Laravel Ai Verify Laravel Package

Product Decisions This Supports

• Whether to gate agent-authored code with an automated verdict. v0.6.0 exposes ai-verify as an MCP tool, so an agent can request a pass/fail verdict mid-task rather than a human running a shell command after the fact. This turns "should we require AI verification before merge?" from a process question into a configurable, testable policy.
• Build vs. buy for AI code governance. The package supplies verdicts, dependency graphs (ai-graph), impact reports and signed-ish receipts (ai-verify-receipt) as stable JSON. Building this in-house means owning an MCP server, a graph model, and a receipt format — a multi-quarter internal tool for something adoptable as a dependency.
• Roadmap sequencing for agent tooling. The release is deliberately opt-in and Boost-gated: nothing changes without laravel/mcp installed, and it can be disabled via AI_VERIFY_MCP_BOOST=false or ai-verify.mcp.boost. That makes it safe to trial on one team or one repo without committing the platform roadmap.
• Where we invest in developer experience vs. enforcement. Tool-call verdicts make verification cheap to invoke, which shifts the default from "verify at PR review" to "verify inside the agent loop." That changes review-headcount assumptions and CI cost models.
• Auditability and compliance positioning. Receipts as first-class output give us an evidence trail for AI-assisted changes — relevant if we need to answer "who/what validated this diff" for customers, auditors, or internal risk.
• Evaluation of freshness/consistency guarantees. Boost runs each call in a fresh process, so tools see the agent's latest edits — a correctness property we can rely on when specifying acceptance criteria for agent workflows rather than bolting on cache-busting steps.
• Use cases worth piloting: pre-merge guardrail on agent PRs; impact analysis before touching shared modules (ai-graph); automated change receipts attached to release notes; agent self-correction loops where a fail is consumed as data, not an exception.

When to Consider This Package

Adopt when most of these hold:

• The stack is Laravel/PHP and the team already runs Laravel Boost with an MCP-capable agent (Claude Code, Cursor, or similar). Without Boost and laravel/mcp, v0.6.0 delivers nothing new.
• You want verification results as machine-readable JSON consumed by agents or CI, not a human-readable report.
• You have agent-authored or agent-assisted changes flowing into review and want a repeatable, low-friction gate.
• You need impact/dependency context before merging into shared code, and a receipt artifact for the record.
• You can tolerate a pre-1.0 surface (v0.6.0) where tool names, JSON shape, and config keys may still move.

Look elsewhere or defer when:

• No Boost, no MCP client, or a non-Laravel backend — you would be paying integration cost for an interface you cannot call.
• You need a human-facing dashboard, trend reporting, or policy administration UI; this is a CLI/tool surface with JSON.
• You expect deep static analysis or type-level proof; the value here is verdict + graph + receipt, not a full analyzer.
• Test suites routinely exceed the default 180-second Boost timeout and you cannot plumb the timeout parameter through your agent config.
• Your governance model demands signed, tamper-evident attestations today — receipts exist, but verify their integrity story before promising it to compliance.
• Your team has no agent workflow at all; the shell-command path would already have been sufficient.

How to Pitch It (Stakeholders)

To executives: A low-risk, opt-in capability that lets AI coding agents check their own work before a human sees it. It ships with an off switch, changes nothing unless we already run Laravel Boost, and produces a verdict plus a receipt for every check — meaning we can answer "what validated this AI-written change?" with an artifact rather than a shrug. The strategic value is optionality: we get an audit-ready governance primitive for AI-assisted development without a platform commitment or an in-house build.

To engineering: Agent-native verification. With Boost installed, ai-verify, ai-graph, and ai-verify-receipt show up as MCP tools returning the same JSON as the --json flags, so agents call them directly instead of shelling out. Each call runs in a fresh process, so results reflect the agent's latest edits — no stale-read footguns. A fail verdict is a normal tool result, not an error, which is exactly what you want for self-correction loops. Configuration is one include-list entry, gated on laravel/mcp, with per-project opt-out. Watch two things: the 180s default timeout for long suites (pass timeout explicitly), and the fact that we are on a 0.x line — treat tool names and JSON schema as unstable and pin the version.