# Requirements baseline (Step 0)

## Functional requirements
- Accept authenticated HTTP requests for a stateless API.
- Persist application records with transactional consistency and indexed queries.
- Publish domain events asynchronously so request handling is decoupled from workers.
- Process events with retry and dead-letter behavior.
- Expose operational logs, metrics, and traces suitable for incident response.
- Support repeatable infrastructure deployment from version-controlled Terraform.

## Non-functional requirements
- Managed, horizontally scalable runtime with no server maintenance.
- Regional production deployment with documented recovery assumptions.
- Encryption in transit and at rest; least-privilege service identities.
- API target of 99.9% monthly availability, p95 response time under 500 ms for normal reads, and at-least-once event processing.
- Auditability of infrastructure changes and application access.
- Validation must not provision cloud resources.

## Constraints
- Google Cloud is the target cloud; product selection is explicitly deferred in this phase.
- Terraform is the infrastructure-as-code format.
- The solution must remain parameterized by project, region, and environment.
- No secrets or production identifiers may be committed.
- The deliverable is one repository derived from the workflow-agent template.

## Assumptions
- A client or API gateway supplies authentication tokens and request-level authorization context.
- The application container is built and published by an existing CI pipeline.
- A single primary region is acceptable initially; disaster recovery is a follow-up design decision.
- Application code, schema migrations, and SLO dashboards are owned by the service team.
- Cloud billing, organization policy, and quota administration are available to the deployment operator.

## Open questions
- What are peak requests per second, payload sizes, and retention periods?
- Which identity provider, tenant model, and authorization policy are required?
- What RPO/RTO and multi-region requirements apply?
- What data classification, residency, and deletion obligations apply?
- Which CI runner identity may deploy Terraform, and where is state hosted?
- Which event schemas, compatibility policy, and consumer ownership model apply?
- Are custom domains, WAF rules, private ingress, or VPC connectivity required?

**Product selection deferred:** true. The answers above are the input to Step 1; unresolved questions must be confirmed before production sizing.