Backend PHP

PHP-036 · Log calls never receive passwords, tokens, secrets, card data, authorization headers or whole request payloads

PHP-044 · Passwords are hashed with password_hash/the framework hasher, never md5, sha1, a plain hash, crypt or reversible encoding

PHP-047 · Real credentials (passwords, API keys, tokens, DSN passwords) are loaded from secret configuration, never written as literals

PHP-041 · The user approves removing authorization checks or making a route or firewall public

PHP-041 · Every public action of a declared protected controller checks authorization (off until protectedEndpointPaths is set)

PHP-042 · A controller loading an object by a client-supplied ID checks ownership or permission for that object (review)

PHP-043 · The user approves disabling CSRF protection (forms, framework config, middleware exceptions)

PHP-025 · Request values are validated before a cast or intval() turns garbage into a valid-looking scalar

PHP-026 · Input and security checks are runtime guards, never assert() (disabled in production by zend.assertions=-1)

PHP-039 · A controller that reads a raw request payload validates it server-side (validator, form, mapped DTO; review)

PHP-040 · Request data never populates models wholesale (create/fill/update with all input, empty $guarded, unguard, OBJECT_TO_POPULATE without groups)

PHP-045 · Request, cookie or other external data never reaches unserialize()

PHP-046 · Shell commands are never built from runtime values; processes take an argv array (Symfony Process, proc_open array)

PHP-050 · SQL and DQL text never interpolates or concatenates runtime values; values are bound parameters

PHP-051 · Table, column and sort identifiers in SQL come from an allowlist, never from the request or an unchecked variable

PHP-048 · Production HTTP client configuration keeps TLS peer and hostname verification on (Symfony framework.http_client)

PHP-048 · Production HTTP clients keep TLS peer and hostname verification on (curl, Guzzle, Symfony HttpClient, streams, Laravel Http)

PHP-049 · Outbound requests do not go to a URL taken straight from the request without a destination policy (SSRF; review)

PHP-077 · A new inline suppression names the rule and says why (@phpstan-ignore identifier (reason), @psalm-suppress Issue with a reason, phpcs:ignore Sniff)

PHP-077 · The user approves changes that lower PHPStan/Psalm strictness, grow baselines or ignores, exclude tests or stop CI from failing on checks

PHP-021 · New functions, methods and properties declare native parameter, return and property types

PHP-022 · New public contracts narrow mixed and object when the accepted or returned values are known (review)

PHP-023 · New public methods taking or returning array/iterable document element types or the shape (list<T>, array<K, V>, array{…})

PHP-024 · An inline @var does not drop the null a call may return (intelephense resolves the call's type)

PHP-031 · New comparisons with null, booleans, '' or 0 and new in_array/array_search calls are strict

PHP-032 · No empty catch block and no catch that reports success; a failure is recovered, translated or propagated

PHP-033 · A catch that throws a new exception passes the caught one as previous; a broad catch rethrows or logs (review)

PHP-034 · A failed write, payment or lookup does not return a fabricated success, ID or default (review)

PHP-062 · Async messages and jobs carry identifiers and serializable data, not entities, requests, resources or services

PHP-065 · Async transports keep exhausted messages (a failure transport or failed-job store), instead of discarding them

PHP-060 · Outbound HTTP calls have a time limit (Guzzle timeout, curl CURLOPT_TIMEOUT, stream context timeout; review)

PHP-061 · Retry loops are bounded (attempt counter, maximum, backoff) instead of retrying forever (review)

PHP-007 · Imports respect the project's declared module dependency directions (off until namespaceRules is set)

PHP-008 · Declared domain code does not depend on HTTP, routing, container or controller types (off until domainPaths is set)

PHP-009 · Business code reaches databases, files, the network and processes through injected adapters, not raw sinks

PHP-010 · Production code receives its collaborators through DI, not globals, singletons or container helpers

PHP-011 · Business services take specific dependencies, not the general service container

PHP-013 · Production classes inject database, HTTP, cache, queue and mail clients instead of constructing them

PHP-018 · An application organizes features with namespaces; a new bundle class needs a reuse purpose (review)

PHP-020 · A turn does not generate an interface for every new class (two or more <Name>Interface each with one new implementation; review, once per stop)

PHP-067 · Business time decisions read an injected clock (PSR-20 ClockInterface), not time(), date() or new DateTime()

PHP-015 · (suggestion) A new readonly class that is not designed for extension is final

PHP-027 · New PHP files follow the project's declare(strict_types=1) convention (strictTypes parameter or the coding-standard config)

PHP-028 · (suggestion) A constructor that only copies parameters into properties can promote them (PHP 8.0+)

PHP-059 · New monetary amounts are not floats; they use minor units (int) or exact decimals with a currency and rounding rule (review)

PHP-038 · HTTP responses never carry stack traces, file paths or the raw message of an unexpected exception

PHP-078 · The user approves removing or changing public signatures of @api code or declared public API paths

PHP-079 · A turn that adds, removes or changes HTTP routes also updates the published API schema (review, once per stop)

PHP-052 · A method making several writes that must succeed together owns a transaction (review)

PHP-053 · A catch that rolls back a transaction rethrows (or translates) the failure

PHP-053 · A method that begins a transaction rolls it back on the exceptional path (catch or finally)

PHP-054 · Message handlers do not flush or commit when the bus's doctrine_transaction middleware owns the unit of work

PHP-066 · Messages, e-mails and remote calls inside a database transaction wait for the commit (after-commit, outbox; review)

PHP-055 · The user approves deleting or renaming a committed migration

PHP-055 · Records migrations Claude wrote with the user's approval this session, so the edit is asked once per file

PHP-055 · The user approves changing a committed migration (it may already have run somewhere); new changes go in a new migration

PHP-056 · The user approves a migration that drops, renames or retypes schema in its up step (expand/contract for rolling deploys)

PHP-001 · A class, interface, trait or enum sits where Composer's PSR-4 mapping expects it (namespace and file name)

PHP-002 · New code uses no syntax newer than the PHP version composer.json declares (config.platform.php, else require.php)

PHP-035 · Reusable backend code has no var_dump/dd/dump/print_r, echo/print or exit/die; only entrypoints print or terminate

PHP-002 · New calls into a PHP extension (mbstring, intl, bcmath, gmp, redis…) need ext-* or a polyfill in composer.json

PHP-004 · Production code does not import namespaces that only require-dev packages or autoload-dev provide

PHP-005 · composer.lock is written by Composer, never edited by hand (its content-hash must match composer.json)

PHP-005 · A turn that changes composer.json dependencies also updates composer.lock (application projects; once per stop)

PHP-005 · Build and deployment scripts install from composer.lock; they never run an unconstrained composer update

PHP-006 · composer update names the packages it updates instead of re-resolving every dependency

PHP-080/PHP-006 · A new Composer package names the changed feature or tooling that needs it (review)

PHP-068/PHP-069/PHP-073 · A turn that changes production PHP code changes tests too, or says why none applies (review, once per stop)

PHP-072 · Tests assert outcomes, not the SQL text a mocked connection or statement receives (review)

PHP-074 · Tests never call exit or die (they end the PHPUnit run with a false result) unless run in a separate process

PHP-075 · Tests make assertions that can fail (no assertTrue(true), assertSame($x, $x) or bare assertion counters)

PHP-077 · The user approves edits that remove test methods or assertions from a test file

PHP-077 · The user approves newly skipped, incomplete or todo tests

Records the work tree when a prompt starts, the baseline of the end-of-turn checks (PHP-003, PHP-005, PHP-068, PHP-079)

PHP-003 · Claude does not end a turn with syntax errors, undefined types, functions or variables, or calls with too many arguments it introduced (intelephense)

PHP-075 · Production code ships implemented behavior, not "not implemented" exceptions, TODO-only bodies or TODO stub returns

PHP-076 · A final message claiming passing tests or checks needs a successful PHPUnit/Pest/PHPStan/Psalm/… run after Claude's last edit

PHP-076 · Records, per session, Claude's edits and the PHP test, static-analysis and architecture runs that succeeded after them