backend-systems-guidance

Backend Systems Guidance

This is a composable overlay, not a standalone workflow. Use alongside the repo's implementation skill when the change touches backend code.

Choose activity independently from backend depth. A review request is read-only unless the user also asks for remediation; use the architecture and reliability rules as inspection criteria and report findings instead of changing code.

This is the canonical backend overlay in this repo. It extends the thin baseline backend-guidance overlay with stronger guidance for non-trivial service boundaries, repositories, reliability, and trust boundaries.

Prefer it over backend-guidance when the task includes new endpoints or consumers, multi-layer refactors, repository or transaction work, auth or trust-boundary logic, or backend review that needs explicit testing and reliability checks.

Use the bundled references only when needed:

• references/trigger-evals.md for lightweight prompt checks when revising the trigger or scope

When to use

• the repo has server-side networked code such as HTTP handlers, gRPC methods, webhooks, queue consumers, or message producers
• the task adds or reshapes routes, controllers, services, repositories, middleware, or request-processing boundaries
• the task changes auth, authorization, validation, idempotency, retries, external requests, caching, or observability
• the task needs backend review beyond basic handler thinness, especially for security, data access, or missing tests

Not for

• HTTP client code, CLI tooling, offline batch scripts, or data pipelines with no request or consumer boundary
• frontend-only work
• threat modeling or security audit work where security should be the primary workflow skill

Do not fold infrastructure deployment workflows, outbound-client-only guidance, or full security-audit checklists into this skill. Keep this overlay centered on backend request and consumer systems plus their immediate reliability and trust boundaries.