A2 | Emit create-input shapes (EntityCreate or equivalent) |
A3 | Emit update-input shapes (EntityUpdate or equivalent) |
A9 | Soft-delete semantics (default reads filter deleted rows) |
B1 | Honor required / optional |
B2 | Honor unique |
B3 | Apply validation { } beyond required folding |
B4 | Map semantic types (email, phone, …) distinctly |
D3 | Honor api.cors (config or middleware) |
D4 | Honor api.rate_limit (config or enforcement) |
D5 | Pagination and/or filter/sort on list |
D6 | Typed error responses (4xx/5xx + stable body shape) |
E1 | Auth scheme from app.auth (jwt / api_key / session / oauth) |
E2 | Wire auth into API (security requirements or middleware) |
E3 | Reflect policy create/read/update/delete |
E4 | Predicates: public, authenticated, role(…) |
E5 | Predicates: owner / owner_or_manager(…) |
E6 | Consistent 401/403 denial paths (runtime or contract documents both) |
G1 | Emit job artifacts (callable or schedulable) |
G2 | Emit queue declarations / bindings |
G3 | Wire workflow dispatch |
G4 | Wire workflow notify |
G5 | Wire workflow emit + event types |
G6 | Wire lifecycle hooks (on / before / after) |
G7 | Surface ai_context (emit, embed, or agent-facing artifact) |
H2 | Automated test fixtures or scaffolds |
