29 May 2026

feedSymfony Blog

SymfonyOnline June 2026: Hunting Vulnerabilities in Symfony with LLMs

We are thrilled to welcome the global Symfony community online on June 11-12, 2026, for SymfonyOnline June 2026. Get ready for deep-dive technical tracks! šŸŽ¤ Speaker announcement! Join Vincent Amstoutz, Lead Dev, Speaker & OSS Contributor, for…

29 May 2026 12:30pm GMT

feedDrupal.org aggregator

mark.ie: My LocalGov Drupal contributions for May 2026

My LocalGov Drupal contributions for May 2026 markconroy

29 May 2026 11:50am GMT

feedSymfony Blog

Symfony 8.1 curated new features

Symfony 8.1.0 is about to be released. As for any other Symfony release, our backward compatibility promise applies and this means that you should be able to upgrade easily to 8.1 without changing anything in your code. During the last couple of months, we've…

29 May 2026 9:53am GMT

Symfony 8.1.0 released

Symfony 8.1.0 has just been released. Check the New in Symfony 8.1 posts on this blog to learn about the main features of this new stable release; or check the first beta release announcement to get the list of all its new features. Read the Symfony upgrade…

29 May 2026 8:53am GMT

28 May 2026

feedDrupal.org aggregator

A Drupal Couple: Why I Believe in Agentic Recipes

Image
Imagen
A hand draws a glowing warm-gold path through layered teal digital wireframes, illustrating an orchestration plan threading through complex AI tooling.
Article body

I built my AI tooling first to help me work on Drupal projects and sites, and on the Claude Code plugins I develop. My wife uses the same tooling in her job now, which is the part that turned a personal hack into something I had to actually maintain.

I built it because two things were unreliable. The AI was not always following instructions in CLAUDE.md, and I was cutting steps. Anthropic's own docs are honest about this. They call CLAUDE.md instructions advisory, and hooks deterministic. That is the precise version of what I was feeling. Reading a rule and following a rule are not the same thing, for an AI or for a tired human. So I built tooling around the places where the gap mattered most, one piece at a time, because each piece came from something that had just broken.

Scope, eventually

Scope is the first step in my workflow now, but it was not the first step I added. It became the first step after I watched the AI solve a different goal than the one I had asked for, over-engineer changes that did not need engineering, and reach for the wrong abstraction often enough that I needed a step that just stopped the work and named what we were actually doing.

Scope is not necessarily specs. Specs are how. Scope is what we are even doing here, and what we are not doing, and what counts as done. Now it runs before anything else, and short alignment checks ride along through the later stages so the agent does not drift back into its own version of the goal.

I was surprised by how often the first sentence I wrote into scope made me realize I had been about to build the wrong thing.

Research, and the guides

Research came next. I started with local frameworks for the Drupal work I do a lot of. ECA module workflows. AI module pipelines. Each framework grew the way these things grow, full of decisions I had made and forgotten and made again differently. Eventually the frameworks got too big to share with my wife. She would not have read them, and I could not have pointed her at one piece without dragging in twenty others.

So I broke them apart. One decision per file. One question, one answer. Published online so we could both reach them from any project, and so the agent could fetch only what the current task needed. That is the atomic guides. Around 1,600 of them now, across 88 topics, with routing metadata that lets the agent decide which one to read for which question.

That worked, until I noticed the AI was missing pieces. Not in the small guides. In the structured ones, the ones with sequences and decisions. When you ask the AI to read a guide via WebFetch, the content gets summarized on the way in. Some steps survive. Some get described in vaguer language. Some get dropped. The agent does not know which is which.

So I forced curl. Bytes in, bytes read. No summarization layer between the agent and the content. The skill that fetches my guides is built around this rule, and three different places in its prose remind the agent why curl is mandatory. The rule is enforced by the skill, not by a hook, but the skill is invoked on every fetch, so in practice it holds.

Design, implementation, and a lot of review

After scope and research came design and implementation. The patterns here are well-trodden. Phase the work. Set acceptance criteria before writing. Test first when the test is cheaper than the code it is checking. Ask the human at each step that is hard to reverse. Nothing original. The win is consistency. The AI does not do this on its own unless I make the workflow visible, so I made it visible.

Then I added review. Seven validators, each running against the diff and writing an audit. TDD checks tests came first. SOLID and DRY catch the structural drift. Security scans for the mistake classes the AI is good at making and humans are good at missing. The guides validator checks the work against the atomic guides cited in design. Visual regression and visual parity catch the rendered-output drift the other gates would miss. I added them because passing tests and good code are not the same thing, and I have shipped enough clean-looking diffs with hidden problems to know the difference.

Opinions, and the playbook

Then I realized I needed opinions in a form the framework could carry. Some opinions are rules. Use drush commands, not raw PHP, when you need to do something to Drupal from the command line. Use Composer in the right order when you remove a module. Mobile-first breakpoints with sizes-based responsive images for content body, breakpoint-based for art-directed hero. Rules. One rule, applied across many contexts.

I called this layer the playbook, at the project level. Local rules always win on conflict. Published sets you can subscribe to for the patterns you keep using across projects. That worked. The agent stopped reaching for raw PHP when drush was the right tool, and stopped picking breakpoint-based responsive images for body content where sizes-based was the cleaner answer.

The wall

Working on the biggest tool I am still building, the one that takes a brand definition and walks all the way to an implemented app, I hit a wall I had to name.

Use drush is a playbook instruction. It is a rule about how to do a class of things in this project when I am using Drupal. That shape is fine. The playbook holds it well.

But how to wire responsive images is not a rule. It is directing the orchestration of a specific goal in Drupal with AI. The first is a single instruction, applied widely. The second is a plan for a named capability, applied once, end to end, with project-specific choices baked into the middle of it. Both are opinions. They are not the same shape.

I had no artifact for the second one. The playbook covers pieces. There is even an entry called responsive-image-sizing-per-context, which is a real rule that applies in a real way. But the end-to-end orchestration of wire-responsive-images-for-this-project lives in chat threads, where I walk the agent through the project's image strategy by hand. 16:9 at full width for a hero. 16:9 in a card, same ratio but a different image style because the rendered size is different. 4:3 portrait somewhere else. Every project has its own strategy, and the agent has to translate it into image styles, breakpoints, and field display assignments per view mode per content type. I keep saying roughly the same sequence with slightly different wording, and the agent keeps doing roughly the same thing with slightly different quality.

The same gap shows up in other places. Drupal has a declarative SEO recipe that installs the modules and sets reasonable defaults, which works well on projects where the defaults match what you need. But on a project where the team wants separate fields for metatag, Open Graph, and Twitter cards per content type, the declarative recipe cannot make that decision for you. Something has to direct the orchestration for that project's specific shape. A Next.js front-end wired to a Drupal back-end is the same story. Atomic guides cover JSON:API, decoupled menus, content routing, and the end-to-end procedure with this project's choices has no artifact home. The wall is not specific to images. It is the orchestration shape itself.

Recipes

Hence recipes. Not a guide, because guides are atomic and a recipe carries orchestration over multiple atoms. Not a playbook entry, because that is a single rule, and an orchestration is by definition more than one decision. Not a skill, because a skill is something the AI installs, sitting in the agent's front-matter for every session, whether this project needs responsive image wiring or not. A recipe is something the agent reads when this project needs this capability, and skips otherwise.

The mental model is straight. The first ten lines describe the feature, like a skill's frontmatter, so the agent can read just that and decide whether to keep going. Roughly:

---

recipe: responsive_image_wiring

describes: Wire Drupal responsive image styles, breakpoints, and field display modes from declared image use-cases per content type.

applies_when: project has image fields rendered across multiple breakpoints, art direction or resolution switching, or both.

requires: image, responsive_image, breakpoint

produces: image styles, responsive image styles, field display config per view mode per content type

---

Below that header, the body. The opinion (how we do it, what we refuse to do). The sequence of steps, each citing its atomic source so the agent fetches the decision rather than guessing it. The data flow from the declared inputs to the applied Drupal state. The repetition pattern (once, per content type, per view mode). The contract for what state the recipe reads before it acts. References, with the curl rule honored, so the agent reads bytes and not summaries.

Load on demand. Not installed. Updated when the modules and core the recipe sits on move, because I have been refining my atomic guides by hand long enough to know the same maintenance applies one layer up. I am wiring the update automation into my own setup right now, but the format is what matters. The format has to allow that automation for anyone who wants to build it, not depend on any one person owning it.

I do this in Drupal because Drupal is my community. The pattern is the same anywhere there is a stable capability layer above atomic APIs. Next.js. Rails. Design systems. Anywhere the orchestration of a named feature is repeatable but the choices inside it are project-specific.

I am sharing this to see if it resonates. I built each layer of my tooling because something was breaking when I did not have it, and recipes are the latest piece in that sequence. Orchestration plans for named capabilities. Loaded on demand. Not installed. I would like to know whether other people running AI on real projects are hitting the same wall, the one where you can feel the difference between a rule and an orchestration but you have no artifact to hold the second one. If you are hitting it, I would like to hear from you.

Author
Abstract
I built my AI tooling one layer at a time, each piece added because something was breaking when I did not have it: scope, atomic guides, the curl rule, validators, the playbook. Working on the biggest tool I am still building, I hit a wall I had to name. Use drush is a rule. Wire responsive images for this project is an orchestration. Both are opinions, but they are not the same artifact shape. This post walks that journey to the layer I think is missing, and asks whether other people building AI tooling on real projects feel the same gap.
Rating
No votes yet

Add new comment

28 May 2026 5:22pm GMT

Smartbees: Custom Autenti Integration for WooCommerce

See how we seamlessly integrated WooCommerce with the Autenti system without affecting the checkout process.

28 May 2026 12:04pm GMT

01 Apr 2004

feedPlanet PHP

ezSystems are classy folks

cover
Last week I helped the folks at ezSystems debug some APC problems they were having. The problems ended up being a 64bit architecture problem (they have uber-fast Opterons) and the bug is now fixed in 2.0.3.

Today I received Python & XML from them (off my Amazon wishlist). Thanks guys!

On a side note, my wishlist seems borked. The list I get when I search on my email address or name is not the same one I can edit when I log into the site.

01 Apr 2004 6:53pm GMT

PHP april fools...

1st of April 2004 get's to it's end and I guess it's time, to summarize the recent April fools a bit. Not that I think anyone in the world believes in them, but some were quite funny:

1. Changes to case sensitivity in PHP.
Alan Knowles announced that PHP will change to the studlyCase API and therefor will get everything broken by changing established functions.

2. IBM takes over Zend.
Myself hacked a little article about IBM taking over Zend to make PHP a compete of Java.

3. The first PHP virus has been seen.
Wasn't there one last year, too?

4. PHP has been overtaken by Micro$oft.
Mhhh... a little bit unreliable, if they had been taken over by IBM this morning... Maybe one should first look, what others wrote...

5. And finally, PHP4 and 5 showed their real faces...
Take a look at a phpinfo() output!

I guess I missed some, so feel free to comment on this entry, if you found another!

01 Apr 2004 5:49pm GMT

PHP Virus Attacking Web Hosts

Symantec have a report of the virus here. I've yet to see any of the PHP news sites picking up on it but, using a virtual host account, managed to deliberately expose some PHP scripts to it. From examining the infected scripts, what's disturbing is once infected, every tim...

01 Apr 2004 12:19pm GMT