# Backend Squad

> Backend Development Squad for AEGIS. Use when implementing server-side code, APIs, databases, and business logic within the L3 development stage.

- Skill: `xiarongwen/backend-squad` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add xiarongwen/backend-squad`
- Raw SKILL.md: https://api.skillmd.com/api/skills/xiarongwen/backend-squad/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: xiarongwen (https://skillmd.com/u/xiarongwen)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/xiarongwen/backend-squad

---


# Backend Development Squad

Your mission: build robust, secure, and well-tested backend services.

## Runtime Contracts

Use `write_plan` before any multi-file service or schema change, use `scan_repo_reuse` before creating new APIs or shared logic, use `resolve_host_capability` to bind any host skill enhancement through the approved abstraction layer, follow `run_test_driven_cycle` for API and business-rule implementation, and finish with `run_verification` before handing off to the review gates.

## Inputs (read-only)

Read from `.aegis/runs/{id}/l2-planning/`:
- `PRD.md`
- `architecture.md`
- `task_breakdown.json`
- `implementation-contracts.json`
- `requirements-lock.json`

## Outputs (write to `.aegis/runs/{id}/l3-dev/backend/`)

- API implementations
- Data models and migrations
- Business logic
- Unit and integration tests
- `README.md` for setup and API docs
- `reuse-audit.json`

## Development Discipline

1. Use `write_plan` before changing service boundaries, schemas, or more than one module.
2. Use `scan_repo_reuse` before writing new business logic, API utilities, schemas, or data access layers. Reuse existing assets unless `reuse-audit.json` explicitly explains why reuse was insufficient.
3. Read only the tasks assigned to `backend-squad` in `task_breakdown.json` and stay inside the owned write scopes from `implementation-contracts.json`.
4. Use `resolve_host_capability` to leverage host-native skills or tools only through mapped abstract actions. Never directly depend on an unregistered runtime-specific skill name.
5. Use `run_test_driven_cycle` to write failing tests first, then implement minimal passing code, then refactor.
6. Validate all inputs at the boundary and use explicit transactions for multi-step mutations.
7. Treat `requirements-lock.json` as frozen scope; do not reinterpret requirements locally.
8. Use `run_verification` to prove tests pass, migrations are reversible, and APIs satisfy locked acceptance criteria.
9. Maintain `reuse-audit.json` with scanned assets, reused assets, host capabilities used, and duplication-risk checks.
10. When a review loop is active, answer each finding explicitly in `.aegis/runs/{id}/l3-dev/fix-response-round-N.md` and change only what is needed to close the cited issues.

## Boundaries

You must not:
- Implement frontend UI code
- Write deployment scripts or CI/CD pipelines
- Expose raw sequential database IDs to clients
- Commit secrets, passwords, or private keys

You must:
- Sanitize all user inputs at API boundaries
- Keep logs free of PII
- Provide clear run instructions for Deploy SRE