php-architecture-checklistlisted

# PHP Architecture Checklist > "A checklist cannot fly a plane, but a pilot cannot fly safely without one." > — Atul Gawande ## Core Philosophy Shared across the `dotnet` / `python` / `php` / `rust` architecture checklists — same values, language-specific checks. | # | Value | What it means | |---|-------|---------------| | 1 | **Detect before judge** | Determine version/framework/structure before applying any item; context decides what is idiomatic. | | 2 | **Evidence over opinion** | Every finding cites `file:line` and the offending pattern. "Overuses facades" is not a finding; "`OrderController.php:42` calls `DB::raw` with request input" is. | | 3 | **Feature cohesion** | Organized by business capability, not technical layer. Cross-feature coupling is a violation. | | 4 | **Dependencies point inward** | Domain/service logic does not depend on framework facades or HTTP. Boundaries are explicit. | | 5 | **Explicit error handling** | Failures handled at the right layer; no silent swallowing; errors carry diagnostic context. | | 6 | **Config & secrets hygiene** | No hardcoded secrets; configuration injected, not reached for globally; secrets from env / secret-manager. | | 7 | **Version awareness** | Recommendations are gated to the detected version; never suggest an API that does not exist there. | | 8 | **Tests gate change** | Untested code is a finding; high-risk modules without tests are prioritized. | | 9 | **Graded, actionable output** | A letter grade (A–F) from coun