Phase 2 · Code & repository setup

Get the vendor’s code into git without ever losing track of what you changed. The whole phase exists to create a clean seam between their code and your customizations, so that six months from now a vendor update is a reviewable diff — not an archaeology dig.

Phase 2 — code into git, vendor seam preserved

The MUST path. Optional enhancements (project structure, SemVer/CHANGELOG) slot in but never block the gate.

Gate

Code is in git — develop pushed, a frozen author/vX.X.X branch + author-vX.X.X tag exist on the remote, and git log --all -- .env vendor/ returns nothing.

The one rule that saves you later

CodeCanyon authors frequently patch packages inside vendor/. Treat the shipped tree as sacred until the app is verified running (local development).

Never let an agent touch vendor/ automatically

Do not rename, move, delete, or composer install over a shipped vendor/ before identifying author patches. A blind composer install overwrites those patches and can break the app irreversibly. Document any differences in _CUSTOMIZATIONS.md first.

This phase, page by page

1 · Prerequisites Verify the local toolchain, create the private repo, hosting, and databases, and wire passwordless SSH to both servers.

2 · Branch strategy Pick Option A (solo) or B (team) and learn the branch model the rest of the playbook commits against.

3 · Extract & snapshot the vendor Extract the ZIP into a verified Laravel root, back up a pristine copy, and identify author patches inside vendor/.

4 · Initialize the repository .gitignore BEFORE git init, so secrets and vendor never enter history; init on develop.

5 · Wire .env templates Back up the vendor env, lay down local/staging/production templates, generate a unique key per environment.

6 · Commit & freeze the vendor Verify the pristine baseline, push develop + author/vX + tag, and cut your working branch.

7 · Optional enhancements Project structure, commit + customization standards, SemVer + CHANGELOG — surface, don't silently skip.

Next

The frozen snapshot from this section is what makes Local development safe: you can now run composer install, build assets, and get the app booting locally, always able to diff back to author-vX.X.X.

---

These seven pages are the navigable pipeline for Code & repository setup — the full task-by-task detail, with every verification step, is distilled into them.