{"id":50412327,"url":"https://github.com/cskwork/backend-dev-skills","last_synced_at":"2026-05-31T04:04:55.760Z","repository":{"id":353606828,"uuid":"1216957063","full_name":"cskwork/backend-dev-skills","owner":"cskwork","description":"Evidence-first backend dev pipeline — /explore → /work → /verify → /qa-engineer. Turns Claude Code / Codex / Gemini / Cursor into a disciplined backend engineer that cites, tests, curls, and browser-verifies before saying 'done'.","archived":false,"fork":false,"pushed_at":"2026-05-08T00:24:28.000Z","size":189,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-08T02:39:55.746Z","etag":null,"topics":["ai-agents","ai-coding-assistant","backend","backend-development","claude-code","code-quality","codex","cursor","developer-tools","e2e-testing","gemini-cli","legacy-code","llm","markdown","playwright","prompt-engineering","skills","slash-commands","spring-boot","tdd"],"latest_commit_sha":null,"homepage":"https://github.com/cskwork/backend-dev-skills","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cskwork.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-21T12:00:02.000Z","updated_at":"2026-05-08T00:24:32.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/cskwork/backend-dev-skills","commit_stats":null,"previous_names":["cskwork/backend-dev-skills"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/cskwork/backend-dev-skills","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cskwork%2Fbackend-dev-skills","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cskwork%2Fbackend-dev-skills/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cskwork%2Fbackend-dev-skills/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cskwork%2Fbackend-dev-skills/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cskwork","download_url":"https://codeload.github.com/cskwork/backend-dev-skills/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cskwork%2Fbackend-dev-skills/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33718496,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-31T02:00:06.040Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-agents","ai-coding-assistant","backend","backend-development","claude-code","code-quality","codex","cursor","developer-tools","e2e-testing","gemini-cli","legacy-code","llm","markdown","playwright","prompt-engineering","skills","slash-commands","spring-boot","tdd"],"created_at":"2026-05-31T04:04:54.742Z","updated_at":"2026-05-31T04:04:55.754Z","avatar_url":"https://github.com/cskwork.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Backend Dev Skills\n\n\u003e Turn any AI coding assistant into a **disciplined backend engineer**. Five opinionated, evidence-first skills (`/reproduce` → `/explore` → `/work` → `/verify` → `/qa-engineer`) that refuse to ship guesses — they demand browser as-is proof, citations, fresh test output, real `curl` proof, and a real browser trace before calling anything \"done\".\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://github.com/cskwork/backend-dev-skills/stargazers\"\u003e\u003cimg alt=\"GitHub stars\" src=\"https://img.shields.io/github/stars/cskwork/backend-dev-skills?style=social\"\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/cskwork/backend-dev-skills/network/members\"\u003e\u003cimg alt=\"GitHub forks\" src=\"https://img.shields.io/github/forks/cskwork/backend-dev-skills?style=social\"\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/cskwork/backend-dev-skills/issues\"\u003e\u003cimg alt=\"GitHub issues\" src=\"https://img.shields.io/github/issues/cskwork/backend-dev-skills\"\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/cskwork/backend-dev-skills/commits/main\"\u003e\u003cimg alt=\"Last commit\" src=\"https://img.shields.io/github/last-commit/cskwork/backend-dev-skills\"\u003e\u003c/a\u003e\n  \u003ca href=\"LICENSE\"\u003e\u003cimg alt=\"License: MIT\" src=\"https://img.shields.io/badge/License-MIT-green.svg\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003cimg alt=\"Pure markdown\" src=\"https://img.shields.io/badge/install-pure%20markdown-blue\"\u003e\n  \u003cimg alt=\"No runtime\" src=\"https://img.shields.io/badge/runtime-none-lightgrey\"\u003e\n  \u003cimg alt=\"Works anywhere\" src=\"https://img.shields.io/badge/agents-Claude%20Code%20%7C%20Codex%20%7C%20Gemini%20%7C%20Cursor-purple\"\u003e\n  \u003cimg alt=\"Stack agnostic\" src=\"https://img.shields.io/badge/stack-agnostic-brightgreen\"\u003e\n\u003c/p\u003e\n\n**Works with:** Claude Code · OpenAI Codex · Gemini CLI · Cursor · Aider · Continue.dev · any agent that reads a prompt.\n\n## Table of contents\n\n- [The problem](#the-problem)\n- [The Iron Laws](#the-iron-laws)\n- [What each skill delivers](#what-each-skill-delivers)\n- [Quick start (90 seconds)](#quick-start)\n- [Folder contract (per ticket)](#folder-contract-per-ticket)\n- [Install — per-agent](#install--per-agent)\n- [Who this is for](#who-this-is-for)\n- [FAQ](#faq)\n- [Roadmap \u0026 contributing](#roadmap)\n- [License](#license)\n\n---\n\n## The problem\n\nGeneric AI coding agents ship greenfield code well. They fall apart on **a 200k-line service you've never opened, with three databases, two message buses, and an HTTP client nobody has touched since 2022**.\n\nThey will:\n\n- Invent a utility you already have five of\n- \"Fix\" the symptom instead of the root cause\n- Write a passing unit test while the real endpoint still 500s\n- Drive-by refactor five files that weren't in scope\n- Declare \"done\" before ever running a real `curl`\n- Mark a deploy \"live\" before opening a browser\n\nThese five skills encode the pipeline a senior backend engineer runs in their head — forced, step-by-step, into the agent.\n\n```\n┌────────────┐   ┌──────────┐   ┌───────┐   ┌──────────┐   [deploy]   ┌──────────────┐\n│ /reproduce │─▶─│ /explore │─▶─│ /work │─▶─│ /verify  │────────────▶─│ /qa-engineer │\n└────────────┘   └──────────┘   └───────┘   └──────────┘              └──────────────┘\n   browser as-is     evidence       code        local HTTP               deployed browser\n   before theory     before         with        proof                    E2E + repeatable\n                     code           tests       (localhost)              Playwright suite\n```\n\nEach skill produces a **file-system artifact** (`reproduce.md`, `explore.md`, `work.md`, `verify.md`, `qa.md` + `e2e/specs/*.spec.ts`) under a per-ticket folder, so future sessions — human or AI — can reload context without re-investigating, and the Playwright suite re-runs on every subsequent deploy.\n\n---\n\n## The Iron Laws\n\nEvery skill enforces hard stops. These are not suggestions.\n\n| Skill | Iron Law |\n|---|---|\n| `/reproduce` | **No code fix before the reported browser symptom is captured as-is, with Playwright output and artifact paths.** |\n| `/explore` | **No code changes until an evidence-based plan (with `file:line` citations) exists and is approved.** |\n| `/work` | **No \"done\" claim until fresh verification output is in hand AND paired docs are written.** |\n| `/verify` | **No \"production-ready\" claim until every assertion passes against a live local service with recorded `curl -i` evidence.** |\n| `/qa-engineer` | **No \"live for users\" claim until a real browser completes the flow against the deployed URL, with trace + video recorded, and the result is re-runnable from `e2e/specs/` on the next deploy.** |\n\nWhen the agent is tempted to skip a phase, the skill refuses. That refusal is the point.\n\n---\n\n## What each skill delivers\n\n### [`/reproduce`](./skills/reproduce/) — browser as-is proof before root-cause work\n\n5 phases. Produces `.backend/\u003cYYYYMM\u003e/\u003cslug\u003e/reproduce.md` with:\n\n- Exact user/ticket steps, target URL, account/role, and data identifiers\n- Focused Playwright as-is spec or script\n- Screenshots, console/page errors, request failures, relevant API responses, trace/video when available\n- Status semantics: `reproduced`, `not-reproduced`, `blocked-env`, `blocked-data`, `inconclusive`\n- A concrete handoff into `/explore` or `/work`\n\n### [`/explore`](./skills/explore/) — evidence-based plan before any code\n\n5 phases. Produces `.backend/\u003cYYYYMM\u003e/\u003cslug\u003e/explore.md` with:\n\n- §1 Executive summary — **plain-language prose for non-developers**\n- §2+ AI-optimized symbolic body — every claim cites `file:line`\n- Database-first investigation (live `DESCRIBE` / schema grounding)\n- Reuse inventory (forces the agent to find existing utilities before writing new ones)\n- Blast-radius analysis (callers, shared state, cross-service effects)\n- Proposed changes as a `file · act · reuse/new` table\n\n### [`/work`](./skills/work/) — TDD implementation against the plan\n\n6 phases. Reads `explore.md` as a **contract** and implements it:\n\n- Red → Green → Refactor per change unit\n- Surgical diff review: every hunk must trace to §7 of the plan\n- Fresh verification evidence per command (no paraphrased results)\n- Paired outputs: `work.md` (AI-optimized) + `docs/features|bugs/\u003cdate\u003e-\u003cslug\u003e.md` (human prose)\n\n### [`/verify`](./skills/verify/) — live HTTP-level proof, not unit-test theater\n\n7 phases. Gates merge with real `curl` evidence:\n\n- Payload sourcing: user → saved fixtures → live DB sample → synthesized (in that order)\n- Reusable curl harness per endpoint, with `happy / boundary / negative / regression` variants\n- Bounded re-work loop: on failure, hands `/work` a **specific delta** (not \"fix it\"); caps at 3 iterations then escalates\n- Records every request/response pair verbatim to `runs/run-\u003cN\u003e.log`\n- **Localhost by default** — non-localhost targets are opt-in behind a recorded consent gate (per-request for prod)\n\n### [`/qa-engineer`](./skills/qa-engineer/) — post-deploy browser E2E with a repeatable spec suite\n\n7 phases. Runs *after* `/verify` passes and the change has been deployed:\n\n- **Deployed-env only** — refuses `localhost` (opposite of `/verify`); enforces env-URL matching and slug-scoped prod consent\n- Uses Microsoft's [`playwright-cli`](https://github.com/microsoft/playwright-cli) as an interactive **probe**, then translates each walked flow into a `.spec.ts` file — the cli is how you generate, the spec file is what you re-run\n- Produces a durable Playwright suite under `.backend/\u003cYYYYMM\u003e/\u003cslug\u003e/e2e/specs/` that CI (or a human) re-runs on every subsequent deploy via `npx playwright test specs/smoke.spec.ts`\n- **Update-in-place discipline** on re-invocation: unchanged flows keep their spec verbatim (`git diff e2e/specs/` must be empty for untouched flows); only contract-drifted flows get minimum-delta edits; accumulated debugging survives\n- 3-attempt flake protocol — a variant that passes 3× and fails 2× is `pass-with-flake`, not `pass`\n- Evidence per run: Playwright trace (`trace.zip`), video, screenshots, console log, HAR — all redacted of PII\n- Prod runs default to **read-only** via a route-level write-block fixture; writes require explicit per-step consent\n- Bounded rework loop: FAIL-UI/BACKEND → `/work` delta; FAIL-CONTRACT → `/explore`; cap 2 upstream re-invocations\n\n---\n\n## Quick start\n\n\u003ca name=\"quick-start\"\u003e\u003c/a\u003e\n\nCopy the skills, then invoke by name.\n\n```bash\ngit clone https://github.com/cskwork/backend-dev-skills.git\ncd backend-dev-skills\n\n# Claude Code — native slash commands\nmkdir -p ~/.claude/skills\ncp -r skills/reproduce skills/explore skills/work skills/verify skills/qa-engineer ~/.claude/skills/\n```\n\nOpen any project, type `/explore`, and start:\n\n```\n/explore add a bookmark endpoint so users can pin a document\n```\n\nThe agent asks \"Bug or Feature?\", runs grep/DB investigation, and writes `.backend/\u003cYYYYMM\u003e/\u003cslug\u003e/explore.md`. It then **stops** and waits for your approval before `/work` begins.\n\nFor other agents (Codex, Gemini, Cursor, Aider, …) see [the install guides](./install/).\n\n**Prerequisite for `/qa-engineer` only:** Node.js + `@playwright/test` + `playwright-cli`. The skill detects missing binaries in Phase 1 and offers the install command.\n\n---\n\n## Folder contract (per ticket)\n\nAll five skills share a single workspace per ticket:\n\n```\n.backend/\n  202604/                               ← YYYYMM month bucket\n    add-bookmark-api/                   ← kebab-case slug (≤50 chars)\n      explore.md                        ← /explore\n      reproduce.md                      ← /reproduce (optional pre-fix browser proof)\n      work.md                           ← /work\n      verify.md                         ← /verify\n      qa.md                             ← /qa-engineer\n      harness/                          ← /verify — reusable curl scripts\n        _env.sh\n        _assert.sh\n        POST-bookmarks.sh\n      fixtures/                         ← /verify — per-variant payloads (PII-redacted)\n        POST-bookmarks.happy.json\n        POST-bookmarks.boundary.json\n        POST-bookmarks.negative.json\n      runs/                             ← /verify — raw curl -i logs per iteration\n        run-1.log\n        run-2.log\n      e2e/                              ← /qa-engineer — repeatable Playwright suite\n        _env.sh\n        _login.sh\n        playwright.config.ts\n        storageState.dev.json           ← redacted auth state per env\n        specs/\n          \u003cbug\u003e-as-is.spec.ts           ← /reproduce focused as-is proof (optional)\n          smoke.spec.ts                 ← \u003c90s critical-path, re-run on every deploy\n          \u003cflow\u003e.spec.ts                ← full happy/boundary/negative per flow\n        scripts/\u003cflow\u003e.sh               ← playwright-cli probes (debug/teach)\n        fixtures/\u003cflow\u003e.json\n        artifacts/\n          run-20260421-1430-dev/        ← one folder per execution\n            trace.zip\n            video.webm\n            console.log\n            network.har\n```\n\nThis layout is **the contract** between the five skills. Any AI session (or human) opening the folder gets full context in under a minute, and `e2e/specs/` gives CI (or a human) a one-command post-deploy gate for every subsequent release.\n\n---\n\n## Install — per-agent\n\nSkills are **just markdown prompts** — no binaries, no runtime. Copy them to the right location for your agent and invoke by name.\n\n| Agent | Guide | Invocation |\n|---|---|---|\n| **Claude Code** | [install/claude-code.md](./install/claude-code.md) | `/reproduce`, `/explore`, `/work`, `/verify`, `/qa-engineer` |\n| **OpenAI Codex / CLI** | [install/codex.md](./install/codex.md) | Append to `AGENTS.md` or paste per conversation |\n| **Gemini CLI** | [install/gemini.md](./install/gemini.md) | Append to `GEMINI.md` or paste per conversation |\n| **Cursor / Aider / other** | [install/generic.md](./install/generic.md) | Paste the system-prompt prefix, then each SKILL.md body |\n\n**90 seconds to install.** See the per-agent guides for exact paths.\n\n---\n\n## Who this is for\n\nThese skills were forged in a real 10-service backend monorepo with multiple databases, message queues, caches, SSE, WebSockets, and an external SSO vendor. They are opinionated exactly because legacy codebases punish under-opinionated agents.\n\nThey earn their keep the moment your codebase has:\n\n- **2+ services** with shared state\n- **Any SQL database** older than six months\n- **Any** developer who is not the person who originally wrote the module\n- **Any** compliance/audit requirement on what shipped and why\n\nIf those sound familiar — this repo is for you.\n\n**Stack-agnostic by design.** The pipeline works for:\n\n- Spring Boot / Java (MyBatis, JPA) — implementation-playbook included\n- Node.js / TypeScript (Express, NestJS, Fastify) — adapt the playbook\n- Python (FastAPI, Django, Flask)\n- Go, Rust, Kotlin, C# — anywhere HTTP endpoints and a database exist\n- Any ORM, any SQL dialect, any JWT / OAuth / session auth scheme\n- Any frontend (Vue, React, Svelte, Angular) — `/qa-engineer` is framework-agnostic\n\nOpinion lives in the **process** (cite `file:line`, re-grep before adding new code, prove with fresh output). Stack specifics live in two files you fork: `skills/work/implementation-playbook.md` and `skills/verify/jwt-auth-reference.md`.\n\n---\n\n## FAQ\n\n**Q: Isn't this overkill for a one-line fix?**\nA: Yes. All five skills have explicit \"skip for typo fixes / config tweaks / doc changes\" clauses. Use judgment. The skills exist for the *other* 95% of work where shortcuts cost incidents.\n\n**Q: I already have Cursor / Copilot — why these?**\nA: Those tools optimize for code-completion speed. These skills optimize for **not breaking production in a codebase the author has never seen before**. Different problem.\n\n**Q: Is this Claude-only?**\nA: No. The skills are pure markdown; they work wherever an agent can load a system prompt. Claude Code gets native slash-command support; other agents invoke by name.\n\n**Q: Will this slow me down?**\nA: `/explore` takes 5–15 min. `/verify` takes 5–10 min. You buy back hours the first time either one catches a contract drift before prod.\n\n**Q: Can I modify the skills for my stack?**\nA: Yes — that's the intended use. Fork, localize service names, ports, auth patterns, ship internally. MIT-licensed. The **5/6/7/7 phase structure** is load-bearing; everything else is adjustable.\n\n**Q: Does this work with local / self-hosted models?**\nA: Yes, on instruct-tuned 70B+ class models (Qwen2.5-Coder 32B is the practical floor). Smaller models tend to skip phases or fabricate citations. See [install/generic.md](./install/generic.md).\n\n**Q: What about frontend-only changes?**\nA: `/qa-engineer` covers deployed browser QA for any frontend. `/verify` is backend-only; skip it for pure frontend diffs. `/explore` and `/work` work fine for frontend too — fork `implementation-playbook.md` to your framework's conventions.\n\n---\n\n## Roadmap\n\n\u003ca name=\"roadmap\"\u003e\u003c/a\u003e\n\nContributions welcome — the pipeline generalizes further than one stack. Especially appreciated:\n\n- Alternate `implementation-playbook.md` variants: Node/TypeScript, Python (FastAPI/Django), Go, Rust, Kotlin\n- Alternate `jwt-auth-reference.md` variants: OAuth2 client-credentials, session-cookie, API-key, mTLS\n- Alternate `environment-gates.md` variants: Kubernetes-routed envs, Vercel/Netlify preview URLs, feature-branch staging\n- CI recipes: GitHub Actions / GitLab CI / CircleCI snippets that re-run `e2e/specs/smoke.spec.ts` on every deploy\n- Translations of the human-prose `docs/features|bugs/*.md` templates to other languages\n\nOpen an issue or PR — happy to review and merge.\n\n### How to contribute\n\n1. Fork the repo\n2. For a new stack variant, copy the relevant reference file (e.g. `skills/work/implementation-playbook.md`) to a sibling with a stack suffix (`implementation-playbook.node.md`), edit, and open a PR\n3. For a bug in the core procedure, open an issue describing the failure mode and the agent that hit it\n4. Run `/explore` → `/work` → `/verify` on your own change (dogfood the pipeline)\n\nNo CLA, no contributor-license boilerplate. MIT in, MIT out.\n\n---\n\n## License\n\nMIT — fork, adapt, ship internally, build a startup on top of it. See [LICENSE](./LICENSE).\n\n---\n\n## Star history\n\nIf these skills save you one incident, consider starring the repo so other backend engineers can find them.\n\n---\n\n**Built by a backend engineer who got tired of AI agents confidently shipping broken code into legacy systems.** If you've felt that pain — this is for you.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcskwork%2Fbackend-dev-skills","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcskwork%2Fbackend-dev-skills","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcskwork%2Fbackend-dev-skills/lists"}