Laravel Audit Laravel Package

Product Decisions This Supports

• Build vs buy on code review capacity. This is an LLM-driven audit harness (php artisan audit) that produces prioritised, readable reports. It is a candidate to supplement — not replace — human review and deterministic tooling, and to decide whether to buy a commercial code-audit/ASPM product or grow in-house capability on top of this.
• Scope of the first investment. The stage model (analyse, standards, security) plus audit:tool catalog and per-stage status lets you ship value incrementally: start with standards-conformance (“does our code follow our own conventions?”), add security only once report quality is trusted. That is a product-scoping decision, not just a config choice.
• Whether AI audit runs belong in CI. audit:orchestrate (headless, one agent session, audit:tool as its only tool, closing message in orchestrator.md), --resume[=<run>], pause.json with exit code 4 on usage/rate limits, and model pre-flight checks (agent.check_model) together answer “can this run unattended on a nightly build, or is it a dev-machine tool?”
• Cost governance as a first-class lever. agent.run_budget_usd (AUDIT_RUN_BUDGET_USD), tool.max_calls (400), agent.max_attempts (2), per-task max_turns, per-task spend_usd in status — you can price an audit run per PR, per night, or per release and set a hard ceiling before committing to a cadence.
• Investing in written standards. Boost guideline blocks plus .ai/rules / .ai/guidelines are inlined as ## Coding standards (capped at standards_max_chars, 6000) into standards tasks and the conventions baseline. The quality of this package’s output is a function of how well you have written down your conventions — a cheap, durable product asset.
• Agent/tooling standardisation. Model-agnostic across Claude Code and OpenCode, with project.context + artisan about runtime facts used to rate exploitability. Choose this if those are already your team’s tools; it is not a reason to adopt them.
• Deciding what “audited” means. The new ## Checks section (clean, N findings (IDs), not audited, skipped) turns coverage into an explicit, reviewable artefact — useful for release sign-off conversations where “we ran the audit” is otherwise unfalsifiable.
• Not supported: deterministic gating. LLM findings are non-deterministic and confidence-rated; treat output as triage input, not as a pass/fail build gate on its own.

When to Consider This Package

Consider it when:

• You run a Laravel app and already have (or will adopt) Boost plus a Claude Code or OpenCode session in the workflow — the package assumes that substrate for skills, guidelines and the orchestrator.
• You have a real budget line for model spend and want it bounded and visible rather than open-ended.
• You want repeatable, human-readable audit artefacts in-repo (storage/audit/<run>/) that a PM or tech lead can read without tooling.
• You are pre-launch, post-incident, or doing periodic hardening passes — cadences where a two-attempt, resumable, pausable run is operationally acceptable.
• You want your own written conventions to be the rubric, and are willing to invest in AGENTS.md / .ai/rules.

Look elsewhere (or pair with something else) when:

• You need deterministic SAST/dependency scanning or compliance attestation. Use PHPStan/Psalm/Semgrep/Dependabot alongside; this package does not produce auditable, reproducible evidence.
• Code cannot leave your boundary. Every task is an agent call to a third-party model provider.
• You need API stability. This is the first tagged release (v0.2.0) and it already shows churn: the Codex driver was removed (it “cannot keep agents away from .env”), agent.mode / agent.concurrency / --mode were replaced by agent.max_concurrency / --concurrency, --orchestrate was removed and reintroduced as audit:orchestrate, and agent.verify.always_categories was removed. Pin the version and expect breaking changes at 0.x.
• Your team has no agent CLI, no Boost, or no appetite to maintain project.context and standards docs — you will get shallow findings.
• Security review flag: the Codex removal rationale is a governance signal about secret exposure (.env) to agent processes generally. Anyone adopting this should confirm .env and credentials are excluded from agent-readable context before running it on a production-adjacent repo.

How to Pitch It (Stakeholders)

For executives: This turns “how healthy is our Laravel codebase?” into a repeatable, budgeted process instead of a one-off consultant engagement. Each run has a hard cost ceiling, produces a severity-ordered report that names the most important findings by ID, and — importantly — an explicit ## Checks table showing what was actually audited versus not audited or skipped. You get a defensible answer to “what did we review?” Run cadence and per-run budget are decisions you control. It is early-stage software (first tagged release), so the recommendation is a paid pilot on one repo, not a standards mandate.

For engineering: Artisan-native, no new infrastructure. php artisan audit writes every task outcome to storage/audit/<run>/ as it completes; --resume picks up the latest run without redoing finished tasks; rate limits pause the run cleanly (exit code 4, pause.json, resume command) rather than losing work; agent.run_budget_usd and tool.max_calls cap spend and call volume. It reads your existing Boost guidelines and .ai/rules as the coding standard, so it audits against your conventions rather than a generic style guide. audit:orchestrate runs it headlessly for CI; audit:tool primitives (next, status, wait with finished_since/failed_since, start --stage=) let you drive it from your own session or workflow. Expect to pin the version and budget time for config migration on each 0.x bump.