Sloppy Laravel Package

Product Decisions This Supports

• Whether to scale AI coding agents beyond a pilot. The package is a guardrail layer for Claude Code, Gemini CLI, and Codex, not a linter with an agent theme bolted on. If the roadmap question is "can we let agents touch more repos / more engineers," this is the cheapest way to get an answer with evidence instead of vibes. sloppy diff --merge-base scopes findings to what the branch introduced, so you get a per-PR measure of agent-introduced debt.
• Build vs. buy for architecture enforcement. Every team that cares about module boundaries eventually writes a wiki page nobody reads, then a handful of custom PHPStan rules that rot. This ships 34 rules plus declarative architecture policies and SL301/SL303 layer suffixes. Buying (at MIT, dev-only) beats a homegrown ruleset you'd have to staff.
• Whether architecture intent is executable or aspirational. "Domain must not import Infrastructure" becomes a build failure rather than a code review debate. That's a policy decision a PM can actually point at, and it removes the reviewer-as-style-cop tax from senior engineers.
• Release-gate policy. Diff-scoped ci with --format=github|sarif|gitlab means you can choose a blocking gate, an advisory annotation, or a dashboard feed — and change your mind later. Exit code 2 is reserved for "invalid invocation," not "findings," which lets you separate "our config is broken" from "our code is bad" in CI telemetry.
• Where to spend agent-enablement effort. Coverage-aware reading order and the MCP server change how agents navigate a codebase; that's a lever on output quality that's orthogonal to prompt engineering. It's worth a spike before you commit to a ruleset convention (CLAUDE.md / GEMINI.md / AGENTS.md) as your primary control surface.
• Baseline debt as a leading indicator. PHPStan baseline-growth detection catches the specific failure mode where someone regenerates a baseline and a hundred new problems silently vanish. That's a metric you can put on a dashboard, not just a rule.
• Rollout sequencing and staffing. The two-week "measure with fail_on: none, prune exclude, then raise the gate" loop is a real work item. Budget it as enablement, not as a one-line install.

When to Consider This Package

Adopt when most of these are true:

• The stack is PHP, and ideally Laravel — Pint only runs on Laravel projects or on changed files, and the agent host wiring plus Laravel Boost precedence assume a Laravel-shaped repo.
• PHPStan is already in the pipeline, or you're willing to add it. The heyosseus/phpstan-sloppy extension is the highest-leverage surface: findings arrive in editors and existing baselines rather than as a second, competing tool.
• Agents are already in use or budgeted. Without agent adoption, this collapses into "another static analyzer with an unfamiliar name," competing on rules it won't win.
• There is a modular monolith, a layer convention, or a package boundary worth enforcing — something to declare in architecture.
• Review throughput is the bottleneck. The pitch only lands where PR volume or agent-generated diff volume is genuinely outpacing human review.
• You can tolerate a fast-moving dependency in require-dev. 1.6 tightened config validation, changed what architecture accepts, and made more inputs exit 2; 1.7 added two more agent hosts. That's healthy, but it's churn on your CI.

Look elsewhere or defer when:

• The codebase is polyglot or non-PHP. The value is concentrated in PHP semantics; there's no cross-language story.
• You already run a mature, staffed PHPStan ruleset plus Deptrac or PHPArkitect. Overlap is real, and two architecture enforcers means two configs to explain to new hires and two sources of findings to triage.
• You need automated remediation beyond Rector and Pint. sloppy fix is a tidy-up pass, not a refactoring engine.
• Procurement or platform standards require a vendor with support commitments. 223 stars, zero dependents on the registry, and a single-maintainer shape is the honest picture. If this becomes load-bearing, you own the failure mode.
• Nobody will install the hooks. The differentiating feature is feedback inside the agent loop. If your org won't let agents write .claude/settings.json or won't trust Codex hooks, you're buying the diff gate — useful, but a much smaller purchase.
• The team's tolerance for false-positive tuning is low. Rule accuracy improved materially in 1.6 (SL204/SL210 loop scoping, SL203 with('relation:columns'), SL108/SL110 null handling), but the pilot-and-prune loop is not optional.

Resolve before you pitch, not after: the package metadata's description.md describes an unrelated Eloquent seeder/faker tool. Verify against the tagged repo and the actual vendor/bin/sloppy command surface. This is a five-minute check and a credibility event if a stakeholder finds it first.

How to Pitch It (Stakeholders)

To executives, one paragraph: AI coding agents have moved the bottleneck from writing code to reviewing it, and reviewers can't see what an agent introduced versus what was already there. This package, an MIT-licensed dev-only Composer dependency that sends nothing off the machine, runs deterministic checks on the diff rather than the tree — so we can measure agent-introduced debt per PR, enforce architecture boundaries as a build failure instead of a wiki page, and catch the case where someone regenerates a PHPStan baseline and quietly erases the debt signal. It costs a require-dev line, has no production dependency and no vendor relationship, and removes cleanly.

To engineering leads: start diff-scoped, not full-tree — sloppy scan on a mature app produces a wall of pre-existing findings and will get the tool switched off. Wire sloppy ci --merge-base --format=github into the PR job first, install the PHPStan extension so findings show up where people already look, and treat baseline regeneration as a reviewed change. Then pilot agent hooks on one host and one repo for two weeks with fail_on: none, look at what agents actually trip, prune exclude and layer suffixes, and only then raise the gate. agents uninstall --host= gives you a scoped rollback if the pilot sours.

To security and platform: local and deterministic by design — no LLM, no network calls, no data egress. Dev-only dependency, publishable config, clean uninstall that restores settings files and agent configs to their prior state. Two behaviors worth documenting in the runbook: exit code 2 means invalid invocation (bad path, unknown option, type/range error in config, unparseable file in ci) and lists every problem at once, so a previously silently-ignored option can now stop a run; and the diff score is computed against --merge-base by default in ci, which is what you want for PRs but not necessarily for release branches.

Honest risk register to carry into the pitch: single-maintainer project with near-zero dependent count — assume bus-factor risk and keep the config thin enough to migrate off; the mislabeled package description is a discovery hazard you should fix in your own internal notes; false-positive tuning is real work, so scope it as enablement; and agent hooks add latency to every edit, which is why Claude Code hooks deliberately skip the score. None of these are disqualifying at dev-only scope — but if this becomes the thing that blocks merges, you have quietly made a 223-star project load-bearing, and that's a decision, not an accident.