# Backend Engineering

> Comprehensive guide for modern backend engineering across enterprise architectures (Clean Architecture, Hexagonal/Ports & Adapters, Modular Monoliths, Event-Driven Microservices). Covers API standards (REST with OpenAPI 3.1 & RFC 7807, GraphQL with DataLoader, gRPC, tRPC, WebSockets, SSE, Webhooks), enterprise rate limiting, resilience, OAuth 2.1 / OIDC / PASETO security, and OpenTelemetry observ…

- **Type:** Skill
- **Install:** `agentstack add skill-hiroqt-pixelcrew-backend-engineering`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [hiroqt](https://agentstack.voostack.com/s/hiroqt)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [hiroqt](https://github.com/hiroqt)
- **Source:** https://github.com/hiroqt/PixelCrew/tree/main/.agents/skills/backend-engineering

## Install

```sh
agentstack add skill-hiroqt-pixelcrew-backend-engineering
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Backend Engineering & Modern API Architecture

This skill provides comprehensive instructions, architectural patterns, and implementation blueprints for constructing resilient, scalable, secure backend systems and APIs across modern runtimes (Node.js/TypeScript, Go, Rust, Python, C# .NET).

---

## 1. Core Engineering Directives

1. **Architectural Purity & Decoupling**: Enforce Clean / Hexagonal (Ports & Adapters) boundaries. Core business logic/domain entities must never import database drivers, web frameworks, or third-party SDKs. Adapters implement interfaces declared by the domain.
2. **Standardized API Integration**:
   - **REST**: OpenAPI 3.1 contract-first specifications, standardized pagination (cursor-based), and **RFC 7807 Problem Details** for all error payloads (`type`, `title`, `status`, `detail`, `instance`, `invalid_params`).
   - **GraphQL**: Strict depth/complexity limits, persisted queries, and mandatory `DataLoader` to eliminate N+1 database queries.
   - **gRPC / Protobuf**: HTTP/2 multiplexing, type-safe RPC contracts for internal service-to-service communication.
   - **Streaming & Real-Time**: Server-Sent Events (SSE) for unidirectional streams (e.g. LLM tokens, progress bars), WebSockets for bidirectional low-latency interactions with Redis Pub/Sub cluster backplanes, and Webhooks secured with HMAC-SHA256 signatures.
3. **Enterprise Rate Limiting & Traffic Shaping**: Deploy distributed Sliding Window Counter / Token Bucket rate limiting via Redis Lua scripts with IETF standard headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`, `Retry-After`). Implement tier-based allowances and per-route cost weighting.
4. **Resilience & Fault Tolerance**:
   - **Idempotency**: Require `Idempotency-Key` headers for all mutating operations (`POST`, `PATCH`), backed by atomic database or Redis locks.
   - **Circuit Breakers**: Tri-state circuit breakers (Closed $\to$ Open $\to$ Half-Open) around all external dependencies.
   - **Retries**: Exponential backoff with full jitter to avoid thundering herd / retry storms.
   - **Context Deadlines**: Propagate cancellation tokens/deadlines across all asynchronous calls.
5. **Zero-Trust Security & Modern Auth**: OAuth 2.1 with PKCE, OpenID Connect (OIDC), asymmetric JWTs (RS256/EdDSA) validated via cached JWKS, PASETO v4 tokens, and fine-grained authorization (RBAC/ABAC).
6. **Unified Observability**: OpenTelemetry instrumentation with trace/span propagation (`traceparent`, `x-correlation-id`), structured JSON logging, and Prometheus metrics.

---

## 2. Quick Navigation & Reference Modules

- [Modern Architecture & Domain Design Guide](./references/modern-architecture-guide.md)
- [Rate Limiting, Resilience & Fault Tolerance](./references/rate-limiting-and-resilience.md)
- [API Protocols, Standards & Error Handling](./references/api-protocols-and-standards.md)
- [Security, Authentication & Observability](./references/security-and-observability.md)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [hiroqt](https://github.com/hiroqt)
- **Source:** [hiroqt/PixelCrew](https://github.com/hiroqt/PixelCrew)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-hiroqt-pixelcrew-backend-engineering
- Seller: https://agentstack.voostack.com/s/hiroqt
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.