Use Laravel Excellence Prover with your AI.

Validate laravel excellence

PILLAR I. BEST PRACTICES: (1) prove NO WORKAROUNDS. every feature uses the Laravel-idiomatic solution (Eloquent scopes, FormRequests, Policies, Middleware, Events, API Resources, route model binding). If Laravel provides it, use it, (2) map RESPONSIBILITIES. Controller handles HTTP only, FormRequest validates, Service/Action executes logic, Model defines data, Event handles side effects. Business logic in the controller is a fat controller, (3) enforce MASS ASSIGNMENT protection. explicit $fillable, $request->validated(), sensitive fields excluded, never $request->all(), never $guarded = [], never Model::unguard() in production. PILLAR II. MAXIMUM PERFORMANCE: (4) demonstrate QUERY OPTIMIZATION. eager loading via with(), Model::preventLazyLoading(), scopes for reusable filters, no N+1 anywhere including Blade views, (5) detail PERFORMANCE STRATEGY. Cache::remember() for expensive reads, paginate()/simplePaginate() for lists, chunk()/cursor() for background processing, select() for needed columns only, Jobs for heavy I/O. PILLAR III. ZERO TOLERANCE: (6) verify ARCHITECTURE. config() not env(), DB::transaction() for multi-writes, typed properties, API Resources for JSON, no dd()/dump(), no magic values (use Enums/constants), $afterCommit on listeners in transactions. If rejected, fix the gap before shipping. Structured reflection capability for Laravel development excellence. enforces three pillars: best practices (framework idioms), maximum performance (query and cache optimization), and zero tolerance (no workarounds, no code smells). Catches N+1 Detected (lazy-loading relationships in loops or Blade views. "$users = User::all(); foreach ($users as $user) { $user->posts; }" fires N+1 queries. With 1,000 users: 1 query for users + 1,000 queries for posts = 1,001 database hits. Model::preventLazyLoading() in AppServiceProvider catches this in development. "User::with('posts')->get()" fires exactly 2 queries regardless of user count), Workaround Detected (manual implementations bypassing framework features. "if ($request->input('email') && filter_var(...))" is a manual validation workaround. Laravel provides FormRequest with $rules = ['email' => 'required|email:rfc,dns']. Manual file_get_contents() instead of Http::get(). Manual SQL instead of Eloquent. If Laravel provides it, use it. your manual version will be worse), Fat Controller (business logic inside the controller instead of services. "public function store(Request $request) { // 80 lines of validation, calculation, email sending, cache invalidation }" is a fat controller. Controller: HTTP in/out. FormRequest: validation. Service/Action: logic. Model: data. Event/Listener: side effects. Each responsibility in its place), Mass Assignment Unsafe (using $request->all() or $guarded = []. "User::create($request->all())" allows an attacker to POST is_admin=1 and become admin. $fillable must be explicit. Input must come from $request->validated() via FormRequest. Sensitive fields (is_admin, role, email_verified_at) excluded from mass assignment. Model::unguard() only in database seeders, never in production code), and Architecture Violated (env() in application code, no DB::transaction(), raw responses. "env('STRIPE_KEY')" works locally but returns null in production with config cache. Use config('services.stripe.key'). Multi-model writes without DB::transaction() = partial failures. JSON responses without API Resources = coupled, unversioned output). Call once per feature, endpoint, or refactoring decision