ulpi-io - No business logic in controllers. Controllers validate (Form Request), delegate (Action), return (API Resource). Nothing else.
- No returning Eloquent models directly. Every response goes through an API Resource. Never
return $user. - No inline validation. All validation lives in Form Request classes. Never
$request->validate([...])in controllers. - No
$guarded = []. Every model uses explicit$fillable. Mass-assignment protection is non-negotiable. - No raw queries. Use Eloquent or the query builder with parameter bindings. Never concatenate user input into SQL.
- No bare
queue:work. All queue processing uses Horizon — in development and production. Model::shouldBeStrict()must be enabled inAppServiceProvider::boot(). This prevents lazy loading, silently discarded attributes, and access to missing attributes.
Laravel 12 API
MANDATORY FIRST RESPONSE PROTOCOL
Before writing ANY code, you MUST complete this checklist:
- Read
references/stack.mdto understand locked decisions (runtime, packages, patterns) - Identify the task type from the routing table below
- Read the matching reference file(s) — they contain the patterns, code examples, and anti-patterns
- Only then begin implementation
Writing code without reading the reference = wrong patterns, wasted time, rework.
Routing Table
| Task | Read |
|---|---|
| Starting a session / understanding the stack | references/stack.md |
| Creating or modifying files, folder conventions | references/folder-structure.md |
| API routes, versioning, middleware | references/routing.md |
| Creating or editing a controller | references/controller-pattern.md |
| Adding validation to a request | references/form-requests.md |
| Creating or editing a model, relationships, scopes | references/eloquent-models.md |
| API response transformation, pagination, filtering | references/api-resources.md |
| Business logic, Actions, DTOs, service providers | references/service-layer.md |
| Authentication, tokens, roles, policies | references/auth.md |
| Migrations, seeders, factories, query optimization | references/database.md |
| Error responses, exception handling | references/error-handling.md |
| Logging configuration, structured logging | references/logging.md |
| Redis caching, cache invalidation, TTL strategy | references/caching.md |
| Jobs, queues, events, Horizon, broadcasting | references/queues-jobs.md |
| Writing tests (feature or unit) | references/testing.md |
| Security hardening, CORS, rate limiting, webhooks | references/security.md |
| API documentation generation | references/api-docs.md |
| Telescope, Horizon dashboard, Pulse, health checks | references/observability.md |
| Filament admin panel, resources, pages, widgets | references/filament.md |
| Docker setup, CI/CD, deployment | references/docker.md |
| Notifications, email, SMS | references/notifications-mail.md |
| File uploads, S3, media library | references/file-storage.md |
| Task scheduling, cron jobs | references/scheduling.md |
| AI agents, text/image/audio generation, embeddings, RAG | references/ai-sdk.md |
| AI-assisted development, Boost setup, guidelines, skills | references/boost.md |
| MCP servers, exposing app to AI clients, tools/resources/prompts | references/mcp.md |
Multiple tasks? Read multiple files. The references are self-contained — no need to consult external docs.
Quick Rules
These repeat the critical guardrails for context-window resilience:
- Controllers are thin — validate via Form Request, delegate to Action, return API Resource.
- All mutations in Actions wrapped in
DB::transaction(). - All list endpoints paginated — never return unbounded collections.
- All responses via API Resources — never return Eloquent models directly.
$fillableon every model — never$guarded = [].Model::shouldBeStrict()inAppServiceProvider::boot().- Horizon for all queue processing — never bare
queue:work.