Statamic Form Submission Retention Laravel Package

Product Decisions This Supports

• Build vs. buy gate, not a roadmap input (yet). The 1.0.0 release carries no capability description, changelog detail, migration notes, or linked documentation — only a milestone announcement. The decision this supports today is a triage decision: whether to spend discovery time on it, not whether to standardize on it.
• Where a first stable release typically earns its keep — the categories worth scoring once the package is identified: replacing bespoke in-house glue code, removing a fork we maintain ourselves, or accelerating a scoped feature on the near-term roadmap.
• Stability signal, not a feature signal. The meaningful fact in a 1.0.0 tag is the implied semver commitment: post-1.0, breaking changes should arrive as a 2.0.0. That is a dependency-risk input for platform planning, and it is the one claim in this release we can actually evaluate.
• Do not let it into the roadmap on the strength of the version number alone. A 1.0.0 with an empty release body is as likely to be a hobby project's first tag as a production-ready package. Treat it as unclassified until the checklist below is answered.
• Decisions this explicitly does not support: capacity allocation, vendor/procurement approval, or any commitment to migrate existing services.

When to Consider This Package

Adopt-candidate criteria — all should hold before a spike:

• composer.json declares an explicit illuminate/* / laravel/framework constraint covering the Laravel major you run, and a php constraint covering your runtime. Anything as loose as * or >=5.0 is a red flag.
• Service provider and facade are auto-discovered; no manual config/app.php wiring required.
• A LICENSE file exists and is compatible with your distribution model (MIT/Apache-2.0 vs. proprietary or SSPL).
• Tests exist and run in CI on a visible matrix, not just "works on my machine."
• A documented security disclosure path (SECURITY.md or equivalent), and composer audit is clean on install.
• Transitive dependency footprint is small — check composer why before it lands in a service you have to patch on a deadline.
• If you consumed a pre-1.0 tag, an upgrade/migration note exists for the 0.x → 1.0 jump.

Look elsewhere when:

• The package duplicates a first-party Laravel capability (queues, notifications, broadcasting, auth scaffolding, HTTP client) — first-party always wins on upgrade-path risk.
• Only pre-1.0 tags exist, or the 1.0.0 is the sole release with no stated support policy.
• The maintainer is a single unaffiliated individual with no release in 12+ months and no response on issues — you are effectively adopting a fork you will own.
• Pinned to an older Laravel major with no stated upgrade intent.
• Documentation is a README with no usage examples, no configuration reference, and no error-path guidance.
• Unclear or restrictive licensing.

Note on this release: because the announcement contains no feature, deprecation, or breaking-change content, none of the above can be confirmed from the release itself. The assessment stays at triage until package metadata is reviewed.

How to Pitch It (Stakeholders)

To executives: A Laravel package in our ecosystem just published its first stable release. The version number is a stability signal — it suggests the maintainer intends to honor semantic versioning going forward — but the release note itself tells us nothing about what the package does or whether it fits our stack. Recommendation is a small, time-boxed engineering spike to answer that, not a platform decision. Cost of finding out is low; cost of adopting blind and later owning an abandoned dependency is not.

To engineering: Read the release as a version milestone only. Before any prototype, confirm Laravel/PHP constraint compatibility with our supported matrix, that auto-discovery works, that CI and a license are present, and that the dependency graph is thin. Report back on whether it replaces code we currently maintain ourselves — that is the only case where the ROI is obvious. If it duplicates something Laravel ships, we stop there.