prompt: Design a robust retry strategy for a REST client calling a flaky upstream API.

[User] Design a robust retry strategy for a REST client calling a flaky upstream API.

[Assistant] Use bounded exponential backoff with jitter, a small max retry cap, and timeouts that fit your SLO. Retry only on idempotent requests and transient failures (5xx, timeouts, connection reset). Add circuit breaker to fail fast during sustained outages and surface metrics (latency, error rate, retry count). Include per-request deadlines to avoid unbounded tail latency and propagate correlation IDs for tracing.

[User] What jitter mode should I choose?

[Assistant] Prefer 'full jitter' or 'decorrelated jitter' to spread retry storms. Full jitter picks a random delay in [0, base*2^n] each attempt; it's simple and effective.


prompt: I need a quick primer: SQL window functions for running totals and rankings.

[User] I need a quick primer: SQL window functions for running totals and rankings.

[Assistant] Running totals: SUM(amount) OVER (PARTITION BY account ORDER BY ts ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW). Rankings: use ROW_NUMBER(), RANK(), DENSE_RANK() with ORDER BY inside OVER(). Combine PARTITION BY to reset per group. Avoid mixing ORDER BY in SELECT and window frames incorrectly; rely on explicit frames for deterministic results.

[User] How do I do top-1 per group?

[Assistant] Use ROW_NUMBER() OVER (PARTITION BY grp ORDER BY score DESC) AS rn then filter rn = 1 in an outer query. It's clearer and often faster than DISTINCT ON across engines.


prompt: Explain the difference between blue/green and canary deployments.

[User] Explain the difference between blue/green and canary deployments.

[Assistant] Blue/green runs two production environments (blue, green) and flips all traffic from old to new at once after validation. Canary gradually shifts a small percentage of traffic to the new version, monitoring metrics and increasing if healthy. Blue/green optimizes for fast rollback; canary optimizes for risk reduction and incremental validation under real load.

[User] When would you favor blue/green?

[Assistant] When you need instant rollback and can afford duplicate infrastructure, or when state/data migrations are handled atomically and validated before the flip.


prompt: My Kafka consumer lags spike occasionally. What should I check first?

[User] My Kafka consumer lags spike occasionally. What should I check first?

[Assistant] Check: (1) processing time vs max.poll.interval.ms; (2) batch size and max.poll.records; (3) consumer group rebalances (unstable partitions, frequent membership changes); (4) broker/network throughput; (5) GC pauses. Add metrics (poll latency, process time, commit time) and consider increasing concurrency (more partitions or parallelism within a consumer) if single-threaded processing is the bottleneck.

[User] Commits seem slow.

[Assistant] Use async commits batched per processed batch, ensure idempotent sinks, and avoid committing too frequently. If using transactions/EOS, ensure transaction timeouts and producer buffers aren’t constraining throughput.


prompt: How do I structure a FastAPI project for maintainability?

[User] How do I structure a FastAPI project for maintainability?

[Assistant] Organize by domain: routers/ (API), schemas/ (Pydantic models), services/ (business logic), repositories/ (DB access), core/ (settings, security), and tests/. Keep dependencies pointing inward (API -> services -> repos). Use dependency injection (Depends) sparingly for explicitness, and centralize exception handlers and middlewares. Add pre-commit hooks (black, isort, ruff, mypy).

[User] Where should validation live?

[Assistant] Put request shape/type validation in Pydantic models, cross-field business rules in services. Keep DB constraints for integrity as a final guard.


prompt: We need a feature flag system with gradual rollout and stickiness.

[User] We need a feature flag system with gradual rollout and stickiness.

[Assistant] Use server-evaluated flags with a rules engine: target by attributes (country, app_version), percentage rollouts with consistent hashing on a stable key (user_id) for stickiness, and environment separation. Provide a kill switch, audit logs, and SDK caches with TTL. Evaluate flags at request time for dynamic behavior, but cache decisions for performance when safe.

[User] How do I avoid config debt?

[Assistant] Set TTLs on flags, require owner, add CI checks to block stale flags beyond a certain age, and run periodic cleanup sprints.


prompt: Design an S3 + Lambda image thumbnailer with idempotency and a DLQ.

[User] Design an S3 + Lambda image thumbnailer with idempotency and a DLQ.

[Assistant] S3 ObjectCreated -> Lambda validates content-type, generates thumbnails, stores under thumbnails/{key}. Use ETag + key as idempotency key in DynamoDB to avoid duplicates. Configure Lambda retries with exponential backoff and an SQS DLQ for poison images. Emit metrics/logs. Use memory tuned for sharp/imagelib performance, and consider Provisioned Concurrency for cold start-sensitive paths.

[User] How to prevent reprocessing on overwrite?

[Assistant] Use object versioning and process only the latest version; compare stored ETag in your idempotency record to skip already-processed versions.


prompt: Make a small, readable Git commit message template for a team.

[User] Make a small, readable Git commit message template for a team.

[Assistant]
Template:

<type>(<scope>): <short summary>

Why:
- <reason/impact>

What:
- <key changes>

Notes:
- <breaking changes/migrations>

Types: feat, fix, chore, docs, refactor, test, perf, ci. Keep subject <= 72 chars; use imperative mood.

[User] Do we need ticket IDs?

[Assistant] If your tracker is the source of truth, include the ID (e.g., PROJ-123) in the subject or a footer, but keep the summary readable.


prompt: Best practices for paginating a write-heavy Postgres list endpoint.

[User] Best practices for paginating a write-heavy Postgres list endpoint.

[Assistant] Use cursor pagination by (created_at, id) with a composite index matching the order. Avoid OFFSET. For consistent results under concurrent writes, use WHERE (created_at, id) < (:created_at, :id) for DESC pages. Limit payload size, select necessary columns, and consider keyset pagination helpers. Document forward/backward navigation and next/prev cursors.

[User] How to support filtering too?

[Assistant] Include filter fields in the index or accept slightly less efficient filtered scans. For highly selective filters, build dedicated indexes. Keep cursor encoding including relevant filter context to avoid mismatches when resuming.


prompt: We’re seeing OOMKilled in Kubernetes—how to set resource requests/limits?

[User] We’re seeing OOMKilled in Kubernetes—how to set resource requests/limits?

[Assistant] Profile the app to find steady-state and peak memory. Set requests to typical steady-state plus headroom; set limits high enough to avoid false kills but low enough to protect the node. Use VPA recommendations as a baseline, enable memory QoS (if available), and add liveness/readiness probes that account for GC or warm-up phases. Monitor container_memory_working_set_bytes and eviction signals.

[User] What about CPU throttling?

[Assistant] Avoid setting CPU limits unless needed; prefer requests that allow bursts. If you must set limits, ensure they match performance SLAs and test under load to detect throttling-induced latency.


prompt: How can I reduce LLM hallucinations in a production Q&A bot?

[User] How can I reduce LLM hallucinations in a production Q&A bot?

[Assistant] Use retrieval-augmented generation (RAG) with high-quality embeddings and chunking; prompt the model to answer strictly from retrieved context and cite sources. Add a post-generation verifier for facts and a fallback of 'I don't know' when confidence is low. Constrain with structured prompts, enable content filters, and log+review flagged responses for continual improvement.

[User] Any retrieval tips?

[Assistant] Use domain-tuned embeddings, overlap chunks, and hybrid search (BM25 + vector). Deduplicate and normalize docs; prefer fresh, authoritative sources.


prompt: What’s the difference between idempotency keys and deduplication at-least-once systems?

[User] What’s the difference between idempotency keys and deduplication at-least-once systems?

[Assistant] Idempotency keys ensure repeating the same request produces the same effect (client or server enforces one-time processing). Deduplication removes duplicate messages at the broker/consumer level. Use both: idempotency for side-effect safety at the app boundary and dedupe for transport-level resilience. Store idempotency records with TTL and conflict checks.

[User] Where to store keys?

[Assistant] In a durable, transactional store close to the operation (DB table or cache with write-through). Index by key and created_at for expiry sweeps.


prompt: How do I do structured logging well in a Node.js service?

[User] How do I do structured logging well in a Node.js service?

[Assistant] Use a JSON logger (pino, bunyan) with a consistent schema: level, msg, timestamp, service, trace_id, span_id, user_id (if relevant). Avoid logging PII; use redaction. Log at INFO for key events, WARN for recoverable anomalies, ERROR for failures; DEBUG locally. Include context in logs, not in message strings. Forward to a central system with retention and indexing policies.

[User] Any perf concerns?

[Assistant] Use async logging and avoid heavy formatting. Benchmark; pino with transports disabled in-process is fast. Offload shipping to a sidecar/agent where possible.


prompt: Guidance for writing maintainable Terraform modules.

[User] Guidance for writing maintainable Terraform modules.

[Assistant] Keep inputs minimal and typed with validation. Provide sane defaults and outputs. Use versioned modules with semantic versioning and a CHANGELOG. Document variables and examples. Avoid deep module nesting; prefer composition in stacks. Use 'for_each' and 'depends_on' judiciously. Add linting (tflint), formatting, and basic tests (terraform validate, kitchen/terratest).

[User] How to handle breaking changes?

[Assistant] Release a major version, provide migration notes, and support deprecation windows where possible. Consider a compatibility module temporarily if needed.


prompt: How to design an analytics event schema that’s future-proof?

[User] How to design an analytics event schema that’s future-proof?

[Assistant] Define a core envelope (event_name, user_id, timestamp, context) and a 'properties' object for event-specific fields. Use stable, documented names and types. Add schema versioning and a registry. Enforce validation at ingestion (DDL, JSON Schema). Support nullable/optional fields for evolution, avoid breaking renames. Include privacy metadata (PII flags) and data retention policies.

[User] How to evolve safely?

[Assistant] Use additive changes by default; deprecate, then remove after a window. Provide backfills or derived fields to keep downstreams working.


prompt: I need a resilient webhook consumer design for Stripe events.

[User] I need a resilient webhook consumer design for Stripe events.

[Assistant] Verify signatures on receipt, enqueue to a durable queue, process with idempotency keyed by event.id, and wrap side effects in transactions. Retry with backoff; send poison messages to a DLQ. Expose metrics (throughput, failures) and dashboards. Keep handlers idempotent and avoid long-running logic in the HTTP handler.

[User] How many retries?

[Assistant] Use a small bounded number (e.g., 5) with exponential backoff; beyond that, send to DLQ and alert humans.


prompt: C# async/await common pitfalls in ASP.NET Core.

[User] C# async/await common pitfalls in ASP.NET Core.

[Assistant] Avoid async void except for event handlers; prefer Task-returning methods. Don’t block on async (.Result/.Wait()) to prevent deadlocks. Propagate cancellation tokens down the stack. Pool HttpClient via IHttpClientFactory. Beware context capture; use ConfigureAwait(false) in libraries. Measure thread pool starvation; use async all the way.

[User] How to time-bound external calls?

[Assistant] Use CancellationToken with per-call timeouts (HttpClient policies) and fallback logic using Polly (retry, circuit breaker).


prompt: What’s a practical approach to rate limiting in an API gateway?

[User] What’s a practical approach to rate limiting in an API gateway?

[Assistant] Token bucket or leaky bucket with distributed counters stored in Redis/Memcached. Support per-API-key limits, burst capacity, and sliding windows. Return standard headers (X-RateLimit-*) and a 429 with retry-after. Add shadow mode first to calibrate limits before enforcing. Consider global vs per-route quotas and safe-list internal traffic.

[User] How to prevent Redis hot keys?

[Assistant] Shard keys (hash prefix), add jitter to expirations, and consider hierarchical limits (per-user + per-IP) to spread load.


prompt: We need a privacy-friendly analytics setup for a SaaS app.

[User] We need a privacy-friendly analytics setup for a SaaS app.

[Assistant] Collect minimal data, avoid PII by default, and hash identifiers where possible. Use first-party storage, respect DNT/consent, and sample aggressively. Aggregate metrics on the server, not at the client. Provide data deletion APIs and retention limits. Document what you collect and why. Prefer self-hosted or privacy-forward tools when feasible.

[User] How to handle EU users?

[Assistant] Collect explicit consent for non-essential tracking, store data in-region, and sign DPAs with processors. Offer opt-out and implement subject access/deletion requests.


prompt: Give me a clean GitHub Actions CI for a Python package with tests and cache.

[User] Give me a clean GitHub Actions CI for a Python package with tests and cache.

[Assistant] Matrix Python versions, set up caching for pip, run lint (ruff/flake8), type check (mypy), and tests with coverage. Upload coverage to a service if needed. Use actions/setup-python, actions/cache keyed by hashFiles of requirements*.txt/lockfile. Fail fast on lint/type errors to save time.

[User] What about wheels?

[Assistant] Add a release workflow: build sdist and wheels (cibuildwheel for native), sign if required, and publish to PyPI on a tag push.


prompt: How do I make a secure Docker image for Node.js?

[User] How do I make a secure Docker image for Node.js?

[Assistant] Use a slim base (distroless/alpine with care), create a non-root user, drop caps, and set NODE_ENV=production. Copy only needed files; leverage .dockerignore. Run npm ci with a locked lockfile. Scan images (Trivy) and update frequently. Expose minimal ports, set HEALTHCHECK, and avoid shelling out. Sign images (cosign) and enforce provenance (SLSA).

[User] Anything about openssl?

[Assistant] Pin CA bundles, keep OpenSSL up to date via base image updates, and avoid bundling unused crypto libraries to reduce surface area.


prompt: What’s a good structure for a blameless incident postmortem?

[User] What’s a good structure for a blameless incident postmortem?

[Assistant] Include: Summary (impact, severity, detection), Timeline, Root Causes (technical + organizational), Mitigations, Follow-ups (owners, due dates), What went well/poorly, and Attachments (graphs, logs). Focus on systemic fixes, not blame. Publish within 3–5 business days and track action items to closure.

[User] How to keep it concise?

[Assistant] Cap the summary to 5–7 bullets, use a time-ordered table for the timeline, and move details to an appendix. Clarity beats completeness.


prompt: I need a practical guide to designing idempotent REST endpoints.

[User] I need a practical guide to designing idempotent REST endpoints.

[Assistant] Use PUT for create-or-replace with client-provided IDs, PATCH for partial updates designed to be idempotent (replace-or-upsert fields). Support an Idempotency-Key header to dedupe POSTs for non-idempotent operations. Store request hash and response status/body for the key TTL. Make side effects conditional on idempotency record existence.

[User] What about retries from mobile?

[Assistant] Assume retries happen; require clients to send stable keys and handle timeouts gracefully. Document error codes for duplicate requests (e.g., 409 with existing resource ID).


prompt: How do I choose chunk size and overlap for RAG document ingestion?

[User] How do I choose chunk size and overlap for RAG document ingestion?

[Assistant] Start with 500–1,000 tokens per chunk with ~50–100 token overlap. Tune based on domain: longer for narrative/prose, shorter for code/specs. Ensure chunk boundaries align with semantics (headings, sections). Evaluate retrieval recall on a validation set and adjust; consider hierarchical retrieval (section -> subsection) for large docs.

[User] Should I store metadata?

[Assistant] Yes—source, title, section, timestamp, and permissions. Metadata filtering is critical to precise retrieval and access control.


prompt: What are effective patterns for feature toggles in mobile apps?

[User] What are effective patterns for feature toggles in mobile apps?

[Assistant] Use a remote-config/flag service with cached evaluations and sticky bucketing. Define defaults in the app, fetch on startup with a timeout, and refresh periodically. Namespace flags per environment. Log evaluations for analysis. Decouple flags from code via typed accessors/enums, and remove stale flags as part of release hygiene.

[User] Offline behavior?

[Assistant] Keep last-known-good config and safe defaults. Defer risky features behind server-verified flags so they don't activate without a fetch.