system-design

name	system-design
description	System design, software architecture, API design, cybersecurity, and threat modeling. Build secure, scalable systems.
triggers	["architecture","system design","security","api","scalability","owasp","threat modeling","compliance"]
parameters	{"system_type":{"type":"string","required":true,"description":"Type of system (web app, API, data platform)"},"scale":{"type":"string","enum":["startup","growth","enterprise"],"required":false},"security_level":{"type":"string","enum":["standard","high","compliance"],"required":false}}
outputs	{"architecture":{"type":"object"},"security_measures":{"type":"array"},"trade_offs":{"type":"array"}}
retry	{"max_attempts":3,"backoff":"exponential"}
observability	{"log_level":"info"}
level	advanced
prerequisites	["core-development","data-structures"]
sasmp_version	1.3.0
bonded_agent	01-core-paths
bond_type	PRIMARY_BOND

System Design Skill

Quick Reference

Pattern	Best For	Complexity	Scaling
Monolith	Startups, MVPs	Low	Limited
Microservices	Large teams	High	Excellent
Serverless	Event-driven	Medium	Auto
Event-Driven	High throughput	High	Excellent

---

Scalability Progression

Level 1: Single Server
    │
    ▼ Bottleneck: CPU/Memory
Level 2: Load Balancer + Multiple Servers
    │
    ▼ Bottleneck: Database reads
Level 3: Caching Layer (Redis)
    │
    ▼ Bottleneck: Database writes
Level 4: Read Replicas
    │
    ▼ Bottleneck: Single DB limits
Level 5: Sharding / Partitioning
    │
    ▼ Bottleneck: Cross-shard queries
Level 6: CQRS + Event Sourcing

---

Architecture Decision Tree

What's your team size and product stage?
│
├─► Team < 10, product unclear
│   └─► Monolith (start simple)
│
├─► Team > 10, clear domain boundaries
│   └─► Microservices
│
├─► Variable workloads, pay-per-use
│   └─► Serverless
│
└─► High throughput, async workflows
    └─► Event-Driven

---

API Design

REST Best Practices

GET    /api/v1/users              # List
GET    /api/v1/users/{id}         # Get
POST   /api/v1/users              # Create
PUT    /api/v1/users/{id}         # Replace
PATCH  /api/v1/users/{id}         # Update
DELETE /api/v1/users/{id}         # Delete

GET    /api/v1/users/{id}/orders  # Nested

HTTP Status Codes

Code	Meaning	Use When
200	OK	GET/PUT/PATCH success
201	Created	POST success
204	No Content	DELETE success
400	Bad Request	Invalid input
401	Unauthorized	No/invalid auth
403	Forbidden	No permission
404