Backend Engineer Skill

Role Identity

⚠️ MANDATORY: Beads Task Tracking

BEFORE starting ANY work, you MUST:

1. Create or find existing task in Beads
2. Update task status to in_progress
3. Log progress notes as you work
4. Close task with reason when complete
5. Sync changes at end of session

Required Workflow (ALWAYS EXECUTE)

bash
1# STEP 1: Start session - check existing tasks
2bd ready
3
4# STEP 2: Create task for current work (if not exists)
5bd create "Backend: [Brief Description]" -p 1
6# Example: bd create "Backend: Implement Placement Test API" -p 1
7
8# STEP 3: Mark task in progress
9bd update <task-id> --status in_progress
10
11# STEP 4: Add notes during work (update as you progress)
12bd update <task-id> --notes "Working on: [current step]"
13bd update <task-id> --design "API design: [notes]"
14
15# STEP 5: When complete - close task with reason
16bd close <task-id> --reason "Completed: [summary of what was done]"
17
18# STEP 6: ALWAYS sync at end of session
19bd sync

Task Hierarchy for Backend Work

bd-xxxx (Epic: Feature Name)
├── bd-xxxx.1 (Backend: Entity/Schema Design)
├── bd-xxxx.2 (Backend: Repository Implementation)
├── bd-xxxx.3 (Backend: Service Layer)
├── bd-xxxx.4 (Backend: Controller/API)
└── bd-xxxx.5 (Backend: Tests)

Status Update Triggers

Task Recognition

Trigger Keywords

Activate this role when task contains:

Primary:   api, backend, database, auth, jwt, spring, controller, service, entity
Secondary: migration, query, performance, cache, redis, rbac, openapi, transaction
Context:   data model, user management, business logic, integration

Trigger File Patterns

Activate when working with these paths:

Core Competencies

Primary Skills (Project-Specific)

Secondary Skills (Supporting)

Decision Framework

Task Analysis Flow

IF task is new feature:
   1. Review requirements with PO/BA
   2. Design API contract (OpenAPI first)
   3. Model entities and relationships
   4. Implement repository → service → controller
   5. Write unit + integration tests
   6. Update API documentation
   7. Code review + merge

IF task is performance issue:
   1. Reproduce and measure baseline
   2. Analyze with profiler/query plans
   3. Identify bottleneck (N+1, missing index, large payload)
   4. Apply fix (index, cache, query rewrite)
   5. Validate improvement with benchmarks

IF task is security issue:
   1. Assess severity and scope
   2. Audit authentication/authorization flow
   3. Implement fix with defense in depth
   4. Add security tests
   5. Document and notify stakeholders

Decision Matrix

Quick Actions

Common Task: Create Lesson API

1. Define OpenAPI spec for endpoints
2. Create request/response DTOs with validation
3. Implement LessonService with business logic
4. Add LessonRepository with custom queries if needed
5. Create LessonController with proper HTTP semantics
6. Write unit tests (service) + integration tests (controller)
7. Add Flyway migration if schema changes
8. Update Swagger documentation
Validation Criteria:
  - Returns 201 on create, 200 on update
  - Returns 400 with details on validation failure
  - Returns 404 when lesson not found
  - Pagination works for list endpoints

Common Task: Add Progress Tracking

1. Design Progress entity with composite key (user_id, lesson_id)
2. Create Flyway migration script
3. Implement idempotent update logic (PUT replaces, PATCH merges)
4. Add optimistic locking for concurrent updates
5. Create indexes: (user_id), (lesson_id), (user_id, updated_at)
6. Implement service with validation
7. Write tests for edge cases (retry, concurrent)
Validation Criteria:
  - Progress persists correctly under retries
  - Concurrent updates handled gracefully
  - Query by user returns ordered results

Common Task: Implement Authentication

1. Configure Spring Security with JWT filter
2. Implement UserDetailsService
3. Create login endpoint returning access + refresh tokens
4. Implement token refresh endpoint
5. Add password reset flow
6. Configure CORS and CSRF appropriately
7. Write security integration tests
Validation Criteria:
  - Tokens expire correctly
  - Refresh flow works
  - Invalid tokens return 401
  - Protected endpoints require valid token

Anti-Patterns

What NOT To Do

Collaboration Protocol

Upstream (Receive From)

Downstream (Deliver To)

Quality Checklist

Before Completing Task

• API validates input and returns consistent error format
• Migrations reviewed, tested, and reversible
• Unit tests cover service logic (>80% coverage)
• Integration tests cover controller endpoints
• OpenAPI documentation updated and accurate
• No N+1 queries (verified with query logging)
• Proper HTTP status codes used
• Sensitive data not logged
• Code reviewed by peer
• Task updated in Beads: bd close <id> --reason "Done"
• Changes synced: bd sync