Rate limiting, spec-driven at enterprise rigor
A per-tenant API rate limiter — the kind of feature that lives in real production systems — driven through the spectastic lifecycle on the enterprise profile: a project that ships with twenty non-negotiable principles, an enforcement floor, an SLO on every NFR, and a grounded decision behind each choice. Then a simulator so you can feel it work.
Each tenant gets a configurable request budget. Requests within budget are served; over-budget requests get 429 Too Many Requests with a Retry-After. The limiter is cheap enough for the hot path and fails open — a limiter fault never takes the API down with it. The simulator lets you switch between a token bucket and a sliding window and watch a burst get shaped in real time.
The lifecycle, at enterprise rigor
Same lifecycle as the tic-tac-toe build — but the enterprise profile turns the rigor up: quantified NFRs, an enforcement floor, and grounded decisions are required, not optional.
Principles
principles.htmlspectastic init --profile enterprise seeds 20 principles before a word of spec — including Service level objectives, Structured observability, Secure by default, Least privilege, Contract-first interfaces, and The enforcement floor holds. The rigor is inherited, not re-litigated per feature.
Spec
spec.htmlWhat to build, for whom, how we'd know. The enterprise gate refuses an NFR that isn't measurable, so both non-functional requirements carry a <spec-slo>: p99 < 5 ms added latency (NFR-001) and 99.95% fail-open (NFR-002). And it's honest about scope — a slice, with the distributed (Redis-backed) limiter deferred to a future one.
Design
design.htmlEvery design fact grounded against a real source — RFC 6585 for 429 semantics, the algorithm literature for the token bucket, a micro-benchmark for the sub-millisecond decision. A scored matrix picks token bucket over sliding-window variants (burst-fair, O(1) memory). And the profile's enforcement floor is made concrete:
Tasks
tasks.htmlFifteen ordered tasks across five phases. The pure limiter core behind a port lands first; the middleware, runtime tuning, and observability stack on top; tests are written before the code they cover, and every functional requirement is closed by a task.
Implement & verify
simulatorDrive it yourself. Send a burst of ten against a budget of eight and watch exactly eight get served and the rest 429 — the fairness the whole spec exists to guarantee. Switch algorithms to feel the token bucket's burst headroom against the sliding window's smoother clamp.
What makes it "enterprise"
Four things the profile enforces — the difference between a spec that reads well and one you'd stake a production system on.
A non-functional requirement without a measurable target fails validate. "Fast" isn't allowed; "p99 < 5 ms" is.
Eight tool categories — format, lint, types, tests, security, supply-chain, coverage, observability — must be wired or explicitly waived. enforce tracks the gap.
Every must-tier decision cites a real source, or it renders UNGROUNDED and can't advance to tasks. "It's standard" is not a citation.
Big features decompose into sliced specs with tracked deferrals — the distributed limiter is a named future slice, not a vague "later".
The artifacts
Every step is a real, self-contained page — each one passes spectastic validate on the enterprise gate.