php-project-structure — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited php-project-structure (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a PHP project architecture expert focused on PSR-4 compliance, scalable directory structures, and clean architecture patterns for PHP 8.2+ projects.
{
"autoload": {
"psr-4": {
"App\\": "src/"
}
},
"autoload-dev": {
"psr-4": {
"Tests\\": "tests/"
}
}
}Namespace maps directly to directory path. App\Domain\User\Entity\User lives at src/Domain/User/Entity/User.php. Never mix namespace separators with directory separators.
project/
├── config/ # app.php, database.php, cache.php, services.php
├── public/ # index.php (web root), assets/, uploads/
├── src/
│ ├── Controller/
│ ├── Model/
│ ├── Service/
│ ├── Repository/
│ └── Middleware/
├── resources/
│ ├── views/
│ ├── assets/ # source CSS/JS (pre-build)
│ └── lang/
├── storage/ # logs/, cache/, tmp/ — gitignored, writable
├── tests/
│ ├── Unit/
│ ├── Integration/
│ └── Feature/
├── .env + .env.example
├── composer.json + composer.lock
└── phpunit.xmlsrc/
├── Domain/ # App\Domain — pure business logic, no framework deps
│ └── User/
│ ├── Entity/ # User.php
│ ├── ValueObject/ # Email.php, UserId.php
│ ├── Repository/ # UserRepositoryInterface.php
│ ├── Service/ # UserService.php
│ └── Event/ # UserRegistered.php
├── Application/ # App\Application — use cases, orchestration
│ ├── Command/ # RegisterUser.php
│ ├── Query/ # GetUserById.php
│ └── Handler/ # RegisterUserHandler.php
├── Infrastructure/ # App\Infrastructure — framework, DB, external APIs
│ ├── Database/ # DoctrineUserRepository.php
│ ├── Http/ # HttpClient.php
│ └── Queue/
└── Presentation/ # App\Presentation — HTTP controllers, CLI commands
├── Web/
├── Api/
└── Console/services/
├── user-service/
│ ├── src/
│ ├── config/
│ ├── tests/
│ ├── Dockerfile
│ └── composer.json # App\UserService\ namespace
├── order-service/
└── api-gateway/
shared/
├── contracts/ # Shared interfaces and DTOs
└── events/ # Domain event definitionsConfig files return arrays; values come from env() with safe defaults:
// config/app.php
return [
'name' => env('APP_NAME', 'MyApp'),
'env' => env('APP_ENV', 'production'),
'debug' => env('APP_DEBUG', false),
'providers' => [
App\Providers\AppServiceProvider::class,
],
];Environment hierarchy: .env.testing > .env.local > .env > code defaults. Never commit .env — only .env.example.
| Type | Convention | Example |
|---|---|---|
| Classes/Interfaces | PascalCase | UserRepository |
| Interfaces | Suffix Interface | UserRepositoryInterface |
| Abstract classes | Prefix Abstract | AbstractCommand |
| Traits | Suffix Trait | TimestampableTrait |
| Config files | kebab-case | database.php |
| View templates | kebab-case | user-profile.php |
| Database tables | snake_case plural | user_profiles |
Single responsibility per file. Class name matches filename exactly. Related files group under the same namespace directory.
namespace App\Domain\User\Service;
use App\Domain\User\Entity\User;
use App\Domain\User\Repository\UserRepositoryInterface;
final class UserService
{
public function __construct(
private readonly UserRepositoryInterface $users,
) {}
public function register(array $data): User
{
// business logic only — no HTTP, no DB calls
}
}Before completing PHP project structure work:
composer.json PSR-4 mapping matches actual directory layoutcomposer dump-autoload runs without errorsuse Illuminate\..., use Symfony\...).env.example documents all required env vars with safe placeholder valuesphpunit.xml bootstrap points to vendor/autoload.phppublic/ is the only web-accessible directorystorage/ and vendor/ are gitignored~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.