstan-baseline-per-identifier": "2.3.0",
@@ -97,7 +98,7 @@
     },
     "autoload-dev": {
         "psr-4": {
-            "Project\\": ".tools/project/src",
+            "Redaxo\\Core\\Fixtures\\": ".tools/fixtures",
             "Redaxo\\Core\\Tests\\": "tests",
             "Redaxo\\Rector\\": ".tools/rector"
         }
@@ -161,7 +162,10 @@
             "@sa",
             "@phpunit",
             "@taint"
-        ]
+        ],
+
+        "post-install-cmd": "bash .tools/bin/init-project",
+        "post-update-cmd": "bash .tools/bin/init-project"
     },
     "scripts-descriptions": {
         "rebase-to-bugfix": "Rebase current branch onto bugfix",
@@ -211,6 +215,13 @@
             "options": {
                 "versions": {"redaxo/test": "1.x-dev"}
             }
+        },
+        {
+            "type": "path",
+            "url": "project",
+            "options": {
+                "versions": {"redaxo/project": "6.x-dev"}
+            }
         }
     ]
 }
diff --git a/phpstan.dist.neon b/phpstan.dist.neon
index a1c29b628b..7e438c58a3 100644
--- a/phpstan.dist.neon
+++ b/phpstan.dist.neon
@@ -10,16 +10,23 @@ parameters:
     featureToggles:
         internalTag: false
     paths:
-        - .tools/project
+        - .php-cs-fixer.dist.php
+        - .tools/fixtures
         - addons
+        - assets_src/vendor_files.php
         - boot
         - fragments
         - pages
+        - project/bin/console
+        - project/public
+        - project/src
+        - rector.php
         - setup
         - src
         - tests
     excludePaths:
-        - .tools/project/var
+        # Composer script handler — uses Composer's runtime API (not in the dependency tree).
+        - src/Composer/ScriptHandler.php
     # https://phpstan.org/config-reference#universal-object-crates
     universalObjectCratesClasses:
         - Redaxo\Core\View\Fragment
diff --git a/project/.gitattributes b/project/.gitattributes
new file mode 100644
index 0000000000..7baff78aed
--- /dev/null
+++ b/project/.gitattributes
@@ -0,0 +1,6 @@
+# Files relevant to the skeleton repository itself — kept out of the project created via `composer create-project`
+# (honored for dist installs). README.md is the skeleton's readme; the project's own README is written by the
+# create-project script handler (see Redaxo\Core\Composer\ScriptHandler).
+/.gitattributes export-ignore
+/LICENSE export-ignore
+/README.md export-ignore
diff --git a/project/.gitignore b/project/.gitignore
new file mode 100644
index 0000000000..299e585fa2
--- /dev/null
+++ b/project/.gitignore
@@ -0,0 +1,4 @@
+/public/assets/
+/public/media/
+/var/
+/vendor/
diff --git a/project/.htaccess b/project/.htaccess
new file mode 100644
index 0000000000..0d8830d9d8
--- /dev/null
+++ b/project/.htaccess
@@ -0,0 +1,19 @@
+# Safety net — deny access to the project root.
+#
+# The web server's document root MUST point to the "public/" directory. If a (mis)configured vhost serves the project
+# root instead, this prevents source code, configuration, dependencies and runtime data from being exposed. Access for
+# "public/" itself is re-granted in public/.htaccess.
+#
+# Note: this only takes effect on servers that evaluate .htaccess files (typical Apache shared hosting). On nginx etc.
+# configure the document root to point at "public/" — that is the actual line of defense everywhere.
+
+# The check keys on the mod_authz_core module (introduced in 2.3, standard since 2.4), not on a version number.
+<IfModule mod_authz_core.c>
+    # Apache 2.4+
+    Require all denied
+</IfModule>
+<IfModule !mod_authz_core.c>
+    # Apache 2.2 and earlier
+    Order deny,allow
+    Deny from all
+</IfModule>
diff --git a/project/LICENSE b/project/LICENSE
new file mode 100644
index 0000000000..de3fe1d1e3
--- /dev/null
+++ b/project/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) REDAXO, www.redaxo.org
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/project/README.md b/project/README.md
new file mode 100644
index 0000000000..0f3dae8a8d
--- /dev/null
+++ b/project/README.md
@@ -0,0 +1,32 @@
+# REDAXO project skeleton
+
+Create a new REDAXO project:
+
+```bash
+composer create-project redaxo/project:6.x-dev my-project
+cd my-project
+```
+
+> [!NOTE]
+> The `:6.x-dev` requests the development version, which is required as long as
+> REDAXO 6 has no stable release yet. Once it does, plain
+> `composer create-project redaxo/project my-project` is enough.
+
+Point your web server's document root to `public/`, then run the setup:
+
+```bash
+php bin/console setup:run
+```
+
+## Structure
+
+```
+bin/console               Console entry point (Symfony Console)
+public/                   Document root (point the web server here)
+public/index.php          Frontend controller
+public/redaxo/index.php   Backend controller
+public/media/             Media pool files
+src/                      Your project code (Project class, templates, modules, …)
+src/Project.php           Project class (boot configuration)
+var/                      Runtime data (cache, data, logs, …)
+```
diff --git a/.tools/bin/console b/project/bin/console
similarity index 69%
rename from .tools/bin/console
rename to project/bin/console
index 634c2cde06..12b9a31117 100755
--- a/.tools/bin/console
+++ b/project/bin/console
@@ -4,6 +4,6 @@
 use Project\Project;
 use Redaxo\Core\Environment;
 
-require_once dirname(__DIR__, 2) . '/vendor/autoload_runtime.php';
+require_once dirname(__DIR__) . '/vendor/autoload_runtime.php';
 
 return static fn (array $context) => new Project(Environment::Console);
diff --git a/project/composer.json b/project/composer.json
new file mode 100644
index 0000000000..acb38efdec
--- /dev/null
+++ b/project/composer.json
@@ -0,0 +1,43 @@
+{
+    "name": "redaxo/project",
+    "type": "project",
+    "description": "REDAXO project skeleton for `composer create-project`",
+    "keywords": ["redaxo", "cms", "skeleton", "project"],
+    "homepage": "https://redaxo.org",
+    "authors": [
+        {
+            "name": "Yakamara Media GmbH & Co. KG",
+            "homepage": "https://yakamara.de"
+        },
+        {
+            "name": "REDAXO team & community",
+            "homepage": "https://redaxo.org"
+        }
+    ],
+    "license": "MIT",
+
+    "require": {
+        "php": "^8.5",
+        "redaxo/core": "^6.0@dev",
+        "symfony/runtime": "^8.1"
+    },
+
+    "autoload": {
+        "psr-4": {
+            "Project\\": "src/"
+        }
+    },
+
+    "scripts": {
+        "post-create-project-cmd": "Redaxo\\Core\\Composer\\ScriptHandler::postCreateProject"
+    },
+
+    "config": {
+        "allow-plugins": {
+            "symfony/runtime": true
+        },
+        "sort-packages": true
+    },
+
+    "prefer-stable": true
+}
diff --git a/project/public/.htaccess b/project/public/.htaccess
new file mode 100644
index 0000000000..ef7f6017f4
--- /dev/null
+++ b/project/public/.htaccess
@@ -0,0 +1,17 @@
+# Document root.
+#
+# The project-root .htaccess denies access to everything by default.
+# This re-grants access for the public directory (and everything below it).
+
+<IfModule mod_authz_core.c>
+    # Apache 2.4+
+    Require all granted
+</IfModule>
+<IfModule !mod_authz_core.c>
+    # Apache 2.2 and earlier
+    Order allow,deny
+    Allow from all
+</IfModule>
+
+# Disable directory listings, e.g. of asset folders (needs AllowOverride Options).
+# Options -Indexes
diff --git a/.tools/project/public/index.php b/project/public/index.php
similarity index 66%
rename from .tools/project/public/index.php
rename to project/public/index.php
index 2b0cf74768..4eebbf8cea 100644
--- a/.tools/project/public/index.php
+++ b/project/public/index.php
@@ -3,6 +3,6 @@
 use Project\Project;
 use Redaxo\Core\Environment;
 
-require_once dirname(__DIR__, 3) . '/vendor/autoload_runtime.php';
+require_once dirname(__DIR__) . '/vendor/autoload_runtime.php';
 
 return static fn (array $context) => new Project(Environment::Frontend);
diff --git a/.tools/project/public/redaxo/index.php b/project/public/redaxo/index.php
similarity index 67%
rename from .tools/project/public/redaxo/index.php
rename to project/public/redaxo/index.php
index 481a9daddd..4773685131 100644
--- a/.tools/project/public/redaxo/index.php
+++ b/project/public/redaxo/index.php
@@ -3,6 +3,6 @@
 use Project\Project;
 use Redaxo\Core\Environment;
 
-require_once dirname(__DIR__, 4) . '/vendor/autoload_runtime.php';
+require_once dirname(__DIR__, 2) . '/vendor/autoload_runtime.php';
 
 return static fn (array $context) => new Project(Environment::Backend);
diff --git a/project/src/Project.php b/project/src/Project.php
new file mode 100644
index 0000000000..54d4e78cae
--- /dev/null
+++ b/project/src/Project.php
@@ -0,0 +1,16 @@
+<?php
+
+namespace Project;
+
+use Override;
+use Redaxo\Core\AbstractProject;
+
+final class Project extends AbstractProject
+{
+    #[Override]
+    public function boot(): void
+    {
+        // Runtime initialization for the project. Runs on every request,
+        // after the core and all addons have booted.
+    }
+}
diff --git a/project/src/Template/DefaultTemplate.php b/project/src/Template/DefaultTemplate.php
new file mode 100644
index 0000000000..a1a5204436
--- /dev/null
+++ b/project/src/Template/DefaultTemplate.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Project\Template;
+
+use Override;
+use Redaxo\Core\Content\ArticleContent;
+use Redaxo\Core\Content\AsTemplate;
+use Redaxo\Core\Content\Template;
+use Redaxo\Core\Core;
+
+use function Redaxo\Core\View\escape;
+
+#[AsTemplate('default', 'Default')]
+final class DefaultTemplate extends Template
+{
+    #[Override]
+    public function render(ArticleContent $content): string
+    {
+        // Minimal starting point: a bare HTML document wrapped around the article's content.
+        // In a real project you'll usually move the markup into a fragment (`fragments/`, rendered via `Fragment`)
+        // and build out the <head>, navigation, asset handling etc. there — this method then just glues the parts together.
+
+        $title = escape($content->article->name);
+        $siteName = escape(Core::getServerName());
+        $content = $content->renderContent();
+
+        return <<<HTML
+            <!DOCTYPE html>
+            <html lang="en">
+            <head>
+                <meta charset="utf-8">
+                <meta name="viewport" content="width=device-width, initial-scale=1">
+                <title>$title – $siteName</title>
+            </head>
+            <body>
+            $content
+            </body>
+            </html>
+            HTML;
+    }
+}
diff --git a/psalm.xml b/psalm.xml
index b2ddae5c6f..a766980465 100644
--- a/psalm.xml
+++ b/psalm.xml
@@ -12,17 +12,24 @@
     xsi:schemaLocation="https://getpsalm.org/schema/config vendor/vimeo/psalm/config.xsd"
 >
     <projectFiles>
-        <directory name=".tools/project/public"/>
-        <directory name=".tools/project/src"/>
+        <directory name=".tools/fixtures"/>
         <directory name="addons"/>
         <directory name="boot"/>
         <directory name="fragments"/>
         <directory name="pages"/>
+        <directory name="project/public"/>
+        <directory name="project/src"/>
         <directory name="setup"/>
         <directory name="src"/>
         <directory name="tests"/>
+        <file name=".php-cs-fixer.dist.php"/>
+        <file name="assets_src/vendor_files.php"/>
+        <file name="project/bin/console"/>
+        <file name="rector.php"/>
         <ignoreFiles>
             <directory name="vendor"/>
+            <!-- Composer script handler — uses Composer's runtime API (not in the dependency tree). -->
+            <file name="src/Composer/ScriptHandler.php" />
             <file name=".phpstorm.meta.php" />
         </ignoreFiles>
     </projectFiles>
diff --git a/rector.php b/rector.php
index ef557ac88d..d0b5f6afb4 100644
--- a/rector.php
+++ b/rector.php
@@ -2,6 +2,7 @@
 
 declare(strict_types=1);
 
+use PhpParser\Node\ArrayItem;
 use PhpParser\Node\Expr;
 use PhpParser\Node\Name;
 use Rector\Arguments\Rector\ClassMethod\ArgumentAdderRector;
@@ -82,12 +83,15 @@
 
 return RectorConfig::configure()
     ->withPaths([
-        '.tools/project/',
+        '.tools/fixtures/',
         'addons',
         'assets_src/vendor_files.php',
         'boot/',
         'fragments/',
         'pages/',
+        'project/bin/console',
+        'project/public/',
+        'project/src/',
         'setup/',
         'src/',
         'tests/',
@@ -136,7 +140,8 @@
         TypeDeclaration\ArrowFunction\AddArrowFunctionReturnTypeRector::class,
         TypeDeclaration\Closure\AddClosureVoidReturnTypeWhereNoReturnRector::class,
 
-        '.tools/project/var',
+        // Composer script handler — uses Composer's runtime API (not in the dependency tree).
+        __DIR__ . '/src/Composer/ScriptHandler.php',
     ])
 
     // Upgrade REDAXO 5 to 6
@@ -717,7 +722,7 @@
         new ReplaceArgumentDefaultValue(ExtensionPoint\Extension::class, 'register', 0, 'STRUCTURE_CONTENT_SLICE_MENU', '\\' . Content\ExtensionPoint\SliceMenu::class . '::NAME'),
 
         new ReplaceArgumentDefaultValue(Util\Markdown::class, 'parse', 1, false, $options = [
-            new Expr\ArrayItem(new Expr\ConstFetch(new Name('false')), new Expr\ClassConstFetch(new Name(Util\Markdown::class), 'SOFT_LINE_BREAKS')),
+            new ArrayItem(new Expr\ConstFetch(new Name('false')), new Expr\ClassConstFetch(new Name(Util\Markdown::class), 'SOFT_LINE_BREAKS')),
         ]),
         new ReplaceArgumentDefaultValue(Util\Markdown::class, 'parseWithToc', 3, false, $options),
     ])
diff --git a/src/AbstractProject.php b/src/AbstractProject.php
index d7d17df833..41436ab2a1 100644
--- a/src/AbstractProject.php
+++ b/src/AbstractProject.php
@@ -46,8 +46,9 @@ abstract class AbstractProject implements RunnerInterface
     }
 
     /** @var non-empty-string */
-    public string $corePath {
-        get => $this->corePath ??= $this->projectPath . '/vendor/redaxo/core';
+    final public string $corePath {
+        // The directory of the core itself (this file lives in core's src/).
+        get => dirname(__DIR__);
     }
 
     /** @var non-empty-string */
diff --git a/src/Composer/ScriptHandler.php b/src/Composer/ScriptHandler.php
new file mode 100644
index 0000000000..5420f04e02
--- /dev/null
+++ b/src/Composer/ScriptHandler.php
@@ -0,0 +1,87 @@
+<?php
+
+namespace Redaxo\Core\Composer;
+
+use Composer\Json\JsonManipulator;
+
+use function basename;
+use function file_get_contents;
+use function file_put_contents;
+use function getcwd;
+use function getenv;
+
+/**
+ * Handlers for Composer script events of a REDAXO project, referenced from the project skeleton's composer.json
+ * `scripts`.
+ *
+ * @internal
+ *
+ * This relies on Composer's runtime API (`JsonManipulator`, used so the file's formatting and blank lines are
+ * preserved). Those classes are available while Composer executes the script, but are not part of this package's
+ * dependency tree — hence this file is excluded from static analysis.
+ */
+final class ScriptHandler
+{
+    /**
+     * Runs after `composer create-project redaxo/project`: turns the freshly cloned skeleton into a clean project
+     * (resets composer.json, writes a project README).
+     */
+    public static function postCreateProject(): void
+    {
+        self::cleanUpComposerJson();
+        self::writeReadme();
+
+        echo "Initialized composer.json and README.md for the new project.\n";
+    }
+
+    private static function cleanUpComposerJson(): void
+    {
+        $file = getenv('COMPOSER') ?: getcwd() . '/composer.json';
+        $manipulator = new JsonManipulator((string) file_get_contents($file));
+
+        // Strip the skeleton's own package identity.
+        foreach (['name', 'description', 'keywords', 'homepage', 'authors'] as $key) {
+            $manipulator->removeMainKey($key);
+        }
+
+        // A project created from this skeleton is private by default.
+        $manipulator->addMainKey('license', 'proprietary');
+
+        // Drop the skeleton's scripts block (its only entry is this create-project hook).
+        $manipulator->removeMainKey('scripts');
+
+        file_put_contents($file, $manipulator->getContents());
+    }
+
+    private static function writeReadme(): void
+    {
+        $name = basename((string) getcwd());
+
+        $readme = "# {$name}\n\n" . <<<'MARKDOWN'
+            A website project based on [REDAXO](https://redaxo.org).
+
+            ## Setup
+
+            Install the dependencies and run the setup:
+
+            ```bash
+            composer install
+            php bin/console setup:run
+            ```
+
+            Point your web server's document root at the `public/` directory.
+
+            ## Updating
+
+            After `composer update` — or after pulling changes that update REDAXO or its
+            addons — sync the database schema with the code:
+
+            ```bash
+            php bin/console migrate
+            ```
+
+            MARKDOWN;
+
+        file_put_contents(getcwd() . '/README.md', $readme);
+    }
+}