Xmlvalid Symfony Laravel Package

Product Decisions This Supports

• Build vs buy for XML validation: This package lets us fake the hosted validation API in tests, so choosing a vendor doesn't cost us test coverage or lock us into a manual QA loop. It lowers the switching cost between validation engines.
• Error-location UX on the roadmap: With path now on every error, we can build UI that points users at the exact element/attribute where a business rule fired. That feature becomes assertable in tests before the real endpoint is fully wired.
• Audit and reproducibility: sha256 on the result means we can hash a document and dedupe/cache verdicts; engine means we can answer "which validation engine version produced this verdict?" — a requirement for compliance and for explaining a changed result after an upgrade.
• Test strategy / CI reliability: Contract-faithful mock responses mean deterministic feature tests with no network, no vendor credentials, and no flaky third-party dependency in the pipeline.
• Dependency planning: The mock requires xmlvalid/xmlvalid-php 1.2. That's a scoped, known upgrade task rather than a surprise mid-sprint — worth slotting into the roadmap alongside any live integration work.

When to Consider This Package

• Adopt if: we validate XML against a remote API from a Laravel app, we want tests around validation outcomes (including where a rule failed), and we need offline/deterministic CI.
• Look elsewhere if: validation is purely local (libxml/XSD with no vendor call) — a mock of a remote service adds nothing. Also reconsider if mock fidelity drifts from the live API; false confidence in tests is worse than no tests.
• Caveats: this is a test double, not a validator. Production traffic must still hit the real service, and we should pin versions and run occasional live contract checks to catch drift between the mock and the vendor's actual response shape.

How to Pitch It (Stakeholders)

Executives: Cheap, low-risk test infrastructure that de-risks our XML validation integration. It unlocks error-location UX (telling users exactly which element broke a rule) and gives audit-grade provenance — a content hash plus the engine version — so we can answer "was this document validated, by what, and identically later?" Engineering: a drop-in fake for the validation API in tests; bump the core package to 1.2 to get the new path/sha256/engine models; assertions now cover error location and result integrity, and CI no longer needs vendor credentials.