Request validation against the schema, in the framework

A document describing what the API accepts and a validator enforcing it are two implementations of one rule, and they diverge in the direction of the code.

// middleware, in a non-production environment
$validator = (new ValidatorBuilder())
    ->fromJsonFile('public/openapi.json')
    ->getServerRequestValidator();

$validator->validate($psrRequest);

// and the response, which is the half nobody validates
$responseValidator->validate($operation, $psrResponse);

Validating the response is where this earns its place: a document that claims a field is required and an endpoint that omits it is a bug the clients will find first. Running it in staging rather than production is the pragmatic arrangement, because the validation costs more than the request in some cases. It also removes the argument about whether the document is accurate — something checks.