Menu
Use when adding or changing an external HTTP provider call in SysNDD (gnomAD, Ensembl, UniProt, AlphaFold, MGI, RGD, PubMed, PubTator, MONDO, JAX/HPO) or touching external-call timeouts, retries, caching, or per-request time budgets
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when wiring a SysNDD Vue 3 view or component to the backend API, adding a typed API client, handling API errors, or binding backend data into BootstrapVueNext tables and tooltips — especially around Plumber response shapes and BVN table/tooltip quirks
Use when adding or changing a SysNDD DB migration, editing a SQL view (especially ndd_entity_view or the core read views), touching the migration runner or manifest, restoring a database, or diagnosing a startup failure related to migrations
Use when reviewing or writing SysNDD code for security vulnerabilities or correctness bugs — authorization/role gates, SQL/expression injection, credential and secret handling, data exposure through public or MCP surfaces, resource-exhaustion/DoS from external calls, error/info leakage, and the repo's known R/Plumber footguns — especially before merging a diff or PR
Use when changing gene clustering (STRING/Leiden functional axis or phenotype MCA/HCPC), the analysis snapshot builder or validator, the memoised clustering cache, cache coherence, or LLM cluster summaries — or deploying a clustering change so public endpoints and summaries reflect it
Use when writing, running, or fixing SysNDD R/Plumber API tests (testthat) — including database-writing tests, running a single test inside the API container, mocking external providers, or diagnosing SKIP-vs-PASS, helper-loading, or path-resolution issues
Use when adding or changing durable async jobs, worker-executed code, job handlers, queue lanes or priorities in SysNDD — or diagnosing why a submitted job never runs, stays queued, or fails with "No durable async job handler registered"
| name | sysndd-external-proxy |
| description | Use when adding or changing an external HTTP provider call in SysNDD (gnomAD, Ensembl, UniProt, AlphaFold, MGI, RGD, PubMed, PubTator, MONDO, JAX/HPO) or touching external-call timeouts, retries, caching, or per-request time budgets |
Use this skill before adding or editing any outbound HTTP call to a gene/literature/ontology provider. The rules exist so one slow upstream cannot occupy a worker for tens of seconds or poison a long-lived cache. All helpers live in api/functions/external-proxy-functions.R.
Derive the timeout/retry window from external_proxy_budget(api_name, default_timeout =, default_max =, default_tries =) or route the whole call through make_external_request(url, api_name, throttle_config, ...). Never a hardcoded req_timeout(<n>) / max_seconds = <n> literal — this is enforced by test-unit-external-budget-guard.R (a bypass was reintroduced once via GeneReviews in #389, which is why the guard exists).
Wrap fetchers in memoise_external_success_only(f, cache, source = "<provider>"), not raw memoise::memoise(). It caches successful and true not-found responses but not transient list(error = TRUE, ...) failures, so a blip does not poison the 7/14/30-day caches. Passing source = also emits one structured timing log per call:
[external-proxy] ... event=complete status=... elapsed_ms=... cache=hit|miss
gnomad/ensembl/uniprot/alphafold use the memoise source; mgi/rgd instead log via the inline external_proxy_with_timing() wrapper and omit source to avoid double-logging.
EXTERNAL_PROXY_REQUEST_MAX_SECONDS (default 15s) is wired into both universal wrappers. Once a request's accumulated external time crosses it, further external calls short-circuit to a degraded 503 (request_budget_exceeded = TRUE) without contacting the upstream. The accumulator is reset per request in the preroute hook (bootstrap/mount_endpoints.R) and per job at job start (external_proxy_request_reset(), async-job-worker.R).
.pubtatornidd_reset_external_budget() in pubtator-enrichment-collector.R), or the ceiling — designed for public request paths — caps the back half of the batch.postroute hook emits [request-timing] method=… path=… status=… duration_ms=… external_ms=… slow=… (slow over API_SLOW_REQUEST_MS, default 2000), so a slow request can be attributed to external time./health, /auth, /statistics must never call an external fetcher — enforced by test-unit-cheap-route-isolation.R.
Batch jobs with their own pacing (e.g. publication_date_backfill) intentionally keep raw httr2 retry (429 handling, Retry-After) and are outside the guard scan set — do not "fix" them into external_proxy_budget(). Per-provider budgets are tunable via env (EXTERNAL_PROXY_MONDO_*, etc.).
test-unit-external-budget-guard.R, test-unit-external-proxy-budgets.R, test-unit-external-slow-provider.R, test-unit-cheap-route-isolation.R, and the router-level test-integration-slow-provider-isolation.R.