System composition

CRE8 is a single PHP runtime process started from `public/index.php` that:

1. Loads env and normalizes key sources.
2. Builds typed runtime config (`RuntimeConfig`).
3. Builds DI container (`ContainerFactory`).
4. Runs startup assertions (`BootChecks`).
5. Builds Slim app + middleware + routes (`AppFactory`, `RouteRegistrar`).

Primary subsystems:

- **Bootstrap/config:** `public/index.php`, `src/Bootstrap/*`, `src/Config/*`.
- **Transport policy enforcement:** `src/Http/Middleware/*`.
- **Route orchestration:** `src/Http/Routes/RouteRegistrar.php`.
- **Domain services:** `src/Application/*/*Service.php`.
- **Security primitives:** `src/Security/*`.
- **Observability:** `src/Observability/*`.
- **UI runtime:** `public/ui/*` (no build toolchain).

Dependencies:
 "php": "^8.2",
    "slim/slim": "^4.14",
    "slim/psr7": "^1.7",
    "php-di/php-di": "^7.0",
    "firebase/php-jwt": "^6.11",
    "ext-pdo": "*",
    "ext-sodium": "*",
    "respect/validation": "^2.4",
    "vlucas/phpdotenv": "^5.6",
    "guzzlehttp/guzzle": "^7.10",
    "neomerx/cors-psr7": "^3.0",
    "monolog/monolog": "^3.9",
    "symfony/rate-limiter": "^7.3",
    "symfony/cache": "^7.3"
    
    
    
    
## Trust surfaces

- **Public:** `/`, `/health`, `/.well-known/jwks.json`, `/ui*`, auth bootstrap routes.
- **Gateway surface:** `/api/*` protected by key JWT + device header + use-key constraints.
- **Console surface:** `/console/api/*` protected by owner JWT.