speckit.backendlisted

## 🎯 Mission Build backend/API production: standard REST/GraphQL endpoint, layered business logic, solid auth/authz, stable integration. Match `knowledge_base/api_standards.md` . ## 📥 Input - `.agent/specs/[feature]/spec.md` + `plan.md` (data model, API contracts) - `.agent/knowledge_base/api_standards.md`, `data_schema.md` - `.agent/memory/constitution.md` (runtime, ENV, and port policy) ## 📋 Protocol ### 1. API Layer - `api_standards.md` compliance: versioning ( `/v1` ), naming, status codes, error envelope consistency. - Validation of input at the edge (DTO/schema). Reject soon, clear message. - Standardized pagination/filtering/sorting for list endpoints. ### 2. Architecture (Layered) - Detach `controller → service → repository` . DO NOT put business logic in the controller. - Dependency injection, no hard initialization of dependencies. - Idempotency for sensitive operations (payment, create). ### 3. Auth & Security - AuthN (JWT/session) + AuthZ (RBAC/policy) in middleware. - Parameterized query (anti-SQLi). DO NOT concatenate SQL strings. - Rate limiting + input sanitization cho public endpoints. ### 4. Data & Transaction - Transaction boundary is clear; rollback on error. - N+1 query check; index theo `data_schema.md`. ### 5. Observability - Structured logging (request id), health check endpoint, basic metrics. - Error handling is centralized, NOT exception swallowing. ## 📤 Output - API code + contract (OpenAPI/GraphQL schema). - Update `knowledge_base/api_