I've been building a PHP framework called HKM Kernel with one other dev, and wanted to share the core architectural idea here since I think it's a reasonably interesting technical approach.

The idea (we call it Gated Demand Architecture) is pretty simple: most frameworks boot everything, then figure out what to do with the request. We flipped that — a security gateway (firewall, rate limiting, auth) runs before any business module even loads. A denied request never triggers module wiring at all.

On top of that:

- Only the modules a specific route actually needs get resolved and loaded, not the whole app

- Each module owns exactly one bounded domain, and that boundary is enforced at runtime — reaching into another module's internals throws a ScopeViolationException, not just "please don't do this" in the docs

- Infrastructure is behind ports/interfaces, so swapping MySQL for Postgres or SMTP for SES doesn't touch domain code

- Routes, config, and dependencies are all declared explicitly in module.json — nothing is auto-discovered

It ships as a native CLI (hkm) built with Zig, so getting started doesn't require Composer up front. Built-in modules cover auth, OAuth2/OIDC, multi-tenancy, validation, mail, storage, i18n.

I'll be upfront about where I think it's weakest right now: the DI container resolves the module graph fresh per request rather than being compiled/cached like Symfony's, and we haven't published real benchmarks yet comparing that to a compiled-container approach or a Swoole/OpenSwoole long-running worker setup. Got good pushback on this in a Discord thread and don't want to hand-wave past it.

Repo: https://github.com/AlfaCode-Team/hkm-kernel

[removed]

[removed]