Rate Limit Contract Repair

The problem

Rate limit behavior often drifts across repository middleware, route overrides, and public documentation. This leads to client retry storms, broken SDKs, and inconsistent API enforcement that is difficult to debug without production access.

What it does

• Identifies conflicting quotas, windows, and identities across source code, OpenAPI specs, and docs.
• Traces enforcement paths from identity extraction to response serialization and header handling.
• Standardizes 429 response schemas, Retry-After headers, and SDK retry logic.
• Generates safe repository patches to centralize magic numbers and unify policy definitions.
• Provides a deterministic test matrix using fake clocks and mocked adapters for local verification.

Frameworks & tools

Compatible with any repository containing Express, FastAPI, TypeScript, Python, OpenAPI, GraphQL, or standard HTTP client SDKs.

Why this beats prompting it yourself

Manual review misses the subtle drift between a middleware default and a hard-coded route override. This skill enforces a strict contract register that captures every source of truth, ensuring your patches are reviewable and tests are truly deterministic.

Use cases

• Aligning middleware quotas with OpenAPI specifications and public documentation.
• Fixing SDKs that retry unsafe mutations or ignore Retry-After headers.
• Unifying mixed rate-limit identities like user-based vs tenant-based scopes.
• Standardizing response formats across different service mocks and test suites.

Known limitations

Cannot access live Redis instances, production gateways, or real customer traffic logs. It does not perform production migrations or verify deployed quotas.