Opinionated rules plus a router to deeper references. Code samples in the references were compiled and run on Spring Boot 4.1.1 (Spring Framework 7) and, where they differ, on Boot 3.5.16 (Framework 6.2). Boot 3 vs 4 differences are marked "Boot 3" / "Boot 4" in each reference.
Before writing code
- Detect, do not assume: read
pom.xml/build.gradle(.kts)for the Spring Boot version, Java version, starters in use (spring-boot-starter-webis Boot 3,spring-boot-starter-webmvcis Boot 4), persistence (JPA, JDBC), the migration tool, the test setup, and the package layout and naming conventions of the existing code. Match them. - Never upgrade Spring Boot, Java or dependencies implicitly. A Boot 3 -> 4 move is a deliberate task (
spring-boot-4-migration). - Ask before adding infrastructure: a broker (Kafka, RabbitMQ), a cache provider, a new database, or a scheduler/async setup. Add only what the user requested, with the Boot-managed version (no explicit version for BOM-managed artifacts, never
latest). - Verify every change with the project's own build:
./mvnw verifyor./gradlew build(plainmvn/gradleif no wrapper). Integration tests need Docker when they use Testcontainers.
Router
| Task | Read |
|---|---|
Repositories, projections, pagination, N+1, @Transactional, auditing, Flyway/Liquibase, Spring Data JDBC |
references/data.md |
Controllers, validation, ProblemDetail, RestClient, @HttpExchange, API versioning, OpenAPI, JSpecify |
references/rest-api.md |
Kafka/AMQP, @Cacheable/Caffeine, @Scheduled, @Async, virtual threads, outbox |
references/messaging-caching.md |
@ConfigurationProperties, profiles, secrets, config import, Docker Compose / Testcontainers at dev time |
references/configuration.md |
| AOT, CDS/AppCDS, lazy initialization, native image | references/aot-and-startup.md |
If these standalone skills are installed, also use them for their topic; otherwise rely on the official docs: java-hibernate-jpa (JPA mapping), spring-boot-testing (tests), spring-security (authentication, authorization, CSRF/CORS), spring-observability (metrics, tracing, Actuator, logs), create-spring-boot-java-project (project defaults, Boot 3 vs 4 build changes), java-add-graalvm-native-image-support (native executable).
Core rules
- Structure and layers: package by feature; constructor injection; controllers return DTOs/records, never entities; services own the transaction.
- Validation and errors: Bean Validation on request records with
@Valid; one@RestControllerAdvicereturningProblemDetail. JSpecify annotations document nullability only and do not validate. - Jackson: Boot 4 uses Jackson 3 (
tools.jackson.databind.*,JsonMapper; annotations stay incom.fasterxml.jackson.annotation); Boot 3 uses Jackson 2 (com.fasterxml.jackson.databind.*,ObjectMapper). - Slice-test gotcha: put
@EnableJpaAuditing,@EnableCaching,@EnableAsync,@EnableSchedulingon dedicated@Configurationclasses, not on the@SpringBootApplicationclass, or slices such as@DataJpaTestfail to start (for example, noCacheManager). Slices do not scan@Configurationclasses:@Importthe one a test needs. - Proxied beans:
@Cacheable,@Asyncand@Transactionalwork through proxies: they do nothing on self-invocation or onprivate/finalmethods; test them through the injected bean.
Checklist
- Versions, build tool and conventions detected; starters match the Boot major
- No new infrastructure or dependency without the user's agreement
-
./mvnw verify/./gradlew buildpasses; secrets absent from code, properties and logs
See also: Spring Boot reference https://docs.spring.io/spring-boot/reference/, Spring Framework reference https://docs.spring.io/spring-framework/reference/, Spring Data https://docs.spring.io/spring-data/commons/reference/.