Codexpiator Backend
Single-purpose reference files for backend engineering decisions.
Read the specific file below for the concern at hand.
| File |
Read this when... |
api-design.md |
Designing endpoints, naming, pagination, response shape (for breaking-change/versioning policy, see codexpiator-architecture/api-contracts-and-versioning.md) |
data-modeling-and-db.md |
Schema design, indexing, migrations, SQL vs NoSQL |
auth-and-authorization.md |
Authentication mechanism, session/token trade-offs, password storage |
error-handling-and-logging.md |
Error taxonomy, structured logging, correlation IDs |
caching-strategies.md |
What/how to cache, invalidation, HTTP caching |
background-jobs-and-queues.md |
Moving work off the request path, retries, delivery guarantees |
resilience-and-rate-limiting.md |
Timeouts, retries, circuit breakers, rate limits |
backend-performance.md |
Profiling, DB bottlenecks, scaling direction |
backend-testing.md |
Unit vs integration tests, test data for the backend |
For deeper security hardening beyond the how-to in
auth-and-authorization.md, invoke the codexpiator-security skill —
that skill covers the threat model, this one covers the implementation
approach.
Mandatory pre-completion gate for any backend change
Before considering backend work done:
- For a Python project, confirm dependencies are managed via
uv,
pdm, or poetry and the code passes Ruff (see
shared/stack-recommendations.md).
- Write and run real tests covering every function/endpoint
touched, including edge cases (empty input, boundary values,
invalid/malformed input, concurrent-write scenarios where
relevant) — not just the happy path. Run the full test suite, not
just the new tests in isolation. See
backend-testing.md and
codexpiator-testing-qa/tdd-workflow.md.
- For anything security-sensitive (auth, input handling, data
access), also invoke the
codexpiator-security skill and run its
relevant checks — security behavior needs to be tested as
thoroughly as functional behavior, not assumed correct because it
looks right.
- Suggest running
/codexpiator-audit if the change was significant
— see shared/collaboration-and-audit-practice.md.
Also see that same shared file for when to ask a clarifying question
(AskUserQuestion when available) instead of guessing.
1---2name: codexpiator-backend3description: Backend engineering guidance - API design and contracts, data modeling and databases, authentication and authorization implementation (sessions vs JWT, password hashing - see codexpiator-security for the threat-model/hardening side), error handling and logging, caching, background jobs and queues, resilience and rate limiting, backend performance, and backend testing. Use for any server-side/API/data-layer question.4---56# Codexpiator Backend78Single-purpose reference files for backend engineering decisions.9Read the specific file below for the concern at hand.1011| File | Read this when... |12|---|---|13| `api-design.md` | Designing endpoints, naming, pagination, response shape (for breaking-change/versioning *policy*, see `codexpiator-architecture/api-contracts-and-versioning.md`) |14| `data-modeling-and-db.md` | Schema design, indexing, migrations, SQL vs NoSQL |15| `auth-and-authorization.md` | Authentication mechanism, session/token trade-offs, password storage |16| `error-handling-and-logging.md` | Error taxonomy, structured logging, correlation IDs |17| `caching-strategies.md` | What/how to cache, invalidation, HTTP caching |18| `background-jobs-and-queues.md` | Moving work off the request path, retries, delivery guarantees |19| `resilience-and-rate-limiting.md` | Timeouts, retries, circuit breakers, rate limits |20| `backend-performance.md` | Profiling, DB bottlenecks, scaling direction |21| `backend-testing.md` | Unit vs integration tests, test data for the backend |2223For deeper security hardening beyond the how-to in24`auth-and-authorization.md`, invoke the `codexpiator-security` skill —25that skill covers the threat model, this one covers the implementation26approach.2728## Mandatory pre-completion gate for any backend change2930Before considering backend work done:311. For a Python project, confirm dependencies are managed via `uv`,32 `pdm`, or `poetry` and the code passes Ruff (see33 `shared/stack-recommendations.md`).342. **Write and run real tests covering every function/endpoint35 touched, including edge cases** (empty input, boundary values,36 invalid/malformed input, concurrent-write scenarios where37 relevant) — not just the happy path. Run the full test suite, not38 just the new tests in isolation. See `backend-testing.md` and39 `codexpiator-testing-qa/tdd-workflow.md`.403. For anything security-sensitive (auth, input handling, data41 access), also invoke the `codexpiator-security` skill and run its42 relevant checks — security behavior needs to be tested as43 thoroughly as functional behavior, not assumed correct because it44 looks right.454. Suggest running `/codexpiator-audit` if the change was significant46 — see `shared/collaboration-and-audit-practice.md`.4748Also see that same shared file for when to ask a clarifying question49(`AskUserQuestion` when available) instead of guessing.
emanuelegreco29