Set guardrails for an agent adding idempotency keys

Your payments API is written in Go. Clients retry POST /charges when a request times out, and a few customers have been charged twice.

The fix is idempotency keys: the client sends a key with each charge, and the server never runs the same key twice. The work touches the HTTP handler, a new Postgres table, the service layer and the tests. You want a coding agent to do most of it with light supervision.

How do you set the task up? Decide what the agent owns, what you keep, which constraints it gets, and where you stop it for review before it touches money.