[marandaneto]

💡 Motivation and Context

This is the final PR in the Laravel stack. It adds independent package CI and reviewed publishing without coupling Laravel versions to core PHP releases.

Composer reads package metadata at a repository root. Laravel source stays in packages/laravel, while release tooling prepares a deterministic package-only distribution for a separate repository. Source releases use laravel-vX.Y.Z; distribution releases use vX.Y.Z. Core versions and pnpm intents remain unchanged by Laravel-only releases.

Laravel has separate .laravel-changes/*.json intents and version synchronization. The existing secured core release workflow and bump-script hash are unchanged. Read-only preparation and independent verification precede an approval environment. Publishing checks source freshness, candidate digests and unused refs, then uses atomic GitHub-signed commits. No Composer or package hooks execute with publishing credentials. Source releases do not replace the core latest-release pointer.

The distribution includes package source/config/license and the linked autocapture/Pennant guides, but excludes tests, vendor, local configuration, locks and secrets. Verification also installs the distribution without dev dependencies or scripts, so the required core SDK must already be published.

Administrator setup is required before publishing: create the distribution repository, configure the protected approval environment and narrowly scoped tokens, then register Packagist. None of those actions were performed. Cross-repository publishing is not atomic; recovery steps are documented.

💚 How did you test it?

• 13 Python tests cover version independence, actual pnpm behavior in disposable fixtures, deterministic archives, secret/path/symlink exclusion, distribution replacement, atomic commit requests, ref checks and temporary Composer configuration.
• Full committed-source matrix: Laravel 12 and 13 package/example suites. The example's temporary PHP platform is corrected for Laravel 13 without changing the committed Laravel 12 lock.
• Core: 2,532 tests, 11,366 assertions, plus API snapshot validation.
• Distribution candidate preparation and strict Composer metadata validation pass locally. No live publishing endpoint was called.
• Actionlint, shellcheck and git diff --check pass.
• Core formatting remains scoped to its ruleset. Changed-file linting does not newly enforce unrelated pre-existing warnings across the whole SDK.
• Initial isolated review is recorded before publication.

📝 Checklist

• All commits are signed.
• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran pnpm change to generate a change intent file. Tooling only; Laravel intents are supplied by the preceding package PRs.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Implemented with Pi, Python, shell tools, Composer/pnpm, Git and GitHub CLI in isolated worktrees. Release tests use disposable fixture repositories and fake API clients. The full framework matrix installs real dependencies in temporary committed-source copies. No repository, credential, Packagist registration or release was created by this work. Human review is required before merge or enabling publication.

Reviewed commit: 9989060fd9daf229c76a516cc2a40040590cd032. Reviewed base: 0ce49ab1ed24c6f08f29ab73f551dc1379e0060c. Initial isolated review has no actionable findings.

Stack

Merge bottom-up:

1. feat: add PHP framework integration primitives #282: PHP framework support
2. feat: add the Laravel runtime package #283: Laravel runtime
3. feat: add opt-in Laravel autocapture #284: Optional server autocapture
4. feat: integrate PostHog feature flags with Laravel Pennant #285: Read-only Pennant integration
5. feat: add a runnable Laravel SDK example #286: Runnable Laravel example
6. ci: release the Laravel package independently #287: Independent CI and publishing

Laravel source lives in this repository but its Composer package is released separately. Publish core ^4.20 first. The distribution repository, protected release environment and Packagist setup remain administrator prerequisites. No release has been published.

Review feedback follow-up

Current head: 9aec6bd7d8d85c6ef5896b732b79b9aae39eec76.

Signed bottom-up merges integrate all accepted feedback fixes and the latest first-party internal metadata interface. Publishing code and independent versioning/release policy were not changed by these follow-ups; new source helpers remain covered by the existing distribution whitelist.

Fresh committed-source scripts/test-laravel.sh 12 and 13 pass (106 package tests / 664 assertions, 29 example tests / 163 assertions each); all 13 release-tooling tests and changed-file PHP style checks pass. Component feedback deltas received source/vendor-aware independent reviews, followed by the final integration matrix.

The upstream direct-command thread now has the agreed opt-in calling-command trait, with Pennant cache lifetime integrated after caller restoration. Uninstrumented direct callers remain explicitly unsupported unless wrapped; global interception is not claimed. Nine command and four Pennant cases failed before their fixes and pass afterward; both deltas received clean isolated reviews. No PR was merged and no package/repository/credential/release was created.

Core human-review integration

Signed merges integrate #282 commit 858c204: non-throwing instance group validation (static facade validation unchanged), explicit typed exception source independent of mechanism/handled, provenance protection and scope ownership docs. The core suite passes 2,532 tests / 11,366 assertions. Final committed-source Laravel 12/13 matrices remain green at 106 package tests / 664 assertions and 29 example tests / 163 assertions each. The core delta received a clean isolated review; no automatic Laravel hook-source inference was added.

Before the first Laravel release: server SDK registration

posthog-laravel is not yet registered on PostHog server master for PHP usage attribution, Python/Rust feature-flag library classification/parser, or SDK health frontend/backend registries. A separate backend registration/alias PR must land before the Laravel package ships, following the approach in PostHog/posthog#93911. Event ingestion itself is not rejected just because this library identifier is unclassified. SDK health/version handling must respect Laravel's independent package version, not compare 0.1.x against PHP core 4.x. No backend PR, repository or release was created by this SDK follow-up; this remains an explicit pre-release prerequisite alongside core ^4.20 publication and distribution/Packagist setup.

[github-actions]

posthog-php-lib_curl Compliance Report

Date: 2026-10-29T16:10:58.868559+00:00
Duration: 116734ms

⚠️ Some Tests Failed

46/47 tests passed, 1 failed

---

Capture Tests

⚠️ 29/30 tests passed, 1 failed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	30ms
Format Validation.Event Has Uuid	✅	522ms
Format Validation.Event Has Lib Properties	✅	526ms
Format Validation.Distinct Id Is String	✅	525ms
Format Validation.Token Is Present	✅	524ms
Format Validation.Custom Properties Preserved	✅	525ms
Format Validation.Event Has Timestamp	✅	525ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	525ms
Retry Behavior.Retries On 503	✅	5833ms
Retry Behavior.Does Not Retry On 400	✅	2527ms
Retry Behavior.Does Not Retry On 401	✅	2529ms
Retry Behavior.Respects Retry After Header	❌	6334ms
Retry Behavior.Implements Backoff	✅	16251ms
Retry Behavior.Retries On 500	✅	5635ms
Retry Behavior.Retries On 502	✅	5634ms
Retry Behavior.Retries On 504	✅	5634ms
Retry Behavior.Max Retries Respected	✅	17054ms
Deduplication.Generates Unique Uuids	✅	234ms
Deduplication.Preserves Uuid On Retry	✅	5633ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10841ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5640ms
Deduplication.No Duplicate Events In Batch	✅	531ms
Deduplication.Different Events Have Different Uuids	✅	526ms
Compression.Sends Gzip When Enabled	✅	525ms
Batch Format.Uses Proper Batch Structure	✅	525ms
Batch Format.Flush With No Events Sends Nothing	✅	520ms
Batch Format.Multiple Events Batched Together	✅	514ms
Error Handling.Does Not Retry On 403	✅	2527ms
Error Handling.Does Not Retry On 413	✅	2528ms
Error Handling.Retries On 408	✅	5634ms

Failures

retry_behavior.respects_retry_after_header

Retry delay too short: 804ms < 2500ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	525ms
Request Payload.Flags Request Uses V2 Query Param	✅	523ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	524ms
Request Payload.Flags Request Omits Authorization Header	✅	525ms
Request Payload.Token In Flags Body Matches Init	✅	523ms
Request Payload.Groups Round Trip	✅	523ms
Request Payload.Groups Default To Empty Object	✅	524ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	523ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	523ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	524ms
Request Lifecycle.No Flags Request On Init Alone	✅	517ms
Request Lifecycle.No Flags Request On Normal Capture	✅	509ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	530ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	526ms
Retry Behavior.Retries Flags On 502	✅	628ms
Retry Behavior.Retries Flags On 504	✅	625ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	527ms

[github-actions]

posthog-php-socket Compliance Report

Date: 2026-10-29T16:11:02.031051+00:00
Duration: 115924ms

⚠️ Some Tests Failed

46/47 tests passed, 1 failed

---

Capture Tests

⚠️ 29/30 tests passed, 1 failed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	24ms
Format Validation.Event Has Uuid	✅	520ms
Format Validation.Event Has Lib Properties	✅	521ms
Format Validation.Distinct Id Is String	✅	522ms
Format Validation.Token Is Present	✅	521ms
Format Validation.Custom Properties Preserved	✅	522ms
Format Validation.Event Has Timestamp	✅	521ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	522ms
Retry Behavior.Retries On 503	✅	5829ms
Retry Behavior.Does Not Retry On 400	✅	2523ms
Retry Behavior.Does Not Retry On 401	✅	2524ms
Retry Behavior.Respects Retry After Header	❌	6330ms
Retry Behavior.Implements Backoff	✅	16243ms
Retry Behavior.Retries On 500	✅	5630ms
Retry Behavior.Retries On 502	✅	5630ms
Retry Behavior.Retries On 504	✅	5629ms
Retry Behavior.Max Retries Respected	✅	16243ms
Deduplication.Generates Unique Uuids	✅	527ms
Deduplication.Preserves Uuid On Retry	✅	5628ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10836ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5631ms
Deduplication.No Duplicate Events In Batch	✅	526ms
Deduplication.Different Events Have Different Uuids	✅	524ms
Compression.Sends Gzip When Enabled	✅	522ms
Batch Format.Uses Proper Batch Structure	✅	521ms
Batch Format.Flush With No Events Sends Nothing	✅	518ms
Batch Format.Multiple Events Batched Together	✅	510ms
Error Handling.Does Not Retry On 403	✅	2523ms
Error Handling.Does Not Retry On 413	✅	2525ms
Error Handling.Retries On 408	✅	5627ms

Failures

retry_behavior.respects_retry_after_header

Retry delay too short: 802ms < 2500ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	523ms
Request Payload.Flags Request Uses V2 Query Param	✅	520ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	519ms
Request Payload.Flags Request Omits Authorization Header	✅	520ms
Request Payload.Token In Flags Body Matches Init	✅	521ms
Request Payload.Groups Round Trip	✅	519ms
Request Payload.Groups Default To Empty Object	✅	520ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	520ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	519ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	521ms
Request Lifecycle.No Flags Request On Init Alone	✅	516ms
Request Lifecycle.No Flags Request On Normal Capture	✅	508ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	522ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	522ms
Retry Behavior.Retries Flags On 502	✅	622ms
Retry Behavior.Retries Flags On 504	✅	623ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	522ms

[github-actions]

posthog-php-fork_curl Compliance Report

Date: 2026-10-29T16:11:04.346825+00:00
Duration: 116161ms

⚠️ Some Tests Failed

46/47 tests passed, 1 failed

---

Capture Tests

⚠️ 29/30 tests passed, 1 failed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	31ms
Format Validation.Event Has Uuid	✅	525ms
Format Validation.Event Has Lib Properties	✅	527ms
Format Validation.Distinct Id Is String	✅	527ms
Format Validation.Token Is Present	✅	525ms
Format Validation.Custom Properties Preserved	✅	527ms
Format Validation.Event Has Timestamp	✅	528ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	527ms
Retry Behavior.Retries On 503	✅	5849ms
Retry Behavior.Does Not Retry On 400	✅	2529ms
Retry Behavior.Does Not Retry On 401	✅	2530ms
Retry Behavior.Respects Retry After Header	❌	6337ms
Retry Behavior.Implements Backoff	✅	16273ms
Retry Behavior.Retries On 500	✅	5642ms
Retry Behavior.Retries On 502	✅	5645ms
Retry Behavior.Retries On 504	✅	5635ms
Retry Behavior.Max Retries Respected	✅	16275ms
Deduplication.Generates Unique Uuids	✅	551ms
Deduplication.Preserves Uuid On Retry	✅	5640ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10854ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5638ms
Deduplication.No Duplicate Events In Batch	✅	530ms
Deduplication.Different Events Have Different Uuids	✅	527ms
Compression.Sends Gzip When Enabled	✅	528ms
Batch Format.Uses Proper Batch Structure	✅	526ms
Batch Format.Flush With No Events Sends Nothing	✅	516ms
Batch Format.Multiple Events Batched Together	✅	516ms
Error Handling.Does Not Retry On 403	✅	2527ms
Error Handling.Does Not Retry On 413	✅	2529ms
Error Handling.Retries On 408	✅	5646ms

Failures

retry_behavior.respects_retry_after_header

Retry delay too short: 810ms < 2500ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	517ms
Request Payload.Flags Request Uses V2 Query Param	✅	519ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	518ms
Request Payload.Flags Request Omits Authorization Header	✅	521ms
Request Payload.Token In Flags Body Matches Init	✅	518ms
Request Payload.Groups Round Trip	✅	519ms
Request Payload.Groups Default To Empty Object	✅	519ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	519ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	518ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	518ms
Request Lifecycle.No Flags Request On Init Alone	✅	514ms
Request Lifecycle.No Flags Request On Normal Capture	✅	515ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	521ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	520ms
Retry Behavior.Retries Flags On 502	✅	622ms
Retry Behavior.Retries Flags On 504	✅	621ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	528ms