Meet Polaris: A Complete PHP Identity Stack in One Line of Config (Part 1)

So, Did the Framework Hold Up?

That was the whole point of this exercise. Part one of the Univeros series asked whether AI agents could resurrect a dead PHP framework. This series is the honest test: could I build something genuinely hard on top of it?

I think the answer is yes, and the evidence is in the shape of the code. Polaris is fifty-two endpoints, full MFA, multi-tenant RBAC, rotating tokens with theft detection, and an audit trail, and yet every endpoint is the same readable quad. The framework's module system meant the whole thing installs in one line.

The agents helped a lot with the grind: the RFC 6238 test vectors, functional tests for fifty-two endpoints, keeping the docs in sync with code. But the design decisions (authority comes from the database, not the token; last-owner protection; fail-open breach checks) came from years of getting auth wrong and remembering the scars. The agents are fast hands. The judgment is still mine.

Where to Go Next

Pick the piece you need:

• Part 2: Logins that do not leak covers register, email verification, password login, JWT access tokens, and rotating refresh tokens with reuse detection. (coming soon)




• Part 3: Real MFA in an afternoon covers TOTP/QR, SMS, email, recovery codes, the login gate, and step-up. (coming soon)




• Part 4: One user, many orgs covers organizations, roles, permissions, the Gate, and the tenant invariants. (coming soon)




• Part 5: Bring your own providers and events covers the SMS/email/breach ports and the PSR-14 event stream. (coming soon)

The reference docs live at polaris.univeros.io. The framework is at univeros.io. The source is on GitHub.

composer require univeros/polaris

One line. A whole identity stack. The fixed star your app navigates by. See you in part 2.