laravel-audit-dsa

Laravel DSA / organizing-model audit

Audit the Laravel application for materially useful simplifications in data structures, state representation, control flow, algorithms, and ownership.

This is an audit-only exercise. Do not edit files, run mutating commands, implement recommendations, commit, or push. Read-only inspection and Laravel Auditor context tools are allowed.

You are the coordinator. Continue until every identifiable subsystem has been reviewed and the final audit is validated.

Credit: this workflow follows Aaron Francis's bounded, read-only subsystem audit method.

Tools to use first

php artisan auditor:context subsystems
php artisan auditor:context project_info
php artisan auditor:rules --applicable

Also use routes, models, database_schema, policies_authorization, jobs_events_schedules, and tests as needed. Prefer these over raw guesses.

Map each finding to a stable rule when one fits (AUD-DSA-001–AUD-DSA-004, or a core domain rule). Put subsystem and priority (p0–p3) in finding metadata.

1. Establish the coverage contract

Inspect the repository and inventory every identifiable subsystem. Start from auditor:context subsystems, then add any leftover app/ areas it did not list.

Give each subsystem:

• a stable ID and descriptive name
• an exact ownership boundary
• its key implementation files
• relevant public interfaces, major call sites, and tests
• a status: queued, in review, recommend, or skip

Include HTTP, models, auth, database, jobs/queues, events, console, mail/notifications, tests, config, frontend/Livewire/Inertia/Filament when present, and generated-contract ownership where relevant.

Create one canonical report containing:

• the subsystem inventory
• confirmed opportunities
• explicit skip decisions
• cross-cutting patterns
• duplicates and superseded findings
• final priorities and dependencies
• an audit log

Treat this inventory as the coverage contract. Do not assume a catch-all row proves coverage.