mir-backend-go-echolisted

Make It Right (Echo module). Echo web framework reliability augmentation for Go backends, covering Echo v5 (current) and v4 (maintained). Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Echo library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: echo.Context comes from a sync.Pool and must never be retained past the handler or handed to a goroutine; the v4->v5 rewrite that AI mixes up (Context became a *echo.Context struct, Logger became *slog.Logger, HTTPErrorHandler's arguments swapped, e.Shutdown and e.Close removed in favour of StartConfig); Bind never validates, so a missing c.Validate ships unchecked input, and Bind merges path and query values into one struct, a mass-assignment path; middleware ordering and graceful shutdown; and Echo's insecure defaults - c.RealIP() trusts X-Forwarded-For unless IPExtractor is set, and middleware.Secure sends no HSTS or CSP. TRIGGER only when the Go backend uses the Echo framework - building, reviewing, or debuggi
anantbhandarkar/make-it-right · ★ 15 · AI & Automation · score 81

Install: claude install-skill anantbhandarkar/make-it-right

# /mir-backend-go-echo · Make It Right (Echo) Bottom tier of the chain: `mir-backend` (generic gates) → `mir-backend-go` (Go runtime model) → **this** (Echo library mechanics). Run the gates first; load the Go runtime tier for goroutine lifecycle, context propagation, and race discipline; reach for *this* at Gate 5 (design mechanics), Gate 6 (implementation), and Gate 7 review. **Runtime-level concerns (goroutine leaks, data races, context propagation, typed-nil, slice aliasing, `os.Root`, module checksums) live in `mir-backend-go` — not here.** **Stack state, verified 13 Aug 2026.** | Line | Current | Notes | |---|---|---| | **v5** (`github.com/labstack/echo/v5`) | v5.3.1 (2026-07-21); v5.0.0 GA 2026-01-18 | Current major. `go.mod` requires Go 1.25 | | **v4** (`github.com/labstack/echo/v4`) | v4.15.4 (2026-06-15) | Still receiving security and bug fixes | **Establish the major before writing a line.** Handler signatures, the logger, the error handler, and the whole server-startup API changed in v5 (footgun 2). Note also that `echo-contrib` ships separate release lines for v4 and v5 — importing the wrong one gives type errors that look like Echo's fault. Whichever major you are on, this module's earlier claim that "v5 is pre-release" is obsolete: v5 has been GA since January 2026. ## The Echo footguns AI walks into most ### 1. `echo.Context` is pooled — do not retain it across the handler boundary Echo keeps contexts in a `sync.Pool` and reuses them. Storing the contex