The Artisan and the Agent

I wrote this book while building MiniMailer, a Laravel SaaS, with an AI agent doing most of the typing. What came out of it is a method you can repeat: Contract, Analyze, Build, Test, Deploy. You decide what gets built and how it gets checked. The agent does the heavy lifting, inside rules it can read.

It's a field manual, not a book of advice. Every step is something you run, and every example runs as printed.

What's in it

The book follows the method in five parts, one for each phase, between an introduction and a conclusion.

• Contract. Start with the goal, then write it down where the agent can read it: steering docs, the architecture and infrastructure contracts, and the rule that the contract changes before the code does.
• Analyze. Attack your own spec before someone else does: adversarial thinking, a threat model of the design, an audit method, scanners and how to triage what they find, and hardening the infrastructure.
• Build. Turn the contract into code, with conventions the agent follows because they're written as law, Laravel Boost, the Laravel build track, and several agents working in parallel.
• Test. The testing onion, ring by ring: browser, feature, architecture and unit tests, each one catching what the others let through.
• Deploy. The pipeline as the gate, environments and promotion, the Laravel Cloud track, and the supply chain.

Six appendices close it: the prompt library with all 130 prompts, a reusable steering-doc template, a starter guidelines pack, how to create your own AI skill, Standard Webhooks implemented by hand, and parallel checkouts with git worktrees and Herd.

The ladder

The Complete Package adds the app the book is written about. Each step is a tag in it, and each tag is one decision you can read as a diff:

step-00  Pristine laravel new output: Livewire starter kit, Pest, sqlite, bun
step-01  Boost installed; .ai/guidelines is the contract
step-02  Pint: opinionated style, strict types
step-03  Rector: three configs, one per body of code
step-04  composer scripts: the agent and CI interface
step-05  Conventions: strict Eloquent (non-prod), public_id, final controllers
step-06  Record the project rules: path-scoped law in .ai/rules, one index for agents
step-07  Add the steering layer: design docs, a machine-readable index, and the agent contract
step-08  Author the API contract and serve it raw, host shape decided by config
step-09  Lay the JSON:API foundation: negotiation, strict queries, one error producer, schema registry
step-10  Wire Spectator so the contract is enforced in tests, not just published
step-11  Enforce the change hierarchy with a route-to-contract parity test
step-12  Own the security headers and publish the two well-known files
step-13  Guard outbound requests against SSRF and make API 404s carry zero information
step-14  Install Passport: personal access tokens for confidential clients, PKCE for public ones
step-15  Authorize the Laravel way: a policy per model, denials that read as not found
step-16  Send Standard Webhooks: signed deliveries, rotating secrets, spec retries, a breaker
step-17  Receive Standard Webhooks: raw-body verification, replay window, idempotent redelivery
step-18  Serve MCP over Passport: agents are API clients, tools gated by token scope
step-19  Pin the dashboard to the free tier of Flux
step-20  Take package guidance from Boost's skills rather than a hand-written copy
step-21  Complete the testing onion: arch presets, layering rules, the opt-in browser ring
step-22  Test the tests: mutation runs with covers() targets and one composer script
step-23  Discipline the test harness: frozen clocks and a fail-closed network guard
step-24  Build the docs site: guides and changelog from Markdown, the API reference from the contract
step-25  Make the pipeline the gate: quality, security and tests before any deploy
step-26  Gate promotion on shape: ops:verify-env refuses a misconfigured production boot
step-27  Close the supply chain: verified gitleaks in CI and Dependabot on every ecosystem
step-28  Let an agent with no browser claim a token: the device grant under auth.md names
step-29  Answer each failure by what it would reveal: 401, 403 and one 404
step-30  Deploy production from main, with a preview environment per pull request

How the pre-order works

1. Read the free preview. It's at the top of this page: the Introduction, the full table of contents, the ladder and three prompts from the book, 20 pages.
2. Pre-order if the book is for you. Pick The Book or The Complete Package and pay today, at the launch price.
3. Get the files on Wednesday 14 October 2026. That's release day. Nothing is downloaded at purchase: on 14 October the files appear in your downloads on Polar, with no second payment.

The launch price ends on 14 October. After that, the prices go up to the ones shown crossed out in the table, and a Team tier, five seats of the Complete Package, opens.

Prices exclude VAT, which Polar adds at checkout. Polar handles the checkout, the receipt and the downloads.

Polar is the payment provider and the merchant of record: it sells the book on my behalf, so your invoice comes from Polar and Polar takes care of the VAT.

For further questions, contact me: hello@maudev.me.