From de06cedce281f0244ccd95fb21092ebc54e866fc Mon Sep 17 00:00:00 2001
From: Branimir Georgiev <66906831+braboj@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:06:41 +0300
Subject: [PATCH] refactor(edge): shorter rules, one lead-in

The two lead-in paragraphs become two sentences; long rules lose their
trailing explanations or split in two. The cleartext MUST NOT stands as
its own rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 templates/backend/edge.md            | 36 ++++++++++------------------
 tests/baselines/template-quality.txt |  2 +-
 2 files changed, 14 insertions(+), 24 deletions(-)

diff --git a/templates/backend/edge.md b/templates/backend/edge.md
index 1c8463a9..1fd7f1db 100644
--- a/templates/backend/edge.md
+++ b/templates/backend/edge.md
@@ -2,27 +2,19 @@
 [ID: backend-edge]
 [DEPENDS ON: templates/backend/http.md, templates/security/security.md, templates/backend/observability.md]
 
-Rules for the edge tier — the reverse proxy, load balancer, or gateway
-that sits in front of the application (nginx, Envoy, Caddy, HAProxy, a
-cloud ALB, or a CDN). Compose this template on demand for a service
-exposed to untrusted networks — it is not part of any stack chain by
-default.
-
-The edge is infrastructure, not a service: it terminates TLS, routes,
-and shields the application tier. Keep business logic out of it — that
-belongs in the application layer. API-gateway routing inside a service
-mesh is covered by `microservices.md`.
+Rules for the reverse proxy, load balancer or gateway in front of an
+application exposed to untrusted networks. The edge terminates TLS, routes
+and shields the application; keep business logic out of it.
 
 ## TLS termination
 
-- Terminate TLS at the edge and redirect all plain HTTP to HTTPS — the
-  application MUST NOT be reachable over cleartext
+- Terminate TLS at the edge and redirect plain HTTP to HTTPS
+- Never let the application be reachable over cleartext (MUST NOT)
 - Serve only TLS 1.2+; disable legacy protocol and cipher versions
 - Set HSTS (`Strict-Transport-Security`) at the edge so browsers refuse
   to downgrade
-- Re-encrypt to upstreams (mTLS or TLS) when traffic crosses an
-  untrusted segment; plaintext to upstreams is acceptable only on a
-  trusted private network
+- Re-encrypt to upstreams (mTLS or TLS) across an untrusted segment; send
+  plaintext only on a trusted private network
 
 ## Forwarded headers and client identity
 
@@ -30,9 +22,8 @@ mesh is covered by `microservices.md`.
   de-facto `X-Forwarded-For` / `X-Forwarded-Proto` / `X-Forwarded-Host`
 - Strip inbound forwarded headers from external callers before
   appending your own — never trust a client-supplied `X-Forwarded-For`
-- Configure the application's trusted-proxy list so it reads the real
-  client IP only from hops you control — an over-broad trust list lets
-  callers spoof their address and defeat IP rate limits
+- Limit the application's trusted-proxy list to hops you control; an
+  over-broad list lets callers spoof their IP and dodge rate limits
 - Propagate or originate a correlation/request ID at the edge so a
   request is traceable end to end (see `observability.md`)
 
@@ -40,8 +31,8 @@ mesh is covered by `microservices.md`.
 
 - Route by host and path to upstream pools; keep routing declarative,
   not code
-- Gate traffic on upstream health checks — remove failing instances
-  from rotation and add them back only after they pass readiness
+- Remove a failing instance from rotation by health check; add it back
+  only after it passes readiness
 - Balance across instances (round-robin or least-connections) and
   spread upstreams across availability zones
 - Drain connections on deploy — stop sending new requests to an
@@ -49,9 +40,8 @@ mesh is covered by `microservices.md`.
 
 ## Limits, timeouts, and buffering
 
-- Set explicit connect, read, and write timeouts to every upstream —
-  an unbounded proxy timeout turns one slow upstream into edge
-  exhaustion
+- Set connect, read and write timeouts on every upstream; an unbounded
+  one lets a slow upstream exhaust the edge
 - Cap request body size at the edge to reject oversized payloads before
   they reach the application
 - Bound concurrent connections and enforce per-client rate limits at
diff --git a/tests/baselines/template-quality.txt b/tests/baselines/template-quality.txt
index 968ad08a..d73d7380 100644
--- a/tests/baselines/template-quality.txt
+++ b/tests/baselines/template-quality.txt
@@ -7,7 +7,7 @@ templates/backend/auth.md 98.4
 templates/backend/caching.md 100.0
 templates/backend/concurrency.md 94.8
 templates/backend/database.md 92.0
-templates/backend/edge.md 89.7
+templates/backend/edge.md 97.9
 templates/backend/errors.md 91.7
 templates/backend/features.md 92.2
 templates/backend/grpc.md 96.1