The Job
The PHP skill reviews the code PHP lets you get away with: loose arrays, string workflows, docblocks pretending to be contracts, and tests that pass while the boundary stays soft.
Pint, PHPStan, Psalm, Rector, and the test suite. Vølven should not repeat those findings. It should ask what still gets expensive after they are green.
Signals
Weak array contracts
Arrays moving through services, jobs, controllers, or domain code without a named shape, DTO, value object, or validation point.
Unsafe mixed
mixed used past an adapter edge, or read before the unknown shape is checked and narrowed.
Magic workflow strings
Status, type, event, and state strings that drive behavior without enums or local constants.
Misleading PHPDoc
Annotations that satisfy tools while hiding runtime uncertainty from the next person changing the code.
Example Findings
P1 array shape drift
Payment payload arrays are assembled in three places and consumed as if every key always exists.
P2 enum boundary missing
Order states are strings across policies, mail, and transitions. One typo becomes behavior.
P2 shallow mock test
The test proves the repository was called. It never proves the generated query matches the contract.
Review Prompt
Review this diff with the Vølven PHP debt skill.
Focus on weak array contracts, unsafe mixed boundaries, magic strings,
misleading PHPDoc, hidden helper dependencies, and tests that miss behavior.
Ignore Pint/PHPStan/Psalm/Rector duplicates.
Findings first. Include smallest useful fix.Pair It With Pest
The Pest plugin gives PHP projects a deterministic ratchet for suppressions, TODOs, mixed, and large classes. Use the skill for judgment. Use the plugin for countable debt pressure.