---
title: "WELD: Many parts, one piece."
description: "WELD is a Laravel 13 app with Inertia and Vue that comes with the rest of the Wayne State stack already set up: sign-in, security headers, the standards check, code style and CI. Start your app from it."
url: https://weld.apps.wayne.edu/
llms: https://weld.apps.wayne.edu/llms.txt
generator: Squire agent-ready
---

![WELD logo: a welder's helmet](https://weld.apps.wayne.edu/brand/weld-avatar-512.png)

The Wayne State app stack

# WELD

WELD stands for Wired, Everything, Linked, Deployed.

Many parts, one piece.

WELD is a Laravel 13 app with Inertia and Vue, and the rest of the stack is already in it: sign-in, security headers, the standards check, code style, CI and WayneUI. It's **one install**. Rename it and start on your own pages.

`$ composer create-project waynestate/weld my-app`

Any other shape? [Sourdough](https://sourdough.apps.wayne.edu/) starts four of the five, from raw PHP to Vue islands, with the same sign-in, headers and checks.

[Get started](https://weld.apps.wayne.edu/#start) [Which piece do I need?](https://weld.apps.wayne.edu/#chooser) [Meet the cast](https://weld.apps.wayne.edu/#cast-title) [Docs](https://weld.apps.wayne.edu/docs/index.html)

Start here

## Install it, then run one command

Yes, this is a lot of packages. Most of you can ignore that. Install WELD, run the one command in step 2, and you have a working app with all of it set up. We split the stack into separate projects because Wayne State developers work on very different apps, and you shouldn't have to buy the whole shop to borrow one torch.

1. ### Install
   Composer makes a fresh copy, writes `.env`, sets the app key and runs the first migration.
   ```
   composer create-project waynestate/weld my-app
   ```
2. ### Start it in Docker
   This is the one command. You only need Docker, because PHP and Node run in the containers. Then open `localhost:8000`.
   ```
   # macOS, Linux
   bin/weld.sh up
   # Windows (PowerShell)
   .\bin\weld.ps1 up
   ```
3. ### Run the checks
   Runs the tests, Pint, PHPStan and `composer audit`, the same command CI runs. The standards check is separate: `composer proctor`.
   ```
   composer ci
   ```

[Sourdough](https://sourdough.apps.wayne.edu/) makes the other shapes: `sourdough new my-app` for raw PHP, `sourdough new my-app --laravel` for Laravel with Blade, `sourdough new my-app --laravel --vue` for Vue islands. WELD is the Inertia and Vue shape, ready-made.

Already have an app?

## Which piece do I need?

Most Wayne State apps are older than this stack. Some are raw PHP, some are Laravel, and plenty only need sign-in or an upgrade. That's why every piece also works on its own. WELD is simply all of them installed together.

- I'm starting a new app
  WELD or [Sourdough](https://sourdough.apps.wayne.edu/)
  Pick WELD for Laravel with Inertia and Vue, ready-made. Pick Sourdough to start any other shape, or to shape one yourself.
- My raw PHP app just needs sign-in
  [SESAME](https://sesame.apps.wayne.edu/)
  Adds CAS or Entra ID sign-in to a raw PHP or Laravel app. Your app keeps its own session.
- I'm stuck on PHP 7
  [Booster](https://booster.apps.wayne.edu/)
  Upgrades PHP and Laravel one version at a time, and has a playbook for Vue 2 to 3. It never commits; you read the diff and merge it.
- I'm deploying to Citadel
  [Squire](https://squire.apps.wayne.edu/)
  The build and release scripts Citadel expects, a health check, and a way to run your app locally on the same images.
- I want CI on every push
  [Preflight](https://preflight.apps.wayne.edu/)
  GitLab CI components for PHP tests on each supported version, PROCTOR, Composer audit, Pint, PHPStan and ESLint.
- I want safe defaults at runtime
  [HELMET](https://helmet.apps.wayne.edu/)
  Sends the security headers and CSP, hardens the session cookie and checks proxies before your first page is served.
- I want it to look like Wayne State
  [WayneUI](https://wayneui.apps.wayne.edu/)
  Wayne State's design system. It works in static HTML, raw PHP, Blade and Vue.
- I want Citadel to sign people in before my app
  [Drawbridge](https://drawbridge.apps.wayne.edu/)
  A gateway that signs people in through Entra ID before they reach your app. Your app then checks one small signed token.
- I look after a lot of apps
  [Rollcall](https://rollcall.apps.wayne.edu/)
  Scans your apps and reports which PHP, Laravel and sign-in package each one runs, checked against CREED's support dates.
- I code with an AI agent
  [ADVISOR](https://advisor.apps.wayne.edu/)
  An MCP server your agent can ask about the stack. It answers from CREED's policy file, not from what the model remembers.

### How the four check projects fit together

CREED writes the rules down and PROCTOR grades your app against them. Pinstripe is the code style. Preflight runs all of it in CI.

1. [CREED](https://creed.apps.wayne.edu/) the rules
   The written standards, plus `policy.json`: which PHP, Laravel and Node versions are supported.
2. [PROCTOR](https://proctor.apps.wayne.edu/) the grader
   Reads your `composer.json` and lock file and reports each check against CREED as pass, warning, info or fail.
3. [Pinstripe](https://pinstripe.apps.wayne.edu/) the code style
   Shared presets for Pint, PHPStan, Rector, ESLint and Prettier. Your app adds only its own exceptions.
4. [Preflight](https://preflight.apps.wayne.edu/) the runner
   The CI pipeline that runs all of it, and your tests, on every push.

WELD already has all four set up. Run `composer ci` and `composer proctor` on your machine, and GitLab runs both through Preflight on every push.

## The journey

Roughly in order: what happens to a request on its way to the page, then what happens to your code before it ships.

1. [HELMET](https://helmet.apps.wayne.edu/) sets security headers
2. [SESAME](https://sesame.apps.wayne.edu/) signs the user in
3. [WayneUI](https://wayneui.apps.wayne.edu/) renders the page
4. [PROCTOR](https://proctor.apps.wayne.edu/) checks the code
5. [Preflight](https://preflight.apps.wayne.edu/) runs CI
6. [Squire](https://squire.apps.wayne.edu/) deploys

Up close

## The cast

The same projects with a bit more detail. The first seven are part of WELD. The next five work around your app: upgrades, the fleet scan, deploys, the sign-in gateway and the MCP server. After those come Sourdough and the one we're building next.

![WayneUI logo: a rounded frame around a solid shape, with a gold tab on the lower edge](https://weld.apps.wayne.edu/assets/marks/wayneui.svg)

### [WayneUI](https://wayneui.apps.wayne.edu/)

2.0 Contrast | AA

Wayne State's design system. WELD uses it in the Vue front end and the Blade layouts.

```
$ pnpm verify
✓ tokens     built
✓ contrast   AA, every pair
✓ axe        0 violations
a11y: 100
$
```

![CREED logo: a stone arch with a gold keystone](https://weld.apps.wayne.edu/assets/marks/creed.png)

### [CREED](https://creed.apps.wayne.edu/)

0.1 Volume | Eleven

The written standards, plus `policy.json` with the support dates for PHP, Laravel, Node, MySQL, Vue and Inertia. PROCTOR, Rollcall and ADVISOR all read it.

```
$ creed policy show
php      8.3, 8.4
laravel  12, 13
node     22 LTS
volume   eleven
$
```

![HELMET logo: a white football helmet with a gold facemask](https://weld.apps.wayne.edu/assets/marks/helmet.png)

### [HELMET](https://helmet.apps.wayne.edu/)

0.2 Fit | Snug

In WELD it runs in the global middleware, so every response carries the security headers and CSP.

```
$ helmet headers
CSP      strict, nonce
HSTS     1 year
frames   DENY
$
```

![SESAME logo: an open door with a gold gap](https://weld.apps.wayne.edu/assets/marks/sesame.png)

### [SESAME](https://sesame.apps.wayne.edu/)

0.2 Says | Open

Sign-in through CAS, Entra ID or Drawbridge. Locally, a fake driver signs you in.

```
$ sesame login
→ off to CAS and back
✓ signed in as ab1234
✓ session: app-native
$
```

![PROCTOR logo: an eye with a gold square pupil](https://weld.apps.wayne.edu/assets/marks/proctor.png)

### [PROCTOR](https://proctor.apps.wayne.edu/)

0.2 Strictness | Kind

In WELD it's `composer proctor`. In CI, warnings pass and failures block.

```
$ proctor check
✓ php 8.4 supported
✓ headers present
✓ 42 passed, 0 failed
$
```

![Preflight logo: a runway with a gold center line](https://weld.apps.wayne.edu/assets/marks/preflight.png)

### [Preflight](https://preflight.apps.wayne.edu/)

0.1 Checklist | Long

GitLab CI/CD components. WELD's pipeline uses them to run the tests on PHP 8.3, 8.4 and 8.5, plus the audit.

```
$ preflight run
✓ lint         pass
✓ test         312 pass
✓ portability  pass
$
```

![Pinstripe logo: a striped necktie with a gold tie bar](https://weld.apps.wayne.edu/assets/marks/pinstripe.png)

### [Pinstripe](https://pinstripe.apps.wayne.edu/)

0.1 Creases | Sharp

The code style presets. WELD runs Pint and PHPStan at level 8 from a copy of Pinstripe's 0.1 Laravel presets.

```
$ pinstripe apply
✓ pint      14 files pressed
✓ phpstan   level 8, 0 errors
✓ eslint    clean
style: sharp
$
```

![Booster logo: a syringe with rocket fins and a gold flame](https://weld.apps.wayne.edu/assets/marks/booster.png)

### [Booster](https://booster.apps.wayne.edu/)

0.1 Sting | Mild

Plans an upgrade as hops, like Laravel 10 to 11, and runs them one at a time with Rector. Your tests have to pass on the new PHP before the next hop starts.

```
$ booster plan
1. laravel-10-to-11
2. laravel-11-to-12
3. php-82-to-83
$
```

![Rollcall logo: an open register with gold ticks](https://weld.apps.wayne.edu/assets/marks/rollcall.png)

### [Rollcall](https://rollcall.apps.wayne.edu/)

0.1 Attendance | Taken

Every app answers “present”, with its PHP, Laravel and auth versions. Rollcall only reports. It never opens an issue or blocks a deploy.

```
$ rollcall report
✓ snapshot   today
drift      none
back row   PHP 7.4, waving
$
```

![Squire logo: a satchel with a gold buckle](https://weld.apps.wayne.edu/assets/marks/squire.png)

### [Squire](https://squire.apps.wayne.edu/)

0.3 Armor | Carried

The deploy kit for Citadel: `build.sh`, a release script, a health check and local runs on the same images. This page deploys with it too.

```
$ squire doctor
✓ build.sh     packages only
✓ release.sh   idempotent
✓ /up          answers
$
```

![Drawbridge logo: a castle tower with its bridge down on a gold chain](https://weld.apps.wayne.edu/assets/marks/drawbridge.png)

### [Drawbridge](https://drawbridge.apps.wayne.edu/)

0.1 Moat | Full

One OpenID Connect client, through Entra ID, for every app on Citadel. We'd rather get the nonce and state checks right once than in every app.

```
$ drawbridge config:validate
✓ oidc        Entra ID, PKCE
✓ protected   /admin/
✓ headers     stripped, every spelling
bridge: lowered
$
```

![ADVISOR logo: a speech bubble with a gold compass needle](https://weld.apps.wayne.edu/assets/marks/advisor.png)

### [ADVISOR](https://advisor.apps.wayne.edu/)

0.1 Office hours | Always

Ask it which PHP you can build on and it answers from `policy.json`, with the date. It's read-only in 0.1: it can't write files or run shell commands.

```
$ advisor mcp
✓ serving   stdio
✓ tools     read-only
answers: from policy.json
$
```

![Sourdough logo: a starter jar with a gold band](https://weld.apps.wayne.edu/assets/marks/sourdough.png)

### [Sourdough](https://sourdough.apps.wayne.edu/)

0.1 Rise | Daily

`sourdough new` makes a new app with SESAME, HELMET, PROCTOR and Preflight already in place. Use it when you'd rather shape the app yourself. It bakes four of the five app shapes today, and it is the starter for every shape.

```
$ sourdough new --raw
Next steps:
  cd my-app
  composer install
$
```

### Next off the line

- Rolodex next
  Person data with types, so nobody has to flip through cards by hand.

## Pick your path

The stack has five app shapes. Sourdough bakes four of them today; only raw PHP with a Vue SPA is still waiting. WELD is the Inertia and Vue one, built.

From Sourdough

### Raw PHP

Plain PHP with no framework and no build step, using WayneUI's standalone files.

`composer global require waynestate/sourdough sourdough new my-app --raw`

From Sourdough

### Laravel + Blade

Laravel with Blade views, the classic WSU shape.

`sourdough new my-app --laravel`

From Sourdough

### Laravel + Blade + Vue islands

Laravel with Blade views, and a little Vue where a page needs behavior.

`sourdough new my-app --laravel --vue`

This is WELD

### Laravel + Inertia/Vue

Laravel 13 with Inertia 2 and Vue 3. This is the shape WELD is, with the stack already installed.

`composer create-project waynestate/weld my-app`

Not baked yet: raw PHP + Vue SPA (`--raw --vue`); it prints a plan today.

Hand it to your agent

## Job tickets

Two prompts for whatever coding agent you use. Copy one, or open it in OpenCode, Claude Code, Codex or ChatGPT. Each tells the agent what's already set up and what it must leave alone, and both tell it to ask you before it guesses.

### Get started with WELD

Gets a new app running in Docker, checks it, and plans the rename. It won't rename anything until you say so.

A prompt for your coding agent. Copy it as it stands:

```text
You are a coding agent helping a Wayne State University developer start a new app from WELD: the Wayne State application stack welded into one Laravel app with Inertia and Vue. Sign-in (SESAME), security headers (HELMET), the standards check (PROCTOR) and CI are already joined. The job is to get it running and make it this developer's own.

Read first:
- https://weld.apps.wayne.edu/llms.txt, the index of WELD's pages, each one as Markdown. Fetch the pages you need; do not work from memory.
- ADVISOR, the stack's MCP server, if it is connected: get_project_status and read_project_docs for weld answer from the stack's own docs, and policy_lookup gives today's PHP, Laravel and Node support from CREED. If it is not connected, say so and work from the pages. How to add it: https://advisor.apps.wayne.edu/llms.txt

Task:
1. Clone WELD into a new folder with `git clone https://github.com/waynestate/weld.git my-app`, using the app name I give you in place of my-app.
2. Bring it up with Docker, the only prerequisite: `.\bin\weld.ps1 up` on Windows (PowerShell), `bin/weld.sh up` on macOS and Linux. It copies .env.example to .env, installs the PHP and Node dependencies in the containers, sets the app key and runs the migrations.
3. Check the setup with the doctor subcommand (`.\bin\weld.ps1 doctor` or `bin/weld.sh doctor`) and report every line that is not PASS.
4. Run the gate with the test subcommand, which runs `composer ci` in the app container, and the standards check with `composer proctor` (in the app container if the host has no PHP).
5. Propose what to rename to make it mine: APP_NAME in .env.example and the package name in composer.json. Do not change them yet.

Constraints:
- WELD is Laravel with Inertia and Vue. If I want raw PHP or Laravel with Blade, stop and point me at Sourdough, the starter for every shape: https://sourdough.apps.wayne.edu/llms.txt
- Sign-in is SESAME's, at /login and /logout, and its fake driver stands in locally. Never add password auth back.
- Never commit .env, and never paste a secret into a prompt or a file.
- Give separate commands for Windows (PowerShell), macOS and Linux wherever they differ.
- Ask me before you guess: an app name, a check that fails for a reason you cannot explain, or anything that touches a deploy.

Output: what you ran and what it said, the doctor report, then the rename plan as numbered steps, then your questions.
```

### Add a signed-in page to a WELD app

Adds a route behind SESAME, a Vue page in the app layout and a feature test, then runs the checks.

A prompt for your coding agent. Copy it as it stands:

```text
You are a coding agent adding one signed-in page to an app built from WELD: the Wayne State application stack welded into one Laravel app with Inertia and Vue, at Wayne State University.

Read first:
- https://weld.apps.wayne.edu/llms.txt, then the pages it lists. BEST_PRACTICES.md in this repo says what each practice expects and which stack tool checks it.
- ADVISOR, the stack's MCP server, if it is connected: call list_stack_rules with permutation laravel-inertia-vue, and read_project_docs for weld and sesame. If it is not connected, say so and work from the pages.
- routes/web.php, resources/js/pages/Dashboard.vue, resources/js/layouts/ and tests/Feature/DashboardTest.php.

Task:
1. If I have not said what the page is for, its URL and who may see it, ask.
2. Add the route in routes/web.php the way the dashboard route does it: Inertia::render for a page in resources/js/pages, behind the auth.sesame middleware, with a route name.
3. Write the Vue page with script setup and TypeScript, inside AppLayout with breadcrumbs, the way Dashboard.vue does.
4. Add a feature test beside DashboardTest.php: a guest is sent to /login, and a user signed in with the fake driver gets the page.
5. Run the gate: `composer ci`, or the test subcommand of bin/weld.sh (macOS, Linux) or bin\weld.ps1 (Windows) when the host has no PHP.

Constraints:
- Sign-in belongs to SESAME: protect the route with auth.sesame, and never add password auth.
- HELMET sends a strict CSP with a per-request nonce: no inline scripts, and no new script hosts.
- Keep PHPStan at level 8 and Pint clean. Never lower either to get the gate green.
- Ask me before you guess, and before you add a migration, a Composer or npm package, or anything that touches a deploy.

Output: the files you changed, the gate's result, then your questions.
```

The agent reads the same pages you do: [llms.txt](https://weld.apps.wayne.edu/llms.txt) lists them, [llms-full.txt](https://weld.apps.wayne.edu/llms-full.txt) holds them all in one file, and this page has a [Markdown twin](https://weld.apps.wayne.edu/index.md). Nothing here phones home. The buttons only copy text or open the tool you picked.