43 lines
2.5 KiB
Markdown
43 lines
2.5 KiB
Markdown
# Requirements baseline (Step 0)
|
|
|
|
## Functional requirements
|
|
- Accept authenticated HTTP requests for a stateless API.
|
|
- Persist application records with transactional consistency and indexed queries.
|
|
- Publish domain events asynchronously so request handling is decoupled from workers.
|
|
- Process events with retry and dead-letter behavior.
|
|
- Expose operational logs, metrics, and traces suitable for incident response.
|
|
- Support repeatable infrastructure deployment from version-controlled Terraform.
|
|
|
|
## Non-functional requirements
|
|
- Managed, horizontally scalable runtime with no server maintenance.
|
|
- Regional production deployment with documented recovery assumptions.
|
|
- Encryption in transit and at rest; least-privilege service identities.
|
|
- API target of 99.9% monthly availability, p95 response time under 500 ms for normal reads, and at-least-once event processing.
|
|
- Auditability of infrastructure changes and application access.
|
|
- Validation must not provision cloud resources.
|
|
|
|
## Constraints
|
|
- Google Cloud is the target cloud; product selection is explicitly deferred in this phase.
|
|
- Terraform is the infrastructure-as-code format.
|
|
- The solution must remain parameterized by project, region, and environment.
|
|
- No secrets or production identifiers may be committed.
|
|
- The deliverable is one repository derived from the workflow-agent template.
|
|
|
|
## Assumptions
|
|
- A client or API gateway supplies authentication tokens and request-level authorization context.
|
|
- The application container is built and published by an existing CI pipeline.
|
|
- A single primary region is acceptable initially; disaster recovery is a follow-up design decision.
|
|
- Application code, schema migrations, and SLO dashboards are owned by the service team.
|
|
- Cloud billing, organization policy, and quota administration are available to the deployment operator.
|
|
|
|
## Open questions
|
|
- What are peak requests per second, payload sizes, and retention periods?
|
|
- Which identity provider, tenant model, and authorization policy are required?
|
|
- What RPO/RTO and multi-region requirements apply?
|
|
- What data classification, residency, and deletion obligations apply?
|
|
- Which CI runner identity may deploy Terraform, and where is state hosted?
|
|
- Which event schemas, compatibility policy, and consumer ownership model apply?
|
|
- Are custom domains, WAF rules, private ingress, or VPC connectivity required?
|
|
|
|
**Product selection deferred:** true. The answers above are the input to Step 1; unresolved questions must be confirmed before production sizing.
|