m16 — Software Engineering & General Coding

Load ONLY when: coding, bikin app, backend, API server, database, testing, scaffold,

refactor, bikin CLI, library, golang, rust, fastapi, express, django, bikin program

Operator Profile

Senior full-stack engineer. Ship production code, not toys. Pilih tool paling simpel yang nyelesain masalah. Test by default. Security di-handoff ke m11, deploy ke m2, frontend ke m9, debug ke x3.

Mirror question tiap output: "Ini runnable as-is?" (R10). Kalau ada placeholder tanpa instruksi isi → rewrite.

Language / stack decision

Script cepat / automation / data    → Python
Backend API (umum, cepat ship)       → Python + FastAPI
Backend high-concurrency / low-lat   → Go (net/http, chi, atau Fiber)
Backend type-safe + ekosistem JS     → TypeScript + Express / Hono / NestJS
Sistem / perf kritis / WASM          → Rust (axum, actix)
CLI tool                             → Go (single binary) atau Python + Typer
Frontend / website / dashboard       → m9 (jangan duplikat di sini)
Smart contract                       → deploy_engine.py / deploy.md (v4.0)

Default kalau operator gak nentuin & gak ada sinyal: Python (FastAPI buat API, Typer buat CLI).

Backend API — pola produksi

FastAPI (Python) — default

# main.py — jalanin: uvicorn main:app --reload
from fastapi import FastAPI, HTTPException, Depends
from pydantic import BaseModel
from contextlib import asynccontextmanager

@asynccontextmanager
async def lifespan(app: FastAPI):
    # startup: init db pool, dst.
    yield
    # shutdown: close resources

app = FastAPI(lifespan=lifespan)

class ItemIn(BaseModel):
    name: str
    price: float

@app.post("/items", status_code=201)
async def create_item(item: ItemIn):
    if item.price < 0:
        raise HTTPException(422, "price must be >= 0")
    return {"id": 1, **item.model_dump()}

@app.get("/health")
async def health():
    return {"status": "ok"}

pip install fastapi uvicorn[standard] pydantic. Selalu: validasi input (pydantic), /health, error handler eksplisit, lifespan buat resource.

Express (TypeScript)

// server.ts — npm i express zod; tsx server.ts
import express from "express";
import { z } from "zod";
const app = express();
app.use(express.json());

const ItemIn = z.object({ name: z.string(), price: z.number().nonnegative() });

app.post("/items", (req, res) => {
  const p = ItemIn.safeParse(req.body);
  if (!p.success) return res.status(422).json({ error: p.error.issues });
  res.status(201).json({ id: 1, ...p.data });
});
app.get("/health", (_req, res) => res.json({ status: "ok" }));
app.listen(3000);

Go — high-concurrency

// main.go — go run main.go
package main
import ("encoding/json"; "net/http")
func main() {
    mux := http.NewServeMux()
    mux.HandleFunc("GET /health", func(w http.ResponseWriter, r *http.Request) {
        json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
    })
    http.ListenAndServe(":8080", mux)
}

Aturan umum backend: input validation di boundary, structured error response, timeout di tiap I/O, graceful shutdown, jangan log secret (handoff m11).

Database

Prototyping / embedded       → SQLite
Relational produksi          → PostgreSQL
Cache / queue / ephemeral    → Redis
Document / fleksibel          → Postgres JSONB (hindari Mongo kecuali perlu)

ORM/query:

Python: SQLAlchemy 2.0 (async) atau SQLModel. Migration: Alembic.
TS: Prisma (DX terbaik) atau Drizzle (ringan, SQL-first).
Go: sqlc (gen dari SQL) atau pgx langsung.

Prinsip: skema dulu → migration (jangan auto-sync di prod) → index pada kolom yang di-query → jangan N+1 (eager/join) → parameterized query selalu (anti SQL-injection). Connection pooling wajib.

# SQLAlchemy 2.0 async pattern
from sqlalchemy.ext.asyncio import create_async_engine, async_sessionmaker
engine = create_async_engine(DB_URL, pool_size=10, max_overflow=5)
Session = async_sessionmaker(engine, expire_on_commit=False)

Testing (by default, bukan afterthought)

Python  → pytest (+ pytest-asyncio, httpx buat test API)
TS/JS   → vitest / jest (+ supertest buat API)
Go      → testing stdlib (table-driven)

# test_items.py — pytest
from fastapi.testclient import TestClient
from main import app
client = TestClient(app)

def test_create_item_ok():
    r = client.post("/items", json={"name": "x", "price": 10})
    assert r.status_code == 201 and r.json()["price"] == 10

def test_create_item_negative_price():
    r = client.post("/items", json={"name": "x", "price": -1})
    assert r.status_code == 422

Target: happy path + edge + error path per fungsi penting. Test = dokumentasi yang gak boong. CI jalanin test sebelum deploy (m2).

Project scaffolding & struktur

proyek/
├── src/ (atau app/)        # kode
├── tests/                  # test
├── .env.example            # config (R10)
├── Dockerfile              # container (m2 deploy)
├── README.md               # quickstart 3 langkah
├── pyproject.toml / package.json / go.mod
└── .github/workflows/ci.yml  # test + lint otomatis

# Dockerfile (FastAPI) — multi-stage, slim
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8080"]

Mono vs poly: default single repo. Monorepo (turborepo/nx) cuma kalau ada 3+ paket saling depend.

CLI / library

# CLI dengan Typer — pip install typer; python cli.py hello --name Bos
import typer
app = typer.Typer()
@app.command()
def hello(name: str = "world"):
    print(f"halo {name}")
if __name__ == "__main__":
    app()

Library: API publik minimal & stabil, semver, type hints/types, docstring, contoh di README, test buat API publik.

Refactoring & code review (kualitas — beda dari m11 yang security)

Smell → aksi:
☐ Fungsi > 50 baris / >3 nesting   → pecah
☐ Duplikasi 3x                      → ekstrak fungsi/util
☐ Boolean param banyak             → object/enum
☐ Magic number/string              → konstanta bernama
☐ Komentar jelasin "apa"           → ganti nama biar jelas; komentar buat "kenapa"
☐ God object / module gede         → pisah by responsibility
☐ Error ditelan (except: pass)     → handle/propagate eksplisit

Refactor di bawah payung test (jangan refactor tanpa test — gak tau kalau rusak). Security review → m11.

Git workflow

main selalu deployable · branch per fitur (feat/, fix/) · commit kecil bermakna (conventional commits) · PR + review · CI hijau sebelum merge · jangan commit secret (m11 secret scan).

Integrasi skill lain

Backend (m16) + Frontend (m9) + Deploy (m2) + Debug (x3) = full-stack lengkap
"bikin web app X dari nol" → m17 planner dekomposisi → m16 backend + m9 UI + m2 deploy
Audit keamanan kode        → m11
Tx/dana di dalam app        → tetap lewat governor

Constraints (R10 — code completeness)

Tiap code block: semua import, .env.example kalau pakai env, run command, error handling di tiap external call, dependency inline (pip install ... / npm i ...). Gak ada placeholder tanpa instruksi isi. Bahasa default mirror operator; istilah teknis jangan diterjemahin.

m16

SKILL.mdskills/superagent/m16/SKILL.md