Development

PHP Modernization

PHP 8.x modernization patterns for upgrading legacy PHP applications. Covers constructor property promotion, readonly classes, enums, attributes, generics via PHPDoc, PHPStan level 9+ compliance, and Symfony best practices. By Netresearch.

Latest release v1.24.1

Install

Choose a supported route below. Package contents, agent registration and runtime dependencies can differ between installers.

  1. Claude Code via this marketplace
    /plugin install php-modernization@netresearch-claude-code-marketplace

    First add the marketplace once in Claude Code: /plugin marketplace add netresearch/claude-code-marketplace. Then install the selected plugin. For setup and installation scopes, see Claude Code plugin setup A plugin can include several skills and additional components.

  2. npx interactive skill selection
    npx skills add https://github.com/netresearch/php-modernization-skill

    Requires Node.js 22.20+. Run from the target project, then choose the source skills and agents in the installer. Uses the skills CLI from skills.sh Installs skill instructions. Extra plugin hooks, commands and external runtime tools are not installed by this route.

  3. composer require PHP project, as a package
    composer require netresearch/php-modernization-skill

    Allow the Composer skill installer to activate and approve skill registration when prompted. Requires netresearch/composer-agent-skill-plugin Discovers trusted skill packages and registers their instructions in AGENTS.md. Runtime tools may need separate setup.

  4. composer skills:add PHP project, direct source
    composer skills:add netresearch/php-modernization-skill

    Install and activate netresearch/composer-agent-skill-plugin first; approve the selected source's skill registration. Provided by netresearch/composer-agent-skill-plugin Pins source repositories without a Packagist package and records them in composer.skills.lock. Runtime dependencies remain separate.

What you can do with it

  • Agent contract: a Python verifier (verify_php_project.py), orchestrator (modernize_loop.py), and cheap profiler (introspect.py). stable structured output (JSON with schema_version 1.0.0, SARIF 2.1.0, or JUnit XML), archetype detection, and machine-readable agent_actions[] recommendations downstream agents can act on without re-reading the prose references.
  • Hard guardrails: five binding refusal cases stated in SKILL.md (no readonly on Doctrine entities, no Rector without --dry-run, baseline shrink-not-delete, no blanket final on mock targets, no editing generated files).
  • PHP 8.x feature coverage: 8.0–8.3 baseline, dedicated 8.4 reference (released 2024-11: property hooks, asymmetric visibility, lazy objects, array_find / array_any / array_all), and dedicated 8.5 reference (released 2025-11: pipe |>, array_first / array_last, #[\NoDiscard]).
  • Static-analysis stack: PHPStan (level 9+, level 10 recommended), PHPat (architecture testing), Rector (automated refactoring), PHP-CS-Fixer (@PER-CS), Infection (mutation testing in PR-diff mode), composer audit.
  • Type-safety patterns: DTOs and Value Objects over arrays, generic collection typing via PHPDoc, strict typing everywhere, immutability boundaries (readonly vs. property hooks vs. classic mutation).
  • Framework edges: dedicated references for Doctrine 2.x/3.x edges, API Platform resource separation, and PSR-15 middleware architecture.
  • PSR / PER-CS compliance: PSR-1, 3, 4, 6, 7, 11, 13, 14, 15, 16, 17, 18, 20 plus PER Coding Style. PSR-12 superseded by PER-CS.
  • Project-archetype detection: generic-composer, typo3-extension, symfony-app, monorepo-package. The verifier and orchestrator branch on archetype.
  • Regression suite: synthetic fixtures plus golden-output snapshots guard the verifier from contract drift.

What you get back

  • Structured assessment reports in JSON, SARIF or JUnit XML, with machine-readable action recommendations.

What it expects in your project

Check the source README for current examples, requirements and limitations. Open full README

Tags

  • development
  • quality-security