NICET SSI cheat sheet

Integration scope: systems software integration links independently developed software components (OS services, drivers, middleware, applications, databases) so they exchange data and control through defined interfaces rather than shared assumptions.

Interface contract: each integration point is defined by a protocol, a data format, and an error model; if any of the three is undocumented, the interface is a defect risk regardless of whether it currently works.

Coupling metric: integration quality is judged by coupling (number and strength of dependencies between components) and cohesion (degree to which a component's internals serve one purpose); lower coupling and higher cohesion reduce regression surface.

Synchrony decision rule: use synchronous request/response when the caller must block for a result and latency budget permits; use asynchronous messaging when the caller can proceed without the result or when the consumer is intermittently available.

Idempotency rule: any operation that may be retried (network call, message handler, file transfer) must be idempotent or carry a deduplication key, because at-least-once delivery is the default in most messaging transports.

Timeout and retry rule: every remote call needs an explicit timeout shorter than the caller's own deadline, and retries need bounded counts with backoff; unbounded retries convert a transient fault into a cascading outage.

Data contract versioning: backward-compatible changes add optional fields; removing or renaming a field, changing its type, or changing its meaning is a breaking change requiring a new version or a coordinated migration.

Failure isolation: bulkheads (separate connection pools, thread pools, or queues per dependency) prevent one failing integration from exhausting shared resources used by healthy integrations.

OS-level integration points: shared libraries (dynamic linking via soname/ABI), interprocess mechanisms (pipes, shared memory, sockets, signals), and kernel interfaces (device drivers, ioctl, sysfs/procfs) each have distinct compatibility and permission rules.

ABI vs API: an API change breaks source compatibility (recompile needed); an ABI change breaks binary compatibility (existing compiled binaries fail), so shared-library upgrades require ABI stability checks.

Middleware roles: message brokers decouple producers and consumers (topics/queues, publish-subscribe vs point-to-point); ESBs and API gateways centralize routing, transformation, and policy; each adds a hop that must be counted in latency budgets.

Data mapping rule: when source and target schemas differ, transformations must be explicit and testable; implicit coercion (string-to-number, timezone assumptions, encoding) is a leading source of silent data corruption.

Transaction boundary rule: distributed transactions require either two-phase commit (strong consistency, blocking) or sagas/compensating actions (eventual consistency); choose based on business tolerance for intermediate states.

Security at interfaces: authenticate both ends (mutual TLS or tokens), authorize per operation, encrypt data in transit, and validate all inbound payloads against the schema before processing (never trust the caller).

Observability triad: logs (discrete events), metrics (aggregates such as error rate and latency percentiles), and traces (per-request path across components); correlation IDs must propagate across every hop to make traces joinable.

Integration test levels: contract tests verify interface conformance, component tests verify a service with stubbed dependencies, end-to-end tests verify the full path; test doubles must match the real interface's error behavior, not just its happy path.

Deployment integration: configuration must be externalized from code, environment-specific values injected at deploy time, and startup must fail fast when required dependencies or config are missing rather than degrading silently.