One line in bootstrap.php, above Kohana::init():
require DOCROOT.'vendor/autoload.php';
That is the whole integration. Kohana keeps its modules and its underscore autoloader. Composer brings Packagist. Two autoloaders in one process, and they do not collide: Composer packages use namespaces, Kohana classes have underscores, the lookups never meet.
{
"require": {
"guzzlehttp/guzzle": "~5.0"
}
}
This setup runs in production on one of my projects for a few months. Zero problems from the autoloading side. The problems, when they came, were from me.
Because the technique is trivial and the discipline is not. My rule: Kohana code may call Composer libraries. Composer-level code never calls Kohana. One direction only. In the first week I broke it myself, a Guzzle call straight from a controller, because it was faster. It was faster for a day.
So now every library gets a door. For HTTP there is a small adapter class with my own interface, and the adapter is the only file that knows Guzzle exists. Same for the mailer. Controllers see the interface.
Two reasons for the ceremony. Tests: an adapter behind an interface is replaced by a fake in one line. And the future: if this project ever leaves Kohana, everything behind such interfaces moves for free. The migration becomes a list of adapters instead of a big bang.
In 2014 new PHP libraries live on Packagist. Kohana module repositories are where old ones stay. Start with one library and one adapter. The old module system will not be offended.