The Wayne State app stack

WELD

WELD stands for Wired, Everything, Linked, Deployed.

Many parts, one piece.

WELD is a Laravel 13 app with Inertia and Vue, and the rest of the stack is already in it: sign-in, security headers, the standards check, code style, CI and WayneUI. It's one install. Rename it and start on your own pages.

$ composer create-project waynestate/weld my-app

Any other shape? Sourdough starts four of the five, from raw PHP to Vue islands, with the same sign-in, headers and checks.

Get started Which piece do I need? Meet the cast Docs

Start here

Install it, then run one command

Yes, this is a lot of packages. Most of you can ignore that. Install WELD, run the one command in step 2, and you have a working app with all of it set up. We split the stack into separate projects because Wayne State developers work on very different apps, and you shouldn't have to buy the whole shop to borrow one torch.

1
Install

Composer makes a fresh copy, writes .env, sets the app key and runs the first migration.
```
composer create-project waynestate/weld my-app
```
2
Start it in Docker

This is the one command. You only need Docker, because PHP and Node run in the containers. Then open localhost:8000.
```
# macOS, Linux
bin/weld.sh up
# Windows (PowerShell)
.\bin\weld.ps1 up
```
3
Run the checks

Runs the tests, Pint, PHPStan and composer audit, the same command CI runs. The standards check is separate: composer proctor.
```
composer ci
```

Sourdough makes the other shapes: sourdough new my-app for raw PHP, sourdough new my-app --laravel for Laravel with Blade, sourdough new my-app --laravel --vue for Vue islands. WELD is the Inertia and Vue shape, ready-made.

Already have an app?

Which piece do I need?

Most Wayne State apps are older than this stack. Some are raw PHP, some are Laravel, and plenty only need sign-in or an upgrade. That's why every piece also works on its own. WELD is simply all of them installed together.

I'm starting a new app

WELD or Sourdough

Pick WELD for Laravel with Inertia and Vue, ready-made. Pick Sourdough to start any other shape, or to shape one yourself.
My raw PHP app just needs sign-in

SESAME

Adds CAS or Entra ID sign-in to a raw PHP or Laravel app. Your app keeps its own session.
I'm stuck on PHP 7

Booster

Upgrades PHP and Laravel one version at a time, and has a playbook for Vue 2 to 3. It never commits; you read the diff and merge it.
I'm deploying to Citadel

Squire

The build and release scripts Citadel expects, a health check, and a way to run your app locally on the same images.
I want CI on every push

Preflight

GitLab CI components for PHP tests on each supported version, PROCTOR, Composer audit, Pint, PHPStan and ESLint.
I want safe defaults at runtime

HELMET

Sends the security headers and CSP, hardens the session cookie and checks proxies before your first page is served.
I want it to look like Wayne State

WayneUI

Wayne State's design system. It works in static HTML, raw PHP, Blade and Vue.
I want Citadel to sign people in before my app

Drawbridge

A gateway that signs people in through Entra ID before they reach your app. Your app then checks one small signed token.
I look after a lot of apps

Rollcall

Scans your apps and reports which PHP, Laravel and sign-in package each one runs, checked against CREED's support dates.
I code with an AI agent

ADVISOR

An MCP server your agent can ask about the stack. It answers from CREED's policy file, not from what the model remembers.

How the four check projects fit together

CREED writes the rules down and PROCTOR grades your app against them. Pinstripe is the code style. Preflight runs all of it in CI.

CREED the rules

The written standards, plus policy.json: which PHP, Laravel and Node versions are supported.
PROCTOR the grader

Reads your composer.json and lock file and reports each check against CREED as pass, warning, info or fail.
Pinstripe the code style

Shared presets for Pint, PHPStan, Rector, ESLint and Prettier. Your app adds only its own exceptions.
Preflight the runner

The CI pipeline that runs all of it, and your tests, on every push.

WELD already has all four set up. Run composer ci and composer proctor on your machine, and GitLab runs both through Preflight on every push.

The journey

Roughly in order: what happens to a request on its way to the page, then what happens to your code before it ships.

HELMET sets security headers
SESAME signs the user in
WayneUI renders the page
PROCTOR checks the code
Preflight runs CI
Squire deploys

Up close

The cast

The same projects with a bit more detail. The first seven are part of WELD. The next five work around your app: upgrades, the fleet scan, deploys, the sign-in gateway and the MCP server. After those come Sourdough and the one we're building next.

WayneUI

2.0 Contrast | AA

Wayne State's design system. WELD uses it in the Vue front end and the Blade layouts.

$ pnpm verify
✓ tokens     built
✓ contrast   AA, every pair
✓ axe        0 violations
a11y: 100
$

CREED

0.1 Volume | Eleven

The written standards, plus policy.json with the support dates for PHP, Laravel, Node, MySQL, Vue and Inertia. PROCTOR, Rollcall and ADVISOR all read it.

$ creed policy show
php      8.3, 8.4
laravel  12, 13
node     22 LTS
volume   eleven
$

HELMET

0.2 Fit | Snug

In WELD it runs in the global middleware, so every response carries the security headers and CSP.

$ helmet headers
CSP      strict, nonce
HSTS     1 year
frames   DENY
$

SESAME

0.2 Says | Open

Sign-in through CAS, Entra ID or Drawbridge. Locally, a fake driver signs you in.

$ sesame login
→ off to CAS and back
✓ signed in as ab1234
✓ session: app-native
$

PROCTOR

0.2 Strictness | Kind

In WELD it's composer proctor. In CI, warnings pass and failures block.

$ proctor check
✓ php 8.4 supported
✓ headers present
✓ 42 passed, 0 failed
$

Preflight

0.1 Checklist | Long

GitLab CI/CD components. WELD's pipeline uses them to run the tests on PHP 8.3, 8.4 and 8.5, plus the audit.

$ preflight run
✓ lint         pass
✓ test         312 pass
✓ portability  pass
$

Pinstripe

0.1 Creases | Sharp

The code style presets. WELD runs Pint and PHPStan at level 8 from a copy of Pinstripe's 0.1 Laravel presets.

$ pinstripe apply
✓ pint      14 files pressed
✓ phpstan   level 8, 0 errors
✓ eslint    clean
style: sharp
$

Booster

0.1 Sting | Mild

Plans an upgrade as hops, like Laravel 10 to 11, and runs them one at a time with Rector. Your tests have to pass on the new PHP before the next hop starts.

$ booster plan
1. laravel-10-to-11
2. laravel-11-to-12
3. php-82-to-83
$

Rollcall

0.1 Attendance | Taken

Every app answers “present”, with its PHP, Laravel and auth versions. Rollcall only reports. It never opens an issue or blocks a deploy.

$ rollcall report
✓ snapshot   today
drift      none
back row   PHP 7.4, waving
$

Squire

0.3 Armor | Carried

The deploy kit for Citadel: build.sh, a release script, a health check and local runs on the same images. This page deploys with it too.

$ squire doctor
✓ build.sh     packages only
✓ release.sh   idempotent
✓ /up          answers
$

Drawbridge

0.1 Moat | Full

One OpenID Connect client, through Entra ID, for every app on Citadel. We'd rather get the nonce and state checks right once than in every app.

$ drawbridge config:validate
✓ oidc        Entra ID, PKCE
✓ protected   /admin/
✓ headers     stripped, every spelling
bridge: lowered
$

ADVISOR

0.1 Office hours | Always

Ask it which PHP you can build on and it answers from policy.json, with the date. It's read-only in 0.1: it can't write files or run shell commands.

$ advisor mcp
✓ serving   stdio
✓ tools     read-only
answers: from policy.json
$

Sourdough

0.1 Rise | Daily

sourdough new makes a new app with SESAME, HELMET, PROCTOR and Preflight already in place. Use it when you'd rather shape the app yourself. It bakes four of the five app shapes today, and it is the starter for every shape.

$ sourdough new --raw
Next steps:
  cd my-app
  composer install
$

Next off the line

Rolodex next

Person data with types, so nobody has to flip through cards by hand.

Pick your path

The stack has five app shapes. Sourdough bakes four of them today; only raw PHP with a Vue SPA is still waiting. WELD is the Inertia and Vue one, built.

From Sourdough

Raw PHP

Plain PHP with no framework and no build step, using WayneUI's standalone files.

composer global require waynestate/sourdough
sourdough new my-app --raw

From Sourdough

Laravel + Blade

Laravel with Blade views, the classic WSU shape.

sourdough new my-app --laravel

From Sourdough

Laravel + Blade + Vue islands

Laravel with Blade views, and a little Vue where a page needs behavior.

sourdough new my-app --laravel --vue

This is WELD

Laravel + Inertia/Vue

Laravel 13 with Inertia 2 and Vue 3. This is the shape WELD is, with the stack already installed.

composer create-project waynestate/weld my-app

Not baked yet: raw PHP + Vue SPA (--raw --vue); it prints a plan today.

Hand it to your agent

Job tickets

Two prompts for whatever coding agent you use. Copy one, or open it in OpenCode, Claude Code, Codex or ChatGPT. Each tells the agent what's already set up and what it must leave alone, and both tell it to ask you before it guesses.

Ticket W-1 · A new app

Get started with WELD

Gets a new app running in Docker, checks it, and plans the rename. It won't rename anything until you say so.

You are a coding agent helping a Wayne State University developer start a new app from WELD: the Wayne State application stack welded into one Laravel app with Inertia and Vue. Sign-in (SESAME), security headers (HELMET), the standards check (PROCTOR) and CI are already joined. The job is to get it running and make it this developer's own.

Read first:
- https://weld.apps.wayne.edu/llms.txt, the index of WELD's pages, each one as Markdown. Fetch the pages you need; do not work from memory.
- ADVISOR, the stack's MCP server, if it is connected: get_project_status and read_project_docs for weld answer from the stack's own docs, and policy_lookup gives today's PHP, Laravel and Node support from CREED. If it is not connected, say so and work from the pages. How to add it: https://advisor.apps.wayne.edu/llms.txt

Task:
1. Clone WELD into a new folder with `git clone https://github.com/waynestate/weld.git my-app`, using the app name I give you in place of my-app.
2. Bring it up with Docker, the only prerequisite: `.\bin\weld.ps1 up` on Windows (PowerShell), `bin/weld.sh up` on macOS and Linux. It copies .env.example to .env, installs the PHP and Node dependencies in the containers, sets the app key and runs the migrations.
3. Check the setup with the doctor subcommand (`.\bin\weld.ps1 doctor` or `bin/weld.sh doctor`) and report every line that is not PASS.
4. Run the gate with the test subcommand, which runs `composer ci` in the app container, and the standards check with `composer proctor` (in the app container if the host has no PHP).
5. Propose what to rename to make it mine: APP_NAME in .env.example and the package name in composer.json. Do not change them yet.

Constraints:
- WELD is Laravel with Inertia and Vue. If I want raw PHP or Laravel with Blade, stop and point me at Sourdough, the starter for every shape: https://sourdough.apps.wayne.edu/llms.txt
- Sign-in is SESAME's, at /login and /logout, and its fake driver stands in locally. Never add password auth back.
- Never commit .env, and never paste a secret into a prompt or a file.
- Give separate commands for Windows (PowerShell), macOS and Linux wherever they differ.
- Ask me before you guess: an app name, a check that fails for a reason you cannot explain, or anything that touches a deploy.

Output: what you ran and what it said, the doctor report, then the rename plan as numbered steps, then your questions.

Ticket W-2 · Laravel, Inertia and Vue

Add a signed-in page to a WELD app

Adds a route behind SESAME, a Vue page in the app layout and a feature test, then runs the checks.

You are a coding agent adding one signed-in page to an app built from WELD: the Wayne State application stack welded into one Laravel app with Inertia and Vue, at Wayne State University.

Read first:
- https://weld.apps.wayne.edu/llms.txt, then the pages it lists. BEST_PRACTICES.md in this repo says what each practice expects and which stack tool checks it.
- ADVISOR, the stack's MCP server, if it is connected: call list_stack_rules with permutation laravel-inertia-vue, and read_project_docs for weld and sesame. If it is not connected, say so and work from the pages.
- routes/web.php, resources/js/pages/Dashboard.vue, resources/js/layouts/ and tests/Feature/DashboardTest.php.

Task:
1. If I have not said what the page is for, its URL and who may see it, ask.
2. Add the route in routes/web.php the way the dashboard route does it: Inertia::render for a page in resources/js/pages, behind the auth.sesame middleware, with a route name.
3. Write the Vue page with script setup and TypeScript, inside AppLayout with breadcrumbs, the way Dashboard.vue does.
4. Add a feature test beside DashboardTest.php: a guest is sent to /login, and a user signed in with the fake driver gets the page.
5. Run the gate: `composer ci`, or the test subcommand of bin/weld.sh (macOS, Linux) or bin\weld.ps1 (Windows) when the host has no PHP.

Constraints:
- Sign-in belongs to SESAME: protect the route with auth.sesame, and never add password auth.
- HELMET sends a strict CSP with a per-request nonce: no inline scripts, and no new script hosts.
- Keep PHPStan at level 8 and Pint clean. Never lower either to get the gate green.
- Ask me before you guess, and before you add a migration, a Composer or npm package, or anything that touches a deploy.

Output: the files you changed, the gate's result, then your questions.

The agent reads the same pages you do: llms.txt lists them, llms-full.txt holds them all in one file, and this page has a Markdown twin. Nothing here phones home. The buttons only copy text or open the tool you picked.

WELD WELD

Install it, then run one command

Install

Start it in Docker

Run the checks

Which piece do I need?

How the four check projects fit together

The journey

The cast

Next off the line

Pick your path

Raw PHP

Laravel + Blade

Laravel + Blade + Vue islands

Laravel + Inertia/Vue

Job tickets

WELD