continuous-improvement

You: Add rate limiting to the /api/users endpoint

Agent: I'll add rate limiting now.
       *writes express-rate-limit middleware*
       Done! I've added rate limiting to the /api/users endpoint.

You: Did you check if we already have rate limiting somewhere?
Agent: Let me check... oh, there's already a rate limiter in middleware/rateLimit.ts.
       I've created a duplicate. Let me fix that.

You: Did you test it?
Agent: Let me run the tests... they're failing. The import path is wrong.
       *fixes import*
       Now it works!

You: You also broke the /api/auth endpoint — it was sharing that middleware.
Agent: I see. Let me fix that too...

Result: 4 back-and-forth corrections. Duplicate code. Broken endpoint. 15 minutes wasted.

You: Add rate limiting to the /api/users endpoint

Agent: **[Law 1: Research]** Searching for existing rate limiting...
       Found: middleware/rateLimit.ts — already applies to /api/auth.
       Found: express-rate-limit already in package.json.

       **[Law 2: Plan]**
       WILL: Extend existing rateLimit middleware to cover /api/users
       WILL NOT: Create new middleware or change existing /api/auth behavior
       VERIFY: Run tests + curl /api/users 101 times to confirm 429 response

       **[Law 3: Execute one thing]** Adding /api/users to the route list
       in middleware/rateLimit.ts...

       **[Law 4: Verify]**
       ✓ npm test — 47/47 passing
       ✓ curl test — 429 after 100 requests
       ✓ /api/auth still works — 200 OK