audit-backend-architecture — Distributed-Systems Pattern Maturity Audit

Agents ship the happy-path CRUD and call it done. What decides whether a backend survives scale is the architecture: is there one place that enforces auth/rate-limit/CORS, or is it copy-pasted per route? Does a payment write and its event commit atomically, or can one succeed while the other fails (the dual-write problem)? Does a slow dependency trip a breaker and stay in its own resource pool, or does it exhaust the shared thread/connection pool and take everything down?

This skill works in two lenses:

1. Conformance (Phase 2) — which patterns are present, marked Implemented / Partial / Missing / N/A with file:line.
2. Fit / decision (Phase 3) — for each pattern, Adopt now / Adopt when [trigger] / Defer (premature) given the codebase's actual stage and pains. The most valuable output is often "don't build this yet" — the audit is as much a guard against over-engineering as a gap report.