Domain structure and dependencies
New domains normally contain models, repository, service, and routes modules. Add parsers, builders, or provider modules only for a real responsibility. Use dependency injection and the shared PostgreSQL delegate for ordinary persistence.
HTTP and models
Use conventional status codes: 200/201/204 for success, 400 for business preconditions, 401 for unauthenticated, 403 for known unauthorized actions, 404 for missing or concealed tenant resources, 409 for state or uniqueness conflicts, and 422 for schema validation. Keep database models and API DTOs distinct.
Authorization is part of data access
Any Agent or subordinate-resource query must reuse the accessible-Agent pattern before count and pagination. Mutations resolve effective Permissions from current state. Never trust role names, client flags, or cached grants.
Review and completion
Review correctness first, then contract safety, tenancy and authorization, transaction/external failure behavior, test gaps, and maintainability. Finish with focused checks, required migrations, current documentation, and no unrelated refactor or style churn.