Form Bundle Laravel Package

Technical Evaluation

Architecture fit — poor against the stated target. Despite being scored in a Laravel/PHP context, akyos/form-bundle is a Symfony bundle, not a Laravel package. It is built directly on Symfony primitives: the Form component, Twig, HttpFoundation ($request->query->get() / $request->request->get()), the event dispatcher (form.submitted), and bundle registration via config/bundles.php. None of that maps onto Laravel's container, Blade, HTTP Request (which exposes input(), query(), all()), or service-provider model. The Laravel-shaped onboarding doc (assessment-laravel_dev.md) is itself a red flag: it prescribes Symfony install steps but includes Laravel idioms (e.g. \Log::debug), and it contradicts the README on PHP floor (8.2+ vs 8.4+). Treat the documentation set as unreliable and secondary to the source.

Architecture fit — even within Symfony, it is opinionated and layered. The bundle explicitly depends on akyos/core-bundle and akyos/cms-bundle (both ^8.0). Adopting a contact-form widget therefore means adopting a vendor CMS stack. The 8.0.3 patch (replacing removed Request::get() for admin builder component editing) confirms the admin UI is tightly coupled to Symfony HTTP Foundation internals — that layer would have to be reimplemented entirely in any non-Symfony port.

Integration feasibility. Into Laravel: effectively zero without a port or an out-of-process Symfony service. Into an existing Akyos/Symfony 8 estate: straightforward Composer install, config publish, Twig render, optional listener for submissions. Into a greenfield Symfony app with no Akyos Core/Cms: high friction.

Technical risk — high.

• Adoption signal is nil: 0 stars, 0 dependents, maturity rated "readme."
• Three-package single-vendor chain: CoreBundle → CmsBundle → FormBundle; a break in any layer blocks you, and you own the upgrade path.
• Bleeding-edge floors: PHP >= 8.4 and Symfony ^8.0. Both are very new, narrowing the install base and putting you on the leading edge of upstream churn — a reality already demonstrated by the 8.0.3 UndefinedMethodError regression.
• Unstable transitive dependency: reCAPTCHA via karser/karser-recaptcha3-bundle@dev — a dev-branch constraint in a production contact form is a supply-chain stability concern.
• Bus factor: single-vendor, no visible community, no support policy documented.

Key questions for the maintainer

1. Is CoreBundle/CmsBundle strictly required, or is there a standalone mode?
2. Who maintains this, and what is the response SLA / security-disclosure process?
3. What is the test coverage and CI matrix, and is the release cadence tied to Symfony majors?
4. Where are submissions stored (schema ownership), and how are migrations handled on upgrade?
5. What is the export format, and is PDF/CSV streaming or in-memory?
6. Is email dispatch synchronous or queued?
7. Are there rate limits, honeypot, or IP throttling beyond reCAPTCHA?
8. What is the data-retention / GDPR story for stored submissions?
9. Why is the karser dependency pinned to @dev?
10. Is Symfony LTS supported, or only the newest major?

Integration Approach

Stack fit. Direct fit: an existing Symfony 8 / PHP 8.4 application already running Akyos Core + Cms. Partial fit: a Symfony 8 app willing to adopt the CMS purely to get forms (poor value). No fit: Laravel, or any non-Symfony PHP framework. If the product is Laravel-based, the honest options are (a) build a native equivalent — Laravel's Form Request/Validation plus a schema-driven field table, or use Filament's form builder, which is far closer to the "Contact Form 7" value proposition and has real adoption; or (b) run the Symfony bundle as an isolated service behind an API/iframe if the form authoring UI is genuinely the differentiator.

Migration path. There is no migration path from a bespoke Laravel form to this bundle, and none from this bundle to anything else without extracting the submission data. The only realistic adoption path is greenfield inside an Akyos stack. Conversely, if an Akyos CMS is already in place, integration is close to the README: composer require, enable the bundle, configure mailer + reCAPTCHA keys, render via Twig, subscribe to form.submitted for persistence. Do not accept the documented php bin/console form:install as verified — confirm against the package's console commands.

Compatibility. Hard conflicts are likely in a Laravel project: the bundle's symfony/* and akyos/*-bundle ^8.0 requirements will collide with the Symfony components a Laravel app pins (typically 6.x/7.x), and config/bundles.php bootstrap does not exist. Treat any attempt to install this into Laravel as a failed spike waiting to happen — validate in a throwaway repo before it touches a real composer.json.

Sequencing (if approved for a Symfony 8 estate).

1. Throwaway spike: install Core + Cms + Form, confirm the admin builder actually loads and saves fields.
2. Verify the submission data model — tables, foreign keys, and whether migrations are owned by the bundle.
3. Wire email transport (test against Mailtrap/SMTP sink) and confirm failure surfacing.
4. Configure reCAPTCHA end-to-end and record the exact key/domain binding.
5. Add the form.submitted listener for storage/CRM hand-off and the post-submit redirect.
6. Export validation with a realistic dataset (10k rows) to check memory behaviour.
7. Upgrade drill: pin versions, then rehearse a Symfony minor bump to quantify the maintenance tax.
8. Gate: if steps 1–3 surface undocumented behaviour or the dependency chain blocks a Composer update, stop.

Operational Impact

Maintenance. You will be maintaining three interlinked packages from one small vendor, on PHP 8.4 / Symfony 8 — the fastest-moving corner of the ecosystem. Budget explicit recurring effort for Symfony upgrades, not a one-off integration. The @dev reCAPTCHA constraint should be forked/pinned internally before it reaches production.

Support. No community to lean on: 0 stars and 0 dependents mean no Stack Overflow corpus, no blog posts, no third-party tutorials. Debugging falls back to reading bundle source. A direct commercial or maintainer relationship should be a prerequisite, not a nice-to-have.

Scaling. Contact-form volume is usually modest, so the form rendering path is not the concern. The risk concentrates in three places the README does not address: (1) synchronous mail dispatch — SMTP latency directly inflates request time and will cascade under load; confirm a queue/messenger path or wrap the send in a job; (2) synchronous export — unbounded CSV/PDF generation will hit memory limits on realistic datasets; (3) admin builder queries — field-config loads on every admin edit, fine at low field counts, unverified beyond that. Submissions accumulate in the application DB, so storage and retention policy are yours to own, not the bundle's.

Failure modes to plan for.

• Mailer transport misconfiguration → silent or swallowed send failures; no delivery confirmation mentioned.
• reCAPTCHA key/domain mismatch or the @dev dependency resolving badly → form blocked entirely or spam floods through.
• Missing post-submit redirect → duplicate submissions on refresh (the bundle does not redirect by default).
• CSRF token mismatch after custom template work → hard 419-style rejections users cannot diagnose.
• Symfony upgrade → UndefinedMethodError class breakage in admin builder, exactly as fixed in 8.0.3.
• Absent or mismatched Core/Cms versions → container/service wiring failures at boot.
• No documented rate limiting → abuse via direct POST bypassing the rendered form.

Ramp-up. Conceptually cheap — it is "Contact Form 7 for Symfony," and a Symfony-fluent engineer will be productive in a day. Two caveats: engineers must also absorb the Akyos Core/Cms conventions (the real onboarding cost lives there), and a Laravel-fluent team gets essentially zero transferable knowledge from this exercise. Ramp-up is therefore bimodal: near-zero for an existing Akyos team, prohibitive for anyone else.

TPM recommendation. Do not adopt for a Laravel-based product — the package is architecturally incompatible and the surrounding documentation is demonstrably unreliable. Consider it only as a time-boxed MVP accelerator inside an existing Symfony 8 + Akyos estate, behind a written exit plan (own the submission schema, fork the reCAPTCHA constraint, keep the Twig templates local). For everyone else, the concept is worth copying and the package is not.