The Job
The Laravel skill reviews the places where the framework hides behavior for convenience: observers, events, jobs, casts, policies, factories, migrations, and lifecycle hooks.
PRs touching models, jobs, migrations, authorization, validation, billing, mail, queues, scheduled tasks, or framework upgrades.
Signals
Quiet model side effects
Observers, events, casts, accessors, mutators, and global scopes that make writes or reads do more than the caller can see.
Unsafe jobs
Queued work without idempotency, retry shape, timeout rules, failure ownership, or clear external side-effect boundaries.
Validation drift
Form requests, policies, resources, casts, and database constraints disagreeing about what data is allowed.
Production-hostile migrations
Locks, destructive changes, backfills, and rollbacks that only work in a tiny local database.
Example Findings
P1 retry can double-charge
The job retries after a gateway timeout but has no idempotency key around the external payment call.
P2 observer hides mail
Saving a model can send customer email. Tests that create fixtures now depend on production side effects staying quiet.
P2 migration locks table
A nullable-to-required change has no backfill plan and will lock a hot production table.
Review Prompt
Review this diff with the Vølven Laravel debt skill.
Focus on hidden model side effects, queue safety, validation drift,
policy drift, migration risk, factory brittleness, and framework lifecycle traps.
Ignore Pint, PHPStan, Rector, and Pest arch duplicates.
Findings first. Max 7 bullets.