Kickoff Laravel Package

Product Decisions This Supports

• Build vs buy on the application baseline. Kickoff is not a feature library — it is the scaffold and ops layer (auth, SSO, 2FA, audit trail, webhooks, Docker, deploy, backup, scheduler) that every new app otherwise re-implements. 1.39.0 makes that baseline auditable: secrets excluded from the audit trail, 2FA columns hidden from serialization, webhook SSRF refusal, services bound to 127.0.0.1, no wildcard trusted proxies, CSP composed from the origins the views actually load. That is a defensible "buy" argument versus a homegrown starter kit that will never receive these fixes.
• Security and compliance roadmap items can be closed rather than scheduled. Several items teams typically carry as backlog risk — audit logging that leaks password/remember-token/2FA material, SSO account-takeover via unverified email match, webhooks POSTing to metadata endpoints — are handled here as defaults, not as configuration you must remember to enable. If your roadmap has a SOC2-style questionnaire or a pentest gate, this release materially shrinks the pre-audit checklist.
• Release-engineering confidence as a product decision. bin/deploy now fails fast (set -Eeuo pipefail), uses operations --isolated, checks git state, runs the npm build and optimize, health-checks /up and /, and rolls back honestly. The previous claim that --force existed was false — operations did not run at all. Similarly bin/backup-db verifies the archive and exits non-zero on GPG failure; a backup you cannot verify is not a backup. These are the operational promises you make to customers in an SLA, so their reliability is a product property, not an implementation detail.
• Use cases this unlocks or de-risks. Client work with SSO requirements (enterprise buyers), any app handling PII where audit trails are a contractual term, and multi-app portfolios where every project should inherit the same hardened baseline. The shipped scheduler entries (data:purge, package pruning, Horizon snapshot) mean retention policy exists on day one instead of being a launch-week scramble.
• Guardrails change the cost of future work. RouteSmokeTest, DeployParityTest, FluxIconsExistTest and ContentSecurityPolicyTest, plus strict Eloquent (lazy loading, discarded attributes) outside production, mean regressions surface in CI rather than in a customer's first session. That lowers the maintenance tax on every app built from this scaffold and raises the credibility of "we can support this for N years."
• Concrete defects fixed that map to user-visible outcomes. Self-registered users now receive the default role; migrate:fresh --seed yields a working login; login no longer crashes when registration is disabled; real auth views show SSO buttons; settings saves restart workers; bulk actions explain why users were skipped. These are onboarding and support-ticket reducers, and they should be reflected in demo scripts and sales collateral.
• Mail open/click tracking is now editable in Admin > Settings > Mail. Small feature, but it moves a marketing-owned toggle out of engineering tickets and into a self-serve admin surface — worth noting if marketing stakeholders are buyers of the roadmap.

When to Consider This Package

Consider Kickoff when:

• You are starting new Laravel applications repeatedly and want auth, SSO, 2FA, roles, audit trail, webhooks, media, admin settings, deploy and backup as a reviewed starting point rather than a per-project build.
• You have, or expect to have, enterprise buyers asking about SSO, audit logging, backup verification, or CSP — the defaults here are the answers.
• Your team can absorb a fast platform cadence. Requires PHP 8.5+ for Kickoff and generated apps, with Node 26 pinned via .nvmrc / engines.node. PHP 8.4 users must stay on 1.38. Treat the runtime floor as a hard planning constraint, not a footnote.
• You want operational scripts you can hand to a small ops team or a single on-call engineer without a bespoke runbook.

Look elsewhere or defer when:

• You are on PHP 8.4 or earlier with no near-term upgrade path, or you cannot move to Node 26 — you would be pinned to 1.38 and would not receive the security hardening above.
• You already run a mature, independently hardened starter kit; migration cost would exceed the benefit, and only the specific fixes (audit-trail secret leakage, SSO email claim, webhook host allowlisting, deploy honesty) are worth backporting individually.
• You need a library you can drop into an existing large application rather than a scaffold that generates one. Retrofitting is not the supported path.
• You cannot accept the upgrade ritual: re-publish media-manager-views, rename CACHE_DRIVER → CACHE_STORE in .env (the old key was silently ignored), set QUEUE_CONNECTION=redis and the scheduler cron in production, and run kickoff-patch. Existing apps need that work booked; it is not a composer update and done.

How to Pitch It (Stakeholders)

To executives: This release is hardening, not features — and that is the point. Three categories of risk we would otherwise carry as open backlog items are now closed by default: credentials and 2FA secrets are kept out of audit logs and serialization, SSO no longer hands an account to someone whose email is merely unverified, and webhooks refuse internal/metadata hosts. Our deploy and backup scripts now fail loudly and roll back honestly instead of reporting success they did not achieve. On the cost side, the baseline moves to PHP 8.5 and Node 26, so this is a scheduled platform upgrade with an explicit migration step for existing apps (kickoff-patch, a view re-publish, one environment variable rename). Net: lower security and operational exposure per app, and less engineering time spent re-solving the same problems on every new project.

To engineering: Adopt via the kickoff-patch skill rather than a manual merge. Before you upgrade, confirm the PHP 8.5 / Node 26 toolchain in CI. In existing apps, re-publish media-manager-views, rename CACHE_DRIVER to CACHE_STORE (the old key was being ignored), and set QUEUE_CONNECTION=redis plus the scheduler cron in production — the scheduler now ships in routes/console.php with data:purge, package pruning and a Horizon snapshot, so retention stops being tribal knowledge. New test coverage (RouteSmokeTest, DeployParityTest, FluxIconsExistTest, ContentSecurityPolicyTest) and strict Eloquent outside production will surface lazy-loading and discarded-attribute bugs locally; expect some churn the first time you run the suite against an older app. The two-factor settings view previously referenced a non-existent <x-input-otp>, which broke optimize — if your pipeline skipped that step, turn it back on now that it is fixed.