<!--
Author: Simon-Pierre Boucher
Contact: contact@spboucher.ai
-->

# backend-skills — Backend Development Skill Collection

**Author:** Simon-Pierre Boucher
**Contact:** contact@spboucher.ai

Twenty ultra-sharp backend skills following the method in
[../RESEARCH-SYNTHESIS.md](../RESEARCH-SYNTHESIS.md). Database-specific work
lives in [../db-skills/](../db-skills/) — this collection deliberately
excludes it. All pass `python3 ../tools/validate_skills.py`.

## The collection and its boundaries

**API design**
| Skill | Handles | Explicitly does NOT handle |
|---|---|---|
| `designing-rest-apis` | resources, methods, status codes, pagination, versioning, problem+json, OpenAPI | GraphQL; webhooks; auth mechanics |
| `designing-graphql-apis` | schema design, DataLoader/N+1, cursor pagination, complexity limits | REST; subscriptions infra |
| `designing-webhooks` | payloads, HMAC signing, retries, idempotent delivery | consuming webhooks' business logic; internal messaging |
| `handling-file-uploads` | presigned URLs, validation, safe naming, streaming, resumable | serving files; image processing; CDNs |

**Security (defensive)**
| Skill | Handles | Explicitly does NOT handle |
|---|---|---|
| `implementing-authentication` | password storage, sessions vs JWT, OAuth2/OIDC + PKCE, MFA, resets | permissions → `implementing-authorization`; DB creds → db-skills |
| `implementing-authorization` | RBAC/ABAC, deny-by-default, IDOR, tenant isolation, policy centralization | login/identity → `implementing-authentication` |
| `validating-input` | boundary schemas, allowlists, canonicalization, 422 responses | authn/authz; deep business rules |
| `securing-backend-services` | headers, TLS, dependencies, secrets, SSRF/CSRF, least privilege | login, permissions, input validation, DB security (see above) |

**Reliability & operations**
| Skill | Handles | Explicitly does NOT handle |
|---|---|---|
| `handling-errors` | error taxonomy, problem+json mapping, retries, circuit breakers | validation responses; observability pipelines |
| `instrumenting-observability` | structured logs, correlation IDs, RED metrics, OpenTelemetry, alerting | error-handling code; incident process |
| `testing-backend-services` | test pyramid, testcontainers, contract tests, determinism | UI testing; load testing |
| `managing-configuration` | 12-factor env config, startup validation, secrets separation | infra provisioning; CI/CD config |

**Async & performance**
| Skill | Handles | Explicitly does NOT handle |
|---|---|---|
| `writing-background-jobs` | idempotent jobs, retries/backoff, DLQ, timeouts | inter-service messaging; system cron |
| `handling-async-messaging` | outbox pattern, event versioning, ordering, poison messages | in-process job queues; customer webhooks |
| `caching-strategies` | cache-aside, TTL discipline, invalidation, stampede protection | CDN/edge config; SQL tuning → db-skills |
| `limiting-request-rates` | token bucket, 429/Retry-After, tiered limits, load shedding | authorization; capacity planning |

**Infrastructure & architecture**
| Skill | Handles | Explicitly does NOT handle |
|---|---|---|
| `containerizing-services` | multi-stage builds, non-root, layer caching, health checks | Kubernetes; pipeline design |
| `shipping-with-ci-cd` | stages, build-once-promote, deploy strategies, rollback | writing tests; Dockerfiles |
| `architecting-service-boundaries` | modular monolith default, data ownership, sagas, strangler | messaging mechanics; endpoint design |
| `scaling-backend-services` | statelessness, pooling, load balancing, autoscaling, replicas | query tuning; caching; rate limiting |

## Shared conventions

- Description = WHAT + "Use when …" (literal phrases) + "Do not use for …"
- One default per decision with an escape hatch; concrete values over adjectives
- Every workflow ends with a validation step (replay a job twice, boot with a missing var, kill an instance mid-deploy)
- `SKILL.md` <150 lines; depth in `references/patterns.md` (with TOC)