Inspection report · Form CR-82 · filed 2026-10-28
82 Wayne State applications read against CREED on 2026-10-28: 14 passed, 43 flagged.
Every version an app declares or locks (its PHP floor, its Laravel, Vue and Inertia, the PHP image it runs on) went through Policy::stateOf. 109 facts, 109 answers, no exceptions other than the one the reader is built to raise. The other 25 apps carry no version CREED can read.
Section 1 · The tally
Eighty-two apps, one stamp each
An app passes when every one of its facts is Active or Security. It is flagged when one fact is past end of life and grace, or older than every line the policy lists. The tool is on trial here, not the app: the proof fails only on tool errors.
- 14Passedevery fact Active or Security
- 43Flaggeda fact past grace, or older than any line CREED lists
- 0Tool errorsno crash, no unexpected exception
- 25Not applicableno require.php, no lock, no known image
82 applications, one square each: 14 passed, 43 flagged, 0 tool errors, 25 not applicable.
One square per application, in the order of its anonymous id. The apps are not named here: this repository is public, and which app runs what is the owners' business.
Section 2 · The facts
109 facts, every one answered
A fact is one version from one source. The reader resolves a full version (8.3.12) to its policy line (8.3) and answers its state on the run date. A version older than every line the policy lists gets the documented refusal, never a guess.
| Component | Active | Security | Past grace | Older than the policy lists | Facts |
|---|---|---|---|---|---|
| PHP | 12 | 14 | 13 | 44 | 83 |
| Laravel | 2 | 2 | 5 | 8 | 17 |
| Vue | 5 | 0 | 0 | 0 | 5 |
| Inertia | 0 | 0 | 0 | 4 | 4 |
| All | 19 | 16 | 18 | 56 | 109 |
Where the facts came from
What the run taught CREED
More than half the facts (56 of 109) are versions older than any line the policy lists: PHP before 8.1, Laravel before 10, Inertia 1. The reader refuses them by design, and the proof counts that as working. A fleet report needs one more answer, though: "older than anything we list is past end of life". That change is queued for CREED, with its own tests, before the next tag.
Section 3 · Repeat the inspection
Run it on your own app
The same reader, the same policy, any date you like. Install CREED, then ask it about the versions your app declares.
Install
composer require waynestate/creedAsk about one version (PHP 8.2 on the proof date)
php -r 'require "vendor/autoload.php"; $p = Waynestate\Creed\Policy::bundled(); echo $p->stateOf("php", $p->resolveVersion("php", "8.2.29"), new DateTimeImmutable("2026-10-28"))->name, PHP_EOL;'No PHP on the machine (Docker, from the app folder)
docker run --rm -v "${PWD}:/app" -w /app composer:2 composer require waynestate/creedThe proof run did this for every fact of every app, inside php:8.4-cli with no network, against a throwaway copy of each repository. Each run is logged as one line (tool commit, anonymous unit id, app commit, command, exit code, duration, outcome) in the stack's internal record.
Section 4 · Exclusions
What this does not prove
- It reads what an app declares and locks, not what a server runs today. The image facts are the image each app was recorded as deploying on 2026-10-28.
- 25 of 82 apps declare no version at all (no
require.php, no lock, no known image), so CREED has nothing to answer for them. PROCTOR fails those apps for exactly that reason. - A refusal is not a verdict. 56 facts are older than the policy lists; they are flagged, never counted as passes, until CREED learns to call them past end of life.
- Node and MySQL versions were not part of this run: few apps record them in a file CREED can read.
- The answers are for 2026-10-28. Support windows move; run it again with your own date.
Creed Bratton has never once been audited. These 82 apps have.