Source: app.php

Bounded candidate reference — 2026-10-20: 0.2.0-rc.1 is committed locally through 84f415b3098af5653577b2c65eea31fca21df79c, unpublished and not production-approved; stable PHP >=8.5.11 <8.6.0 is required. This is documentation, not adoption: this knowledge base retains its installed 0.1.0-rc.1 dependency and PHP 8.2.11 local profile. Dated PHP 8.2 evidence is historical; earlier dirty-source reports retain their original test provenance, not retroactive clean-commit proof. Candidate examples are illustrative: API signatures were reviewed, but candidate code was not executed by this editorial update. See current checkpoint, open criteria and adoption boundary.

Origin: examples/reading-list/public/app.php

<?php

declare(strict_types=1);

use Clean\Framework\Config\EnvironmentSource;
use Clean\Framework\Config\Loader;
use Clean\Framework\Http\Request;
use Clean\Framework\Http\RequestLimits;
use Clean\Framework\Http\TrustedProxyPolicy;

$frontBufferLevel = ob_get_level();
ob_start();

/* Close all buffers above the front-controller boundary without retaining data. */
$discardOutput = static function (int $bufferLevel): int {
    $bytes = 0;
    while (ob_get_level() > $bufferLevel) {
        $contents = ob_get_clean();
        if (is_string($contents)) {
            $bytes += strlen($contents);
        }
    }
    return $bytes;
};

try {
    $root = dirname(__DIR__);
    $autoload = $root . '/vendor/autoload.php';
    if (!is_readable($autoload)) {
        throw new RuntimeException('Composer dependencies are unavailable.');
    }
    require $autoload;

    $loader = new Loader(EnvironmentSource::fromRuntime($root . '/.env'));
    $schema = require $root . '/config/schema.php';
    $config = $loader->load($root . '/config/app.php', $root . '/config/environments', [
        'app.name' => ['APP_NAME', 'string'],
        'app.version' => ['APP_VERSION', 'string'],
        'app.release_id' => ['APP_RELEASE_ID', 'string'],
        'app.url' => ['APP_URL', 'string'],
        'app.timezone' => ['APP_TIMEZONE', 'string'],
        'app.debug' => ['APP_DEBUG', 'bool'],
        'http.base_path' => ['APP_BASE_PATH', 'string'],
        'http.canonical_path_mode' => ['HTTP_CANONICAL_PATH_MODE', 'string'],
        'http.trusted_proxies' => ['TRUSTED_PROXIES', 'string'],
        'http.max_body_bytes' => ['HTTP_MAX_BODY_BYTES', 'int'],
        'http.max_files' => ['HTTP_MAX_FILES', 'int'],
        'http.max_upload_bytes' => ['HTTP_MAX_UPLOAD_BYTES', 'int'],
        'http.json_depth' => ['HTTP_JSON_DEPTH', 'int'],
    ], schema: $schema);

    date_default_timezone_set((string) $config->get('app.timezone'));
    error_reporting(E_ALL);
    ini_set('display_errors', $config->get('app.display_errors', false) ? '1' : '0');
    ini_set('log_errors', $config->get('app.log_errors', true) ? '1' : '0');

    $compose = require $root . '/bootstrap.php';
    $kernel = $compose($config, $root);
    $trustedProxyNetworks = array_values(array_filter(array_map(
        'trim',
        explode(',', (string) $config->get('http.trusted_proxies', ''))
    )));
    $request = Request::fromGlobals(
        trustedProxies: new TrustedProxyPolicy($trustedProxyNetworks),
        limits: new RequestLimits(
            (int) $config->get('http.max_body_bytes'),
            (int) $config->get('http.max_files'),
            (int) $config->get('http.max_upload_bytes'),
            (int) $config->get('http.json_depth')
        ),
        basePath: (string) $config->get('http.base_path', '')
    );
    $response = $kernel->handle($request);
    $unexpectedBytes = $discardOutput($frontBufferLevel);
    if ($unexpectedBytes > 0) {
        throw new RuntimeException(sprintf(
            'Application bootstrap emitted %d unexpected byte(s).',
            $unexpectedBytes
        ));
    }
    $response->send();
    $kernel->terminate($request, $response);
} catch (Throwable $exception) {
    $discardOutput($frontBufferLevel);
    $reference = bin2hex(random_bytes(8));
    error_log(sprintf(
        '[reading-list-front] reference=%s exception=%s file=%s line=%d',
        $reference,
        $exception::class,
        basename($exception->getFile()),
        $exception->getLine()
    ));
    // Pre-kernel request-limit failures retain their status; unexpected startup details stay opaque.
    http_response_code($exception instanceof \Clean\Framework\Error\HttpException ? $exception->status() : 500);
    header('Content-Type: text/plain; charset=UTF-8');
    header('Cache-Control: no-store');
    header('X-Content-Type-Options: nosniff');
    echo 'The application could not start. Reference: ' . $reference;
}

Editorial provenance

Source: examples/reading-list/public/app.php. Source SHA-256: 5fa8f5e71e747d00ac208a4bdc7704b76d7afde7ac0a5affb5dfc02854d09db3.

Framework candidate reference; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.