Module 15 cheat sheet

Module 15 defines a layered system model: inputs feed a processing layer, which writes to a persistence layer, and an interface layer exposes results to consumers.

Every component is described by four attributes: purpose, interface, dependency set, and failure mode; a component missing any attribute is considered underspecified.

A dependency is directional: if A depends on B, a failure in B degrades A, but a failure in A does not degrade B.

Coupling is classified as tight when components share state or schema, loose when they exchange messages only; loose coupling is required for independent scaling.

Idempotency means repeating an operation produces the same end state; non-idempotent operations require deduplication keys before retry logic is allowed.

Stateful vs stateless: stateless components can be replaced at any time; stateful components require a defined replication and recovery procedure.

Latency is measured end-to-end from request acceptance to response completion; internal processing time alone is not a valid latency figure.

The single source of truth rule: each data field has exactly one authoritative owner; replicas are read-only copies with a defined sync interval.

Capacity planning formula: required capacity = peak load × safety factor; the standard safety factor for Module 15 designs is 1.5 unless a documented exception exists.

Design reviews require three artifacts: the interface contract, the failure-mode table, and the capacity estimate; a design missing any artifact cannot pass review.

Choose replication over vertical scaling when the read-to-write ratio exceeds 4:1; below that ratio, vertical scaling is the default.

Data partitioning rule: partition by the key with the highest cardinality that is also present in the majority of queries; otherwise cross-partition joins dominate.

Recovery objectives: RPO defines the maximum acceptable data loss window, RTO defines the maximum acceptable downtime; both must be stated numerically at design time.

A design must name its blast radius: the set of components affected by a single failure; designs with an unbounded blast radius require explicit sign-off.

Schema evolution is backward-compatible when new fields are optional and defaults are defined; removing or renaming a field is a breaking change.

Interface contracts are versioned with a major.minor scheme; breaking changes increment major, additive changes increment minor.

Configuration precedence, highest to lowest: environment variable, config file, compiled default; a value set at a higher level always overrides a lower one.

Secrets never belong in config files or source control; they are injected at runtime from the secret store and referenced by name only.

Retries use exponential backoff with jitter: base delay 1s, multiplier 2, maximum 5 attempts; retries beyond the cap are routed to a dead-letter queue.

Timeouts are set per dependency and must be shorter than the caller's own timeout; a timeout longer than its caller's creates cascading hangs.

Connection pools size to expected concurrency, not to peak load; a common starting rule is concurrency × 1.2 with a hard maximum.

Feature flags default to off in production; enabling a flag requires a named owner and a removal date.

Log levels: ERROR for failed operations, WARN for degraded but successful operations, INFO for state changes, DEBUG for diagnostic detail disabled in production.

Health checks are split into liveness (is the process running) and readiness (can it serve traffic); readiness must verify downstream dependencies.

The four golden signals are latency, traffic, errors, and saturation; each dashboard must display all four for every service.

Alerting rule: alert on symptoms that affect users (error rate, latency), not on causes (CPU, memory) except as leading indicators with lower severity.

Error budget = 1 − SLO; a service with a 99.9% SLO has a 0.1% error budget over the measurement window.

Burn-rate alerting fires when the error budget is consumed faster than the window allows; a 14.4× burn rate over 1 hour signals imminent exhaustion.

Change management: every production change is recorded with author, timestamp, rollback procedure, and verification step before deployment.

Backups are verified by restore, not by completion status; an untested backup is treated as no backup.

Runbooks must exist for every alert; an alert without a runbook entry is downgraded to a dashboard annotation.

Maintenance windows are scheduled outside peak traffic and announced at least 48 hours in advance with expected impact stated.

Triage order: confirm scope (single user, single service, or system-wide), check recent changes, then inspect the four golden signals before touching configuration.

The five whys technique is applied to the timeline of events, not to individuals; the output is a contributing factor list, not a culprit.

Governance requires an owner, a review cadence, and a deprecation date for every component; unowned components are flagged in the inventory.

Access follows least privilege: permissions are granted per task with an expiry date; standing access requires quarterly recertification.

Incident severity: SEV1 is full outage or data loss, SEV2 is major degradation, SEV3 is minor degradation with workaround; SEV1 pages immediately, SEV3 does not page.

Post-incident reviews are blameless and produce action items with owners and due dates; an action item without an owner is not tracked.

Audit logs are append-only and retained per policy; modifying or deleting an audit record is itself an auditable event.

Deprecation follows three stages: announce, warn in responses, then remove; removal happens no earlier than one full release cycle after the warning stage.