BE hyperstack: add python-pro-coder skill

[KailasMahavarkar]

Adds python-pro-coder, the server-side counterpart to react-pro-coder (#138): 60 rules with stable IDs for FastAPI + Pydantic v2 + SQLAlchemy 2.0 services, plus the process gates (environment check, task classification, layered architecture order, output contract, negative-doubt pass). Hyperstack has no Python MCP plugin, so the ground truth this skill would otherwise call for lives in references/STACK-2026.md: version-checked facts with the date they were verified and the sources they came from.

The Iron Law is version freshness

The Python API ecosystem rots faster than model memory updates, and the stale answers are the confident ones. Four of them are wrong today and were right in 2023, which is exactly why a rule file beats recall here.

What an agent recalls	Reality, verified 2026-09-04
python-jose for JWT	Abandoned, CVE-2024-33664 (JWE decompression DoS). FastAPI's own docs moved to PyJWT
passlib[bcrypt] for hashing	Unmaintained, breaks on Python 3.13+. pwdlib is the replacement
@app.on_event("startup")	Deprecated since FastAPI 0.93. lifespan context manager
AsyncClient(app=app) in tests	Deprecated in httpx. AsyncClient(transport=ASGITransport(app=app))
Annotated[bool, Query(default=False)]	Raises AssertionError at import. Default goes on the parameter with =

Current versions recorded in the same file: FastAPI 0.141.1 (Python >= 3.10), Pydantic 2.13.5, pydantic-settings 2.15.0, SQLAlchemy 2.0.52, Python 3.14.7 stable with free-threading officially supported (PEP 779).

Rule set

Domain	IDs	Reference
Project structure	PS-1..PS-5	references/PROJECT-STRUCTURE.md
Pydantic v2	PD-1..PD-8	references/PYDANTIC.md
Endpoint design	EP-1..EP-6	references/ENDPOINTS.md
Settings and validation	CF-1..CF-5	references/CONFIG-VALIDATION.md
Dependency injection	DI-1..DI-4	references/DEPENDENCIES.md
Async and performance	AS-1..AS-5	references/ASYNC-PERFORMANCE.md
Security	SE-1..SE-6	references/SECURITY.md
Error handling	ER-1..ER-4	references/ERRORS.md
Database and ORM	DB-1..DB-5	references/DATABASE.md
Testing and quality	TQ-1..TQ-5	references/TESTING.md
Production and observability	OB-1..OB-7	references/OBSERVABILITY.md

Conflicts resolved in the source material

Conflict	Resolution
Session dependency commits (source rule 27) vs transactions owned by the service (source rule 48)	DI-3 + DB-5: the dependency yields, rolls back, and closes; the service commits. A dependency that commits on the way out commits whatever the handler left behind and removes the service's ability to make two writes one unit
Module-level settings = Settings() vs @lru_cache get_settings()	CF-2: pick the dependency form, because app.dependency_overrides can replace it in tests and a module singleton cannot without monkeypatching
Bare except: in the session dependency	DI-3: except Exception:. A bare except swallows CancelledError and turns shutdown into a hang
Open choices presented as settled (SQLModel vs separate models, slowapi, type checker, worker model)	Moved into a decision table in STACK-2026.md with the criterion for each, rather than a recommendation with no condition

Changes

File	Intent
skills/python-pro-coder/SKILL.md	Iron Law, rationalization table, environment gate, 6-step process, forbidden-pattern table, skill boundaries
skills/python-pro-coder/references/*.md (11 domain files)	The rules, one file per domain, each with why and a code contrast
skills/python-pro-coder/references/STACK-2026.md	Version facts, dead dependencies, open decisions, sources, verification date
skills/python-pro-coder/references/REVIEW-CHECKLIST.md	Audit pass list keyed to rule IDs with the severity scale
skills/python-pro-coder/references/OUTPUT-CONTRACT.md	10-section response contract and the negative-doubt routine
skills/python-pro-coder/references/TEMPLATES.md	Settings, session dependency, feature router, page envelope, app factory, conftest, quality config
README.md	Domain table row, count 7 to 8
skills/INDEX.md	Regenerated

No scripts/audit/sources.ts entry: that table tracks package versions per MCP plugin, and there is no Python plugin. The stack file carries the version tracking for this skill instead.

Verification

$ bun scripts/generate-skills-index.ts
Generating skills index (cross-platform)...
Wrote .../skills/INDEX.md

$ bun test
 87 pass
 0 fail
 849 expect() calls
Ran 87 tests across 13 files. [390.00ms]

$ npx tsc --noEmit
(exit 0, no output)

Rule IDs verified contiguous per prefix and totalling 60. Every version and deprecation claim in STACK-2026.md was checked against the registry or the project's own issue tracker on 2026-09-04, with the URLs listed in that file.

Merge order

Rebased on top of #138 after it merged. The README domain count and skills/INDEX.md were resolved against the merged state: count 7 to 8, both skill rows present, index regenerated.