# ADR 0003: Thin HTTP Contracts

- Status: Accepted
- Date: 2026-08-17

## Context

The kernel needs request/response types, but applications already have their
own concrete HTTP objects (and their own security headers, session handling,
and parsing).

## Decision

The kernel defines `RequestInterface` and `ResponseInterface` with only the
surface routing needs (method, path, params) and middleware needs (headers).
Applications implement these interfaces on their own classes.

Middleware and controllers operate on the interfaces, so application code that
needs app-specific features narrows to its concrete types.

## Consequences

- The kernel stays decoupled from any one app's HTTP layer.
- Applications must implement the two interfaces (usually a small change to
  existing Request/Response classes).
- Middleware parameters use `RequestInterface`; concrete middleware may need
  an `instanceof` narrowing to access app-specific request methods.