Richter Laravel Package

Product Decisions This Supports

• Merge-gate policy (advisory vs blocking). v0.70.0 closes a reporting gap by surfacing the risk cause in the HTML report, matching text/markdown output. That makes risk scores explainable to reviewers, which is the prerequisite for moving from "warn on PR" to "block on medium+ risk" without engineers perceiving the gate as a black box.
• Security-debt prioritization. Fixes to model hazard parsing ($fillable combined with $guarded) and middleware tier-3 hazards (a guard a group both appends and removes) mean the tool's ranking of dangerous surfaces is now more trustworthy. This supports decisions about where to spend remediation effort first across legacy Laravel code, especially mass-assignment and auth-middleware ordering.
• Laravel 11+ upgrade planning. Middleware analysis now follows bootstrap/app.php call order, reads group('name', [...]), and correctly hides Kernel groups when withMiddleware is used. If we are migrating from Kernel.php to bootstrap/app.php, analysis results now reflect real runtime ordering — usable as evidence in upgrade sequencing and regression-risk discussions.
• Async/queue architecture mapping. Dispatch resolution changes cut both false positives (a new of a non-dispatchable class in an accumulated job array is no longer unresolved) and false negatives (a spread in a dispatched array now is an unresolved dispatch site; changed ShouldQueue/Dispatchable classes outside \Jobs\ read unresolved). Use this to map job dependencies and decide where queue refactors carry hidden coupling — but treat unresolved as an investigation prompt, not a defect.
• Build vs buy for static analysis. This is a correctness/maintenance release (no new analysis categories), with active internal QA investment (StructArmed, raised symplify/phpstan-rules floor, strict process faking in tests). That strengthens the case for buying/adopting over building bespoke PHPStan rules, while the pre-1.0 pace of semantic changes argues against deep coupling to its output format.
• Version pinning and baseline policy. Graph cache format is now 28 (one-time rebuild, no data migration), and a cache entry with a missing/mis-typed unparseable-files flag or missing node metadata is refused. Operationally cheap — but because findings can appear or disappear between releases (e.g. sibling-read and absence-style fixes, task-slice grading no longer marks every kept surface unproven), cross-version baseline comparisons are invalid. Decision: pin the tool version per CI run and re-baseline deliberately.

When to Consider This Package

Consider adoption when:

• You maintain a Laravel application (particularly Laravel 11+ bootstrap/app.php style) and want risk-ranked, entry-point-oriented analysis (routes, commands, task slices) rather than generic lint output.
• You want the analysis to run in CI alongside PHPStan, with human-readable HTML/markdown reports suitable for PR comments or dashboards.
• You can accept pre-1.0 churn: expect periodic result drift and cache rebuilds; pin versions and communicate score changes as tooling changes, not regressions.
• You will use it advisory-first — an input to prioritization and review — rather than as a hard compliance control.

Look elsewhere when:

• You need a stable API/contract, vendor SLA, or auditor-recognized security certification. This is a community package at v0.x; its risk levels are heuristics, not proof of exploitability.
• You need non-Laravel framework coverage, runtime/dynamic analysis, or dependency-vulnerability scanning as the primary capability.
• Your organization cannot tolerate result volatility across releases in a merge-blocking gate; wait for a 1.0 line or budget ongoing triage of score deltas.
• You have no capacity to triage findings — surfaced hazards without an owner create noise and erode trust faster than no tool at all.

How to Pitch It (Stakeholders)

For executives: This is a low-cost, actively maintained static analyzer purpose-built for Laravel. Rather than replacing security review, it converts "unknown risk" into a ranked, explained list of the surfaces that matter — routes, commands, model mass-assignment, middleware ordering, and job dispatch paths. The current release is about trustworthiness: risk causes are now visible in the HTML report, and several parsing and grading bugs that distorted rankings have been fixed. Recommendation: pilot in advisory mode on one or two services, measure triage time and findings accepted as real, then decide on a merge gate.

For engineering: It slots into the existing PHPStan/QA pipeline. This release improves model-hazard parsing, aligns middleware analysis with Laravel 11+ bootstrap/app.php semantics (including group() and withMiddleware), and reduces both false positives and false negatives in dispatch resolution. Costs to plan for: pin the version in CI, expect a one-time graph-cache rebuild (format 28), and treat report deltas after upgrades as tooling changes requiring re-baselining rather than code regressions. Not a breaking change; no migration work beyond cache invalidation.