New build · Step 1 of 4

What should we build for you today?

Describe the work in plain English. The studio will draft a tech spec, propose an Agent Action Plan, and wait for your approval before any code is written.

Context attached 📄 RFC-118-rate-limits.md × 📐 OpenAPI spec v3.2 × 🔗 Linear: ENG-2104 ×

Estimated plan time: ~6 min · You'll review before code is written.

Recent · 2d ago

Migrate auth service from JWT to OAuth 2.1 with PKCE

● shipped1.2k LOC3 PRs

Recent · 5d ago

Add multi-tenant audit logging across all write endpoints

● shipped3.4k LOC8 PRs

Recent · 1w ago

Refactor billing webhooks for idempotency, add replay tooling

● in review2.1k LOC4 PRs

Plan overview · 14 steps

01 Plan summary & impact

02 Add RateLimit middleware new

03 Tier resolver service new

04 Token bucket store (Redis) new

05 Migrate api_keys schema migration

06 Datadog usage emitter

07 Admin UI: usage inspector

08 Backfill default tier=Free data

09 Update OpenAPI 429 schema

10 Integration tests

11 Load test harness (k6)

12 Update runbook

13 Feature flag rollout plan

14 Last-mile checklist

Out of scope

— Per-endpoint limits

— Customer billing changes

Awaiting human review · 3 issues require your attention

Tiered rate limiting for the public API

Tech spec drafted in 4m 12s · 14 steps · 9 services touched · ~2,400 LOC est. · ~$84 est. compute

Files changed

47

+38 new · 9 modified

Risk score

Medium

2 migrations · 1 breaking

Confidence

94%

Spec ↔ codebase match

Last-mile work

~2 hrs

For your engineers

Implementation steps

— 14 total

02

/services/gateway/middleware/rateLimit.ts

Add token-bucket middleware with tier-aware limits. Reads from Redis, falls back to in-memory. Emits 429 with Retry-After header.

A C Q

05

/db/migrations/0042_add_tier_to_api_keys.sql

⚠ Migration adds NOT NULL tier column to api_keys (1.2M rows). Will lock table in Postgres < 13. Needs your call: backfill strategy.

A C

06

/services/metrics/datadogEmitter.ts

Reuse existing Datadog client. Tag emissions with tier, key_id, route.

C Q

07

/admin-ui/pages/UsageInspector.tsx

⚠ Design dependency: No mockup provided. The agent will scaffold using existing admin patterns — flag for design review post-build.

C Q

10

/tests/integration/rateLimit.spec.ts

Cover: tier resolution, 429 response shape, Retry-After accuracy, Redis failover, key migration backward compat.

Q

Issues to resolve

3 OPEN

High // step 05 · Architect

Adding tier NOT NULL to api_keys (1.2M rows) will lock the table on Postgres < 13. Recommend nullable + backfill + flip pattern. Your call?

Med // step 07 · Code Gen

Admin UI has no design spec. I'll scaffold with the existing <DataTable> pattern. Want me to flag it for design review on completion?

Med // step 13 · QA

Rollout plan suggests %-based traffic shift via LaunchDarkly. Your repo has no LD client — should I add one?

Info // system

Detected 4 similar PRs in the last 90 days touching /services/gateway. Reusing patterns from PR #2841.

Estimated cost: $84.20 · Est. duration: ~9 hrs

⚠ Resolve 3 open issues before approving

Build in progress · Approved 2h 14m ago

Tiered rate limiting for the public API

1,247/3,000

Active agents

38/47

Files completed

6h 12m

Est. remaining

Agent swarm · live

3,000 agents · 1,247 active · 1,753 idle

Code generation · 612

QA & testing · 488

Architecture · 147

Idle · 1,753

Activity stream

LIVE

14:22:08codegen-244Wrote /services/gateway/middleware/rateLimit.ts · +184 LOC

14:22:11qa-091Test suite passed: rateLimit.spec.ts · 24/24 ✓

14:22:14arch-007Verified Redis client compatibility against existing v4.6.x · no breaking changes

14:22:16codegen-301Modified /db/migrations/0042_add_tier_to_api_keys.sql · using safe nullable pattern

14:22:18qa-122Compile check: tierResolver.ts · PASS

14:22:20codegen-577Wrote /admin-ui/pages/UsageInspector.tsx · scaffolded with DataTable, flagged for design review

14:22:23qa-040Runtime validation: 429 response shape matches OpenAPI ✓

14:22:25arch-022Cross-checked: 0 conflicts with PR #2841 patterns

14:22:28codegen-198Wrote /services/metrics/datadogEmitter.ts · reusing existing client

14:22:31systemPre-compile: 38/47 files staged · runtime sandbox boot 0.4s

14:22:33qa-156Load test (k6): p99 = 4.2ms @ 600 rps · within budget

14:22:36codegen-411Updated /openapi/spec.yaml · added 429 response, RateLimit-* headers

Build phases

phase 4 of 7

Codebase ingestion

2.4M LOC mapped

12m

Tech spec generation

14 steps drafted

4m

Plan review

3 issues resolved by you

8m

Code generation

38 / 47 files · 81%

2h 14m

Compile & validate

runtime checks

~45m

QA pass

multi-agent review

~2h

Delivery

PRs + last-mile guide

~10m

Run details

Compute used$28.40

Compute remaining~$55.80

Tokens (input)4.2M

Tokens (output)2.8M

Est. total$84.20

✓ Build complete · 8h 47m

Your code is ready. ~2 hours of last-mile work remains.

The agent generated 4 pull requests across 3 repositories, with a last-mile guide for the work your engineers should finish. Everything is on the aap/rate-limits branch.

Lines written

2,387 LOC

↓ 5% under estimate

Tests passed

142 / 142

100% green

Build cost

$79.10

↓ $5.10 saved

Time vs. manual

~3 wks

→ 8h 47m

Pull requests — 4 ready for review

PR

feat(gateway): tiered rate limiting middleware

policy-engine +1,184 −42 · 18 files · passing CI

#2924

PR

feat(db): api_keys tier column + safe backfill migration

policy-engine +312 −8 · 6 files · passing CI

#2925

PR

feat(metrics): datadog usage emitter + dashboards

observability +418 −12 · 9 files · passing CI

#841

PR

feat(admin-ui): per-key usage inspector (scaffolded — design review needed)

admin-ui +473 −3 · 14 files · passing CI

#1207

Last-mile checklist — for your engineers

⚙

Provision Redis cluster for production

Code is configured for REDIS_URL env var. Provision in your prod environment and add to secrets manager.

infra/terraform/redis.tf · ~15 min

~15m

🎨

Design review for admin UI usage inspector

Scaffolded using existing <DataTable> component. Flag for your design team to apply final styling and confirm IA matches admin patterns.

admin-ui/pages/UsageInspector.tsx · ~1 hr

~1h

🔒

Security review of tier override pathway

Admin can override tier per-key. Recommend SecOps audit of authorization logic before enabling in production.

services/gateway/auth/tierOverride.ts · ~30 min

~30m

📋

Notify customers of Free-tier default

Existing API keys will default to Free tier (60/min). Recommend a 14-day announcement before backfill migration runs.

comms/customer-notice-template.md · ~15 min

~15m