Consistency Laravel Package

Technical Evaluation

What changed in 2.17.08.29 — and why it doesn't change the verdict. The new release is the terminal release of hoa/consistency, and it is the same build the previous assessment already scored (2.17.08.29 is a date-stamped version: 2017-08-29). Every commit in the notes is a 2017 chore, test, or documentation rewrite by the original author during the Hoa project wind-down. There are no features, no security fixes, and no forward-looking work. The assessment's conclusion — reject for direct use — stands unchanged. What the notes do provide is precision on three points that were previously hedged, and those corrections are worth folding in.

Correction 1: hoa/exception is no longer a dependency. The previous assessment named hoa/exception as a likely drag. This release explicitly drops the dependency on hoa/exception (chore(php) Drop dependency to hoa/exception, 2017-08-21). That slightly reduces the dependency-graph footprint of this package. It does not reduce risk: other Hoa sibling packages still pull hoa/exception, so a transitive tree can still contain it — but the blame should now attach to the parent package, not to consistency. Correct the audit instructions accordingly.

Correction 2: the support floor moved up, and that is itself a BC break. chore(php) Migrate to PHP 7.1 and chore(php) Remove PHP 7.x implementations raise the minimum runtime to PHP 7.1. Any consumer pinned below that breaks on upgrade to this version. Combined with chore(composer) Anticipate future BC breaks, the author deliberately tightened Composer constraints in anticipation of abandoning the package — a pre-emptive constraint bump is precisely the mechanism that produces Composer resolution deadlocks downstream. This makes the "dependency drag" risk in the prior assessment more concrete, not less.

Correction 3: the source tree moved, which is a packaging-level BC break. chore(path) Move code into the Source directory plus fix(autoloader) Take into the move to Source means class-to-file mappings changed. PSR-4 consumers are fine; anything referencing vendor paths directly, or any tooling that assumes the pre-move layout, is not. Low probability in a Laravel app, but it is a real break and it landed in the final release with no follow-up patch — there is no 2.17.08.30 to fix a regression.

Architecture fit. Unchanged: effectively zero for a Laravel application. The release notes contain no new capability. Xcallable received a documentation rewrite, but the API surface is identical to what the prior assessment evaluated. Closure::fromCallable(), the container's call()/makeWith(), Macroable, and class_alias() remain the correct substitutes. Note that curry was rewritten against "new PHP features" — meaning PHP 7.1 features specifically, which are now nine years stale and receive no maintenance.

Integration feasibility. Mechanically still trivial; lifecycle cost still the dominant term. Dropping hoa/exception makes the install marginally cleaner, which — as before — makes the trap slightly more attractive. The package still registers autoload/stream plumbing at bootstrap, and that remains the expensive-to-remove part.

Technical risk — high, and now finalized. The critical new fact is that this release is the last one. There is no subsequent tag to fix a regression in the Source/ move, no patch for a PHP 8.x incompatibility, no advisory channel. Additional notes:

• HHVM support dropped (chore(ci) Drop HHVM support) — irrelevant to a Laravel estate, but confirms the CI matrix was being dismantled rather than expanded.
• Frozen at PHP 7.1 with removed legacy implementations. On PHP 8.1–8.3 this is inside the deprecation-to-fatal window described previously: reflection-based callable handling and dynamic properties surface as errors, not warnings.
• Date-versioned scheme. 2.17.08.29 encodes YY.MM.DD. Stakeholders who see a version number and assume a release cadence should be told explicitly that there will never be a 2.18.x. This is a communication task, not just an engineering one.

Key questions a TPM must get answered before any decision.

1. Is this a direct dependency or transitive? composer why hoa/consistency — unchanged, still the first question.
2. If transitive, which parent pulls it, and is that package abandoned? (Do not attribute hoa/exception to this package any more — check the parent.)
3. Are any consumers pinned below 2.17.08.29? If so, they are on a pre-7.1 floor and the upgrade to this version is itself a breaking change to sequence deliberately.
4. What is the concrete capability being consumed — Xcallable, aliasing, or the bootstrap shim?
5. Who owns containment or the fork, and what is the patch SLA, given there is definitively no upstream?

Integration Approach

Stack fit. Poor, unchanged. For a Laravel 10/11 application on PHP 8.1–8.3, this package sits outside its supported envelope and this release does not move it closer.

Preferred path — do not integrate; substitute. Unchanged mapping:

Migration path if it is already in the tree (transitive case).

1. Audit — composer why, full dependency chain, confirm whether the parent is itself abandoned. Attribute hoa/exception to the parent, not to consistency.
2. Isolate — never call Hoa classes from application code; wrap the consumed behavior behind an interface in app/Support/.
3. Pin and lock — exact pin, plus a composer audit / CI drift check.
4. Replace — swap the parent for a maintained alternative, or fork the parent and strip Hoa.

Version sequencing note (new). If containment rather than removal is chosen for the current cycle, pin at or above 2.17.08.29 to take the hoa/exception drop, but record explicitly that this is a terminal, unpackaged-future version. Do not treat "latest" as "maintained." The Source/ relocation means any pinned version below 2.17.08.29 has a different file layout — do not mix documentation or path assumptions across that boundary.

Compatibility checks before anything ships. Unchanged, plus one addition: confirm the runtime is ≥ PHP 7.1 before attempting install at all (this release removed the lower-PHP implementations), and re-run the stream-wrapper / error-handler diff (stream_get_wrappers(), get_defined_functions() before and after autoload) since the autoloader itself was modified in this release.

Sequencing. Assessment spike (1–2 days) → substitution decision → containment wrapper + CI guard if transitive (2–3 days) → parent replacement as a separate backlog item. Run in parallel with feature work; this is infrastructure hygiene.

Recommendation. Reject for direct use. Treat any transitive presence as a technical-debt ticket with a named owner and a removal date. The release notes confirm rather than challenge this position.

Operational Impact

Maintenance. Unchanged and now definitive. This release is the last commit in the repository's life; the archive followed. There is no upstream, no advisory channel, no PHP 8.x/9.x fix, and no constraint widening. The Anticipate future BC breaks commit means the author knowingly left Composer constraints in a state designed to fail safe — good intent, but it converts future upgrades into resolution errors rather than warnings. Budget for an internal fork as a permanent ownership tax.

Support. No vendor, no maintainer triage, documentation frozen at the 2017 rewrite published in this release. The rewritten doctests and docs in these notes are the final state of Hoa's documentation for this package — useful for reading the API, useless for troubleshooting a modern runtime. Escalation path remains "whoever can read the vendor directory."

Scaling. Runtime cost negligible; the scaling risk is organizational. One new consideration: because this is the terminal release and the version scheme is date-based, there is no mechanism by which the package will ever become better aligned with a modern stack. Every additional service that inherits it inherits a permanently frozen artifact. Across a growing PHP version matrix, that is a repeated blocker in every upgrade cycle.

Failure modes, ranked by likelihood.

1. PHP upgrade fatal — reflection/callable handling frozen at 7.1 semantics surfaces as a hard error on deploy. Highest probability, highest blast radius.
2. Composer resolution deadlock — the deliberate constraint tightening in this release conflicts with a Laravel or PHP bump.
3. Missing lower-PHP implementations — install or runtime failure on any environment below PHP 7.1, because the compatibility shims were removed rather than deprecated.
4. Global side effects — stream wrapper or error-handler registration colliding with Laravel's filesystem or exception handling; the autoloader was touched in this release, so re-verify.
5. Security exposure — unpatched flaw, no disclosure channel, discovered by external scan.

Ramp-up. The API remains readable in under an hour. The ramp-up cost is unlearning it, plus one new communication item: engineers and stakeholders who see a "latest release" must be told plainly that 2.17.08.29 is the final version and will never be superseded. Publish a short ADR stating the rejection, the approved substitutes, and the terminal-version fact; that document is worth more than any onboarding session.

Bottom line for the roadmap. This release is the epilogue, not a revival. It corrects one detail in the prior assessment — hoa/exception is no longer pulled by this package — and sharpens two others: the PHP floor moved to 7.1, and the author pre-emptively tightened Composer constraints before walking away. The correct TPM action is unchanged: a written rejection, a dependency-graph audit to confirm no transitive arrival, and a scoped containment-and-removal ticket (2–5 days) closed out before the next PHP upgrade forces the issue.