Ghostwriter Statamic Laravel Package

Technical Evaluation

Framing correction: the brief calls this a Laravel/PHP package. It is a Statamic 6 addon running on Laravel; the hard runtime floor is Statamic 6.30 and PHP 8.3, with a pinned dependency on 1994/ghostwriter-core ^1.10. That distinction matters for who owns the upgrade.

Architecture fit

• Addon installs into the existing Statamic control panel, so it inherits auth, permissions and collection visibility. "Only the collections you can view are listed" indicates the addon respects Statamic's authorization model rather than inventing its own — a strong signal for enterprise use.
• Heaviest new surface is Preview: unsaved drafts rendered through the site's own Antlers templates. This is architecturally the riskiest item, because it couples an editorial tool to template correctness and to whatever those templates pull in.
• Content to revisit is an index that is maintained incrementally on entry save/delete plus a scheduled full pass. That is a denormalised read model; expect migrations and a backfill on install.
• Connections centralises API key management — one credential store to govern, audit and rotate.

Integration feasibility

• Additive release: new config keys (suggest.claims, revisit.external_links, revisit.age_in_full, preview.enabled, preview.script_hosts, preview.timeout) with documented defaults. Low blast radius on existing behaviour.
• Requires the Laravel scheduler to be running via cron. Confirm this before promising the revisit list is "always current" — a missing cron entry silently degrades the feature to save-time updates only.
• External link checking is outbound HTTP from the application server. Needs egress allowlisting, and should be reviewed against SSRF posture (the addon does its own rate limiting — 1 req/s per host, one check per address per week — which is a good sign).
• Background behaviour is implied ("in the background" for Suggest links, Sunday 04:00 link checks, 03:00 daily revisit) — verify whether these run on the queue and what happens if no worker is running.

Technical risk

• AI cost is variable and multi-step. A single "Suggest edits" run involves a free heuristic pass, a review call, then a second verification call; "Another version", "Write it for me" and comment application are additional calls. There is a cost confirm before sending — good — but no stated budget cap. This is the primary financial risk.
• Preview isolation. The notes claim private headers, noindex, and blocked third-party scripts. Two gaps to probe: what preview.script_hosts allows, and whether preview rendering can be pointed at a staging template set rather than production. A template that throws is handled ("says why", "Show blocks instead"), but a template with side effects is not addressed.
• Shared-state writes. Alt text is saved directly to the image asset after a warning about how many pages use it. Slug is filled only on new or unpublished entries; SEO fields are never written over human text. These are sensible guardrails but the alt-text write is a site-wide mutation triggered from an editor screen.
• Decision memory. "Decisions are shared and remembered" implies persisted per-entry, per-suggestion state. Understand retention, whether it survives content re-imports, and whether it is keyed to a revision.
• Version coupling. Statamic 6.30 + PHP 8.3 + core ^1.10 is a three-way floor. Any one of these lagging blocks the upgrade.

Key questions

1. What is the per-run and monthly AI spend at our draft volume, and is there a hard cap or per-site quota?
2. Which provider receives content, under what DPA, and is prompt/response retention disabled?
3. Does Preview run against production templates only, and can it be restricted to a staging or read-only template namespace?
4. Is the daily revisit pass queued or synchronous, and what is its runtime on our largest collection?
5. What migrations ship, and is the downgrade path clean?
6. Multi-site and multi-locale behaviour for revisit ranking, internal linking and preview?
7. Can suggest.claims and revisit.external_links be enforced centrally via config so individual sites cannot opt into spend or egress we haven't approved?

Integration Approach

Stack fit

• Native fit if we are already on Statamic 6. If we are on Statamic 5 or PHP 8.2, this release is not available to us until that platform work lands — treat the platform upgrade as the real project and the addon as the payload.
• The config-first settings (config/ghostwriter.php) mean we can ship policy as code and keep the UI toggles out of editorial hands where needed. Use that.
• Complements existing SEO tooling (SEO Pro or plain fields) rather than replacing it; the addon only proposes and never overwrites authored text.

Migration path

1. Upgrade Statamic to 6.30+ and PHP to 8.3 in a maintenance window; verify addon compatibility matrix first.
2. Bump 1994/ghostwriter-core to ^1.10 and the addon to v1.3.0 together — do not stagger these.
3. Run migrations; run the one-off backfill so Content to revisit has data on day one rather than after the first weekly pass.
4. Publish config with safe defaults: external link checking off, claims checking on, preview enabled only where templates are known-clean.
5. Register the scheduler entry and confirm it fires in staging before production.

Compatibility

• Additive within v1.x; no deprecations or breaking changes are described. Editorial workflows built on the existing "Edit with Ghostwriter" flow continue to work — Suggest edits is a sibling action, not a replacement.
• Template-side change is opt-in: {{ live_preview:ghostwriter }} lets a site exclude elements from previews. Sites that don't add it will render everything.

Sequencing

• Phase 1: platform upgrade + addon install + revisit index populated. Value: passive inventory of stale pages, zero AI spend, zero egress.
• Phase 2: Preview tab enabled for a single pilot collection, with preview.timeout tuned and templates audited for side effects.
• Phase 3: Suggest edits and Finish this page for a pilot editor group; instrument cost per run from the confirm dialog and provider dashboard.
• Phase 4: external link checking on, after egress approval, starting with one site.
• Do not enable Phases 3–4 before cost telemetry exists. Everything before that is free.

Operational Impact

Maintenance

• Three moving parts to keep in step: addon version, ghostwriter-core version, Statamic/PHP floor. Pin all three and let Renovate/Dependabot open a single grouped PR.
• Two scheduled jobs (daily 03:00 revisit, weekly Sunday 04:00 link check) become part of the scheduler contract. Add them to the platform's job inventory and alert on missed runs — a silent scheduler is the most likely quiet failure.
• New persisted state (revisit index, suggestion decisions, comment state) means backup/restore coverage and a schema to review on every upgrade.

Support

• Editor-facing support burden shifts from "how do I write this" to "why did it suggest that" and "why is this page on the revisit list". The reason-and-source display in Suggest edits is the mitigation; train a small number of champions rather than the whole team.
• Cost disputes are the likely support ticket. The pre-send confirm dialog is the artefact to point at; capture screenshots in the runbook.
• Preview template failures will be reported as addon bugs but are template bugs. Give support a script: reproduce in Preview, check the error text, compare with the live page, escalate to dev.

Scaling

• AI calls scale with editor activity, not traffic — predictable and controllable via seat count and settings.
• Revisit index scales with total published entries and rewrites on every save. Watch for write amplification on high-churn collections; the weekly full pass is the recovery mechanism if incremental updates drift.
• External link checking scales with unique outbound URLs, not pages. The once-a-week-per-address and 1 req/s rules bound it well, but a link-heavy legacy site will still produce a long first run.
• Preview renders through full templates on every draft change. That is real CPU per keystroke-ish event; preview.timeout and a single pilot collection are the throttles.

Failure modes

• AI provider outage: Suggest edits, Layouts, Extras and comment application degrade. Drafting and editing must remain usable — verify the degraded path in staging.
• Scheduler not running: revisit list goes stale; editors lose trust in the feature and stop using it. Alerting on job completion is the fix.
• Template exception in Preview: handled with an error message and fallback, but blocks the preview workflow for that collection. Needs a template ownership path.
• Cost spike: a single editor looping "Another version" or applying comments repeatedly. Mitigate with budget alerts and a documented ceiling; there is no stated hard cap in the notes.
• Alt-text overwrite: a site-wide asset mutation from an editor screen. Confirm the confirm-dialog wording is specific enough and that undo exists beyond the session.
• Egress block or DNS failure silently marking links broken — the two-consecutive-failures rule protects against transient errors, but a firewall change would fail every check consistently. Watch the first week's results.

Ramp-up

• Editors: roughly an hour. The flow is Preview → Text → Finish this page, with Accept/Edit/Dismiss and Undo throughout. Keyboard shortcuts and comment pinning need a live demo more than a doc.
• Developers: half a day. Config surface is small and documented; the real work is template auditing for Preview and the scheduler/cron verification.
• Platform/security: a review cycle for provider data handling and outbound link checking before Phase 4.
• Recommend a two-week pilot with one collection and three to five editors, measuring: cost per draft, accept rate on suggestions, revisit-list triage time, and any preview failures. Decide on wider rollout from that data, not from the release notes.