10. OS, cloud, and question index

// opposite lock order = deadlock
synchronized (a) { synchronized (b) { /* ... */ } }
synchronized (b) { synchronized (a) { /* ... */ } } // other thread
// fix: always lock a then b; or
if (lockA.tryLock(50, TimeUnit.MILLISECONDS)) { try { /* ... */ } finally { lockA.unlock(); } }

A process has its own address space and PID, so a crash of one process does not wipe another, and IPC is pipes, sockets, or mmap. A thread shares the process heap and code and has its own stack and registers, so context switch is cheaper. In Java, Thread and ExecutorService share the JVM heap, and a native crash or System.exit still kills the process. I pick a process when I need isolation, a different runtime, or blast-radius, such as Horizon ROS2 nodes, and a thread for shared in-memory work. Deadlock needs all four Coffman conditions: mutual exclusion, hold-and-wait, no preemption, and circular wait, for example two locks in opposite order. I fix with a global lock order, tryLock plus timeout, fewer locks, or concurrent collections instead of two mutexes, and I detect with jstack. Java stack is frames and locals; heap is objects; GC reclaims heap; OutOfMemoryError is heap and StackOverflowError is too-deep recursion. This IE.in 2025-grad OS block is the same loop as Rate Limiter, count 1, not UTA two-DSA. I do not claim I tuned the JVM; Horizon 60 FPS and Argus 24 FPS are process and thread workloads, not GC stories.

Example: Thread 1 synchronized on lock A then B while thread 2 synchronized on B then A is a Coffman cycle; ordering both to lock A then B, or tryLock with a timeout, lets a transfer method finish.

If they probe: Go deeper on Bankers, I say avoidance is textbook and rare in app Java. If they mix Rate Limiter HLD, I note count 1 and not UTA.

Kafka order is per partition, not global: the same message key lands on the same partition and is FIFO there, while different keys have no total order. More partitions buy consumer parallelism and do not buy a stronger order guarantee, and global order means one partition and you just gave up scale. Producer retries can reorder unless max in flight is 1 or you use an idempotent producer, and I say that sentence without designing a cluster. A B-Tree stores keys and data in internal nodes, which is multiway and disk-friendly because high fanout keeps height short. A B-plus tree keeps all keys in leaves, links those leaves for range scans, and uses internals as indexes only, which is why Postgres and InnoDB pick it for range. Ylogx uses Postgres, so B-plus is under the hood, and I did not operate Kafka and I will not invent a Ylogx topic. This igreaper CS was their R3 after Rotten Oranges, OA-as-R1, not UTA two-DSA. Live Code remains Java HashMap and heap, not a Kafka client.

Example: If two orders for the same customer id must stay FIFO, I partition by that key; a range query of last week of KPI facts is a B-plus leaf walk in Postgres, not a Kafka scan.

If they probe: A cluster diagram or a Ylogx topic name, I refuse to invent Kafka ops I did not run.

For amazon.com I walk browser to DNS to TCP 443 to TLS to HTTP, with TCP as a reliable ordered byte stream and UDP as datagrams. My honest UDP example is Horizon GStreamer at 60 FPS, not Kafka. If they push OSI I stop at L2 MAC, L3 IP, L4 TCP or UDP, and L7 HTTP. Transactions are ACID, and Ylogx truth is Postgres with BEGIN and COMMIT or ROLLBACK. A database deadlock is two transactions updating rows in opposite order; Postgres aborts one and the app retries or locks rows in a global order, which is the same idea as Java lock order. RLS on three Ylogx tiers is authorization, not isolation level. Bankers is deadlock avoidance and is rare in app Java; I do not pretend Ylogx ran it. This GFG sde-1-17 last live is not UTA two-DSA, and Rate Limiter count stays 1 if they mix loops.

Example: Browser resolves the name, opens TLS on 443, then GETs HTML, while the rover camera feed is UDP-style GStreamer at 60 FPS so a lost datagram is better than a stalled TCP retransmit.

If they probe: A seven-layer recitation or a Bankers tableau from internship, I give one OSI line and say we cap pools instead of Bankers.

// LC 6570344 shape: count then rank. Heap only if they asked top-K, not full sort.
Map<String, Integer> freq = new HashMap<>();
for (String w : words) freq.merge(w, 1, Integer::sum);
PriorityQueue<String> pq = new PriorityQueue<>((a, b) -> freq.get(a) - freq.get(b)); // min-heap size k

Java HashMap is an array of bins, mix with hash XOR hash unsigned-right-shift 16, then index with hash AND n minus 1 because capacity is a power of two. Collisions are a list, treeify at 8 if the table is large enough, untreeify on shrink, equals after hash, and load factor 0.75 resizes 2 times. Keys need stable hashCode and equals together, and a mutable key after put is a lost entry. HashSet is HashMap with a dummy PRESENT value. Average get and put are O of 1, worst O of n if everything collides and you ignore treeify. TreeMap is sorted keys at O log n, and I use it only if they need order. PriorityQueue is a binary heap: extract-min is O log n while streaming, which wins for Connect Sticks, size-k Top-K, and Dijkstra, not a full sort of every review unless they asked full order. This is Java Live Code, not Ylogx Redis, and Login Tracker is unverified if they pivot to that shape.

Example: Count good-review words in a HashMap, then keep a min-heap of size K if they want top-K reviews instead of sorting all r, which is the LC 6570344 follow-up shape.

If they probe: ConcurrentHashMap or Redis LRU, I say HashMap is unsynchronized one-JVM, Redis was the minus 35 percent shared cache at Ylogx, and I do not mix those unless they ask.

DNS maps hostname to IP through a recursive resolver, root, TLD, and authoritative servers, with TTL caches. Ylogx is GoDaddy nameservers to Route 53 to ALB. MAC is layer 2 on a local segment and switches; IP is layer 3 and routers, and DHCP can change IP while MAC stays. Virtual memory lets a process see a virtual address space mapped to RAM or swap. Thrashing is working set larger than RAM so page in and out dominate CPU. Fix thrashing with less memory pressure, fewer processes, a bigger box, or locality, not more threads. A huge Java heap on tiny RAM is GC plus swap death, and I do not claim I tuned that in internships. Ylogx 99.9 percent and sub-210 ms are cache and CDN, not paging, and this GFG loop is December 2020 older. I do not invent a thrashing incident.

Example: Ylogx.app resolves via GoDaddy and Route 53 to an ALB, while a box that swapped because 20 camera queues were unbounded would miss 24 FPS; Redis minus 35 percent is cache, not swap.

If they probe: MAC-layer debugging or a page-table I configured, I stay on DNS plus working set and I do not invent a NIC incident.

Ylogx BI was REST on FastAPI plus NestJS, cacheable resources and HTTP verbs, and GraphQL or ProtoBuf are skills, not what that app shipped. Docker packs app plus deps; Ylogx ran Docker on ECS and Argus is containerized on more than 20 cameras. I shipped ECS plus Docker plus CloudFront, not I ssh’d EC2 and apt-got, and Kubernetes is on the skills list so I do not claim I owned a cluster. S3 is an object store and is not a shipped resume bullet; honest is Postgres for RLS rows, and objects would go to S3 if they asked where PDFs live, marked off-resume if I say I used S3 in prod. NoSQL on skills includes Mongo, Firebase, Redis, and FAISS; what I shipped is Postgres facts plus RLS and Redis as a hot cache at minus 35 percent, not the warehouse. I did not shard Ylogx; I shipped one Postgres plus RLS plus Redis and I say that limit out loud. Hooks are REST, Docker, ECS, CloudFront, Route 53, Redis minus 35 percent, sub-210 ms, 99.9 percent, three-tier RLS, and Argus 24 FPS. This IE.in L4 list after BR is not UTA two-DSA.

Example: A KPI JSON GET is REST cached at CloudFront hitting ECS; the bot cache is Redis minus 35 percent; tenant isolation is RLS in one Postgres, not a shard map I did not build.

If they probe: EKS or an S3 production story, I keep S3 conceptual and k8s as skills-only.

Rohit Jain R2 named core CS and the topics are unnamed, so I do not invent a list. If 18 August probes CS, I answer from the named section 5.F set: OS, Kafka or B-plus, CN and transactions and Bankers, HashMap and priority queue, DNS and virtual memory, S3 REST Docker. This is not Rank A UTA two-DSA. Unnamed stays unnamed. I keep process versus thread, Coffman deadlock, and ECS versus k8s honesty in my pocket. I do not volunteer a ten-minute OS lecture during two DSA. Login Tracker stays unverified if they drift there. Rate Limiter count stays 1 if they mix that loop.

Example: If they say tell me some CS, I ask which area, then I pick process versus thread with a Java lock-order example rather than guessing their unnamed list.

If they probe: A topic list they never published, I refuse to guess and I ask them to name OS, DB, or networks.

Saloni intern Interview 2 named CS fundamentals with no topic list, plus a custom DS time-based eviction and Sets also unnamed. I do not treat intern CS as a named OS, DB, or CN list. The closest public shape of that DS is TTL eviction, and mentor Login Tracker is unverified, not this intern. This is intern 6 months, not FTE UTA evidence, and not Rank A two-DSA. If they ask HashMap internals I answer Java. If they ask eviction I sketch a map plus ordered timestamps without calling it Login Tracker. Unnamed stays unnamed. I will not invent Job 10454435 intern CS.

Example: A HashMap from key to node plus a time-ordered structure for oldest expiry is the eviction shape; I still say Login Tracker is unverified if they use that name.

If they probe: Their exact unnamed prompt, I do not guess; I ask whether they want TTL eviction or OS.

I shipped Docker plus ECS plus CloudFront plus ALB plus Route 53 at Ylogx, with sub-210 ms, 99.9 percent uptime, and CI/CD. Skills list Kubernetes and AWS. I do not upgrade ECS to I ran EKS. Argus is containerized more than 20 cameras, which is not a k8s claim. Kubernetes stays conceptual unless a named cluster exists. GitHub Actions built and deployed to ECS. I will not invent Fargate versus EC2 launch type. This is resume-derived honesty, not a 10454435 invention.

Example: A production request is CloudFront to ALB to an ECS task running a Docker image tagged with a git SHA; kubectl is a textbook sentence, not my intern cluster.

If they probe: Quiz k8s objects, I map them to ECS tasks and services conceptually and repeat I did not operate a cluster.

Postgres: Ylogx facts + RLS 3 tiers ; Argus event log . Redis: cache, −35% bot DB latency — not source of truth. Mongo/Firebase/FAISS/Neo4j: skills . FAISS/GraphDB belong to IQVIA/Stratify retrieval talk, not Ylogx warehouse. Maps to IE-asked NoSQL/sharding: I did not shard. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: Postgres: Ylogx facts + RLS 3 tiers ; Argus event log .

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

GoDaddy DNS → Route 53 → ALB → ECS. Maps to IE-asked DNS (GFG 2020). Do not invent MAC-layer debugging. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: GoDaddy DNS → Route 53 → ALB → ECS.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

GraphQL if nested dashboard over-fetch; we did not. ProtoBuf for high-frequency internal payloads (camera metadata), not the browser KPI JSON. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. I stop after one example rather than inventing architecture I did not ship.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Horizon: ROS2 nodes ≈ processes; GStreamer UDP 60 FPS. Argus: containerized workers, 20+ cameras, 24 FPS , Postgres logs — not a JVM thread lecture unless they ask Java. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation.

Example: Horizon: ROS2 nodes ≈ processes; GStreamer UDP 60 FPS.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

void transfer(Object from, Object to) {
    Object first = System.identityHashCode(from) < System.identityHashCode(to) ? from : to;
    Object second = first == from ? to : from;
    synchronized (first) { synchronized (second) { /* mutate */ } }
}

int i = (h ^ (h >>> 16)) & (table.length - 1); // bin
// list → tree at 8; resize at size > 0.75 * cap

PriorityQueue<int[]> min = new PriorityQueue<>((a, b) -> a[0] - b[0]); // [freq, id]
for (int[] x : items) {
    min.offer(x);
    if (min.size() > k) min.poll();
}

A process has its own PID, virtual address space, page tables, heap, and file-descriptor table, and crash isolation is the point. A thread is a TID inside a process with a shared heap and its own stack, registers, and program counter. Java is one JVM process; new Thread and pool workers share the heap, which is why synchronized and volatile exist, and a native SIGSEGV still kills the JVM. Isolation I actually shipped is an ECS task or Docker container as a process or pid-namespace boundary, not a Java thread. Horizon ROS2 nodes are processes talking over DDS, not one giant thread. Ylogx 99.9 percent and GiftedBooks 99.5 percent are process and container uptime, not I tuned JVM threads. Argus more than 20 cameras is many workers, processes or a bounded pool, at 24 FPS; I do not invent a Java Thread per camera in production. This is IE.in 2025-grad and GFG sde-1-17, same Rate Limiter loop, not UTA two-DSA.

Example: If an inference worker segfaults inside a shared JVM, the API dies with it; putting the detector in another container process keeps Postgres logging alive, which is why process beats thread for blast-radius on Argus-style workers.

If they probe: Ask GIL, I say CPython GIL is not the Java answer; the JVM maps to native threads.

All four Coffman conditions are required: mutual exclusion so the lock is not shareable, hold and wait so you hold A while waiting for B, no preemption so you cannot steal a held lock, and circular wait. The Java example is thread 1 synchronized on a then b versus thread 2 synchronized on b then a, and the same bug happens with ReentrantLock if acquire order flips. I break any one condition: global lock order by identityHashCode or resource id, tryLock with timeout so I do not hold-and-wait forever, fewer locks, or never nest if I can compose one lock. I detect with a thread dump, jstack, or jcmd Thread.print, looking for BLOCKED plus a cycle. The design answer is fix app code, not kill minus 9 the JVM. The database cousin is two transactions updating rows in opposite order; Postgres detects and aborts one, and the app retries or locks rows in a global order. Ylogx is Postgres. I do not claim a production deadlock write-up I do not have, and I did not ship Bankers. This pair of IEs is still not UTA two-DSA; Rate Limiter count stays 1.

Example: A transfer method that always locks the account with the smaller identityHashCode first cannot form a circular wait with another transfer on the same pair of accounts.

If they probe: Ask wait versus deadlock, I distinguish BLOCKED cycle from livelock RUNNABLE retries.

The stack is per-thread frames with locals, arguments, and return address, and it grows and shrinks with calls; StackOverflowError is too-deep recursion, not GC failed. The heap holds objects and arrays, shared by all Java threads; OutOfMemoryError Java heap space means the live set exceeds dash Xmx. GC reclaims objects unreachable from roots such as stack references, statics, and JNI, and you do not call free; pause is stop-the-world depending on collector. I do not lecture Eden, Survivor, Old, or G1 versus Parallel unless asked; one line is most objects die young and modern JDK default is generational G1. Internships did not tune dash Xmx or dash Xms. Latency numbers are API, Ylogx sub-210 ms and GiftedBooks sub-300 ms, not GC pause SLOs. This was IE.in 2025-grad memory management, Rate Limiter loop, not UTA. I do not invent a GC log from internships.

Example: A recursive path-sum that does not stop at leaves blows the stack with StackOverflowError while the heap is fine; allocating a huge ArrayList of frames blows the heap with OutOfMemoryError while the stack is fine.

If they probe: Push generations, I give one G1 sentence and return to stack versus heap.

Bankers is deadlock avoidance, not detection and not Coffman prevention. You allocate only if the resulting state is safe. Tables are Max of process by resource, Allocation, Need equals Max minus Allocation, and Available. Safe means there exists a sequence that can finish: some process with Need less than or equal Available, pretend it finishes, add its Allocation back, repeat. Unsafe is not yet deadlock; deadlock cannot occur from a safe state if max claims are honest. This is rare in app servers; thread pools and connection pools are bounded resources, not Bankers. GFG sde-1-17 last live asked it with threads versus processes, not UTA two-DSA. I did not implement Bankers at Ylogx, IQVIA, or Horizon; we cap the pool instead.

Example: If three threads each may need 2 connections and the pool has 3, Bankers would refuse an allocation that leaves a state where no thread can finish; in production I size the pool and timeout rather than run the safety algorithm on every request.

If they probe: Want me to run a numeric tableau, I will, and I still will not claim Ylogx ran Bankers.

The CPU uses virtual addresses, and the MMU maps them to physical frames via page tables, with a TLB on the fast path. A miss that is present walks tables; not present is a page fault. Demand paging brings pages from swap or file until touched, and a typical page is 4 KiB, though huge pages exist and I will not volunteer them unless asked. Isolation means process A cannot read process B’s virtual address space, so a Horizon ROS2 node crash is not the whole rover image, unlike a bad native thread in one process. This is GFG 6-months December 2020, older, still in bible 5.F. Ylogx ECS task memory limit is the practical cap, not a page table I configured. ZED 2 at more than 2 million points per second is a working-set problem: keep the costmap window in RAM and do not page the cloud. I do not invent a thrashing incident.

Example: If the rover tries to keep the entire dense cloud plus a huge JVM heap on a small box, virtual addresses still look fine while the working set no longer fits RAM, which is the bridge into thrashing.

If they probe: Ask me to walk a multi-level page table, I sketch VPN to PPN and return to isolation and working set.

Thrashing means more time paging than running because the working set of runnable processes is larger than RAM. The CPU looks busy on disk I/O and idle for useful work. The fix is fewer concurrent processes, more RAM, or better locality, not add threads. The Java trap is dash Xmx larger than host RAM, which is OS swap plus GC, a death spiral. A heap that is too small is a different failure: allocation failure or a full GC loop, which is not OS thrashing, and I say the difference. Argus more than 20 cameras at 24 FPS needs bounded in-flight frames, drop or skip, not unbounded queues that blow RSS. Ylogx Redis minus 35 percent is cache, not swap. Same older GFG December 2020 R2. I do not invent a production thrashing ticket.

Example: Twenty camera workers each queueing uncompressed frames will page the box to death and miss 24 FPS; a bounded queue that drops stale frames keeps the working set inside RAM.

If they probe: Conflate GC stop-the-world with thrashing, I separate JVM pause from OS swap.

Resume: YOLOv9 73%→89% mAP , 15k images, 24 FPS , 20+ camera feeds, Postgres logs, containerized, violations −50% , compliance 2× . Do not invent “one Java `Thread` per camera in prod.” Honest design: bounded worker pool (or one process per N cameras) + queue with backpressure ; drop frames vs unbounded RAM. Isolation: a crashed inference worker should not take the logger/API with it → process (container) boundary beats a shared-heap thread for fault isolation. 24 FPS × 20 cameras is a capacity question (pool size, queue bound), same shape as `ThreadPoolExecutor` core/max/queue — Live Code can be Java even if the ship was Python. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes.

Example: Resume: YOLOv9 73%→89% mAP , 15k images, 24 FPS , 20+ camera feeds, Postgres logs, containerized, violations −50% , compliance 2× .

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Resume: ROS2 rover, ERC 2024 17th / 80+ , GStreamer 60 FPS , ZED 2 2M+ pts/s , costmap −55% collision, obstacle +40% . Public `Gstreamer-UDP` = supporting webcam-stream artifact, not a second project. ROS2 node ≈ process (own VAS, DDS IPC). Pipeline threads exist inside GStreamer / rclcpp executors — shared-heap, need not-block-the-callback. 60 FPS = budget ~16 ms/frame. A blocking lock on the capture thread is a livelock/latency bug, not “use Bankers.”. 17th/80+, 60 FPS, 2M+ pts/s, −55% / +40% — concurrency for deadlines , not JVM GC lore. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation.

Example: Resume: ROS2 rover, ERC 2024 17th / 80+ , GStreamer 60 FPS , ZED 2 2M+ pts/s , costmap −55% collision, obstacle +40% .

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Resume: FastAPI + NestJS, Postgres, 99.9% uptime, sub- 210 ms , CloudFront / ECS / Docker / ALB / Route 53, Redis −35% bot path, RLS 3 tiers . One ECS task = Linux process(es) in a container. Scale-out = more tasks (processes), not more `new Thread()` on one JVM you did not run. Thread-safety question they may still ask in Java Live Code: request handlers share heap → `synchronized` / concurrent map / don’t mutate a global limiter unsafely (Rate Limiter is count=1 , other loop). 99.9%, sub-210 ms, Redis −35%, 3-tier RLS. Kubernetes is on the skills list — do not claim you operated a k8s thread scheduler here (see R20). I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Independent Rate Limiter SDE I count is 1, and that loop is OA plus system design, not UTA two-DSA. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: Resume: FastAPI + NestJS, Postgres, 99.9% uptime, sub- 210 ms , CloudFront / ECS / Docker / ALB / Route 53, Redis −35% bot path, RLS 3 tiers .

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Deadlock: wait-for cycle, no progress, threads BLOCKED . Livelock: threads RUNNABLE , keep reacting (unlock/retry/yield) but the invariant never advances. Polite philosophers put forks down forever; two `tryLock` fail and spin-retry with no backoff. Starvation: some thread never enters the CS (unfair lock, writer-preference, always-notify-wrong-waiter). Progress exists — just not for you. Fix livelock: backoff, random retry, lock order, `tryLock` + give-up to a queue. Horizon 60 FPS: livelock looks like busy pipeline, zero frames out. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Horizon 60 FPS: livelock looks like busy pipeline, zero frames out.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Intrinsic: `synchronized(obj) { while (!ok) obj.wait(); }` — `wait` releases the monitor ; must loop (`while`, not `if`) for spurious wakeups / stolen signal. Prefer `notifyAll` unless you can prove one waiter. `notify` vs `notifyAll`: wrong waiter wakes → lost signal. `notifyAll` is the interview-safe default. `ReentrantLock` + `Condition`: `await` / `signal` / `signalAll`. Extra: `tryLock`, `lockInterruptibly`, multiple conditions (notEmpty vs notFull) — cannot do that with one `Object` monitor cleanly. `synchronized` cannot `tryLock`. Nested `synchronized` in opposite order = Coffman cycle. Producer-consumer is the sketch (camera frames / KPI events). Do not claim you shipped `Condition` at Ylogx. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Why: cap threads, reuse, backpressure . `new Thread` per request = native stack + scheduler death. `ThreadPoolExecutor(core, max, keepAlive, queue, factory, handler)`. Queue full → create up to max → then RejectedExecutionHandler . `Executors.newFixedThreadPool(n)` = unbounded `LinkedBlockingQueue` → `max` never used; OOM under burst. `newCachedThreadPool` = unbounded threads. Interview: construct `ThreadPoolExecutor` yourself . Handler: `CallerRunsPolicy` (backpressure on caller), abort, discard. Daemon vs non-daemon: JVM exits when only daemons remain. Argus 20+ cameras / IQVIA LangGraph agents = bound the pool . Ylogx 99.9% is not “cached thread pool.”. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

Example: Argus 20+ cameras / IQVIA LangGraph agents = bound the pool .

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

`NEW` → `RUNNABLE` (includes OS running + ready) → `TERMINATED`. `BLOCKED`: waiting to enter `synchronized`. `WAITING`: `wait()` / `join()` / `LockSupport.park`. `TIMED_WAITING`: sleep / timed wait. Deadlock dump: `BLOCKED` + cycle. Livelock dump: `RUNNABLE`, no cycle. Tooling (`jstack`) is CS, not an internship bullet. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Generational: Eden → Survivor → Old . Hypothesis: most objects die young. Promotion if they survive collections. Stop-the-world vs concurrent marking (G1). You do not need CMS history. ZGC/Shenandoah = ultra-low pause, not intern evidence. Roots: stacks, statics, JNI. `finalize` is dead; `Cleaner` / try-with-resources for native. Java 8+: Metaspace (class metadata, native) replaced PermGen. `OutOfMemoryError: Metaspace` ≠ heap. Do not invent GC pause % for 99.9% / 99.5%. Those are service uptime.

Example: Stop-the-world vs concurrent marking (G1).

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Thread switch: save/restore registers + stack pointer; same page tables. Process switch: also CR3 / ASID — more TLB shootdown. Prefer threads for shared in-memory cache (one JVM). Prefer processes for blast radius (Argus worker, ROS2 node, ECS task). Green threads vs native: modern HotSpot 1:1 native . Virtual threads (Loom) = many tasks on few carriers — mention only if they ask Java 21; not on resume. Horizon nodes = process; Ylogx ECS task = process; in-process FastAPI/Nest workers = threads/async on a shared heap. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Process switch: also CR3 / ASID — more TLB shootdown.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Object a = new Object(), b = new Object();
Thread t1 = new Thread(() -> {
  synchronized (a) { synchronized (b) { /* work */ } }
});
Thread t2 = new Thread(() -> {
  synchronized (b) { synchronized (a) { /* work */ } }
});
// Fix: lock(a) then lock(b) on BOTH paths (order by System.identityHashCode).

synchronized void put(T x) throws InterruptedException {
  while (q.size() == cap) wait();
  q.add(x);
  notifyAll();
}
synchronized T take() throws InterruptedException {
  while (q.isEmpty()) wait();
  T x = q.remove();
  notifyAll();
  return x;
}

ExecutorService pool = new ThreadPoolExecutor(
    4, 8, 60, TimeUnit.SECONDS,
    new ArrayBlockingQueue<>(128),
    new ThreadPoolExecutor.CallerRunsPolicy());
// shutdown() / awaitTermination; never unbounded queue for “20 cameras”.

Available=3
P0 Need=1 Alloc=1
P1 Need=4 Alloc=2   // 4>3 → cannot run first
P2 Need=2 Alloc=2
Work=3 → P0 (need 1) → Work=4 → P2 (need 2) → Work=6 → P1 (need 4). Safe: P0,P2,P1.
If P1 Need were 7 and Work never reaches 7 → unsafe. Do not allocate.

REST: Ylogx BI was REST (FastAPI + NestJS). JSON over HTTP; AuthN at API; RLS still in Postgres. Docker: package app + runtime. Ylogx: containers on ECS . Argus: containerized multi-cam workers. Not “I dockerized a laptop demo.”. EC2: VM that *can* run Docker. Honest: resume path is ECS managing containers , not “I SSH’d a fleet of EC2.” If they insist: ECS tasks still run on compute (Fargate or EC2 launch type) — I will not name which (off-resume). S3: object store (PDFs, model weights, static assets). Not a named Ylogx bullet. Contrast: Postgres = RLS rows / joins; S3 = blobs. Stratify/GiftedBooks *could* store models/PDFs as objects — do not invent a bucket name.

Example: EC2: VM that *can* run Docker.

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Candidate listed an AWS-services task ; wording unnamed. Do not invent the task. Safe shape if they ask “which AWS did you use?”: CloudFront, ECS, Route 53, ALB (resume). Docker as the unit of deploy. Map each to a job: CDN/edge, container scheduler, DNS, L7 load balancer. Stop before a 12-service zoo (RDS name, ECR, ACM, WAF, EKS). Ylogx deploy sentence — that *is* the AWS-services answer. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. If the source did not name the prompt I keep a short pack ready and I do not guess the title.

Example: Safe shape if they ask “which AWS did you use?”: CloudFront, ECS, Route 53, ALB (resume).

If they probe: The exact wording is unnamed and I will not invent it; I offer the three-block pack or I write the DSA if the slot is actually code.

Resolver asks recursive DNS; authoritative zone answers A/AAAA/CNAME/ALIAS. Ylogx hook: GoDaddy held the domain; Route 53 was the AWS DNS that aimed at the ALB . Registrar ≠ hosted zone. Same GFG slot also asked MAC vs IP, thrashing, virtual memory — not AWS. One line each if they chain: MAC = L2 local; IP = L3 routable; VM pages; thrashing = working set > RAM. GoDaddy + Route 53 + ALB. Not “I designed Route 53 geolocation.”. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Ylogx hook: GoDaddy held the domain; Route 53 was the AWS DNS that aimed at the ALB .

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Do not prep as if 18 Aug is an EC2-cost OA. If they still ask cost: Frugality = CloudFront + Redis before a larger box; no invented AWS bill. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. I stop after one example rather than inventing architecture I did not ship.

Example: Do not prep as if 18 Aug is an EC2-cost OA.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

A browser hits CloudFront, then ALB, then an ECS task running a Dockerized FastAPI or NestJS API, then Postgres with three-tier RLS, and Redis sits on the hot bot path. DNS is GoDaddy to Route 53 to that ALB. Dashboards are sub-210 ms and uptime is 99.9 percent. Redis cut bot DB latency 35 percent. CI/CD is GitHub Actions building the image and rolling ECS. The LLM SQL RAG is not on the dashboard hot path. Kubernetes is skills-only; this path is ECS. I do not invent Fargate versus EC2 launch type.

Example: Opening a KPI dashboard is CloudFront cache or origin to ALB to ECS to Postgres; asking the bot a question may hit Redis minus 35 percent then SQL under SET ROLE, which is a slower path on purpose.

If they probe: K8s ingress names, I map them conceptually to ALB plus ECS and repeat I did not run a cluster.

CloudFront is a CDN at the edge so static and cacheable KPI JSON does not hit ECS on every repeat view, which is how you defend sub-210 ms. It also terminates TLS at AWS edge and hides origin. Frugality is cache before a bigger box. Nginx is on the skills list as the same reverse-proxy idea; the resume public edge is CloudFront plus ALB, not I put Nginx on the internet. Cache versus origin is the mental model: TTL on GET, no cache on tenant-specific POST. 99.9 percent still depends on ECS remaining healthy behind ALB. I do not invent a cache-hit percentage. Argus cameras are not this CDN path.

Example: Thirty dashboards that 60 percent more ops used would melt ECS if every widget missed the edge; CloudFront holds the cacheable GETs while ECS serves origin and the bot path uses Redis.

If they probe: An Nginx conf I shipped as the public edge, I correct to CloudFront plus ALB.

Docker is the image and the running container. ECS is the scheduler: cluster, service, task, and task definition, so desired count stays N, health checks replace bad tasks, and rolling deploys happen without a screen session on a fat VM. That is what Ylogx shipped with CI/CD. Just docker run is not 99.9 percent. Kubernetes would also schedule containers; I did not operate it here. ALB targets ECS tasks, not random docker ps. Argus containerized 20-plus cameras is Docker isolation, not an ECS claim unless I am talking Ylogx. I will not invent CPU units.

Example: A GitHub SHA becomes a task definition revision; ECS starts a new task, ALB waits for slash health 200, then an old task stops, which docker run on one VM cannot do cleanly.

If they probe: Fargate versus EC2 launch type, I mark off-resume unless I can confirm.

ALB = L7 (HTTP/HTTPS) load balancer. Host/path rules; health checks; drain on deploy. Route 53 points at the ALB, not at a single task IP (tasks die). Not NLB (L4) unless they ask the contrast — resume names ALB. Host-header / www vs non-www isolation is how “the site is up but Google 403s” actually fails (prep class of bug; no fake ticket ID). “GoDaddy DNS with Route 53 to route traffic through an ALB.”. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: ALB = L7 (HTTP/HTTPS) load balancer.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

GoDaddy: registrar (bought the name). Can also do DNS; we used AWS DNS for the ALB alias. Route 53: hosted zone; alias/A to ALB (AWS-native target). Cutover: point GoDaddy NS (or relevant records) at Route 53 so AWS is authoritative for the app hostname. Debug order if the site “vanishes”: registrar NS → Route 53 records → ALB listener/certs → CloudFront alternate domain → origin. Isolate, don’t reboot ECS first. Configured GoDaddy DNS with Route 53. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Route 53: hosted zone; alias/A to ALB (AWS-native target).

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

GitHub Actions is the intern CI/CD: test, image, deploy to ECS. The image tag is the commit SHA so I can roll forward or back. ECS keeps a desired count and replaces tasks behind ALB health checks. CloudFront continues to cache the dashboard during a short overlap. Secrets are injected, never committed. I do not claim a 20-stage textbook pipeline. 99.9 percent is compatible with a two-minute overlapping roll and not with taking the service to zero. Kubernetes rollingUpdate is the analogue I can name without claiming I ran it.

Example: Main branch push runs pytest, docker build, docker push, then register task definition and update-service; ALB stops sending traffic to 503 tasks.

If they probe: Ask for the YAML, I sketch steps and refuse to invent OIDC ARNs.

Resume-stated p-ish latency, not a load-test dump I do not have. Budget: CloudFront cache for static; Redis for hot schema/repeat bot queries (−35% DB latency); connection pooling; no LLM on the dashboard hot path . SQL RAG is slower than a cached KPI GET — do not pretend every chatbot token is 210 ms. If they ask p99: I measured to put sub-210 ms on the resume; I will not fabricate percentiles. “achieving sub-210 ms response times.”. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Budget: CloudFront cache for static; Redis for hot schema/repeat bot queries (−35% DB latency); connection pooling; no LLM on the dashboard hot path .

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Meaning: health checks, rolling deploys, don’t SSH-mutate prod, ALB only healthy targets. Not multi-AZ claimed. GiftedBooks is 99.5% (different product; don’t mix). Incidents I will discuss as a *class*: DNS/host-header/CloudFront vs origin, not a named SEV. BI that is down is not “AI” (Deliver Results / Highest Standards backup). “99.9% uptime” on Ylogx daily queries. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: GiftedBooks is 99.5% (different product; don’t mix).

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Kubernetes is on the skills list; I am not a cluster owner. What I actually ran is Docker on ECS with CloudFront, ALB, Route 53, GitHub Actions CI/CD, Redis minus 35 percent, and 99.9 percent uptime at Ylogx. Ingress in k8s is the same reverse-proxy idea as Nginx or ALB. I can talk Deployments, Services, and rollingUpdate as standard CS. I will not fake kubectl against a named account. Argus containerized 20-plus cameras is not EKS. GiftedBooks 99.5 percent is not this ECS story. I keep that honesty even if they push.

Example: If they ask how I would roll out, I describe ECS starting a new task, waiting until ALB is healthy, then stopping an old task, and I can say the k8s analogue is a Deployment without claiming I ran it.

If they probe: Want EKS node groups, I stop rather than invent.

Argus: YOLOv9, 20+ cameras, 24 FPS , Postgres logs, containerized . Scale = workers per stream, not an ALB/CloudFront story. Ylogx: HTTP BI, CloudFront/ECS/ALB, sub-210 ms . Don’t paste the Ylogx diagram onto Argus, or GPU onto Ylogx. Argus containerized 20+ cams; Ylogx ECS. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation.

Example: Argus: YOLOv9, 20+ cameras, 24 FPS , Postgres logs, containerized .

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Task role / env for DB URL. LLM must not hold a superuser connection. NestJS RBAC + Postgres RLS, 3 org tiers . Scaling ECS without RLS scales leaks . Parameterized SQL, read-only role, timeout, row cap. RLS/RBAC 3 tiers + ECS deploy. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. IQVIA is LangGraph Deep Research across 200-plus sites and Hybrid RAG on 200-plus page BRDs with LangSmith traces and evals. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: NestJS RBAC + Postgres RLS, 3 org tiers .

If they probe: Where not to use an LLM, I name Ylogx RLS, Argus PPE boxes, and Horizon costmap; if the slot is labeled GenAI Fluency but is Distance K, I write the tree, not a RAG essay.

VM: hypervisor, guest kernel, heavier. Container: shared host kernel, isolated processes + filesystem (namespaces/cgroups). Image = layers + entrypoint; container = running instance. Why Docker for Ylogx: same artifact from CI to ECS. Why not a snowflake EC2 AMI as the first cut. Docker containers on ECS. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Why not a snowflake EC2 AMI as the first cut.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Task def: image, CPU/mem, ports, env. Service: keep desired count; attach load balancer. Cluster: pool the service runs in. Scale = desired count (horizontal), not “resize the laptop.”. ECS service behind ALB — I will not invent desired-count numbers. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

ALB: HTTP(S), host/path, sticky optional, health checks. NLB: TCP/UDP, extreme connections, not the BI default. Nginx: skills list (reverse proxy/static). Not named on the Ylogx AWS bullet — don’t put Nginx in the diagram unless they ask skills. ALB named; Nginx = skills only. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Cache key ≈ URL (+ headers you chose). Hit = edge; miss = origin (ALB/ECS). Invalidation after frontend deploy, or versioned asset names. Cookie/Authorization often bypass cache — authenticated API is not a 210 ms CDN miracle. CloudFront for static/API edge; Redis for origin DB. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: Cookie/Authorization often bypass cache — authenticated API is not a 210 ms CDN miracle.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Alias (AWS): name → ALB/CloudFront without a naked-CNAME headache. NS: who is authoritative. TTL: how long lie lives after a cutover. Do not claim geolocation / failover routing (multi-region-adjacent). Route 53 after GoDaddy. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Route 53 after GoDaddy.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Start v2 tasks → ALB health pass → shift traffic → stop v1. Don’t SIGKILL the fleet. Health check = HTTP path that means “can serve,” not “process exists.”. 99.9% is this discipline plus boring DNS, not a multi-region active-active (not on resume). CI/CD + 99.9% uptime. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Start v2 tasks → ALB health pass → shift traffic → stop v1.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Vertical: bigger task CPU/mem — Frugality last. Horizontal: more ECS tasks behind ALB. Cache (Redis −35%) and CDN first. I did not shard Postgres. Redis + CloudFront before a larger box. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation.

Example: Cache (Redis −35%) and CDN first.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Stateless HTTP, resource URLs, JSON. Ylogx dashboards: REST, not GraphQL-first (GraphQL is skills; over-fetch wasn’t the first pain). Idempotent GET for KPIs; POST for report generate. RESTful APIs on the Ylogx bullet. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Postgres: rows, joins, RLS, transactions. Redis: hot keys, TTL, −35% bot DB latency. S3 (if asked): immutable blobs, no RLS-over-SQL. Don’t store tenant fact tables in S3 and call it BI. Postgres + Redis shipped; S3 only if they ask the IE list. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Redis: hot keys, TTL, −35% bot DB latency.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Browser
  → CloudFront (edge cache / TLS)
      → ALB (L7, health checks)
          → ECS tasks (Docker)
              ├ NestJS  (auth, RBAC, report CRUD)
              └ FastAPI (SQL RAG)
          → Redis     (schema + hot answers)
          → Postgres  (RLS, 3 org tiers)

GoDaddy (registrar)
  → Route 53 (hosted zone, alias to ALB)

# sketch — not the production file
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
ENV PORT=8080
EXPOSE 8080
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8080"]

# sketch — Ylogx names CI/CD; Actions is skills-list
# on: push to main
# jobs:
#   build: docker build / tag
#   push:  docker push $REGISTRY/$IMAGE:$SHA
#   deploy: register ECS task def with new image → update service
# health: ALB target group must go healthy before old tasks drain

GET /health  → 200 only if:
  - process up
  - can reach Postgres (or fail-open only if you *mean* that — Ylogx BI should fail closed)
ALB interval/threshold: unhealthy ⇒ stop sending traffic
CI/CD waits for new tasks healthy

+desiredCount on ECS service
ALB spreads HTTP
Redis stays shared (hot keys)
Postgres: still one primary + RLS  (I did not shard)
CloudFront still in front
NOT: second region, EKS, Kafka

S: Horizon Feb–Jun 2024. ERC 2024 date does not slip. T: Perception + planning that can run , not a lab stack after the event. A: Ship GStreamer 60 FPS + ZED 2 2M+ pts/s mapping + costmap fusion — not wait on extra hardware. R: 17th / 80+ ; obstacle +40% ; collision −55% . What you cut: extra sensors / new architecture week-of. What you refused to cut: a planner that still collides (no costmap). Resume does not state a missed ERC. Do not invent a miss. Sequence 60 FPS + costmap so the run happened. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed.

Example: S: Horizon Feb–Jun 2024.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Learned ROS2 as the integration bus (nodes, topics, time), not a new CNN. Discarded: “train a giant vision model and hope”; naive TCP MJPEG webcam; bump-and-turn with no costmap. Proof of learning is the shipped graph + metrics, not a course certificate. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Learned ROS2 as the integration bus (nodes, topics, time), not a new CNN.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Owned camera + mapping + costmap as software-team blockers , not “someone else’s camera ticket.”. Trade-off: costmap + fusion on ZED 2 vs buy another sensor ( Frugality / Backbone ). Challenge: 2M+ pts/s cannot all go to a remote laptop; stale costmap = planned collision. Debug: GStreamer latency vs ROS2 callback vs ZED rate. Outcome: 17th / 80+ , −55% collision. Public `Gstreamer-UDP` supports the feed story — do not list it as a second bullet. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Trade-off: costmap + fusion on ZED 2 vs buy another sensor ( Frugality / Backbone ).

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

TCP is a reliable ordered byte stream with handshake and retransmission. UDP is datagrams with no handshake, so a lost packet is gone. My honest UDP example is the Horizon GStreamer camera feed, including the public Gstreamer-UDP JPEG RTP over UDP on a LAN. Live video prefers drop-over-stall, which is why 60 FPS is UDP-style rather than TCP MJPEG. I do not claim Kafka as my UDP story; Kafka was igreaper CS, not this intern. This GFG sde-1-17 CN question sits with Bankers and threads versus processes and is not UTA two-DSA. Argus 24 FPS is a detector budget, not this camera transport. I will not put an LLM on the rover feed either.

Example: A lost UDP datagram on the operator feed is a brief glitch at 60 FPS; TCP retransmit of the same frame would stall the pipeline and miss the ERC live constraint.

If they probe: Why not TCP for reliability, I say live video would rather drop a frame than wait, and I keep Kafka out of this intern.

Horizon costmap and actuation are a should-not: occupancy and commands must be auditable and exact. A weights file is at most one node. Argus PPE boxes stay YOLO at 73 to 89 percent mAP and 24 FPS, not an LLM looking at frames. Ylogx RLS policy and money totals without SQL stay off the model, and dashboards stay sub-210 ms. Primary GenAI story is still IQVIA if they want where I did use it. This maps bible 5.E Fluency prompts, not a 10454435 invention. I use the rover only if they ask anything you would not let a model drive. InstaRecon remains ethics only if GitHub comes up.

Example: A costmap cell that says occupied because ZED fused depth is something the planner can use; a fluent paragraph that says probably a rock is not a cmd_vel.

If they probe: Want IQVIA after this, I switch to 200-plus sites and LangSmith; I do not mix those stacks onto the rover.

I was core software on a semi-autonomous Mars rover using ROS2 for ERC 2024. The camera feed is 60 FPS with GStreamer, and ZED 2 produces more than 2 million points per second into RViz and Gazebo. A costmap plus sensor fusion plus predictive algorithms drove path planning. Obstacle detection improved 40 percent and collision risk dropped 55 percent. We placed 17th globally of more than 80 teams. I was a software team member, not I trained a model. Public Gstreamer-UDP supports the feed story and is not a second resume bullet. I do not put an LLM on this costmap, and I do not merge Argus YOLO into the rover.

Example: Camera to GStreamer 60 FPS sits beside ZED depth into an occupancy grid the planner reads; that is the 60-second picture, with 17th of 80-plus as the outcome.

If they probe: Ask about YOLO, I say Argus is a different project at 24 FPS.

ERC is localization + planning + comms + a live operator feed. A `.pt` / weights file is one node . ROS2 is the bus : drivers, time sync, topics, costmap, actuators. Argus (YOLOv9 73→89 mAP , 24 FPS ) is a different project — do not merge YOLO into Horizon. +40% obstacle came from a pipeline (depth → occupancy → plan), not a tutorial OpenCV threshold. −55% collision is planning + fusion , not a better classifier alone. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation.

Example: ROS2 is the bus : drivers, time sync, topics, costmap, actuators.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Node: a process with a job (camera, ZED mapper, costmap, planner, actuator, viz bridge). Topic: named pub/sub stream (images, point cloud, occupancy, cmd). Many subscribers; no reply required. Service / action (if they probe): request-reply or long-running goal. Do not invent which ERC tasks used which. Graph = who publishes / who subscribes. That is the architecture. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Resume: real-time camera feed 60 FPS with GStreamer (rover). GitHub `adarshx01/Gstreamer-UDP` : Python sender/receiver wrapping `gst-launch-1.0`, UDP JPEG RTP, same LAN , banner “Team Horizon.” Webcam analogue , not a second project, not the ZED mapper. Public pipeline (repo): `v4l2src → videoconvert → videoscale → 640x480 raw → jpegenc → rtpjpegpay → udpsink`. Receiver: `udpsrc → rtpjpegdepay → jpegdec → autovideosink`. Why not Flask/TCP MJPEG: retransmit + stack copies kill live FPS. UDP + GStreamer hardware path keeps the operator feed. Honest gap: repo default is 640×480 JPEG RTP ; resume 60 FPS is the rover claim. Do not say the public script *is* 60 FPS or that it ran the ERC stereo camera. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation.

Example: Resume: real-time camera feed 60 FPS with GStreamer (rover).

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

ZED 2 stereo depth → 3D mapping 2M+ data pts/s , connected to RViz (viz) and Gazebo (sim). Dense cloud stays local for costmap. Downsample for remote viz. Student hardware, not a cloud GPU bill ( Frugality ). Do not invent voxel size, Hz, or a named SLAM package that is not on the resume. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation.

Example: ZED 2 stereo depth → 3D mapping 2M+ data pts/s , connected to RViz (viz) and Gazebo (sim).

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

A costmap is an occupancy grid in robot or map frame with free, occupied, and unknown cells, plus inflation so the footprint does not clip. The planner reads costs, not raw pixels, because stop if red pixel still hits rocks at speed. Resume wording is sensor fusion plus predictive: more than the current camera frame, fusing ZED occupancy over time so you plan around where obstacles are. The metric is collision risk minus 55 percent, and I do not invent N crashes in field logs. The alternative I refused first was extra hardware or reactive bump-and-turn. I do not put an LLM on this grid. 60 FPS is the camera pipeline, not the detector FPS from Argus. Live Code analogue is an int grid plus a PriorityQueue planner in Java.

Example: Inflating occupied cells by the rover radius turns a thin rock into a cost the planner will go around; without inflation you plan a geometrically free path that still clips the corner, which is the collision you are trying to cut 55 percent.

If they probe: Ask for voxel size or a named SLAM package, I will not invent it.

Resume: 40% improvement in obstacle detection accuracy on the rover pipeline. Do not invent the baseline number or that it was YOLOv9 (Argus is PPE, 15k images, 24 FPS ). Say: depth + occupancy + fusion beat a blob detector; the +40% is the resume result. 60 FPS is the operator/autonomy feed , not Argus 24 FPS. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes.

Example: Resume: 40% improvement in obstacle detection accuracy on the rover pipeline.

If they probe: A named GPU, TensorRT, ByteTrack, or API routes, I refuse to invent them; if they mix Horizon 60 FPS into Argus, I separate GStreamer video infra from the detector.

Horizon shipped ROS2 Python nodes + GStreamer/ZED native libs. Resume does not list C++ . Honest: I do not claim a C++ bullet. Native SDKs are C/C++; I owned the graph (topics, costmap, feed), not “I wrote the ZED SDK.”. Same ideas in Java: `HashMap` of topic → subscribers; `BlockingQueue` as a mailbox; grid `int[][]` as costmap; planner = graph search on that grid (`PriorityQueue` for Dijkstra/A*). One line: “I think in maps, queues, and graphs; I write Java in this editor.”. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Horizon shipped ROS2 Python nodes + GStreamer/ZED native libs.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

ZED 2 ──point cloud──► mapper ──occupancy──► costmap ──► planner ──cmd──► actuators
Camera ──GStreamer 60 FPS──► operator / autonomy (UDP-style feed)
Other sensors ─────────────────────────────► fusion ──┘
Gazebo (sim) / RViz (viz) subscribe to the same topics

Classes: `Node`, `Topic`, `Costmap`, `Planner`, `GstCamera`, `ZedMapper`, `Actuator`. Failure modes they want: drop frames vs stall; stale costmap ; sim (Gazebo) ≠ dust/lighting — still needed field time. Thread-safety: one writer per topic mailbox; do not splice the grid from two nodes without a lock or single fusion node. Scale: 2M+ pts/s → downsample for viz; keep dense for local costmap. If stretched: do not expose unauthenticated field telemetry. If they insist Java: interfaces + in-memory bus (sketch in Must-know). I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Scale: 2M+ pts/s → downsample for viz; keep dense for local costmap.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Field, not SaaS: dropped frames vs 60 FPS ; costmap lag → plan on stale occupancy. Debug order: GStreamer pipeline latency vs ROS2 callback vs ZED cloud rate — measure, do not guess. Test: Gazebo + RViz playback + field runs; resume FPS / +40% / −55%. Rebuild: stricter time-sync ZED ↔ costmap; better sim-to-real for dust; same split perception vs planning vs comms. Knowledge sharing: if only you understand GStreamer/ZED, the rover fails when you are on another subsystem (Hire/Develop honest — not a people manager). I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Field, not SaaS: dropped frames vs 60 FPS ; costmap lag → plan on stale occupancy.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Owned integration (camera + mapping + costmap), not fake skip-levels. Backbone optional: software fusion vs “buy another sensor”; commit was ZED 2 + costmap ( −55% ). Do not invent a named teammate fight or that you were team lead. Resume: software team member . I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Backbone optional: software fusion vs “buy another sensor”; commit was ZED 2 + costmap ( −55% ).

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Pub/sub (ROS2 topics / Kafka-like): producer does not wait; multiple consumers; decoupled rates . Kafka order is per partition (igreaper IE-asked ) — not used on the rover. RPC/service: need an answer (set a parameter, get a pose once). Shared map: simplest LLD, races on the grid. Fusion node = single writer. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes.

Example: Pub/sub (ROS2 topics / Kafka-like): producer does not wait; multiple consumers; decoupled rates .

If they probe: A named GPU, TensorRT, ByteTrack, or API routes, I refuse to invent them; if they mix Horizon 60 FPS into Argus, I separate GStreamer video infra from the detector.

Image: 2D pixels, good for operator 60 FPS . Point cloud: 3D metric, 2M+ pts/s — too fat to plan on raw. Occupancy / costmap: discretized 2D (or 2.5D) costs for search. That is why −55% is a planner metric. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Image: 2D pixels, good for operator 60 FPS .

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Live view: late frame is useless → UDP + accept drops (GStreamer RTP). File copy, HTTP API, Ylogx REST: TCP . Handshake/reliability: TCP 3-way; UDP none. Firewall: repo notes same-LAN + open port (public `Gstreamer-UDP`). I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Handshake/reliability: TCP 3-way; UDP none.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

A camera pipeline wants isolation and deadlines. A ROS2 node is a process with its own address space talking over topics, so a mapper crash does not kill GStreamer. Threads inside GStreamer or an rclcpp executor share a heap, so a blocking lock on the capture thread is a latency bug at 60 FPS, about 16 milliseconds per frame. Argus more than 20 cameras at 24 FPS is a bounded worker pool or one process per N cameras with backpressure, not unbounded Java threads. I do not invent a Java Thread per camera in production. Process beats thread for blast-radius; thread beats process for cheap shared-memory work. I do not put an LLM on this pipeline. Live Code can still be a Java ThreadPoolExecutor sketch of the same bound.

Example: If capture and NMS share one process and NMS blocks, frames stall; putting ingest in one process and inference in another with a bounded queue keeps 24 FPS or 60 FPS from becoming a GC or lock story.

If they probe: Bankers, I say this is a deadline and queue-bound problem, not an avoidance algorithm.

Planner = shortest path on a grid. `PriorityQueue` (binary heap) for Dijkstra/A* — same reason as LC 6570344 “why PQ.”. Refuse: sort the whole map every tick; refuse `TreeMap` of cells as the primary frontier. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation.

Example: `PriorityQueue` (binary heap) for Dijkstra/A* — same reason as LC 6570344 “why PQ.”.

If they probe: A named GPU, TensorRT, ByteTrack, or API routes, I refuse to invent them; if they mix Horizon 60 FPS into Argus, I separate GStreamer video infra from the detector.

interface Subscriber<T> { void onMsg(T msg); }

final class Topic<T> {
    private final List<Subscriber<T>> subs = new CopyOnWriteArrayList<>();
    void subscribe(Subscriber<T> s) { subs.add(s); }
    void publish(T msg) { for (Subscriber<T> s : subs) s.onMsg(msg); }
}

final class Pose { final double x, y, yaw; Pose(double x, double y, double yaw) { this.x = x; this.y = y; this.yaw = yaw; } }
final class Cloud { final float[] xyz; Cloud(float[] xyz) { this.xyz = xyz; } } // xyz packed; downsample before viz
final class Occupancy { final int[][] cost; Occupancy(int[][] cost) { this.cost = cost; } }
final class CmdVel { final double v, w; CmdVel(double v, double w) { this.v = v; this.w = w; } }

final class RoverGraph {
    final Topic<Cloud> cloud = new Topic<>();
    final Topic<Occupancy> grid = new Topic<>();
    final Topic<CmdVel> cmd = new Topic<>();
    // Camera/GStreamer is out-of-band UDP to operator; optional Topic<byte[]> preview
}

final class Costmap {
    static final int FREE = 0, LETHAL = 100;
    final int w, h, infl;
    final int[][] cost;
    Costmap(int w, int h, int infl) {
        this.w = w; this.h = h; this.infl = infl;
        this.cost = new int[h][w];
    }
    void markLethal(int gx, int gy) {
        if (gx < 0 || gy < 0 || gx >= w || gy >= h) return;
        cost[gy][gx] = LETHAL;
        for (int dy = -infl; dy <= infl; dy++)
            for (int dx = -infl; dx <= infl; dx++) {
                int x = gx + dx, y = gy + dy;
                if (x < 0 || y < 0 || x >= w || y >= h) continue;
                if (cost[y][x] < LETHAL) cost[y][x] = Math.max(cost[y][x], LETHAL - 1);
            }
    }
    // Decay / unknown: do not invent a filter name. Resume: fusion + predictive over successive clouds.
}

int planCost(int[][] cost, int sx, int sy, int gx, int gy) {
    int h = cost.length, w = cost[0].length;
    int[][] dist = new int[h][w];
    for (int[] row : dist) Arrays.fill(row, Integer.MAX_VALUE);
    PriorityQueue<int[]> pq = new PriorityQueue<>(Comparator.comparingInt(a -> a[0]));
    dist[sy][sx] = 0;
    pq.offer(new int[]{0, sx, sy});
    int[][] d = {{1,0},{-1,0},{0,1},{0,-1}};
    while (!pq.isEmpty()) {
        int[] cur = pq.poll();
        int c = cur[0], x = cur[1], y = cur[2];
        if (c != dist[y][x]) continue;
        if (x == gx && y == gy) return c;
        for (int[] k : d) {
            int nx = x + k[0], ny = y + k[1];
            if (nx < 0 || ny < 0 || nx >= w || ny >= h) continue;
            if (cost[ny][nx] >= 100) continue; // lethal
            int nc = c + 1 + cost[ny][nx];    // inflation as extra cost
            if (nc < dist[ny][nx]) { dist[ny][nx] = nc; pq.offer(new int[]{nc, nx, ny}); }
        }
    }
    return -1; // no path — stop, do not hallucinate a cmd
}

DNS: name → IP (Ylogx hook: GoDaddy nameservers → Route 53 → ALB). MAC = L2 local hop; IP = L3 routable. TLS/HTTPS sits above that (TCP 443). Older IE — do not treat as UTA-default. Ylogx DNS path is on the resume; Nginx is a skill, not that DNS row. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes.

Example: DNS: name → IP (Ylogx hook: GoDaddy nameservers → Route 53 → ALB).

If they probe: A named GPU, TensorRT, ByteTrack, or API routes, I refuse to invent them; if they mix Horizon 60 FPS into Argus, I separate GStreamer video infra from the detector.

Prompt was CN , not “configure Nginx.”. If they pivot: HTTPS = HTTP over TLS; reverse proxy sits at the HTTP hop after TLS terminate. Same IE also had transactions/deadlocks / Bankers / threads vs processes — keep CN short. One sentence CloudFront/ALB, then stop unless they ask edge vs origin. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. If the source did not name the prompt I keep a short pack ready and I do not guess the title.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: The exact wording is unnamed and I will not invent it; I offer the three-block pack or I write the DSA if the slot is actually code.

Docker/REST are the overlap; not TLS/secrets named. Ylogx: REST + Docker on ECS (not “I ran EC2 by hand”). Secrets stay off the image: inject at task/CI, not `Dockerfile ENV` with real keys. ECS + Docker + CI/CD; k8s is on skills, production path I can defend is ECS. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: Ylogx: REST + Docker on ECS (not “I ran EC2 by hand”).

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Bhavya HM asked Spring login layers, Controller, Facade, Service, Repository, which is not Interview 2 LRU and not Login Tracker. Login Tracker is unverified mentor practice. I sketch SOLID-ish layers without inventing Ylogx as a Spring app if it was NestJS and FastAPI. AuthN versus AuthZ stays deterministic; I do not put an LLM on login. Ylogx actually did RLS plus RBAC on three tiers, JWT-related web securities on the resume wording, not a copied Spring tutorial. I will not give credential-stuffing or exploit steps. I will not stamp this as Job 10454435. If they want cache of sessions, I do not call it Login Tracker.

Example: A login POST hits a controller, a service checks credentials and issues a JWT, a repository reads the user row, and RLS still applies after authentication; that is layers, not a tracker of oldest login.

If they probe: Say Login Tracker, I mark unverified and I offer LRU shape only as mentor practice, not as our R2.

This is IE.in 2025-grad R2 in an OA plus three loop whose system design was Rate Limiter, and independent SDE I count is 1, not UTA two-DSA. I do not treat it as our default UTA question. If they still ask, I stay high-level: a token bucket in front of an API, and I do not claim I shipped one at Ylogx. Distributed scale means a shared counter such as Redis, with honest limits about consistency. Login Tracker is unverified and is not this prompt. I do not open a full HLD unless they asked. Ylogx 99.9 percent is not a rate-limiter metric. Job 10454435 does not name this.

Example: If I sketch at all, I say each request consumes a token from a bucket keyed by user id in Redis with a TTL window, and I immediately say I did not ship that at Ylogx.

If they probe: Start a 45-minute design, I clarify this loop is count 1 and not UTA, then I still answer if they insist.

DoS was a follow-up word, not an exploit lab. I answer rate-limit and auth at the API, and fail closed. I give no attack steps. I skip a long elevator HLD unless they ask; Ylogx RLS and RBAC is the security story. This GFG 2025 OA-plus-2 is not UTA two-DSA. Rate Limiter as a full design is count 1 on a different loop. I do not discuss phishing or exploits. If they want intern security I stay on JWT plus RLS plus secrets in CI.

Example: An unauthenticated flood against an elevator API is answered with auth and a limiter at the edge, fail closed, with no packet-craft steps; tenant data still depends on RLS if they pivot to Ylogx.

If they probe: Exploit details, I refuse and I return to fail closed plus RLS.

Internship deploy: CloudFront + ALB + ECS , not “I operated an Nginx cluster.”. Reverse proxy job: TLS at the edge, route `/api` vs static, hide origin ports, health-aware forwarding. AWS-native stand-in for intern Nginx: ALB (L7) + CloudFront (CDN/edge). Same *idea*, managed box. Local/dev: Nginx or the NestJS/FastAPI process behind a single proxy — intern-honest. Do not claim HAProxy/Nginx in front of Ylogx; `chatgpt_share` HAProxy notes are Class C coaching, not an IE (bible §9). GoDaddy → Route 53 → ALB; CloudFront; Docker/ECS; sub-210 ms ; 99.9% uptime. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: AWS-native stand-in for intern Nginx: ALB (L7) + CloudFront (CDN/edge).

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Client TLS to CloudFront (and/or ALB). Origin stays private. HTTP 80 only to redirect to 443 — not as the API. Host-header / www vs non-www mismatches showed up as indexing 403s / noindex (ops isolation: CloudFront vs origin, DNS, ALB host headers, robots). Defensive debugging, not an attack writeup. App never needs the user’s password to “be HTTPS”; the edge terminates TLS. That DNS + ALB + CloudFront path is the resume sentence. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: HTTP 80 only to redirect to 443 — not as the API.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

GitHub Actions + CI/CD on skills; Ylogx automated pipelines to ECS. CI secrets (encrypted store) → job env at runtime. Never commit `AWS_SECRET_*`, DB URLs, Auth0 client secrets, Azure keys. Image build: no secrets in layers. Deploy: ECS task definition / runtime env from the pipeline. Logs: do not `echo` secrets; do not dump them in LangSmith traces (IQVIA). Leak path intern knows: secret in a PR, then rotate , do not “delete the commit” as the only fix (history still has it). Ylogx CI/CD; IQVIA Azure AI Search creds in env/secret store, not in traces. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Never commit `AWS_SECRET_*`, DB URLs, Auth0 client secrets, Azure keys.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Resume-derived + intern ceiling. What I shipped: environment variables and CI secret injection. That is intern-normal. Vault (HashiCorp / AWS Secrets Manager / Azure Key Vault): *idea* = store, rotate, audit, short-lived creds; app fetches at start or via sidecar. I did not run Vault as platform owner. Saying “we used Vault in prod” without resume evidence is a lie. When env is enough: one intern app, few secrets, ECS task isolated, rotate by redeploy. When a vault wins: many services, rotation policy, audit who read the DB password, dynamic creds. Amazon-scale is vault-like (IAM roles, Secrets Manager) — I used task role + env , not a vault cluster. Secrets off git; ECS task role / env. Azure keys for IQVIA Search similarly off-repo. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

HTTPS, JWT, RLS, RBAC. Not XSS/SQLi exploit demos, not credential stuffing, not InstaRecon internals. HTTPS: traffic not plaintext. JWT / OAuth 2.0 / Auth0: who the caller is at the API. RBAC: 3 organizational tiers (role) at NestJS. RLS: Postgres enforces which rows even a valid SQL can see (SQL RAG cannot use a superuser connection). Ylogx RLS + RBAC for 3 org tiers ; bot DB latency −35% via cache is *perf*, RLS is *authz*. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: JWT / OAuth 2.0 / Auth0: who the caller is at the API.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Skills: JWT, OAuth 2.0, Auth0. Product: NestJS API auth; do not invent an Auth0 tenant diagram if you cannot defend it. JWT: signed claims (`sub`, `exp`, role/tier). API verifies signature + expiry. Not encryption by default (JWS vs JWE — intern: signed, not “secret in the token”). OAuth: user authenticates at IdP; app gets a token. Authorization code is the intern-safe flow to name. Do not describe phishing or token-steal recipes. Session cookie: server store vs JWT stateless — either is fine; pick what you shipped and say so. LLM must not hold a superuser DB URL. Token at gateway; SQL as the user’s DB role . NestJS RBAC + Postgres RLS; SQL RAG +65% analysis productivity *because* analysts query safely, not because the model is a DBA.

Example: Skills: JWT, OAuth 2.0, Auth0.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

RBAC = can this role hit `GET /reports` vs admin-only. RLS = even if SQL is `SELECT * FROM kpi`, other orgs’ rows do not return. App-only `WHERE org_id = ?` is one missed query from a leak. RLS is defense in depth for the SQL RAG path. Run generated SQL as the user’s role so policies apply. Service-role connection = prompt can dump the warehouse. 3 tiers = organizational role (intern: e.g. org admin / manager / member — do not invent extra products). Engineered RLS + RBAC for 3 org tiers ; reports 40% faster; 99.9% uptime is availability, not authz. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: 3 tiers = organizational role (intern: e.g.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Skip JWT if they already got Ylogx. BRDs are confidential. Azure credentials in env/secret store, not in LangSmith traces. Do not log full document text in production traces. Tenant isolation: do not invent a multi-tenant model that is not on the resume. Hybrid RAG on 200+ page BRDs; Deep Research 200+ websites ranked — security story is *data handling*, not a new auth product. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. IQVIA is LangGraph Deep Research across 200-plus sites and Hybrid RAG on 200-plus page BRDs with LangSmith traces and evals.

Example: Hybrid RAG on 200+ page BRDs; Deep Research 200+ websites ranked — security story is *data handling*, not a new auth product.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Stratify: marketplace + profiles — JWT/OAuth as skills; do not let a RAG bot exfiltrate another user’s datasets. 30% faster ML iteration; 50+ models. Argus: camera feeds sensitive; auth on dashboard; no public stream URLs . 89% mAP (from 73% ), 15,000+ images, 24 FPS , 20+ camera feeds, violations −50% , compliance 2x . Skip RLS depth — Ylogx owns that. GiftedBooks: per-user PDFs; JWT/session on API; secrets off the client. sub-300 ms , 99.5% uptime. Pick one product; do not mix Argus mAP into Ylogx RLS. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes.

Example: 30% faster ML iteration; 50+ models.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

If they scroll to InstaRecon or PhiSiFi, I give an ethics one-liner: it was a security-awareness demo with consent and no production attacks. Then I redirect to StratifyLabs, Argus, Ylogx, or IQVIA. I do not discuss phishing, credential theft, or exploit steps. I do not walk reconnaissance techniques. Those repos are not resume metric stories. Ylogx three-tier RLS, Argus 89 percent mAP, and IQVIA 200-plus page BRDs are the named work. I stay calm and short. I will not be drawn into a dual-use walkthrough.

Example: The sentence I will actually say is awareness demo, consent, no production attacks, then immediately Argus 73 to 89 percent mAP or Ylogx Redis minus 35 percent.

If they probe: Keep asking how it worked, I repeat that I will not provide exploit or phishing content and I pivot.

Skills: Docker, Kubernetes, GitHub Actions, CI/CD. Internships: ECS + Docker (Ylogx); Argus containerized 20+ feeds. Honest: k8s is on the list; I am not a cluster owner. Ingress in k8s is the same reverse-proxy idea as Nginx/ALB. Pipeline intern: build image → push registry → deploy ECS. Secrets from Actions, not from the Dockerfile. Automated CI/CD, Docker on ECS, sub-210 ms . I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront. Kubernetes is on the skills list; what I actually shipped is Docker plus ECS.

Example: Internships: ECS + Docker (Ylogx); Argus containerized 20+ feeds.

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Client talks to proxy; proxy talks to FastAPI/NestJS/Java app. App not on the public internet. Reverse (TLS, routing, gzip, static) vs forward proxy (client-side egress) — intern: “Nginx in front of my API is reverse.”. LB: one VIP, many backends, health checks. Nginx can do both; Ylogx used ALB . TLS termination: decrypt at proxy; HTTP to origin on a private network (or re-encrypt origin — intern: terminate at ALB/CloudFront). CloudFront/ALB = managed reverse proxy; Nginx skill = same concept. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

HTTPS = HTTP over TLS. Confidentiality + integrity of the hop; not “the API is authorized.”. Cert proves the server name (roughly); browser trusts a CA. Intern does not need to derive RSA. HTTP on 80 should redirect; APIs on 443. JWT still needs HTTPS: a stolen bearer token is the account. TLS does not replace RBAC. Web Securities = this + JWT + RLS + RBAC, not a pentest report. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: HTTP on 80 should redirect; APIs on 443.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Cert + private key on the edge (ALB/CloudFront/Nginx). Private key is a secret — same rules as DB passwords (not in git). Terminate = decrypt at that hop. Backend may see HTTP + `X-Forwarded-Proto: https`. Intern trap: committing `privkey.pem`. Treat like any other secret; rotate if leaked. I did not paste certs into the Ylogx repo; AWS edge owned the cert. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Clones, forks, screenshots, CI logs, leftover laptops. Git history keeps the blob after you “delete the file.”. Fix: secret store + rotate the credential (DB password, API key, JWT signing key). `.env.example` with empty keys is OK; `.env` is not. GitHub Actions secrets → ECS env. IQVIA Azure keys same rule. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Secrets: encrypted, masked in logs (still do not echo). Variables: non-sensitive config (node version, region name). `env: AWS_KEY: ${{ secrets.AWS_KEY }}` in the deploy job. Never `AWS_KEY: AKIA...` in YAML. Fork PRs: do not expose production secrets to untrusted workflows (intern awareness; no attack recipe). Ylogx CI/CD to ECS — this is the mechanism, not a 20-stage textbook. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Ylogx CI/CD to ECS — this is the mechanism, not a 20-stage textbook.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Three segments: header.payload.signature. Verify signature with server secret/public key. Do not “decode = trusted.”. Claims: `sub`, `exp`, maybe `role`. Clock skew intern: small leeway, do not skip `exp`. Logout/stateless: access token short-lived; intern may mention refresh without designing a theft protocol. Signing key = secret. Rotate = invalidate old tokens. Same CI-not-git rule. NestJS verifies JWT; RLS still applies when the bot runs SQL. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

AuthN: who are you (login, JWT). AuthZ: what may you do (RBAC) and which rows (RLS). RBAC: roles → permissions. ABAC: attributes (intern one-liner; do not pretend you shipped ABAC). RLS: DB policy `USING (org_id = current_setting(...) )` so *every* query is filtered. 3 org tiers RBAC + RLS so SQL RAG cannot cross tenants. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: 3 org tiers RBAC + RLS so SQL RAG cannot cross tenants.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

App never stores the user’s IdP password. Redirect, code, token. Authorization code (+ PKCE on public clients) is enough to name. Implicit is legacy; do not teach token-in-URL attacks. A `read:reports` token still must not read another org’s rows. Auth0/OAuth on skills; Ylogx enforcement story is NestJS + Postgres. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Auth0/OAuth on skills; Ylogx enforcement story is NestJS + Postgres.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Least-privilege DB role for the RAG connection. Input validation is format; it is not RLS. Rate limiting belongs at edge/API — point at the one SDE I Rate Limiter IE if they want LLD; do not invent a second count. The SQL RAG row in the architecture: LLM → SQL → user role → RLS. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Independent Rate Limiter SDE I count is 1, and that loop is OA plus system design, not UTA two-DSA.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

`X-Forwarded-Proto` / `Host` must be trusted only from the load balancer hop . App should not trust a raw client-supplied forwarded header as gospel. Host-header mismatch is how www vs apex and 403/noindex bugs appear (Ylogx-shaped ops). No HTTP request-smuggling lab. Intern: “one hop I trust is the ALB.”. CloudFront vs origin vs ALB host headers when isolating the SEO 403. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Host-header mismatch is how www vs apex and 403/noindex bugs appear (Ylogx-shaped ops).

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

# intern sketch — TLS at this box or at ALB in front
server {
    listen 443 ssl;
    server_name api.example.com;
    # ssl_certificate / ssl_certificate_key  ← files from secret store, not git
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

env:
  DATABASE_URL: ${{ secrets.DATABASE_URL }}
# never: echo $DATABASE_URL
# never: ENV DATABASE_URL=postgres://... in Dockerfile for real creds

ALTER TABLE kpi ENABLE ROW LEVEL SECURITY;
CREATE POLICY kpi_isolation ON kpi
  USING (org_id = current_setting('app.current_org')::uuid);
-- SET app.current_org from the authenticated user, not from the LLM

// Talk: verify signature + exp + sub; then map role → RBAC; SQL still RLS.
boolean allowed(String bearer, String route) {
    Claims c = verifyAndParse(bearer); // reject bad sig / expired
    return rbac.can(c.role, route);
}

.env
*.pem

REST: Ylogx BI was REST (FastAPI + NestJS). Not GraphQL in production for this app. Docker: package FastAPI/NestJS + deps into images; run as containers. EC2: I did not “run EC2 by hand.” Compute was ECS tasks (which may sit on EC2 or Fargate — I will not invent launch type). EC2 = VM you SSH; ECS = scheduler that places containers. S3: object store (models, PDFs, static). Not the RLS warehouse. Postgres holds rows. NoSQL: no joins — session/hot cache → Redis (−35% bot DB latency). Not Mongo for Ylogx facts. Sharding: split a table by key when one primary dies at tenant scale. I did not shard Ylogx.

Example: EC2: I did not “run EC2 by hand.” Compute was ECS tasks (which may sit on EC2 or Fargate — I will not invent launch type).

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Docker is the packaging answer; S3 is storage class; REST is API style; EC2 is compute class. Wrong: “I used Kubernetes in production at Ylogx.” Right: “I containerized with Docker and ran on ECS .”. If they then ask k8s: map concepts (below). Do not volunteer EKS. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: Docker is the packaging answer; S3 is storage class; REST is API style; EC2 is compute class.

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

The resume lists Kubernetes and also ECS and Docker, and the honest split is skills versus shipped. Shipped is Docker on ECS at Ylogx with CloudFront and automated CI/CD. I did not operate Kubernetes in those internships. I will not upgrade the story. Argus is containerized, not k8s. I can still explain what k8s adds: desired state, schedulers, rolling updates, Service DNS, once you already have Docker. Sub-210 ms and 99.9 percent attach to the ECS path. Rate Limiter distributed scale is a different loop, count 1, not this intern.

Example: Docker build and ecs update-service is what ran; kubectl apply is what I can explain on a whiteboard without a cluster name.

If they probe: Treat skills as production, I correct them once and stay calm.

Browser
  → CloudFront (CDN / edge)
  → ALB
  → ECS tasks (Docker: NestJS auth/CRUD, FastAPI SQL RAG)
  → Redis (hot schema/answers, −35% bot DB latency)
  → Postgres (RLS, 3 org tiers)
DNS: GoDaddy nameservers → Route 53 → ALB

Static dashboards (React/Recharts, 30 KPIs) should not burn ECS CPU — CloudFront. API still needs healthy ECS tasks; CDN does not save you if every task is dead. Sub-210 ms: cache + pooling + CDN, not “LLM on the dashboard hot path.”. Secrets: env / ECS task role , not Git. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. IQVIA is LangGraph Deep Research across 200-plus sites and Hybrid RAG on 200-plus page BRDs with LangSmith traces and evals. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: Static dashboards (React/Recharts, 30 KPIs) should not burn ECS CPU — CloudFront.

If they probe: Where not to use an LLM, I name Ylogx RLS, Argus PPE boxes, and Horizon costmap; if the slot is labeled GenAI Fluency but is Distance K, I write the tree, not a RAG essay.

Docker packs the app and its dependencies into an image and runs a container with a shared kernel. ECS schedules those containers as tasks and services on AWS, which is what Ylogx shipped. Kubernetes is a portable scheduler with a larger object model, and it is on my skills list, not my intern cluster. I will not say I ran EKS. CloudFront and ALB sit in front of ECS, not in front of a minikube I invented. CI/CD is GitHub Actions to a registry to ECS. Argus containerized 20-plus cameras uses the Docker idea, not k8s. I can interrupt myself after those sentences if they already have the split.

Example: Ylogx: GitHub Actions builds a Docker image, ECS runs N copies behind ALB, CloudFront caches the dashboard; Kubernetes is the sentence after that if they ask what I did not run.

If they probe: Want 20 more seconds on pods versus tasks, I give the cheat map and stop.

We needed to run Docker APIs with a load balancer, rolling deploys, and CI/CD, not a multi-tenant internal platform. ECS on AWS was enough for that intern SaaS, with CloudFront, ALB, and Route 53. Kubernetes would add objects I would have to operate without a platform team story on the resume. Frugality is managed ECS plus Redis minus 35 percent before inventing a cluster. I am not claiming ECS is always better than EKS. I am claiming what I shipped. 99.9 percent and sub-210 ms are attached to that path. I will not invent a cost spreadsheet.

Example: Thirty KPI dashboards in front of one Postgres with RLS did not require a custom operator or a service mesh; ECS plus CloudFront plus Redis was the honest size.

If they probe: Ask when I would pick k8s, I say many teams, many services, portable on-prem, which I did not have there.

On push, Actions checks out, runs tests, builds a Docker image tagged with the git SHA, pushes a registry, and updates the ECS service to a new task definition. Tests run before push. Desired count stays N while the scheduler rolls tasks. Secrets come from Actions secrets, not from the Dockerfile or git. I will not invent ECR versus Docker Hub unless I confirm. I will not paste a private workflow. This is the automated CI/CD bullet with Docker on ECS. I do not put SQL RAG or YOLO on the health endpoint that gates the roll.

Example: A failing pytest should stop the job before ecs update-service; a green SHA becomes a new task, ALB must see 200 on health, then an old task drains.

If they probe: Want OIDC versus access keys, I say that is off-resume unless I confirm, and I still will not echo secrets in logs.

ALB target group: HTTP check on a cheap path (e.g. Unhealthy target gets no traffic . That is the production check I can name from the Ylogx path (ALB is on the resume). ECS: optional container health check (process/command). ALB check is what users feel; container check is what the scheduler feels. K8s analogue (conceptual): liveness = restart the container; readiness = drop from Service endpoints; startup = slow boot. I did not configure kubelet probes on a cluster I ran. App must not return 200 on `/health` if Postgres/Redis required path is down — or ALB will send traffic into a brick. Do not invent the exact path, interval, or unhealthy-threshold numbers. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: K8s analogue (conceptual): liveness = restart the container; readiness = drop from Service endpoints; startup = slow boot.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Recreate / kill-all-then-start: all v1 die, then v2 boot. Users see errors for the gap. Rolling: keep serving on remaining tasks; start v2; health check ; drain v1. ECS: min healthy % / max % surge. K8s Deployment: `maxUnavailable` / `maxSurge`. Sketch: `v1 v1 v1` → `v1 v1 v2` → `v1 v2 v2` → `v2 v2 v2`. 99.9% math ( Standard CS , apply to Ylogx claim): ~8.8 h/year, ~43 min/month, ~1.4 min/day. One 10-minute full outage does not automatically miss monthly 99.9% — but it burns a large slice of the budget and a deploy should not be that slice. Honest: 99.9% is resume-stated availability for handling daily queries, not a public status-page export I will fake. Rolling + ALB health is the mechanism I will talk. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed.

Example: Recreate / kill-all-then-start: all v1 die, then v2 boot.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

CloudFront: cache static (JS/CSS/images) and optionally cacheable GETs near the user. Cuts origin load; helps sub-210 ms . HTML/API that is user-specific (RLS dashboards, SQL RAG) is a poor CDN cache unless you vary on auth carefully — default: don’t cache tenant JSON . Nginx is on the skills list (reverse proxy / static). Ylogx named ALB + CloudFront , not “I ran Nginx as the public edge.” Do not replace ALB with Nginx in the story. Frugality LP backup: CDN + Redis before a bigger task size. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: Cuts origin load; helps sub-210 ms .

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Resume: containerized, 20+ camera feeds, Postgres logs, 24 FPS , 73→89% mAP , 15k images. That is Docker packaging so the detector+API can run in more than one place. It is not “I scheduled 20 pods on EKS.”. If they ask scale: more camera processes/tasks, not a fake HPA story. Do not invent cluster autoscaler. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes. Horizon is ROS2 with a GStreamer 60 FPS feed, and I do not put an LLM on the costmap or actuation. Kubernetes is on the skills list; what I actually shipped is Docker plus ECS.

Example: Resume: containerized, 20+ camera feeds, Postgres logs, 24 FPS , 73→89% mAP , 15k images.

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

GiftedBooks: sub-300 ms , 99.5% uptime. No ECS/CloudFront/ALB on that bullet. Tools line also has Vercel / Render / Railway — do not assign GiftedBooks to ECS to make the cloud story neater. Use 99.5% only as a second uptime number if they ask another product. Primary deploy story = Ylogx . I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: GiftedBooks: sub-300 ms , 99.5% uptime.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

An image is immutable layers. A container is a running instance sharing the host kernel through namespaces and cgroups. A VM has a guest kernel and is heavier. A process is what actually executes inside the container, and an ECS task is the scheduler unit wrapping that. Docker is not a hypervisor. Ylogx isolation is container plus ECS tasks, which is why 99.9 percent is process and container uptime. Java threads still share one JVM process inside that container. I do not claim I ran VMs as the Ylogx unit of deploy.

Example: The NestJS API is a process inside a Docker container described by an image, scheduled as an ECS task; threads in that JVM share a heap, so a native crash still kills that task, which ALB then marks unhealthy.

If they probe: Why not one fat VM, I say rolling, health, and blast-radius, which is why we did not docker run in screen.

Pod: smallest schedule unit; one or more containers sharing net/volumes. Deployment: desired replica count + rolling update of a Pod template. ≈ ECS service + task definition revision. Service: stable virtual IP / DNS to current ready Pods. ≈ ALB target group + ECS service discovery (not identical, same idea). Cluster: control plane (API server, scheduler, controllers) + nodes. ECS cluster is AWS’s equivalent box, not the same API. Ingress / Gateway: HTTP routing into Services. AWS analogue often ALB Ingress or just ALB in front of ECS. Things I will not pretend I operated: etcd, CNI, NetworkPolicy at scale, custom operators, EKS node AMI upgrades. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Rolling deploy depends on readiness/ALB , not liveness. Liveness-on-a-slow-dependency causes restart storms. Interview trap: “health check = ping.” Ping only proves the process answers HTTP, not that the DB pool works. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages.

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Recreate: downtime window. Bad for 99.9% if you care about deploys. Rolling: mix of versions; need backward-compatible APIs/migrations (expand/contract). Blue-green: two full environments; flip LB. Fast rollback; costs 2× capacity during the flip. Canary: send 1–5% traffic to v2; needs metrics. I did not run a canary platform at Ylogx — do not claim Flagger/App Mesh. Schema: never drop a column in the same rolling wave that still has v1 readers. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python.

Example: Bad for 99.9% if you care about deploys.

If they probe: I give one concrete example, quote only resume metrics, and I stop before inventing a Job 10454435 question.

Fargate = no SSH box for the task/pod. EC2 launch type / node = you still have VMs. I will not invent which Ylogx used. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Argus is YOLOv9 on more than 15,000 images, 73 percent to 89 percent mAP, 24 FPS, and more than 20 cameras, and I do not put an LLM on PPE boxes. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront. Kubernetes is on the skills list; what I actually shipped is Docker plus ECS.

Example: EC2 launch type / node = you still have VMs.

If they probe: A named GPU, TensorRT, ByteTrack, or API routes, I refuse to invent them; if they mix Horizon 60 FPS into Argus, I separate GStreamer video infra from the detector.

CI is checkout, test, and build the Docker image so a red pytest never ships. CD is push the image and update the ECS service so the cluster rolls to the new SHA. Secrets come from Actions secrets, never from git or Dockerfile. That is the intern Ylogx pipeline. I do not paste private YAML. I do not claim a 20-stage textbook. Health checks fail closed so 99.9 percent is not a slogan. Kubernetes rollingUpdate is the analogue I can name without kubectl production.

Example: On push to main, pytest runs, docker build tags GITHUB_SHA, the image is pushed, and ecs update-service starts new tasks behind ALB; a failing test never reaches desired count.

If they probe: OIDC ARNs or ECR versus Docker Hub, I refuse to invent unless I confirm.

No desired count, no ALB drain, no rolling, no replacement on crash, secrets in a shell history. 99.9% needs more than one healthy task behind a health-aware LB, and a deploy that does not kill them together. That is the difference between “I know Docker” and “I shipped on ECS.”. I only quote August 2026 resume metrics, and I do not invent headcount, GPU names, p99 dumps, or extra percentages. Job 10454435 still has no public named live question, so unnamed stays unnamed. Live Code is Java, and I name the production language honestly when the shipped stack was Python. Ylogx shipped Redis at minus 35 percent bot DB latency, three-tier RLS, Docker on ECS, and CloudFront.

Example: 99.9% needs more than one healthy task behind a health-aware LB, and a deploy that does not kill them together.

If they probe: Kubernetes, I keep it conceptual and repeat that production was Docker on ECS with GitHub Actions CI/CD; I do not invent Fargate versus EC2 launch type unless I can confirm.

Namespaces give a container its own PID, net, and mount view so it looks like a process tree, not a VM. Cgroups cap CPU and memory so one camera worker cannot eat the host. Overlayfs stacks image layers plus a writable top, which is why images are layers. That is the four-line Dive Deep if they ask how Docker isolates without a guest kernel. ECS still schedules those containers. I did not tune cgroup numbers as a resume metric. Thrashing is still possible if limits exceed RAM. I will not invent a UID from memory.

Example: Twenty Argus workers each in a cgroup with a memory max will OOM-kill a runaway queue instead of paging the whole box, which is how you protect 24 FPS neighbors.

If they probe: Kernel versions or a named runtime, I stay on namespace, cgroup, overlay, and ECS.

FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
# HEALTHCHECK CMD curl -f http://127.0.0.1:8000/health || exit 1
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

# sketch — not a pasted private workflow
on: { push: { branches: [main] } }
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pytest   # or npm test
      - run: docker build -t $ECR_REPO:$GITHUB_SHA .
      - run: docker push $ECR_REPO:$GITHUB_SHA
      - run: # register task def + ecs update-service --force-new-deployment

GET /health
  if cannot ping Postgres (and Redis if required): return 503
  else 200 {"ok": true}

desired = 3
start new task (image:sha2)
wait ALB healthy
stop one old task
repeat until all sha2

month ≈ 30 * 24 * 3600 = 2_592_000 s
0.1%  ≈ 2592 s ≈ 43 min