Create an ideation: "Add per-user rate limiting to the /search endpoint. 
Burst: 20 req/s. Sustained: 5 req/s. Return 429 with Retry-After header."

{
  "board_id": "a1b2c3d4-...",
  "title": "Per-user rate limiting on /search",
  "description": "Burst limit 20 req/s, sustained 5 req/s. Return 429 + Retry-After.",
  "context": "Currently no rate limiting exists. Load tests show search abuse spikes."
}

{
  "ideation_id": "...",
  "question": "Where should rate-limit counters be stored?",
  "choices": ["Redis (shared across instances)", "In-process (per-replica, no shared state)", "Database (durable, slower)"]
}

{
  "ideation_id": "...",
  "domains": 2,
  "ambiguity": 1,
  "dependencies": 3,
  "justification": "Touches API middleware and Redis infra. Dependencies on cache invalidation and auth service are flagged."
}

{
  "ideation_id": "...",
  "status": "refined"
}

{
  "ideation_id": "..."
}

{
  "spec_id": "...",
  "title": "Rate limit exceeded returns 429",
  "description": "Send 21 sequential requests in 1 second as the same user. The 21st returns HTTP 429 with Retry-After header.",
  "acceptance_criteria_ref": "AC-1"
}

{
  "spec_id": "...",
  "rule": "Rate-limit counters must be scoped to authenticated user ID, not IP address.",
  "rationale": "IP-based limiting blocks shared office networks. Auth user is the correct identity boundary."
}

{
  "spec_id": "...",
  "endpoint": "GET /search",
  "response_on_limit": {
    "status": 429,
    "headers": {"Retry-After": "<seconds>"},
    "body": {"error": "rate_limit_exceeded", "retry_after": "<seconds>"}
  }
}

{
  "spec_id": "...",
  "score": 82,
  "narrative": "Acceptance criteria are complete and testable. Business rule on auth-scoped limits is unambiguous. API contract covers success and failure shapes. Missing: load-test baseline for Redis latency under burst — flagged as a card.",
  "recommendation": "approve"
}

{
  "spec_id": "...",
  "status": "approved"
}

{
  "spec_id": "...",
  "title": "Rate limiting — Sprint 1: middleware + Redis counter",
  "objective": "Implement the per-user sliding-window counter in Redis and wire it into the /search middleware. 429 returned and test scenario AC-1 passes.",
  "expected_outcome": "All burst-limit test scenarios pass in CI. No auth-service changes required."
}

{
  "sprint_id": "...",
  "score": 78,
  "narrative": "Scope is deliverable in one sprint. Redis dependency is flagged — Redis must be running in the test environment.",
  "recommendation": "approve"
}

{
  "sprint_id": "...",
  "status": "active"
}

{
  "board_id": "...",
  "title": "Implement sliding-window rate limiter middleware",
  "card_type": "normal",
  "spec_id": "...",
  "sprint_id": "..."
}

{
  "card_id": "...",
  "conclusion": "Sliding-window counter implemented in Redis using sorted sets. Middleware added to /search route. Returns 429 + Retry-After header when burst or sustained limit exceeded. All three test scenarios pass in CI.",
  "completeness": 95,
  "completeness_justification": "All acceptance criteria covered. Minor gap: Redis TTL cleanup job not yet automated — added as a follow-up card.",
  "drift": 5,
  "drift_justification": "Minor scope addition: added unit test for edge case where user ID is null. Not in original spec but caught during implementation."
}

{
  "spec_id": "...",
  "scenario_id": "...",
  "status": "passed",
  "test_file_path": "tests/middleware/test_rate_limit.py",
  "test_function": "test_burst_limit_returns_429",
  "last_run_at": "2026-05-07T14:30:00Z",
  "output_snippet": "PASSED tests/middleware/test_rate_limit.py::test_burst_limit_returns_429 in 0.42s"
}