# PROCTOR

> PROCTOR checks a PHP app against CREED's version policy from the command line: PHP support, patch levels, Composer constraints, the audit, MySQL 5.6 and CI. It writes text, JSON, GitLab Code Quality or SARIF.

**Policy Rules Of Code, Tested On Release.** The invigilator your composer.lock didn't know it needed: no phones,
no EOL PHP.

PROCTOR is a framework-free PHP CLI that measures a PHP application against
the WSU version policy. It reads the app's composer.json and composer.lock,
decides the support state of the app's PHP floor from a policy file, and
reports each check as pass, warning, info or fail. The checks and their rules
come from the stack's version policy decision and from the policy file
passed with `--policy`; PROCTOR itself holds no policy of its own.

> [!NOTE]
> **Not to be confused with:** code style is Pinstripe, CI is Preflight. PROCTOR grades an app against CREED's rules.

Checks: `composer ci` (the same command runs on GitLab and GitHub). Front page: [`site/index.html`](https://nougat.snu.gs/enterprise-apps/proctor/blob/HEAD/site/index.html).
On Citadel it is served by the raw-PHP deploy layer in [`deploy/`](https://nougat.snu.gs/enterprise-apps/proctor/blob/HEAD/deploy/): a Squire kit whose front controller serves `site/` behind HELMET's security headers. For local development, keep serving `site/` directly.
Documentation: [proctor.apps.wayne.edu/docs](https://proctor.apps.wayne.edu/docs/).

Every page below is Markdown. The HTML pages send the same Markdown to a client that asks for `text/markdown`. Written by Squire's agent-ready kit from the README and the pages; do not edit.

## Pages

- [PROCTOR: Watches the exam. Doesn't help.](https://proctor.apps.wayne.edu/index.md): PROCTOR checks a PHP app against CREED's version policy from the command line: PHP support, patch levels, Composer constraints, the audit, MySQL 5.6 and CI. It writes text, JSON, GitLab Code Quality or SARIF.
- [CI checks | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/check-ci.md): The checks that verify CI pipelines run composer ci and that Preflight includes are pinned to a commit SHA.
- [Composer checks | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/check-composer.md): The checks that read composer.json and composer.lock, from unbounded constraints and the committed lock to audit results and the Composer version on PATH.
- [PHP checks | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/check-php.md): The checks that grade the PHP floor, patch currency, platform portability, MySQL 5.6 compatibility and deploy scripts.
- [WayneUI checks | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/check-wayneui.md): The checks that flag forked copies of WayneUI views and an installed WayneUI that is behind the latest release.
- [Checks | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/checks-overview.md): An overview of every check PROCTOR runs and how each reports pass, warning, info or fail.
- [Formats | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/formats.md): The four output formats PROCTOR writes: text, json, codequality and sarif.
- [GitHub code scanning | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/github-code-scanning.md): How the sarif format feeds GitHub code scanning on the GitHub mirror through the official upload action.
- [Overrides | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/overrides.md): How an app carries a policy-overrides.json file to waive a check's fail findings until an expiry date.
- [Policy | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/policy.md): How PROCTOR finds the CREED-format policy file it grades with, from --policy through the bundled copy.
- [Quick start | PROCTOR docs](https://proctor.apps.wayne.edu/docs/guides/quick-start.md): Run PROCTOR against an app and read its pass, warning, info or fail report.
- [Overview | PROCTOR docs](https://proctor.apps.wayne.edu/docs/index.md): A framework-free PHP CLI that measures a PHP app against the WSU version policy.
- [Install | PROCTOR docs](https://proctor.apps.wayne.edu/docs/install.md): Install PROCTOR as a Composer dev dependency so the command is available as vendor/bin/proctor.
- [Commands | PROCTOR docs](https://proctor.apps.wayne.edu/docs/reference/commands.md): The PROCTOR commands and their options, starting with proctor check and the options every command accepts.
- [Configuration | PROCTOR docs](https://proctor.apps.wayne.edu/docs/reference/configuration.md): Every setting PROCTOR reads, from the --policy option and the PROCTOR_POLICY variable to the extra.proctor keys in composer.json.
- [Exit codes | PROCTOR docs](https://proctor.apps.wayne.edu/docs/reference/exit-codes.md): What each PROCTOR exit code means: 0 for pass, 1 for one or more failures and 2 for a tool error.
- [Proof | PROCTOR docs](https://proctor.apps.wayne.edu/docs/reference/proof.md): Where to see PROCTOR's proof runs against real Wayne State applications, behind a Wayne State employee sign-in.
- [Rule ids | PROCTOR docs](https://proctor.apps.wayne.edu/docs/reference/rule-ids.md): The stable, namespaced rule id that every finding carries, grouped by check.
- [Troubleshooting | PROCTOR docs](https://proctor.apps.wayne.edu/docs/troubleshooting.md): How to work through a PROCTOR run that trips, warns or fails, and how to read the report to fix the finding.
- [Upgrading | PROCTOR docs](https://proctor.apps.wayne.edu/docs/upgrading.md): How to upgrade PROCTOR to a newer release and note the changes that affect your runs.

## Prompts

- [Get started with PROCTOR](https://proctor.apps.wayne.edu/#prompt-get-started): Installs PROCTOR, runs the check and explains each FAIL and WARN with the smallest fix. It changes nothing. Works for raw PHP, Laravel with Blade, and Laravel with Inertia and Vue. The prompt itself is in https://proctor.apps.wayne.edu/index.md.
- [PROCTOR in GitLab CI, through Preflight](https://proctor.apps.wayne.edu/#prompt-gitlab): Adds Preflight's proctor component to the app's pipeline, so findings show on each merge request as Code Quality. The prompt itself is in https://proctor.apps.wayne.edu/index.md.
- [PROCTOR in GitHub code scanning](https://proctor.apps.wayne.edu/#prompt-github): Adds a workflow that uploads the SARIF report on each push and pull request. Every action is pinned to a commit SHA, as the ci-pipelines check asks. The prompt itself is in https://proctor.apps.wayne.edu/index.md.

## Source

- [README](https://nougat.snu.gs/enterprise-apps/proctor/blob/HEAD/README.md): the project's README, with install, commands and checks
- [Everything in one file](https://proctor.apps.wayne.edu/llms-full.txt): the README and every page above, as one Markdown file

## Optional

- [ADVISOR](https://advisor.apps.wayne.edu/llms.txt): the stack's MCP server: read-only tools that answer from CREED's policy and the parts' docs instead of from memory
- [WELD](https://weld.apps.wayne.edu/llms.txt): the Wayne State application stack: every part, and the reference app