Bundle Ai Kit Laravel Package

Technical Evaluation

Architecture fit. A single-purpose Composer plugin: five classes, one interface seam (SyncContextResolverInterface), and Deptrac-enforced layering (Contract ← Context ← Installer ← Root). It is a dev-time tooling dependency with no runtime surface — nothing it ships is loaded by the application. That makes it architecturally cheap to add and cheap to remove.

The important distinction for a Laravel team is between mechanism and content. The mechanism — a Composer plugin that renders versioned AI rules into editor-specific paths on install — is framework-agnostic and transfers fully. The content is Symfony-bundle specific (AbstractBundle, bundle extension/prepend conventions, bundle test patterns), so expect roughly 20–30% of the rule corpus to apply directly to Laravel work. The reusable content is the quality bar: PHPStan level 9 with no baselines, GrumPHP pre-commit mirroring CI, Infection with a covered-MSI floor, Deptrac layer enforcement, and a PHP × Composer CI matrix. That is a credible reference implementation regardless of framework.

Integration feasibility. Low effort to install, one composer require --dev plus a config.allow-plugins entry (mandatory on Composer 2.2+). CI asserts PHP 8.2/8.3/8.4 across Composer 2 and 3, which matches a modern Laravel estate. Sync writes into .cursor/rules/, .cursor/skills/*, .cursor/agents/, and AGENTS.md at the Composer root.

Technical risk.

• Install-time code execution. A Composer plugin runs arbitrary PHP in every developer install and every CI job. With 3 stars and 0 dependents there is no external review surface and no downstream canary. Pin exactly, or vendor.
• Adoption signal contradicts the score. The 8.23 score reflects code-quality instrumentation (static analysis level, mutation MSI, architecture tests), not ecosystem health. Treat the score as "well-built" and the star/dependent count as "unvalidated." Both are true simultaneously.
• Editor lock-in. There is deliberately no editor abstraction — paths are fixed inside AiRulesInstaller. The MDC bodies are written to degrade to plain Markdown, but only .cursor/* and AGENTS.md are produced. Claude Code, Codex, and Copilot users get the AGENTS.md file and must wire the rest by hand.
• Merge-only with no documented prune. "Never delete user files" is the right default, but it means a version bump cannot remove superseded rules. Without a manifest of what was synced, the ruleset drifts and the failure is silent — agents follow an obsolete convention and produce confidently wrong code.
• Composer plugin API coupling. Composer 3 support is CI-asserted, but plugin-API breaks are a recurring class of failure and this would be a build-blocking one.
• Dirty working tree. Sync on install means composer install mutates tracked files; in CI that produces diff noise and can trip clean-checkout assertions.

Key questions.

• Is there a dry-run/diff mode, and a manifest enabling prune of stale rules?
• Does sync fire on every composer install, including CI and staging deploys where require-dev is installed?
• What license governs the rule corpus, and is forking into an internal ruleset permitted?
• Is there a versioning contract between rule content and plugin, or does a patch bump silently rewrite .cursor/?
• Is Cursor the standardized editor for the team? If not, the plugin is dead weight and only the content is valuable.
• Who owns updates if the sole maintainer stops shipping?

Integration Approach

Stack fit. Dev-only, works in any Composer 2 project including Laravel. Frame it internally as two separable artifacts: (1) a delivery mechanism for AI coding standards, and (2) a reference configuration for a quality gate. Adopt them independently. Do not present this to stakeholders as a Laravel package — it is a Symfony-bundle ruleset shipped by an editor-agnostic installer.

Migration path.

1. Read-only first. Clone the repo and read ai/cursor/rules/*.mdc and ai/skills/*/SKILL.mdc directly. Extract the transferable rules — SOLID boundaries, contract-over-concrete-dependency, PHPStan-9-no-baseline, Makefile-first, mutation thresholds — into an internal rules repo. Zero dependency, zero install-time risk, and it surfaces how much is actually reusable before you commit.
2. Adopt the plugin only if Cursor is the standard. composer require --dev symkit/bundle-ai-kit, add the allow-plugins entry, run once on a branch, review the generated tree as a normal code change, commit it.
3. Fork if you need Laravel paths or multi-editor output. The SyncContextResolverInterface seam plus a five-class codebase makes "replace the target paths" a contained change, not a rewrite. The MDC frontmatter and body conventions (kebab-case filenames, alwaysApply/globs split, no Cursor syntax in bodies, plain-text skill cross-references) are the most reusable artifact in the repository and worth copying verbatim into your internal standard.

Compatibility. Requires PHP 8.2+. Rules land relative to the Composer root, which is correct for repo-per-service and wrong for monorepos — a single ruleset at the root will not represent services with divergent conventions. Commit the synced tree; do not gitignore .cursor/, because those files are executed by agents and must be code-reviewed.

Sequencing.

• Week 0: read-only extraction; decide Cursor-only versus multi-editor; confirm license permits forking.
• Week 1: pilot in one greenfield service. Add a CI job that re-runs sync and fails on diff — this is the only reliable drift detector given merge-only semantics.
• Week 2–3: author Laravel-specific rules using the same conventions; port the GrumPHP/Deptrac/Infection templates, being careful to re-point Deptrac layers at your own namespace layout.
• Week 4+: pin the version, set a quarterly review, and keep an exit path — if upstream stalls, the fork is a day's work.

Operational Impact

Maintenance. Near-zero runtime maintenance: no services, no schema, no data. The real load is content maintenance. AI rules decay as the codebase moves, and merge-only sync means the .cursor/ tree accumulates rather than converges. Budget one to two hours per month per repository, plus a review gate on rule changes — rules are executed by agents, so treat them as code with an owner and a changelog, not as documentation.

Support. Effectively none. Three stars, zero dependents, one maintainer, no published support policy. The escalation path is reading the source (feasible — it is small) or forking. Plan for the fork rather than assuming upstream responsiveness.

Scaling. Trivially scalable technically — workstation and CI artifact, no latency, throughput, or concurrency concerns. The scaling limit is organizational: N repositories each carrying their own copy diverge within a quarter. Centralize the authoritative ruleset and push outward; do not let services self-author.

Failure modes.

• Plugin not enabled via allow-plugins → silent no-op; new joiners conclude the standards do not exist.
• Composer plugin-API break → install fails and blocks every build. Contain by pinning and keeping sync runnable as a standalone script.
• Sync mutating the tree in CI → dirty checkout, cache-key churn, flaky gates. Gate sync to local dev or a dedicated job.
• Stale rules after a bump → agents follow superseded conventions. Manifests as review churn, never as an error.
• Cross-framework rule bleed → Symfony AbstractBundle guidance applied to a Laravel service provider layer, producing confident, wrong-shaped code. Worse than no rules; scope the Symfony-specific files out explicitly.
• Path handling on Windows is unverified in the material provided; assume POSIX and test before mandating.

Ramp-up. Consumer ramp is under an hour: install, read AGENTS.md, run the make targets. Contributor/fork ramp is one to three days — the Deptrac rules make module boundaries self-documenting, and tests split cleanly into Unit and Integration with a temp-directory pattern. Two non-obvious snags will cost most of that time: the Makefile-first convention (never invoke vendor/bin/ directly) and the documented GrumPHP/Deptrac in-process autoloader conflict, which must be worked around by routing the Deptrac task through make.

Recommendation. Adopt the pattern, not the package. Extract the rule corpus and the quality-gate configuration into an internal, Laravel-shaped ruleset; use the Composer plugin as the delivery mechanism only if Cursor is the standardized editor. Do not let a three-star, single-maintainer project become a blocking install-time dependency.