coding-os 0.3.2__py3-none-any.whl

templates/angular/scaffold/src/frontend/angular.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "./node_modules/@angular/cli/lib/config/schema.json",
+  "version": 1,
+  "cli": {
+    "packageManager": "npm"
+  },
+  "projects": {
+    "{{PROJECT_NAME}}-frontend": {
+      "projectType": "application",
+      "root": "",
+      "sourceRoot": "src",
+      "prefix": "app",
+      "architect": {
+        "build": {
+          "builder": "@angular/build:application",
+          "options": {
+            "browser": "src/main.ts",
+            "index": "src/index.html",
+            "tsConfig": "tsconfig.app.json",
+            "styles": ["src/styles.css"]
+          },
+          "configurations": {
+            "production": {
+              "budgets": [
+                { "type": "initial", "maximumWarning": "500kB", "maximumError": "1MB" },
+                { "type": "anyComponentStyle", "maximumWarning": "4kB", "maximumError": "8kB" }
+              ],
+              "outputHashing": "all"
+            },
+            "development": {
+              "optimization": false,
+              "extractLicenses": false,
+              "sourceMap": true
+            }
+          },
+          "defaultConfiguration": "production"
+        },
+        "serve": {
+          "builder": "@angular/build:dev-server",
+          "configurations": {
+            "production": { "buildTarget": "{{PROJECT_NAME}}-frontend:build:production" },
+            "development": { "buildTarget": "{{PROJECT_NAME}}-frontend:build:development" }
+          },
+          "defaultConfiguration": "development"
+        },
+        "test": {
+          "builder": "@angular/build:unit-test"
+        }
+      }
+    }
+  }
+}

templates/angular/scaffold/src/frontend/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "{{PROJECT_NAME}}-frontend",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "ng serve",
+    "build": "ng build",
+    "lint": "tsc -p tsconfig.app.json --noEmit",
+    "test": "ng test --watch=false"
+  },
+  "dependencies": {
+    "@angular/common": "^22.0.0",
+    "@angular/compiler": "^22.0.0",
+    "@angular/core": "^22.0.0",
+    "@angular/platform-browser": "^22.0.0",
+    "@angular/router": "^22.0.0",
+    "rxjs": "~7.8.0",
+    "tslib": "^2.6.0"
+  },
+  "devDependencies": {
+    "@angular/build": "^22.0.5",
+    "@angular/cli": "^22.0.5",
+    "@angular/compiler-cli": "^22.0.0",
+    "jsdom": "^28.0.0",
+    "typescript": "~6.0.2",
+    "vitest": "^4.0.8"
+  }
+}

templates/angular/scaffold/src/frontend/src/app/app.component.ts

@@ -0,0 +1,19 @@
+import { Component, ChangeDetectionStrategy } from "@angular/core";
+import { RouterOutlet } from "@angular/router";
+
+// Root standalone component — shell only, no business logic.
+@Component({
+  selector: "app-root",
+  standalone: true,
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [RouterOutlet],
+  template: `
+    <main>
+      <h1>{{ title }}</h1>
+      <router-outlet />
+    </main>
+  `,
+})
+export class AppComponent {
+  readonly title = "{{PROJECT_NAME}}";
+}

templates/angular/scaffold/src/frontend/src/app/app.config.ts

@@ -0,0 +1,22 @@
+import {
+  ApplicationConfig,
+  ErrorHandler,
+  provideBrowserGlobalErrorListeners,
+} from "@angular/core";
+import { provideHttpClient } from "@angular/common/http";
+import { provideRouter } from "@angular/router";
+
+import { GlobalErrorHandler } from "./core/global-error-handler";
+import { routes } from "./app.routes";
+
+// The DI root — wires application-wide providers only, no logic.
+// Zoneless by default (no zone.js); the global ErrorHandler is the
+// ONLY error-response shaper.
+export const appConfig: ApplicationConfig = {
+  providers: [
+    provideBrowserGlobalErrorListeners(),
+    provideRouter(routes),
+    provideHttpClient(),
+    { provide: ErrorHandler, useClass: GlobalErrorHandler },
+  ],
+};

templates/angular/scaffold/src/frontend/src/app/app.routes.ts

@@ -0,0 +1,8 @@
+import { Routes } from "@angular/router";
+
+import { HealthComponent } from "./health/health.component";
+
+// Standalone routes — lazy-load feature components as the app grows.
+export const routes: Routes = [
+  { path: "", component: HealthComponent },
+];

templates/angular/scaffold/src/frontend/src/app/core/global-error-handler.ts

@@ -0,0 +1,12 @@
+import { ErrorHandler, Injectable } from "@angular/core";
+
+// The ONLY place that shapes an unhandled error (parallel to a backend's
+// global exception filter). Logs full detail; UI surfaces a generic message
+// and never renders a raw server/stack string to the user.
+@Injectable()
+export class GlobalErrorHandler implements ErrorHandler {
+  handleError(error: unknown): void {
+    const detail = error instanceof Error ? error.stack ?? error.message : String(error);
+    console.error("[{{PROJECT_NAME}}] unhandled error:", detail);
+  }
+}

templates/angular/scaffold/src/frontend/src/app/health/health.component.ts

@@ -0,0 +1,14 @@
+import { Component, ChangeDetectionStrategy, inject } from "@angular/core";
+
+import { HealthService } from "./health.service";
+
+// Standalone, presentation-only: reads a signal from the service and renders.
+@Component({
+  selector: "app-health",
+  standalone: true,
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  template: `<p role="status">status: {{ health.status() }}</p>`,
+})
+export class HealthComponent {
+  protected readonly health = inject(HealthService);
+}

templates/angular/scaffold/src/frontend/src/app/health/health.service.spec.ts

@@ -0,0 +1,16 @@
+import { TestBed } from "@angular/core/testing";
+
+import { HealthService } from "./health.service";
+
+// Sample unit test — proves `ng test` (the @angular/build:unit-test builder
+// on Vitest + jsdom) runs green day-one. Services stay presentation-free, so
+// they are testable in isolation with no TestBed component fixture.
+describe("HealthService", () => {
+  beforeEach(() => TestBed.configureTestingModule({}));
+
+  it("reports ok status", () => {
+    const service = TestBed.inject(HealthService);
+
+    expect(service.status()).toBe("ok");
+  });
+});

templates/angular/scaffold/src/frontend/src/app/health/health.service.ts

@@ -0,0 +1,10 @@
+import { Injectable, signal } from "@angular/core";
+
+// Injectable service — owns state (signals) and side effects, so the
+// component stays presentation-only and the service is testable in isolation.
+@Injectable({ providedIn: "root" })
+export class HealthService {
+  private readonly _status = signal<string>("ok");
+
+  readonly status = this._status.asReadonly();
+}

templates/angular/scaffold/src/frontend/src/index.html

@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>{{PROJECT_NAME}}</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+  </head>
+  <body>
+    <app-root></app-root>
+  </body>
+</html>

templates/angular/scaffold/src/frontend/src/main.ts

@@ -0,0 +1,9 @@
+import { bootstrapApplication } from "@angular/platform-browser";
+
+import { AppComponent } from "./app/app.component";
+import { appConfig } from "./app/app.config";
+
+// Entry point — no logic. Providers live in appConfig (the DI root).
+bootstrapApplication(AppComponent, appConfig).catch((err) =>
+  console.error("{{PROJECT_NAME}} failed to bootstrap", err),
+);

templates/angular/scaffold/src/frontend/src/styles.css

@@ -0,0 +1,14 @@
+:root {
+  color-scheme: light dark;
+  font-family: system-ui, sans-serif;
+}
+
+body {
+  margin: 0;
+}
+
+main {
+  max-width: 60rem;
+  margin: 0 auto;
+  padding: 1.5rem;
+}

templates/angular/scaffold/src/frontend/tsconfig.app.json

@@ -0,0 +1,8 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "types": []
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["src/**/*.spec.ts"]
+}

templates/angular/scaffold/src/frontend/tsconfig.json

@@ -0,0 +1,27 @@
+{
+  "compileOnSave": false,
+  "compilerOptions": {
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "noImplicitOverride": true,
+    "noPropertyAccessFromIndexSignature": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "experimentalDecorators": true,
+    "importHelpers": true,
+    "target": "ES2022",
+    "module": "preserve"
+  },
+  "angularCompilerOptions": {
+    "strictTemplates": true,
+    "strictInjectionParameters": true,
+    "strictInputAccessModifiers": true
+  },
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.app.json" },
+    { "path": "./tsconfig.spec.json" }
+  ]
+}

templates/angular/scaffold/src/frontend/tsconfig.spec.json

@@ -0,0 +1,8 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./out-tsc/spec",
+    "types": ["vitest/globals"]
+  },
+  "include": ["src/**/*.d.ts", "src/**/*.spec.ts"]
+}

templates/angular/scaffold-boundary.yaml

@@ -0,0 +1,27 @@
+# Scaffold boundary for the angular stack.
+# Schema: docs/governance/scaffold-boundary-contract.md
+
+version: 1
+stack: angular
+
+roots:
+  - src/frontend/
+
+file_patterns:
+  - "src/frontend/**/*.ts"
+  - "src/frontend/**/*.html"
+  - "src/frontend/**/*.css"
+  - "src/frontend/**/*.json"
+
+imports_from:
+  - src/shared/
+  - src/shared/types/
+  - src/shared/contracts/
+
+forbids_writing_in:
+  - src/backend/
+  - src/mobile/
+
+notes:
+  - "Components are standalone and presentation-only; services own state and side effects."
+  - "One global ErrorHandler is the only error shaper; components never format raw errors for users."

templates/angular/skills/angular/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: angular
+tier: stack
+domain: [frontend]
+description: Use when creating or modifying TypeScript/HTML/CSS files under src/frontend/ in an Angular SPA — standalone components, injectable services, signals, RxJS streams, routes, guards, interceptors, and their tests. Triggers on any .ts/.html change under src/frontend/. Covers standalone bootstrap, signal-driven change detection, service-owned state and side effects, the global ErrorHandler, and component testing with TestBed. Stack-agnostic UI patterns live in the core frontend-fundamentals skill.
+globs: "src/frontend/**/*.{ts,html}"
+depends_on:
+  - clean-code
+  - frontend-fundamentals
+  - a11y
+last_reviewed: "2026-06-14"
+---
+
+REQUIRED BACKGROUND: You MUST also follow the core `frontend-fundamentals` skill (stack-agnostic UI patterns — three-state async, accessibility, SEO), `a11y`, and `clean-code`. This skill adds ONLY Angular-specific patterns on top.
+
+# angular
+
+## Layer contract (matches `structure.tree`)
+
+| Layer | May import | Never |
+|---|---|---|
+| `*.component.ts` | feature service, child components, signals | `HttpClient`, shared mutable state, sibling services' internals |
+| `*.service.ts` | `HttpClient`, other services, RxJS | `@Component` APIs, the DOM, components |
+| `core/` (error handler, guards, interceptors) | services (for auth/config lookups) | feature components |
+| `app.config.ts` / `app.routes.ts` | providers, route targets | business logic |
+
+Components stay presentation-only — no `HttpClient`, no shared mutable state — so
+they are testable in isolation and a data-source swap is a service-layer-only
+change.
+
+## Standalone & bootstrap
+
+- Every component is `standalone: true` and declares its own `imports`. No
+  `@NgModule` anywhere in this stack.
+- The app boots via `bootstrapApplication(AppComponent, appConfig)` in `main.ts`
+  (no logic). Application-wide providers live in `app.config.ts` — the DI root.
+- Routes are a flat `Routes` array in `app.routes.ts`; lazy-load non-trivial
+  features with `loadComponent`.
+
+## State & change detection
+
+- Drive the view with `signal`/`computed`/`effect`; pair every component with
+  `ChangeDetectionStrategy.OnPush`.
+- A service owns shared/global state via signals exposed as `asReadonly()`; the
+  component reads them and never mutates global state directly.
+- Pass data in with typed `input()`, changes out with `output()`; no two-way
+  mutation of shared state from a child. Manual `detectChanges()` in feature
+  code signals a missing signal.
+
+## Services & DI
+
+- Data access and side effects live in `@Injectable({ providedIn: "root" })`
+  services using `HttpClient` + RxJS — never in a component.
+- Inject with `inject()` or constructor params; never `new` a service — that
+  bypasses the injector and breaks test overrides.
+- Surface config through a typed service; never read globals (`window`,
+  `import.meta.env`) deep inside a component.
+
+## Error handling
+
+- ONE global `ErrorHandler` (`core/global-error-handler.ts`) logs full detail.
+  The UI shows a generic, mapped message — never a raw server/stack string.
+  Map API error codes to user-facing i18n keys at the display boundary.
+
+## RxJS & teardown
+
+- Prefer the `async` pipe in the template over manual `subscribe`.
+- A manually-subscribed stream MUST tear down via `takeUntilDestroyed()` (or an
+  explicit `Subscription` cleared in the destroy hook) — an unmanaged
+  subscription leaks.
+
+## Testing
+
+- Services: pure unit tests — exercise signals/streams with stubbed `HttpClient`,
+  no DOM.
+- Components/e2e: `TestBed.configureTestingModule({...})` then render and assert
+  one interaction, one happy + one error path per feature minimum.
+- Never depend on real network or timers; provide stubs through the testing
+  injector.

templates/angular/skills/angular/references/anatomy.md

@@ -0,0 +1,69 @@
+<!-- domain:ANGULAR | layer:reference | ssot:true | updated:2026-06-27 -->
+# Angular Anatomy
+
+> P: Canonical file map + entity recipes for the Angular (standalone, signals) stack.
+> R: Adding any `.ts`/`.html`/`.css` under `src/frontend/`, or routing a frontend task.
+> S: Reading backend / mobile code — wrong stack.
+> N: [SKILL.md](../SKILL.md), [scaffold-boundary.yaml](../../../scaffold-boundary.yaml)
+
+> Nav: [Skill](../SKILL.md)
+
+---
+
+## 1. Boundary
+
+SSOT: `src/templates/angular/scaffold-boundary.yaml`.
+
+## 2. Layout map
+
+| Pattern | Location | Naming | Imports from | Description |
+|---|---|---|---|---|
+| Component | `src/app/<feature>/<feature>.component.ts` | `<feature>.component.ts` | its service | Standalone, signal-driven view; presentation only |
+| Service / state | `src/app/<feature>/<feature>.service.ts` | `<feature>.service.ts` | `HttpClient` | Injectable state (signals) + data access (RxJS) |
+| Routes | `src/app/app.routes.ts` | `app.routes.ts` | components | `provideRouter`, lazy `loadComponent` |
+| Core | `src/app/core/` | `<name>.ts` | none | Global ErrorHandler, interceptors, guards |
+| Bootstrap | `src/main.ts` | `main.ts` | `app.config` | `bootstrapApplication` — no logic |
+| Test | `<file>.spec.ts` | `<file>.spec.ts` | source under test | Colocated unit / component spec |
+
+## 3. Entity recipes
+
+### Add a new component
+- **Trigger:** "add a `<feature>` view / page".
+- **Files emitted:**
+  1. `src/app/<feature>/<feature>.component.ts`
+  2. `src/app/<feature>/<feature>.component.html`
+  3. `src/app/<feature>/<feature>.component.spec.ts`
+- **Steps:**
+  1. `@Component({standalone: true})`; `inject()` the service.
+  2. Read state from `signal()`s; send user intent to the service.
+  3. Register a lazy route in `app.routes.ts`.
+
+### Add a new service / state
+- **Trigger:** "share state", "call the API".
+- **Files emitted:**
+  1. `src/app/<feature>/<feature>.service.ts`
+  2. `src/app/<feature>/<feature>.service.spec.ts`
+- **Steps:**
+  1. `@Injectable({providedIn: 'root'})`; hold state in signals.
+  2. Data access via `HttpClient`; let the global ErrorHandler shape failures.
+
+### Add a new test
+- **Trigger:** any new component / service.
+- **Files emitted:** `<file>.spec.ts` next to source.
+- **Steps:**
+  1. `TestBed.configureTestingModule` with the standalone component.
+  2. Assert rendered signal state + service interaction.
+
+## 4. Conventions
+
+#### Naming
+- Files: `kebab-case.component.ts`, `kebab-case.service.ts`.
+- Classes: `PascalCase` (`UserListComponent`); signals: `camelCase`.
+
+#### Test colocation
+- Colocated: `user.component.spec.ts` sits next to `user.component.ts`.
+
+#### Dependency rules
+- ✓ component → service → `HttpClient`.
+- ✗ component never calls `HttpClient` directly.
+- ✗ `src/frontend/` never imports from `src/backend/` / `src/mobile/` — share via `src/shared/`.

templates/angular/stack.yaml

@@ -0,0 +1,75 @@
+version: 1
+id: angular
+language: typescript
+label: "Angular + TypeScript"
+category: frontend
+
+structure:
+  root: src/frontend
+  tree: |
+    src/frontend/
+    ├── package.json
+    ├── tsconfig.json
+    ├── angular.json
+    └── src/
+        ├── main.ts              # bootstrapApplication entry (no logic)
+        ├── app/
+        │   ├── app.config.ts    # application providers (DI root) — no logic
+        │   ├── app.component.ts # root standalone component
+        │   ├── core/            # cross-cutting: error handler, interceptors, guards
+        │   └── <feature>/       # one folder per domain
+        │       ├── <feature>.component.ts  # standalone, signal-driven view
+        │       └── <feature>.service.ts    # injectable state + data access (RxJS)
+        └── styles.css
+  notes: "standalone components only (no NgModules); state via signals; data + side effects in injectable services (RxJS); one global ErrorHandler is the ONLY error shaper; routing via provideRouter"
+primary_skill: angular
+skills: [angular]
+
+# VERIFY_FRONTEND_* override the "(none)" defaults from base.yaml.
+substitutions:
+  DOMAIN_ROUTES: "Frontend→`docs/playbooks/angular-app.md`"
+  SKILL_ROUTES: "Frontend→`angular`"
+  ENGINEERING_RULE_ROUTING: "Frontend→`docs/engineering/angular-rules.md`, a11y→`docs/engineering/angular-rules.md`"
+  TOOL_ROUTING_IMPL: "`lint-frontend`, `build-frontend`"
+  VERIFY_FRONTEND_GLOB: "`src/frontend/`"
+  VERIFY_FRONTEND_SUITES: "lint-frontend + test-frontend"
+  VERIFY_FRONTEND: "`cd src/frontend && npm run lint && npm test`"
+  QUICK_ROUTING: |-
+    - Angular component / signal task → [Angular App Playbook](./playbooks/angular-app.md)
+    - Service / state / RxJS task → [Angular App Playbook](./playbooks/angular-app.md)
+    - Route / guard / interceptor task → [Angular App Playbook](./playbooks/angular-app.md)
+  STACK_REF_CODES: |-
+    - `REF:PLAYBOOK-ANGULAR` → `./playbooks/angular-app.md`
+    - `REF:ANGULAR-RULES` → `./engineering/angular-rules.md`
+    - `REF:A11Y` → `./engineering/accessibility.md`
+
+ref_codes:
+  - {code: "REF:PLAYBOOK-ANGULAR", path: "./playbooks/angular-app.md",        desc: "Angular app playbook"}
+  - {code: "REF:ANGULAR-RULES",    path: "./engineering/angular-rules.md",    desc: "Angular engineering rules"}
+  - {code: "REF:A11Y",             path: "./engineering/accessibility.md", desc: "Accessibility checklist"}
+
+routing_entries:
+  - "Angular component / signal task → [Angular App Playbook](./playbooks/angular-app.md)"
+  - "Service / state / RxJS task → [Angular App Playbook](./playbooks/angular-app.md)"
+
+rules:
+  - {file: rules/frontend.md, globs: ["src/frontend/**/*.{ts,html,css}"]}
+
+makefile_targets:
+  - {name: lint-frontend,  cmd: "npx --yes eslint . && cd src/frontend && npm run lint"}
+  - {name: build-frontend, cmd: "cd src/frontend && npm run build"}
+  - {name: test-frontend,  cmd: "cd src/frontend && npm test"}
+
+verify:
+  - {glob: "src/frontend/**/*.ts", suites: "lint-frontend + test-frontend", cmd: "npx --yes eslint . && cd src/frontend && npm run lint && npm test"}
+
+dimensions:
+  - {name: "Angular component",     read_files: ["docs/playbooks/angular-app.md", "docs/engineering/angular-rules.md"]}
+  - {name: "Route / page",          read_files: ["docs/playbooks/angular-app.md", "docs/engineering/angular-rules.md"]}
+  - {name: "Service / state",       read_files: ["docs/engineering/angular-rules.md"]}
+  - {name: "Accessibility",         read_files: ["docs/engineering/angular-rules.md"]}
+
+skill_enforcement:
+  - {globs: ["src/frontend/**/*.ts"], primary: angular, secondary: [clean-code, frontend-fundamentals, a11y, state-management, testing-strategy, performance]}
+  - {globs: ["src/frontend/**/*.component.ts"], primary: angular, secondary: [clean-code, frontend-fundamentals, a11y]}
+  - {globs: ["src/frontend/**/*.service.ts"], primary: angular, secondary: [state-management, clean-code, frontend-fundamentals]}

templates/aspnet-core/rules/backend.md

@@ -0,0 +1,20 @@
+---
+globs: ["src/backend/**/*.cs"]
+alwaysApply: false
+---
+
+# ASP.NET Core Backend Rules (auto-loaded on src/backend/**/*.cs)
+
+When editing any C# file under `src/backend/` in an ASP.NET Core project, follow these standards:
+
+- **Endpoint signature** — minimal-API handlers take the DTO + injected services as parameters and return a typed value or `Results.*`. No response envelope built by hand.
+- **Typed errors** — throw a typed exception (domain or `HttpException`-equivalent); a single `ExceptionHandlingMiddleware` maps it to the RFC 9457 problem shape `{type, title, status}`. Never write an error body anywhere else.
+- **Cancellation** — flow `CancellationToken` from the endpoint into every downstream DB / HTTP call so cancellation propagates.
+- **Validation** — validate request DTOs (DataAnnotations or FluentValidation); reject fail-closed with field-level details. No raw model binding without validation reaching a service.
+- **Middleware order** — exception handling → routing → cors → auth → endpoints. Never put business logic in middleware.
+- **Tests** — every endpoint gets `WebApplicationFactory<Program>` coverage, happy + error paths; services get host-free unit tests.
+- **Separation** — Features/, Services, Repositories, Data/. Endpoints don't talk to the `DbContext` directly — services / repositories do.
+
+Canonical policy: `docs/engineering/aspnet-core-rules.md`
+Playbook: `docs/playbooks/aspnet-core-service.md`
+Primary skill: `aspnet-core`

templates/aspnet-core/scaffold/docs/engineering/aspnet-core-rules.md

@@ -0,0 +1,36 @@
+<!-- domain:BACKEND | layer:rules | ssot:true | updated:{{DATE}} -->
+# ASP.NET Core Engineering Rules
+
+Purpose: Non-negotiable conventions for the {{PROJECT_NAME}} ASP.NET Core backend.
+Read when: Editing anything under `src/backend/`.
+Skip when: Frontend/mobile work.
+Read next: [ASP.NET Core Service Playbook](../playbooks/aspnet-core-service.md)
+
+> Nav: [Master Index](../00-index.md)
+
+## Hard rules
+
+1. **Layering** — endpoint → service → repository, imports flow one way only
+   (the table in the `aspnet-core` skill is the SSOT).
+2. **Transport-free services** — a service importing `HttpContext` or building a
+   response is a build-blocking review finding.
+3. **One error shaper** — only the global `ExceptionHandlingMiddleware` writes
+   error bodies; it logs full detail and returns the problem shape with no
+   internals (no stack traces, no driver messages).
+4. **Validation fail-closed** — every input is a validated DTO; an unvalidated
+   body never reaches a service.
+5. **Dependency injection** — register services in `Program.cs` and inject by
+   constructor / endpoint parameter; never `new` a service — it bypasses the
+   container and breaks test overrides.
+6. **Nullable + warnings-as-errors** — `<Nullable>enable</Nullable>` and
+   `TreatWarningsAsErrors` are the lint gate; a `!` null-forgiving operator
+   requires a written justification at the call site.
+7. **No floating config** — bind configuration once at bootstrap via the options
+   pattern (`IOptions<T>`); services receive typed options, never read raw
+   configuration keys.
+
+## Testing bar
+
+Services ≥ unit-tested per public method (no host); endpoints ≥ happy + error
+path via `WebApplicationFactory<Program>`; repositories integration-tested
+against a disposable database.

templates/aspnet-core/scaffold/docs/playbooks/aspnet-core-service.md

@@ -0,0 +1,40 @@
+<!-- domain:BACKEND | layer:playbook | ssot:true | updated:{{DATE}} -->
+# ASP.NET Core Service Playbook
+
+Purpose: The end-to-end recipe for adding or changing an ASP.NET Core endpoint in {{PROJECT_NAME}}.
+Read when: Any task that adds an endpoint, controller, service, middleware, or DTO.
+Skip when: Pure infra/devops work — see the deployment docs.
+Read next: [ASP.NET Core Engineering Rules](../engineering/aspnet-core-rules.md), [Error Format](../api-contracts/error-format.md)
+
+> Nav: [Master Index](../00-index.md)
+
+## Add an endpoint (the only sanctioned path)
+
+1. **Contract first** — define the request/response DTOs as records; error cases
+   use the shared problem format ([error-format](../api-contracts/error-format.md)).
+2. **Feature folder** — `src/backend/Features/<Feature>/` holds the endpoints +
+   service for one domain; nothing else reaches into it.
+3. **Endpoints** — `<Feature>Endpoints.cs`: bind/validate the DTO, call exactly
+   one service method, return the value. No response envelope built by hand.
+4. **Service** — `<Feature>Service.cs`: business logic only, no `HttpContext` and
+   no transport types, typed domain exceptions on failure.
+5. **Repository** — data access for one aggregate; services never touch the
+   `DbContext` directly.
+6. **Wire** — register the service in `Program.cs` and call `<Feature>Endpoints.Map(app)`.
+7. **Test** — unit-test the service (no host) + `WebApplicationFactory<Program>`
+   integration-test the endpoint (happy + error path).
+8. **Verify** — `cd src/backend && dotnet format --verify-no-changes && dotnet test`.
+
+## Global wiring (set once in `Program.cs`)
+
+`builder.Services.Add*` registrations → `app.UseMiddleware<ExceptionHandlingMiddleware>()`
+runs first so every downstream handler inherits one error shape.
+
+## Anti-patterns
+
+- Error JSON built inside an endpoint — the middleware owns the shape.
+- A service importing `HttpContext`/`IHttpContextAccessor` — that layer must stay
+  transport-free.
+- `new SomeService()` instead of constructor / parameter injection — bypasses the
+  container and breaks test overrides.
+- Binding a real port in tests — always build through `WebApplicationFactory<Program>`.

templates/aspnet-core/scaffold/src/backend/Backend.csproj

@@ -0,0 +1,11 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>{{PROJECT_NAME}}</RootNamespace>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+  </PropertyGroup>
+
+</Project>