mir-backend-python-flasklisted

Make It Right (Flask module). Flask 3.1 + Werkzeug 3.1 specific reliability augmentation. Use alongside the mir-backend skill when the target stack is Flask — it carries the mechanical footguns that the framework-agnostic skill deliberately omits: app/request context misuse (current_app/request/g outside a context, background threads, Celery tasks), missing input validation and object-level authorization, SQLAlchemy session scoping and teardown, the app-factory pattern and circular imports, offloading heavy work to Celery/RQ, Flask 3.1 config safety (SECRET_KEY_FALLBACKS key rotation, TRUSTED_HOSTS after the SERVER_NAME behaviour change, MAX_CONTENT_LENGTH / MAX_FORM_MEMORY_SIZE / MAX_FORM_PARTS, debug-mode RCE), Alembic migration safety via Flask-Migrate, and Flask's own 2026 advisories. TRIGGER only when the Python backend stack is Flask — building, reviewing, or debugging a Flask route, blueprint, extension, SQLAlchemy session, or Flask-Migrate revision. Always loads TOGETHER WITH mir-backend (the gates) a
anantbhandarkar/make-it-right · ★ 15 · API & Backend · score 81

Install: claude install-skill anantbhandarkar/make-it-right

# /mir-backend-python-flask · Make It Right (Flask) Bottom tier of the chain: `mir-backend` (generic gates) → `mir-backend-python` (CPython runtime model) → **this** (Flask library mechanics). Run the gates first; load the Python runtime tier for the concurrency/process model; reach for *this* at Gate 5 (design mechanics), Gate 6 (implementation), and Gate 7 review. **Runtime-level concerns (GIL, async-vs-sync, blocking the event loop, fork-safe pools, cold start) live in `mir-backend-python` — not here.** **Stack assumed**, versions verified 13 Aug 2026: Flask **3.1.3** (released 18 Feb 2026; requires Python ≥3.9) · Werkzeug **3.1.8** · Flask-SQLAlchemy over SQLAlchemy **2.0.52** · PostgreSQL · Flask-Migrate / Alembic **1.19.1** · Celery or RQ for background work. If the project uses bare SQLAlchemy with a `scoped_session` instead of Flask-SQLAlchemy, apply the session-scoping rules directly — the pattern is the same, the scaffold differs. **Flask 3.1 changed `SERVER_NAME` semantics and added several limit settings** — see item 6; a codebase written against 3.0 has a real gap. ## The Flask footguns AI walks into most These are the stack-specific cousins of the failure-mode catalog. Each is something Flask code gets wrong even when the *logic* is right. ### 1. App and request context — the three magic proxies and where they die `current_app`, `request`, and `g` are context-local proxies that only resolve inside an active application or request context. Using them at imp