Is Moodle HQ keeping up with how software gets built now?

Two things changed for Moodle developers over the last three years. Moodle’s core got a serious architectural overhaul. And the way the rest of the industry writes software moved to AI agents that read docs, run tests and open pull requests on their own.

Moodle HQ has handled the first change well. The second is more mixed, and the gap is mostly in what HQ publishes for outside developers, not in what it does internally.

Where Moodle came from

Moodle 1.0 shipped on 20 August 2002. Moodle 2.0 followed on 24 November 2010, and its release notes describe “a lot of large new features, some completely rewritten features”.¹1 Moodle HQ, Releases; MoodleDocs, Moodle 2.0 release notes. Moodle 2.9 (May 2015) brought AMD JavaScript modules and Mustache templates,²2 THE Journal, Moodle Gets Redesigned Navigation, User Interface Upgrade (May 2015); Moodle HQ, JavaScript Modules. the frontend stack most plugins still use. Moodle 4.0 (April 2022) reworked the interface around a course index and new menus.¹

Each of those was a big step. None of them changed the basic shape of the PHP side: global functions in lib.php, callbacks found by naming convention, and a web root that held everything. That is what the last few releases have been taking apart.

Where the architecture is heading

Look at the 4.3 to 5.3 releases together and a pattern shows. Moodle is adopting the PHP-FIG standards (the PSR interfaces that Symfony and Laravel code is built around) one subsystem at a time.

Hooks (4.3). The Hooks API is “a replacement for some of the lib.php based one-to-many plugin callbacks”, built on the PSR-14 event dispatcher standard.³3 Moodle HQ, Hooks API. Before, core found plugin code by looking for functions with magic names. Now a plugin registers a listener for a typed hook object. That is easier to read, easier to test and much easier for tools to find. Moodle 4.4 then converted more callbacks and let hooks be declared with PHP attributes.⁴4 Moodle HQ, release notes for 4.4, 4.5, 5.1, 5.2 and 5.3.

Dependency injection (4.4). Moodle added a PSR-11 container that “internally makes use of PHP-DI”.⁵5 Moodle HQ, Dependency Injection. Classes can ask for their dependencies in the constructor, and tests can swap in a mock. Moodle 5.3 added container injection through attributes (MDL-89528).⁴

Routing (4.5, then 5.1). The routing docs describe “a powerful routing system based upon the Slim Framework, and FastRoute”, with routes declared as attributes and PSR-7 requests and responses.⁶6 Moodle HQ, Routing. The 4.5 release notes list the “Initial implementation of the Routing system” (MDL-81031), and 5.1 shipped it as an engine for cleaner URLs, recommended but not required.⁴

The /public web root (5.1). MDL-83424 moved web-accessible files into a public folder. The tracker issue explains why: it opens the way to “moving third-party library installation to a deploy phase”, moving Node build steps to deploy time, and “options to migrate to a frontend framework in the future”.⁷7 Moodle Tracker, MDL-83424: Restructure Moodle code directories. We covered the upgrade side in our Moodle 5 post.

Composer (5.2). MDL-87950 started providing third-party libraries through Composer. The issue calls this a blocker for OpenTelemetry work, wants “a single source of truth” for versions, and says HQ plans to “properly mandate the use of Composer in 6.0”.⁸8 Moodle Tracker, MDL-87950: Provide third-party libraries via Composer. Moodle 5.3 added Symfony Console support for CLI commands (MDL-85847).⁴

Frontend (5.2, 5.3). React, TypeScript, ES modules and the Moodle Design System landed in 5.2. We wrote a separate post on that, so we won’t repeat it here.

PHP floor. Moodle 4.4 required PHP 8.1, 5.0 required 8.2, and 5.2 requires 8.3.⁴ The PHP side of that story is mostly about security.

AI subsystem (4.5 onward). Moodle’s AI subsystem splits AI into placements (“the UI components and associated workflows that allow users to interact with AI”), providers (“the interface between AI systems and the Moodle LMS”), actions and a manager. Its “Golden Rule” is that placements and providers never talk to each other directly.⁹9 Moodle HQ, AI subsystem. Providers have been added every release since: OpenAI and Azure in 4.5, Ollama in 5.0, DeepSeek in 5.1, Bedrock and Gemini in 5.2, Anthropic Claude in 5.3.⁴ This is AI as a product feature for teachers and students. It is not tooling for developers.

Our reading of all this, not HQ’s wording: Moodle core is turning into a framework that looks like modern PHP. Someone who knows Symfony or Laravel can now read a Moodle 5.3 router, container or hook and recognise it. That matters for people, and it matters even more for AI models, which have seen far more Symfony-shaped code than Moodle-shaped code.

What the AI-era terms actually mean

Several phrases get thrown around in 2026. Here is what each one means in its sources.

• Vibe coding. Andrej Karpathy, 2 February 2025: “There’s a new kind of coding I call ‘vibe coding’, where you fully give in to the vibes”. He described accepting changes without reading the diffs.¹⁰10 American Dialect Society mailing list, Word: vibecoding, vibe coding, quoting Karpathy’s post of 2 February 2025. It describes throwaway work, not production plugins.
• Agentic coding. No single author. One glossary defines it as “a development workflow where an autonomous AI agent reads, edits, and executes code with limited human supervision”.¹¹11 PromptLayer, Agentic coding (glossary). Mitchell Hashimoto’s plain definition of the underlying idea: “An agent is the industry-adopted term for an LLM that can chat and invoke external behavior in a loop.”¹²12 Mitchell Hashimoto, My AI Adoption Journey (5 February 2026).
• Context engineering. Shopify’s Tobi Lütke called it “the art of providing all the context for the task to be plausibly solvable by the LLM”, and Karpathy described it as “filling the context window with just the right information” (June 2025).¹³13 Simon Willison, Context engineering (27 June 2025), quoting Tobi Lütke and Andrej Karpathy.
• Harness engineering. Hashimoto, 5 February 2026: “anytime you find an agent makes a mistake, you take the time to engineer a solution such that the agent never makes that mistake again”. His examples are an AGENTS.md file and scripts that tell the agent when it is wrong.¹²
• Loop engineering. Addy Osmani, 8 June 2026: “Loop engineering is replacing yourself as the person who prompts the agent.”¹⁴14 Addy Osmani, Loop Engineering (8 June 2026); arXiv, Loop Engineering: Building Blocks, Adoption, and Impact (August 2026). An August 2026 arXiv paper dates the term to practitioners in June 2026.¹⁴
• Graph engineering. Used since mid-2026 for multi-agent workflows drawn as explicit graphs of agents, checks and human approvals.¹⁵15 arXiv, Graph Engineering in the Era of LLM Agents (August 2026); PALO IT, Beyond the Harness: Making Sense of Loop and Graph Engineering (undated, 2026). Usage is loose and the definitions vary.
• Route engineering. We found no real usage of this phrase. Routing between models exists as a technique, but “route engineering” is not an established term.

Strip away the names and every one of these says the same thing. An agent does good work when it can find accurate context fast and when something quick and automatic tells it when it is wrong. Anthropic’s own Claude Code guidance puts it as “give it a check to run”.¹⁶16 Anthropic, Best practices for Claude Code. So the useful question for Moodle is how well it supplies those two things.

The scorecard

Where Moodle is ahead

Conventions. Moodle has a strict, documented coding style and fixed places for every file: strings, capabilities, database upgrades, privacy providers.¹⁷17 Moodle HQ, Coding style. A code checker enforces the style. Agents do well with rigid conventions.

Plugin CI. moodle-plugin-ci runs PHP lint, the code checker, PHPDoc checks, mess detection, copy-paste detection, savepoint checks, Mustache and Grunt checks, PHPUnit and Behat in one tool, and it is still actively released (4.5.11 in August 2026).¹⁸18 Moodle HQ, moodle-plugin-ci commands and releases; Moodle, moodle/moodle repository. For an agent, this is a ready-made “check to run”.

Docs as code. The developer docs live as Markdown in moodle/devdocs, versioned per release.¹⁹19 Moodle, moodle/devdocs. An agent can clone them and search the 5.3 version directly.

Faster tests are coming. MDL-88495, fixed in 5.3, lets PHPUnit databases be snapshotted and upgraded. The issue reports local setup going “from around 2 minutes to having unit tests ready to under 5 seconds”, and Catalyst’s plugin runs dropping from 4 to 5 minutes to 45 seconds.²⁰20 Moodle Tracker, MDL-88495: Support being able to snapshot and upgrade PHPUnit databases. Agents run tests many times per task, so this one change helps a lot.

HQ does use AI tools internally. The moodlehq/design-system repo has had a .claude/CLAUDE.md and Copilot instruction files since March 2026, with a rule to “Prefer ZeroHeight MCP” for design guidance.²¹21 Moodle HQ, design-system CLAUDE.md and copilot-instructions.md. The Moodle App repo has Copilot instructions, and a tracker issue opened in February 2026 aims to “Investigate and decide our approach for AI and agentic development” for the app.²²22 Moodle HQ, moodleapp copilot-instructions.md; Moodle Tracker, MOBILE-5004: Add context to copilot reviews and MOBILE-5007: AI agentic development support and tools.

Where Moodle lags

Nothing for agents in core. moodle/moodle has no AGENTS.md or equivalent, and its CONTRIBUTING.md says nothing about AI.²³23 Moodle, CONTRIBUTING.md. The newer repos got instruction files. The repo plugin developers actually work against did not. Requesting moodledev.io/llms.txt returns a 404 as of 28 October 2026.²⁴24 Moodle HQ, moodledev.io/llms.txt (404 when checked on 28 October 2026). A tracker search for “llms.txt” returns no issues.

No official static analysis. Core has no PHPStan configuration and moodle-plugin-ci has no PHPStan command.¹⁸ The community fills the gap with phpstan-moodle, and one community toolkit defaults it to level 2 because higher levels drown in stdClass and mixed noise.²⁵25 GitHub, micaherne/phpstan-moodle; jeanlucio, moodle-dev-tools. For agents this matters more than for people: a type checker is the cheapest way to catch a call to a method that does not exist.

Flaky browser tests. HQ maintains a list of flaky Behat scenarios and a script that tags them @skip in CI.²⁶26 Moodle HQ, moodle-skip-tag-injector. That is a sensible fix for HQ’s pipeline. It also tells you that a failing Behat run is not always a real failure, which is exactly the signal an agent cannot judge.

Scaffolding and AI help sit outside HQ. tool_pluginskel’s latest release, 1.8.0, came in February 2026 from a personal GitHub account, not moodlehq.²⁷27 GitHub, moodle-tool_pluginskel. The most visible Moodle toolkit for coding agents is community-built: a Claude Code plugin with skills for XMLDB, hooks, PHPUnit, Behat and privacy.²⁸28 GitHub, SaadRahman01/claude-moodle-dev; Moodle HQ, Developer meeting, January 2025. A January 2025 developer meeting included a community talk inviting developers into research on LLMs and Moodle development.²⁸ Compare WordPress, whose official WordPress/agent-skills repo appeared in January 2026, alongside AI contribution guidelines that say “You are responsible for your contributions” and ask for disclosure of “meaningful AI assistance”.²⁹29 WordPress, AI Guidelines for WordPress (1 February 2026) and WordPress/agent-skills. Laravel Boost installs an MCP server, guideline files and skills with one command.³⁰30 Laravel, Laravel Boost. Symfony documents Mate, a “CLI that gives coding agents project-aware tools for your application”.³¹31 Symfony, Symfony AI documentation. Drupal has a proposed AI contribution policy under discussion.³²32 Drupal, Proposed guidelines for AI contribution.

Three things that would help most

1. An AGENTS.md in moodle/moodle and an llms.txt on moodledev.io. HQ already writes these for its own React repo. One for core, covering the public/ layout, hooks over callbacks, the DI container and the testing commands, would target the most common mistake we fix when agents write Moodle code in our own work: patterns copied from older releases, because most Moodle code online predates these changes.
2. An official PHPStan baseline and a phpstan command in moodle-plugin-ci. With a PHP 8.3 floor and a typed DI container, the conditions exist. Even a low level with a published baseline would give every plugin a fast, deterministic check.
3. A short AI contribution rule. WordPress’s version fits on one page. Accountability, disclosure and review expectations would help reviewers on the tracker, and would tell plugin authors what HQ expects.

None of this is expensive next to what HQ has already done with routing, DI and Composer.

Why this matters to us

We build Moodle plugins with AI agents, and a senior engineer reviews every change. The gaps above are what we work around every day: we write our own agent instructions, run our own static analysis and lean hard on moodle-plugin-ci, because Moodle doesn’t ship those pieces yet.