The development prompt.

# ICOM Framework — development prompt

Build and deploy an original, understandable PHP framework at framework.icom.la. Target the ease of writing a small Laravel application, explicit modular architecture associated with Symfony, a request lifecycle compatible with persistent PHP workers, practical security defaults, and portable deployments. Treat superiority as a hypothesis to measure, never as a release claim.

## Deliverable

Ship a usable, MIT-licensed 0.1 developer preview with source, Composer installation, a command-line entry point, complete local documentation, a live API playground, regression tests and reproducible benchmark commands. Require PHP 8.4+. Preserve unrelated hosting data. Deploy only public entry points and assets under the subdomain document root; store application source and secrets outside it. Use HTTPS and production error handling.

## Architecture and behavior

- Use PSR-4 autoloading, PSR-7 requests/responses, PSR-15 middleware, PSR-11 dependency injection, PSR-3 logging and PSR-16 cache interfaces. Use maintained interface/HTTP-message packages; do not reinvent these standards or vendor modified third-party source.
- Provide fluent method routing, named parameters, names/URL generation, route-specific middleware, HEAD/OPTIONS/405 semantics, and a request-bound service container. No global mutable application facade. Detect circular dependencies and disallow singleton capture of scoped services.
- Resolve typed controller dependencies and request parameters explicitly. Isolate each request container and release it in finally blocks. Include guarded FrankenPHP and Swoole adapters; document experimental status and runtime restrictions honestly.
- Provide deterministic validation with field-level errors and rejection of unknown rules; escaped PHP views; PDO prepared queries, identifier-safe query builder, transactions and a migration command; a file cache with TTL and atomic writes; a locked rate limiter with Retry-After.
- Apply CSP, nosniff, referrer and framing controls, unique request IDs, structured logs, generic production error responses, body-size limits, strict host validation and a signed expiring CSRF double-submit cookie for the browser demo. Never trust forwarded client addresses by default. Use password_hash/password_verify and libsodium authenticated encryption helpers. No default user, password or exposed administration console.
- Include environment/configuration loading without executable configuration from users. Keep credentials and logs out of public output, downloadable distributions and version control.
- Provide liveness/readiness routes, graceful bounded worker loops, Docker/FrankenPHP and Kubernetes deployment examples, CI tests, and rollback instructions. Mark examples not exercised on hosting as unverified.

## Developer experience

Use the brand ICOM Framework. Build a restrained, accessible documentation interface with an overview, installation, routing, container, middleware, validation, database, cache, security, runtime, testing and the full development prompt. Include a working playground for a GET greeting and CSRF-protected POST validation, with response status, timing, JSON output and curl examples. Make the source archive and its SHA-256 digest downloadable. Avoid fictional Packagist/GitHub URLs or fabricated performance numbers.

## Verification and release gates

Test route ordering/methods, route URL encoding, request injection, container scope isolation and captive dependency rejection, middleware ordering, validation edge cases, SQL parameterization and identifier injection, cache expiry/corruption, concurrent rate limiting, authenticated-encryption tampering, CSRF tampering/expiry, error redaction and repeated requests through one application instance. Test actual production HTTP routes, headers, CSRF positive/negative cases, hidden-file protection and TLS. Browser-test desktop and mobile, navigation, copy controls and both playground requests. Run composer validate/audit and PHP lint. Record real measurements with workload/runtime/machine details; do not compare against Laravel/Symfony without running equivalent applications under equal conditions.

## Release boundaries and further work

A 0.1 preview is not an enterprise certification, a replacement for the Laravel/Symfony ecosystems, or a proven throughput improvement. Queues, ORM, distributed cache, OIDC/SAML, full authentication product, distributed tracing exporters and production worker soak tests need subsequent releases. Provide interfaces and extension documentation where useful, but never present stubs as completed features.

## Source references checked 2026-09-10

- Laravel 13 release notes (PHP 8.3+): https://laravel.com/framework/docs/releases
- Symfony 8.1 current release (PHP 8.4+): https://symfony.com/releases/8.1
- FrankenPHP worker state/reset requirements: https://github.com/php/frankenphp/blob/main/docs/worker.md
- PHP-FIG standards: https://www.php-fig.org/psr/