How It Works

A control point has a name (payment.charge), a domain derived from its class namespace, and a contract. The contract declares risks with their corrections (recover(): the handler's return value is the result), policies (Retry, Transaction, Breaker, composed in a fixed order), limits (within() records a slow run without failing it, attempts() caps retries, ensure() fails a run whose result is wrong), and an escalation for anything no correction covers.

Every run ends in exactly one outcome: succeeded, recovered, escalated, or refused by an open breaker. The outcome is what attempt() returns, what the events carry, what the fake records, what the log receives as one record per transition, and what the optional store keeps in a table.

Control points nest. A child carries its parent's run id, a child's escalation reaches the parent's corrections, and retries never compose across the stack. The trace id and the current point ride on Laravel's Context, so they reach queued jobs and every log line the application writes.

An inventory reads the codebase without running it: monitor:points lists every point with its contract, --check fails the build when a point has no escalation, a name is duplicated, or a class in a critical namespace is not a control point. The same rules are available as a Pest expectation and a PHPStan rule.