Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@poc/spiral-emit/app/src/Endpoint/Web/Request/BreedListRequest.php`:
- Around line 7-9: The project is missing the spiral/filters dependency used by
the request DTOs (e.g., BreedListRequest implementing
Spiral\Filters\Model\FilterInterface and five other request classes); update
composer.json by adding "spiral/filters": "^3.16.2" to the require section and
then run composer install (or composer update) to pull the package so the
FilterInterface is available at runtime.

In
`@poc/spiral-emit/app/src/Modules/OPSpiral/Endpoints/Console/OPInstructionEmitCommand.php`:
- Line 16: Replace the JSON emission in OPInstructionEmitCommand so the CLI
outputs YAML per the feature contract: locate the line using
$this->info(json_encode($emitter->emit())); and change it to emit YAML (for
example using Symfony\Component\Yaml\Yaml::dump($emitter->emit()) or PHP's
yaml_emit) and pass the resulting YAML string to $this->info(); ensure the
emitter->emit() result is serialized to YAML rather than JSON.

In
`@poc/spiral-emit/app/src/Modules/OPSpiral/Endpoints/Web/OPInstructionEmitRoute.php`:
- Around line 14-15: The /op/instruction endpoint
(OPInstructionEmitRoute::__invoke) currently returns full instruction payload to
unauthenticated callers; restrict access by adding an authorization check or
environment gate at the top of __invoke: inject/use the framework's security
service (e.g., AuthorizationChecker or Security) and call
isGranted('ROLE_ADMIN') (or check kernel.environment !== 'prod' if you want
non-production only) and return a 403/forbidden Response via ResponseWrapper
when the check fails. Ensure the guard runs before using InstructionEmitter so
unauthenticated/unauthorized callers never receive the payload.

In
`@poc/spiral-emit/app/src/Modules/OPSpiral/Infrastructure/Internal/Reflection/DocBlockSummaryReader.php`:
- Around line 22-25: Wrap the DocBlockFactory::create($v) call in a try/catch
that catches InvalidArgumentException so parsing errors do not bubble up; if
create() throws, log or ignore the exception and return an empty string (or a
safe fallback) instead of letting the exception crash RouteParser::parse();
modify the block around DocBlockFactory::createInstance() /
DocBlockFactory::create() in DocBlockSummaryReader.php to return a safe fallback
when catching InvalidArgumentException.

In
`@poc/spiral-emit/app/src/Modules/OPSpiral/Infrastructure/SerializableInstruction.php`:
- Around line 32-36: The code in SerializableInstruction uses json_encode() and
json_decode() without error handling which can return false and cause a
TypeError; update the JSON normalization in the method to call
json_encode($vars, JSON_THROW_ON_ERROR) and json_decode($json, true, 512,
JSON_THROW_ON_ERROR) inside a try/catch(JsonException) block, and in the catch
either rethrow a clearer exception or handle/log the error before
returning/throwing so that recursiveNullFilter($assoc) is only called with a
valid array; reference the SerializableInstruction method where $json and $assoc
are produced and the recursiveNullFilter() call.
- Around line 13-21: The __toString() method currently calls toYaml() which uses
Yaml::dump(...) with DUMP_EXCEPTION_ON_INVALID_TYPE and may throw, so wrap the
call to toYaml() inside a try/catch in SerializableInstruction::__toString(); on
exception return a safe fallback string (e.g. empty string or a JSON-encoded
safe representation from toAssoc()) and optionally log the error. Ensure you do
not change toYaml() behavior (keep Yaml::dump flags) but prevent any exception
from propagating out of __toString() by catching \Throwable and returning the
fallback.

In
`@poc/spiral-emit/app/src/Modules/OPSpiral/Infrastructure/Web/Internal/RouteParser.php`:
- Around line 31-35: The parse() method in RouteParser.php assumes
$route->getTarget() is an Action and directly reads 'controller'/'action' and
constructs a ReflectionMethod, which will throw for other target types; add a
runtime type check to ensure the target is an instance of Action (or handle
other supported target types) before calling
$this->propertyReader->read($target, 'controller') and
$this->propertyReader->read($target, 'action'), and skip or appropriately
process non-Action targets so ReflectionMethod is only constructed for valid
controller/action pairs; update parse() to branch on instanceof Action (or the
relevant target classes) around the $target, $controller, $action, and
ReflectionMethod usage.

In `@poc/spiral-emit/composer.json`:
- Around line 15-29: The package phpdocumentor/reflection-docblock is needed at
runtime (DocBlockSummaryReader used by RouteParser), so move
"phpdocumentor/reflection-docblock" from require-dev into the top-level
"require" section of composer.json; update composer.json dependencies
accordingly so that DocBlockFactory::createInstance() and DocBlockSummaryReader
are available in production installs (ensure you add the package entry to the
require block and remove it from require-dev to avoid duplication).

In `@poc/spiral-emit/Taskfile.yml`:
- Line 40: The Taskfile task is validating against a live URL; replace the
remote schema URL with a pinned local schema file committed to the repo (e.g.
add a versioned file like schemas/instruction.v1.json), update the Taskfile.yml
command that runs "task emit ... | check-jsonschema --schemafile ..." to point
to that local path instead of
https://thumbrise.github.io/op/reference/instruction.v1.json, and commit the
schema so CI uses the deterministic, versioned local copy; ensure the local
filename matches the version used in the Taskfile (instruction.v1.json) and
update any README/atlas docs if they reference the remote URL.

---

Nitpick comments:
In `@poc/spiral-emit/Taskfile.yml`:
- Line 40: The current pipeline hides emitter stderr by redirecting "task emit"
with "2>/dev/null"; update the Taskfile entry that runs "task emit | tee
/dev/stderr | check-jsonschema --schemafile
https://thumbrise.github.io/op/reference/instruction.v1.json -" to stop
discarding stderr (remove "2>/dev/null") or make the stderr suppression
conditional (e.g., wrap the redirection behind a VERBOSE/DEBUG flag) so that
emitter diagnostics from "task emit" are visible during validation and can be
turned off explicitly when needed.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@poc/spiral-emit/app/src/Modules/OPSpiral/Endpoints/Console/OPInstructionEmitCommand.php`:
- Line 16: The CLI currently calls json_encode without error handling which can
return false silently; in OPInstructionEmitCommand (the command method that
calls $this->info(json_encode($emitter->emit()))), pass JSON_THROW_ON_ERROR to
json_encode and catch JsonException so failures surface and the command returns
self::FAILURE; update the method to json_encode($emitter->emit(),
JSON_THROW_ON_ERROR) inside a try/catch catching JsonException and log the
exception (process/error output) then return self::FAILURE to fail fast.

In `@poc/spiral-emit/Taskfile.yml`:
- Line 40: The current Taskfile pipeline suppresses emit errors via the shell
redirection "2>/dev/null" which hides diagnostics from the "emit" task; update
the Taskfile (the "task emit" pipeline invocation that currently runs: task emit
2>/dev/null | tee /dev/stderr | check-jsonschema ...) to stop discarding stderr
— remove the "2>/dev/null" redirection (or instead forward stderr into the pipe
with "2>&1") so that actual emit errors (container/PHP failures) are visible to
the user and still passed through to tee and check-jsonschema for debugging.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@poc/spiral-emit/app/src/Endpoint/Web/HomeController.php`:
- Around line 48-60: The OPError metadata in HomeController::exception()
declares a Term('TestException') but the method actually throws PHP's base
Exception, so update the error contract to match the real thrown type (or change
the thrown exception to the declared type); specifically, either replace
Term('TestException', ...) with Term('Exception', ...) in the #[OPError(...)]
attribute for the exception() method, or throw new TestException('This is a test
exception.') in exception() so the #[OPError] term, Status('500'), and the
thrown exception are consistent.