20. Resume stack defense — listed versus shipped

T1.1 Python + FastAPI — FACT: IQVIA both systems; Ylogx SQL RAG Resume-derived Standard CS

TECHNOLOGY. FACT where used: IQVIA Deep Research and Hybrid RAG on FastAPI; Ylogx LangChain SQL RAG on FastAPI. NestJS is the TypeScript API sibling at Ylogx, not a replacement for this card.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

A request hits a path operation. FastAPI validates the body, runs the coroutine or function, and serializes the response. At IQVIA that function starts a LangGraph run (thread id, state). At Ylogx that function is the SQL-RAG loop: schema context, model emits SQL, execute as the caller’s DB role. ASGI (uvicorn) is the usual server. I do not invent a worker count. Live Code is still Java — same request/handler idea, different syntax. Production intern path was Python.

3. Why we used it on this intern/project

IQVIA needed Python because LangGraph, LangChain, Firecrawl clients, and Azure SDKs live there. Ylogx needed Python for LangChain SQL RAG while NestJS kept typed auth modules. One Flask god-object that mixed auth, CRUD, RAG, and dashboards would have been harder to test. Constraint: intern ownership of the AI path, not a JVM rewrite.

4. Where in architecture

Client → CloudFront/ALB (Ylogx) or intern API (IQVIA)
     → [FastAPI]
     → LangGraph nodes | LangChain SQL RAG
     → Azure Search / GraphDB | Postgres+RLS (+ Redis)
     → JSON response

5. Before / after / why simpler failed

Before: a notebook or a linear script that could not expose a stable HTTP contract or retry a dead scrape. After: a service with typed request bodies. Simpler Flask-everything failed modular RBAC testing at Ylogx and mixed IQVIA graphs into CRUD.

6. Core concepts

7. Internal flow

HTTP request
  → route match + body validate
  → inject resources (graph / role-bound DB)
  → run node or SQL-RAG loop
  → serialize JSON
  → (Ylogx) never put LLM on dashboard GET

8. How integrated

IQVIA: FastAPI wraps LangGraph compile/invoke. Ylogx: FastAPI is the Python service beside NestJS; dashboards stay NestJS REST. Snippets below are interview-small, not dumped prod.

Shipped-pattern sketch (Python intern), not a production dump.

# Interview sketch — Ylogx SQL RAG shape (Python intern)
# Not a dumped production route table.
from fastapi import FastAPI, Depends, HTTPException
app = FastAPI()

@app.post("/bot/ask")
def ask(q: Question, caller=Depends(current_caller)):
    # execute as caller DB role so RLS applies — FACT pattern
    return sql_rag(q.text, role=caller.db_role)

Standard CS illustration — not a manifest/config I shipped on an intern bullet.

# Standard CS illustration — not a manifest I shipped
# uvicorn main:app --host 0.0.0.0 --port 8000

9. Config that matters

MISSING: uvicorn workers, replica count, exact health path string, request timeout seconds. FACT: Ylogx Docker/ECS desired count exists as the serving idea; IQVIA has no latency %.

10. Runtime: one request/data path

Ylogx: NL POST → FastAPI → Redis key with tier → miss → SQL as role → Postgres RLS → return. IQVIA: research POST → FastAPI → LangGraph planner → parallel tools → ranker → writer. Dashboard GET does not enter this FastAPI LLM loop (FACT: sub-210 ms path has no LLM).

11. Scale 10× honest / 100×

10×. More pooling, timeouts, and cache on repeat NL. Cap LangGraph fan-out. Do not put SQL RAG on every KPI tile. I did not shard.

100×. MISSING what I would need to learn: job queue, backpressure, multi-region failover — I did not ship those. Not “I already ran 100×.”

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Symptoms: 5xx on /bot/ask only; dashboards still sub-210-ish. Metrics you had: none named beyond resume −35%/sub-210. MISSING: APM. Check: NestJS healthy vs FastAPI task. Recent change: prompt/schema. Mitigate: fail closed, do not skip RLS.
2. Symptoms: research answers with no citations. Metrics: LangSmith traces FACT. Check: docs reducer empty. Mitigate: do not write.
3. Symptoms: 403 on bot, 200 on dashboard. Check: RLS role vs endpoint RBAC.
4. Symptoms: slow after Redis blip. Check: fail-open to Postgres as same role, never owner.
5. Symptoms: deploy after CI. Check: new image, ALB health, not Kubernetes.

14. Monitoring

FACT: LangSmith on IQVIA; ALB health checks on Ylogx 99.9% mechanism. MISSING: FastAPI QPS dashboard, p95, Datadog.

15. Security slice

Ylogx: parameterized SQL, RLS role, no pg_catalog. IQVIA: secrets not in traces; no full confidential BRD dump. CORS is not isolation.

16. Performance / Frugality

Frugality: FastAPI for the Python AI path instead of rewriting NestJS in Python or Spring. Do not run Playwright on every URL to ‘use async.’ LP: Ylogx Frugality stays Redis-primary; this card is Invent/Simplify for IQVIA graphs.

17. Alternatives

18. When NOT to use

Do not use FastAPI as a dumping ground for React SSR. Do not use it to run dashboard KPIs through an LLM. Do not claim it was Kubernetes.

19. Limitations

MISSING: exact concurrency model in prod. I will not invent gunicorn vs uvicorn bake-off.

20. What I vs we vs must-not-claim

I: FastAPI route + SQL RAG / graph invoke wiring I owned. We: IQVIA/Ylogx product. Must-not-claim: JVM intern, Flask-as-Ylogx, Kafka consumers.

21. What would the interviewer ask next?

They will ask why two services at Ylogx. Answer: NestJS auth/CRUD; FastAPI SQL RAG. Then: would you merge? Not if RBAC tests and RAG tests need different languages.

22. Mini follow-up chain

Why FastAPI? Python AI path. Why not Flask? Skills; this intern was FastAPI+NestJS. What feature? Typed routes + RAG/graph. If FastAPI down? Bot/research fail; dashboards may still live on NestJS — classify. How monitor? ALB health FACT; LangSmith IQVIA; no Datadog. What did YOU do? Owned the Python intern path. Redesign today? Same split; add SQL-shape CI; still no EKS theatre.

T1.2 TypeScript + NestJS + REST — FACT: Ylogx auth, RBAC, report CRUD, dashboard APIs Resume-derived

TECHNOLOGY. FACT: Ylogx full-stack AI BI with NestJS, RESTful APIs, React dashboards. IQVIA was FastAPI, not Nest. GraphQL is listed, not this intern protocol.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

Browser calls REST. NestJS authenticates the caller (JWT-shaped identity at the API — Auth0 is NOT this card). Guards enforce RBAC (what you may do). Handlers talk to Postgres with a mapped DB role so RLS still applies. Report builder and dashboard GETs live here. SQL RAG lives on FastAPI. FastAPI/NestJS are siblings behind ALB, not a mesh I invented.

3. Why we used it on this intern/project

Problem: full-stack BI with three org tiers, custom reports, 30 KPIs, chatbot. Constraint: typed role modules. Why not simpler: one Flask mixing auth and LLM. Why REST not GraphQL: 30 KPIs were not dying from over-fetch; origin and cache were. LP: Ownership of the API/isolation path.

4. Where in architecture

Browser React
  → CloudFront (static) / ALB
  → [NestJS REST]
  → RBAC guard → map DB role
  → Postgres RLS
  → JSON for reports/tiles
FastAPI sits beside this for SQL RAG only

5. Before / after / why simpler failed

Before: ad-hoc reports waiting on an engineer (40% faster reports is the resume after). App-only WHERE would fail on generated SQL — that is why RLS is a sibling card. GraphQL-first would have been protocol fashion, not the pain.

6. Core concepts

7. Internal flow

Request → middleware → JWT identity
  → RBAC guard (action)
  → controller
  → DB as mapped role (row)
  → JSON
Dashboard GET: no LLM

8. How integrated

NestJS on ECS Docker with FastAPI. REST JSON. Prisma is listed-not-the-warehouse-ORM claim.

Shipped-pattern sketch (TypeScript intern).

// Interview sketch — NestJS RBAC then DB role (TypeScript intern)
// Not dumped production guards.
@Injectable()
class TierGuard implements CanActivate {
  canActivate(ctx: ExecutionContext) {
    const user = ctx.switchToHttp().getRequest().user;
    return user.can('reports:read'); // RBAC action
  }
}
// Then open Postgres as mapped role — RLS card.

9. Config that matters

MISSING: exact Nest version, cluster mode, Prisma usage. FACT: REST, 3-tier RBAC, sub-210 ms dashboards without LLM.

10. Runtime: one request/data path

Tile GET: CloudFront JS → ALB → NestJS guard → pooled Postgres RLS → Recharts JSON. Report POST similar. Bot POST goes FastAPI.

11. Scale 10× honest / 100×

10×. Desired count, pooling, N+1 fix on tiles. Still no LLM on tiles. Still REST unless over-fetch becomes the pain — it was not first.

100×. MISSING: GraphQL federation, Kafka events, multi-region Nest. Learn those; do not claim them.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. 403 on one endpoint: RBAC first, then RLS. MISSING APM.
2. Slow 30-tile page: N+1 vs origin vs CloudFront. No Datadog invention.
3. After deploy: ALB health on Nest task vs FastAPI.
4. User sees empty KPI: RLS deny vs empty warehouse. Fixtures.
5. CORS error: browser origin, not Postgres.

14. Monitoring

FACT: ALB health; sub-210 ms claim on this path. MISSING: APM, Nest metrics vendor.

15. Security slice

RBAC guards; no secrets in JWT payload; HTTPS at CloudFront/ALB. XSS/CSRF as CS if asked — Web Securities skills. Isolation remains RLS.

16. Performance / Frugality

Frugality: REST first. Ownership: intern API modules. Do not buy GraphQL to look senior.

17. Alternatives

18. When NOT to use

Do not use Nest to execute superuser SQL for the bot. Do not put LangGraph in Nest to ‘unify languages.’

19. Limitations

MISSING: exact module list. Do not dump a fake org chart of 40 microservices.

20. What I vs we vs must-not-claim

I: auth/RBAC/report/dashboard REST I owned. We: product. Must-not-claim: Auth0 tenant admin, GraphQL prod, k8s sidecars.

21. What would the interviewer ask next?

Why TypeScript? Guards and DTOs. Why not rewrite FastAPI into Nest? LangChain lives in Python.

22. Mini follow-up chain

Why NestJS? Typed RBAC modules. Why not GraphQL? REST shipped. Feature needed? Action checks + JSON tiles. If Nest down? Dashboards/reports fail; classify vs FastAPI. Monitor? ALB health FACT. YOU? Intern API path. Redesign? Same split; still no Auth0 fiction.

T1.3 PostgreSQL + RLS — FACT: Ylogx 3-tier isolation; Argus event log is Postgres without claiming Ylogx RLS Resume-derived

TECHNOLOGY. FACT: Ylogx RLS + RBAC for 3 organizational tiers; PostgreSQL warehouse; Argus PostgreSQL logging. Deep RLS story is Ylogx. Argus is events, not three-tier BI.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

Caller authenticates at NestJS. Map to a non-owner DB role (SET ROLE / role-bound connection — exact session API MISSING, pattern FACT). Policies apply on SELECT. JOINs cannot outrun the policy. LLM-generated SQL runs as the same role. Table owner bypasses RLS — RAG DSN must not be owner. Argus: insert detection events (camera, class, conf, ts, box), not video blobs.

3. Why we used it on this intern/project

Problem: app-only WHERE org_id dies on missed JOIN and on generated SQL. Constraint: BI chatbot emits SELECT. Why not simpler: trust the intern helper. Why not Mongo: facts need joins/aggregations/RLS. LP: Dive Deep (with Redis) and Earn Trust of isolation; Ylogx Ownership.

4. Where in architecture

NestJS/FastAPI
  → SET ROLE / role-bound conn  [Ylogx]
  → [PostgreSQL RLS]
  → rows the tier may see
Argus: YOLO event → INSERT → Postgres (no Ylogx 3-tier claim)

5. Before / after / why simpler failed

Before: helper WHERE that generated SQL will skip. After: policy at read. Simpler app-only failed the chatbot threat model.

6. Core concepts

7. Internal flow

authenticate → map tier → DB role
  → SELECT ... (generated or handwritten)
  → policy USING (...)
  → return allowed rows only

8. How integrated

Ylogx: Postgres source of truth + RLS. Redis cache cannot skip this. FastAPI/Nest both use role-bound access.

Standard CS illustration — not a dumped Ylogx schema I will pretend is production DDL.

-- Interview sketch — RLS idea, not a dumped prod schema
-- Standard CS illustration of the intern pattern.
ALTER TABLE facts ENABLE ROW LEVEL SECURITY;
CREATE POLICY tier_read ON facts
  USING (tier_id = current_setting('app.tier_id')::int);
-- Bot DSN is NOT table owner.

Shipped-pattern sketch (Python intern). Pool leftover-role is a known class.

# Python intern pattern: execute as caller role
with connection() as conn:
    conn.execute("SET ROLE %s", (caller.db_role,))  # parameterized
    rows = conn.execute(sql, params)  # RLS applies

9. Config that matters

MISSING: exact policy SQL, pool size, SET ROLE vs SET LOCAL vs separate users, replica. FACT: 3 tiers as role.

10. Runtime: one request/data path

NL or dashboard query → role-bound Postgres → policy → rows. Cache key includes tier so Redis cannot undo this.

11. Scale 10× honest / 100×

10×. More RLS tests as orgs grow. Connection pooling. Still one primary. I did not shard.

100×. MISSING: Citus, Postgres-XL, multi-region write. Learn; do not claim.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Wrong-org row in report: JOIN + policy. Deny fixture. No Datadog needed to name the class.
2. Bot returns other org: DSN owner vs role. Stop.
3. Intermittent wrong tier: pool leftover-role class.
4. Dashboard empty: RLS vs truly empty. Fixture both.
5. Slow warehouse: MISSING EXPLAIN capture; still no invented p95.

14. Monitoring

MISSING: RDS Performance Insights. FACT: deny-tier tests as the intern eval analog (not LangSmith).

15. Security slice

RLS is which rows. Secrets in env. Parameterized SQL. Prompt injection still hits allow-list + role.

16. Performance / Frugality

Frugality: one primary with policies vs shard-as-first-sentence. Dive Deep: JOIN leak class.

17. Alternatives

18. When NOT to use

Do not use RLS as a substitute for RBAC (actions). Do not claim IQVIA BRD multi-tenant RLS fiction.

19. Limitations

MISSING: policy performance numbers. I will not invent them.

20. What I vs we vs must-not-claim

I: isolation path I owned at Ylogx. We: warehouse. Must-not-claim: DBA of a sharded fleet, Postgres on Argus as 3-tier BI.

21. What would the interviewer ask next?

Is WHERE enough with code review? No — chatbot SQL and JOINs.

22. Mini follow-up chain

Why RLS? Generated SQL. Why not app WHERE? JOIN/helper miss. Feature? Row filter by role. If Postgres down? Product down; cache is not SoR. Monitor? Deny fixtures; no Datadog. YOU? Policies + bot DSN. Redesign? Same; more fixtures; still no shard theatre.

T1.4 RBAC (3 tiers) + JWT identity pattern — Auth0 is NOT this card Resume-derived Standard CS

TECHNOLOGY. FACT: RBAC for 3 organizational tiers as role. JWT is the skills-line identity pattern at the API. Auth0 is listed-only (Tier 3). OAuth 2.0 is skills; deep product is Ylogx RLS+RBAC.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

Login at NestJS issues or accepts a JWT-shaped identity. Guards check actions. Map identity to one of three DB roles. RLS filters rows. Bot, reports, dashboards share that isolation. Sessions vs JWT is Standard CS: two ECS tasks need shared session store or a token; revocation is harder with JWT (short exp / denylist — denylist TTL MISSING). CSRF: cookies auto-sent vs Bearer not auto-sent by a random site.

3. Why we used it on this intern/project

Problem: role without row = viewer SELECTs another org; row without role = any login hits admin POST. Why not one admin flag. Why not Auth0-as-prod: listed, not the named intern hop. LP: Ownership + Earn Trust of isolation.

4. Where in architecture

Client
  → [JWT at NestJS]
  → RBAC (actions)
  → map → DB role
  → Postgres RLS (rows)
Auth0 logo is skills, not this box

5. Before / after / why simpler failed

Before: endpoint checks only, or RLS only. After: both. Simpler two-tier flatten was not the product.

6. Core concepts

7. Internal flow

login → token
  → each request: verify
  → guard(action)
  → SET ROLE / mapped user
  → RLS

8. How integrated

Tokens at the API; execution as DB role. Secrets: env / ECS task role, not Git.

Shipped-pattern sketch. Not an Auth0 tenant export.

// Identity at API — TypeScript intern pattern
// Auth0 is NOT claimed here.
const payload = verifyJwt(token, env.JWT_SECRET); // algorithm pinned
if (!payload.role) throw unauthorized();
// map payload.sub → dbRole among 3 tiers

9. Config that matters

MISSING: token TTL, IdP vendor, cookie vs Bearer choice in prod. FACT: 3 tiers as role.

10. Runtime: one request/data path

Dashboard GET carries identity → RBAC → RLS. Same identity on bot path. Cache key includes tier.

11. Scale 10× honest / 100×

10×. More members per tier is still one policy. Do not explode per-user custom roles first.

100×. MISSING: company-wide IdP, SSO to Amazon Cognito fiction, global denylist cluster.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. User hits admin API: guard. Then RLS still for data.
2. Two tasks lose login: session store vs JWT CS.
3. Bot ignores RBAC: service role class.
4. CORS * plus cookie: CSRF class — CS, no exploit.
5. Interviewer points Auth0: listed; intern evidence is this card.

14. Monitoring

MISSING: auth metrics. FACT: isolation tests.

15. Security slice

This whole card is the security slice: identity, actions, rows. No InstaRecon payloads.

16. Performance / Frugality

Frugality: do not buy Auth0 theatre to explain three tiers you already enforced in Postgres.

17. Alternatives

18. When NOT to use

Do not use JWT as RLS. Do not put this story on IQVIA BRDs.

19. Limitations

MISSING: exact three role names. Prepare from YOUR memory if they exist internally — do not invent on the PDF.

20. What I vs we vs must-not-claim

I: mapping and guards I owned. We: IdP if any. Must-not-claim: Auth0 operator, Amazon Cognito, mentee security training.

21. What would the interviewer ask next?

Can RBAC live only in NestJS? For HTTP verbs yes; for bot SQL no.

22. Mini follow-up chain

Why RBAC+JWT? Actions + identity. Why not Auth0 card? Listed. Feature? 3 tiers. If IdP down? MISSING vendor; API verify fails closed. Monitor? Deny tests. YOU? Guards+role map. Redesign? Same two-layer; still no Auth0 fiction.

T1.5 Redis — FACT: Ylogx −35% bot database latency Resume-derived

TECHNOLOGY. FACT: reducing bot database latency by 35% via caching. Cache-aside on the SQL-RAG path. Not a CDN. Not a shipped rate limiter. TTL and p95 MISSING.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

NL in → key = tier/role + query fingerprint (not raw NL only) → GET → hit returns if still that tier → miss → SQL RAG as role (RLS) → SET → return. Redis down: fail-open to Postgres for analysis availability; never fail-open RLS (never skip role). Schema lookups every turn were part of the DB cost — both schema cache and answer cache are hot. Dashboards’ sub-210 ms is edge+pooling+no LLM, not this −35% claim.

3. Why we used it on this intern/project

Problem: every NL turn hit Postgres; felt like ‘the model is thinking’ when DB was the cost. Why not bigger RDS first: Frugality — repeat NL is a cache. Why not CloudFront for tenant JSON: wrong layer, leak. LP: Frugality primary is this Redis card. Dive Deep shares isolation with RLS.

4. Where in architecture

FastAPI SQL RAG
  → [Redis] key includes tier
  → miss → Postgres RLS
  → SET
CloudFront is a different box (static)

5. Before / after / why simpler failed

Before: uncached SQL RAG. After: −35% bot DB latency. Simpler ‘cache the NL string globally’ leaks across tiers.

6. Core concepts

7. Internal flow

GET key
  hit → return (same tier)
  miss → validate SQL → exec as role → SET → return
  Redis down → same exec as role, skip SET

8. How integrated

Beside FastAPI on ECS. Keys must include tier. Never cache tenant JSON at CloudFront as a substitute.

Shipped-pattern sketch (Python intern). TTL omitted because MISSING.

# PSEUDOCODE SKETCH — no production key or TTL disclosed
key = tier | role | fingerprint(allowed_schema, normalized_question)
value = redis.get(key)
if value is present: return value
with role_bound_read_only_connection(caller) as db:
    sql = generate_and_validate(question, allowed_schema)
    rows = db.execute(sql, bound_parameters)  # RLS applies
if redis_available: redis.set(key, rows)
return rows
# never key = raw_question
# never fallback to owner/superuser

9. Config that matters

MISSING: TTL, maxmemory, cluster vs standalone, hit rate. FACT: −35%. INFERENCE: single Redis next to ECS, not a documented Redis Cluster.

10. Runtime: one request/data path

Bot NL → Redis → optional Postgres. Dashboard path does not need this Redis to defend sub-210.

11. Scale 10× honest / 100×

10×. Higher hit ratio on hot NL; still RLS on miss; still pool. I did not shard Redis or RDS.

100×. MISSING: Redis Cluster, read replicas, 100× QPS numbers. Learn; do not claim already ran.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Bot slow, dashboards fine: this path, not ALB. MISSING APM; use −35% as the claim you measured intern-side.
2. Wrong org answer after cache add: key without tier.
3. Redis process dead: latency back, isolation holds.
4. After schema change: stale schema cache class — MISSING exact invalidation.
5. Interviewer says rate limiter: redirect. Independent SDE I count is 1, not UTA.

14. Monitoring

MISSING: Redis INFO metrics vendor. FACT: −35% is the intern measurement claim; no Datadog.

15. Security slice

Tier in key is the security slice. RLS still on miss. No secrets in cache values if avoidable.

16. Performance / Frugality

Frugality: cache repeat NL instead of bigger RDS first. LP mapping locked: Ylogx Frugality.

17. Alternatives

18. When NOT to use

Do not cache dashboard private JSON at the edge. Do not use Redis as RLS. Do not claim IQVIA Redis −35%.

19. Limitations

MISSING: TTL. [YOU NEED TO PREPARE THIS] if you remember a TTL from your memory — do not invent one in the room if you do not.

20. What I vs we vs must-not-claim

I: cache-aside + tier keys I owned. We: Redis host. Must-not-claim: ElastiCache topology I cannot defend, rate limiter product, Datadog hit-rate board.

21. What would the interviewer ask next?

Why cache-aside not write-through? App owns the fill after RLS query.

22. Mini follow-up chain

Why Redis? Repeat NL/schema cost. Why not bigger RDS? Frugality. Feature? Tier-scoped cache-aside. If Redis down? Postgres as same role. Monitor? −35% claim; no Datadog. YOU? Key design + miss path. Redesign? Same; still no TTL fiction.

T1.6 LangChain SQL RAG — FACT: Ylogx chatbot +65% analysis productivity Resume-derived

TECHNOLOGY. FACT: AI chatbot using LangChain SQL RAG; +65% data analysis productivity; Redis −35% on this path; RLS applies. Not LangGraph. Not LangSmith. Not dump-tables-into-the-LLM.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

User asks NL → Redis tier-scoped → miss → prompt with allow-listed schema/views + ‘return SQL only’ → parse/allow-list → parameterized read-only exec with timeout and row cap → show SQL with results (grain bugs stay visible) → never table-owner DSN. Eval is golden NL → expected SQL shape/result, not English BLEU, not LangSmith.

3. Why we used it on this intern/project

Problem: non-technical users waited on engineers; dumping warehouse rows hallucinates counts and blows tokens. Why not LangGraph here: NL→SQL→exec is a guarded chain, not parallel scrapers. Why not service-role: prompt injection becomes a dump. LP: Ownership of the bot path; isolation is Earn Trust.

4. Where in architecture

UI chatbot
  → FastAPI
  → [LangChain SQL RAG]
  → SQL as user role
  → Postgres RLS
  → optional Redis

5. Before / after / why simpler failed

Before: engineer-written SQL per question. After: +65% productivity behind isolation. Stuff-the-warehouse failed token limits and trust.

6. Core concepts

7. Internal flow

NL → (Redis) → prompt(schema)
  → SQL string → validate
  → exec as role → rows
  → return rows + SQL

8. How integrated

FastAPI + LangChain + Postgres + Redis. NestJS does not execute the model SQL.

Shipped-pattern sketch. Exact timeout/row_cap MISSING — placeholders not resume numbers.

# Interview sketch — SQL RAG guardrails (Python intern)
sql = llm.invoke({"schema": ALLOWED_VIEWS, "q": question, "rule": "SQL only"})
sql = allowlist_parse(sql)  # fail closed on unknown tables
rows = execute_as_role(sql, params, role=caller.db_role, timeout=..., row_cap=...)
return {"sql": sql, "rows": rows}

9. Config that matters

MISSING: model name, temperature, timeout seconds, row cap. FACT: LangChain SQL RAG, +65%, −35% Redis.

10. Runtime: one request/data path

See Redis + RLS cards; this is the NL→SQL hop between them.

11. Scale 10× honest / 100×

10×. Cache hot NL; pool; fail closed on unknown tables; still RLS. Read replicas = would-do not shipped.

100×. MISSING: warehouse size, 100× tables without a semantic layer I already ran.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Wrong total, SQL looks fine: grain. Show SQL.
2. Empty vs deny: RLS fixture vs truly zero.
3. Slow bot: Redis miss vs model vs DB. −35% is DB side.
4. Injection attempt: allow-list before bind.
5. Product wants dashboard AI: refuse for sub-210.

14. Monitoring

MISSING: bot latency dashboard. FACT: −35% Redis; +65% productivity protocol MISSING — say mechanism then resume number.

15. Security slice

Allow-list, parameterized, RLS, read-only. Prompt is not authorization.

16. Performance / Frugality

Frugality: SQL aggregates vs stuffing rows. Do not buy a bigger model to skip RLS.

17. Alternatives

18. When NOT to use

Do not use SQL RAG on the 30 KPI hot path. Do not use it without a role.

19. Limitations

MISSING: model vendor. [YOU NEED TO PREPARE THIS] which LLM you actually called, if you remember — do not invent OpenAI vs local as FACT if the PDF is silent.

20. What I vs we vs must-not-claim

I: chain guardrails + role exec. We: warehouse. Must-not-claim: LangGraph-on-Ylogx, LangSmith-on-Ylogx.

21. What would the interviewer ask next?

Why not LangGraph? No 200-site fan-out here.

22. Mini follow-up chain

Why SQL RAG? NL without dump. Why not LangGraph? Chain not research graph. Feature? SQL as role. If model down? Bot down; dashboards live. Monitor? SQL-shape tests. YOU? Guardrails. Redesign? Semantic layer; still RLS.

T1.7 LangGraph + Firecrawl / Bing / DuckDuckGo / Google Playwright — FACT: IQVIA Deep Research 200+ Resume-derived

TECHNOLOGY. FACT: Architected multi-agent Deep Research using LangGraph, LangChain, FastAPI, Firecrawl, Bing, Duck Duck Go, Google Playwright; 200+ websites ranked. Stateful agent orchestration. Not Ylogx. No IQVIA latency %.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

FastAPI receives the query → planner writes a search plan → fan-out Firecrawl (crawlable pages), Bing and DDG (alternate indexes/snippets), Playwright (JS-heavy when APIs are not the page) → reducer appends docs → checkpoint → ranker (agreement down-ranks isolates) → writer synthesizes only from ranked state, refuse sentence without retrieved span → optional cycle, cap iterations. LangSmith traces node order (sibling card).

3. Why we used it on this intern/project

Problem: linear chain dies on first timeout; one Google API misses families of sites; first-hit looks confident when two pages contradict. Why four tools: coverage + rate limits; Frugality = fewer Playwright renders when snippets suffice. Why graph: parallel + retry + cycle + checkpoint. LP: IQVIA Invent and Simplify / Learn / Backbone (hybrid sibling). Do not force Hire and Develop.

4. Where in architecture

FastAPI
  → [LangGraph]
       ├ Firecrawl
       ├ Bing
       ├ DuckDuckGo
       └ Playwright
  → rank (agreement)
  → writer (cite-or-abstain)

5. Before / after / why simpler failed

Before: one-shot chat or sequential chain. After: 200+ ranked. Mega-prompt failed context and citations.

6. Core concepts

7. Internal flow

query → plan
  → parallel tools → append state
  → checkpoint
  → rank
  → write or hop-again (capped)

8. How integrated

LangChain tools inside LangGraph nodes; FastAPI entry; LangSmith traces.

Shipped-pattern sketch.

# Interview sketch — parallel tools append (Python intern)
# Not a proprietary IQVIA graph dump.
def scrape_node(state):
    # each tool returns docs; reducer appends
    return {"docs": state["docs"] + new_docs}

# dead Playwright must not clear Bing docs

Standard CS illustration — not a manifest/config I shipped on an intern bullet.

# Standard CS illustration — not a manifest I shipped
# checkpointer = MemorySaver()  # or a real saver; storage engine MISSING
# graph.compile(checkpointer=checkpointer)

9. Config that matters

MISSING: checkpointer backend, concurrency cap, scrape cache TTL, gold-set size. FACT: 200+ sites, four tools, ranking.

10. Runtime: one request/data path

One research query fans tools, ranks, writes. Empty scrape must not vote.

11. Scale 10× honest / 100×

10×. More ranker and scrape cache, not Playwright on every URL. Cap fan-out. Do not re-run 200-site graph for one 404 — checkpoint.

100×. MISSING: shard a research index, 100× QPS, bill. No IQVIA latency %.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Fluent answer, empty docs in trace: writer bug.
2. Playwright timeouts, Bing present: reducer must keep Bing.
3. Contradictory sources: surface disagreement, do not mush.
4. Cost spike: fewer Playwright, more snippets.
5. Legal probe: research for analysts, no exploit steps.

14. Monitoring

FACT: LangSmith traces. MISSING: scrape QPS board, latency %.

15. Security slice

Do not scrape confidential BRDs with this web stack — that is Hybrid RAG. Secrets not in traces. No InstaRecon payloads.

16. Performance / Frugality

Frugality: selective Playwright. Invent: graph vs chain.

17. Alternatives

18. When NOT to use

Do not use this graph as Ylogx dashboards. Do not use it as cite-free BRD tests (Hybrid sibling).

19. Limitations

MISSING: exact ranker model. Do not invent a second model card.

20. What I vs we vs must-not-claim

I: graph wiring, ranker vs first-hit, tool fan-out. We: IQVIA platform. Must-not-claim: Firecrawl author, k8s crawler fleet.

21. What would the interviewer ask next?

Isn’t LangChain enough? Tools yes; this product needs a graph.

22. Mini follow-up chain

Why LangGraph? Parallel+checkpoint+cycles. Why not one scraper? Families of sites. Feature? Agreement ranking. If Playwright down? Other tools still append. Monitor? LangSmith. YOU? Wiring+ranker. Redesign? Cache scrapes; still cite-or-abstain.

T1.8 Azure AI Search Hybrid + Semantic — FACT: IQVIA Hybrid RAG on 200+ page BRDs Resume-derived

TECHNOLOGY. FACT: Hybrid RAG Agent with Azure AI Search (Hybrid + Semantic), GraphDB, LangGraph adaptive retrieval; 200+ page BRD/PDF. No IQVIA latency %. FAISS is skills. Qdrant is not on the resume.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

BRD chunked with structure (headings, clause IDs, tables) → index in Azure → query hybrid → semantic reorder → optional GraphDB hop (next card) → LangGraph chooses lexical vs semantic vs hop → generate from small set → LangSmith gold questions with expected citation ids. Secrets for Azure in env, not traces. GiftedBooks is a different store (student PDF, sub-300 ms) — do not steal Azure there.

3. Why we used it on this intern/project

Problem: stuffing PDF invents citations; vector-only FAISS misses IDs/table names. Why not Qdrant: not on resume. Why not GiftedBooks FAISS-as-IQVIA. LP: Backbone hybrid vs vector-only; Invent retrieval.

4. Where in architecture

BRD/PDF
  → structured chunks
  → [Azure AI Search Hybrid+Semantic]
  → optional GraphDB
  → writer + LangSmith

5. Before / after / why simpler failed

Before: stuff-the-PDF or cosine-only. After: process 200+ page BRDs with citations. FAISS-only misses FR-214-style IDs.

6. Core concepts

7. Internal flow

question → hybrid retrieve
  → semantic rerank
  → maybe graph hop
  → small context → generate
  → fail if no span

8. How integrated

Azure SDK from FastAPI/LangGraph. GraphDB sibling. LangSmith evals.

Shipped-pattern sketch. Exact API flags may differ — do not swear a console screenshot.

# Interview sketch — hybrid retrieve then generate (Python intern)
hits = azure_search.search(q, query_type="semantic")  # hybrid+semantic as billed
ctx = hits[:SMALL_K]
if not spans_overlap(answer, ctx):
    abstain()

9. Config that matters

MISSING: chunk size, embedding model name, replica SKU, bill, k. FACT: Hybrid + Semantic + 200+ pages.

10. Runtime: one request/data path

BRD question → Azure → optional hop → cited answer.

11. Scale 10× honest / 100×

10×. Do not re-embed every question. Hybrid retrieve small set. Graph hop cheaper than another generation for relational Q. No shard Azure claimed.

100×. MISSING: 100× tenants, private endpoint topology, 99.99% Search SLA I operated.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Misses REQ-1044: lexical not used — hybrid.
2. Wrong section tests: gold ids.
3. Latency probe: none on resume; do not invent.
4. FAISS pointed on skills: listed; intern is Azure.
5. GiftedBooks mix: student file vs BRD SaaS-shaped intern.

14. Monitoring

FACT: LangSmith. MISSING: Azure portal metrics, latency %.

15. Security slice

Confidential BRDs; env secrets; no full text in traces.

16. Performance / Frugality

Frugality: hybrid retrieve vs stuffing. Do not operate a second vector DB for fashion.

17. Alternatives

18. When NOT to use

Do not use Azure as GiftedBooks. Do not claim Ylogx used Azure Search.

19. Limitations

MISSING: SKU and bill. [YOU NEED TO PREPARE THIS] only if you truly remember — else say MISSING.

20. What I vs we vs must-not-claim

I: retrieval wiring + evals. We: Azure subscription. Must-not-claim: Azure billing owner, Qdrant, FAISS-prod-IQVIA.

21. What would the interviewer ask next?

Hybrid vs semantic — two products? Hybrid = lexical+vector; semantic = Azure ranker on top.

22. Mini follow-up chain

Why Azure hybrid? IDs + meaning. Why not FAISS? Listed; intern is Azure. Feature? Semantic ranker. If Search down? RAG fails closed. Monitor? LangSmith gold cites. YOU? Chunk+query path. Redesign? Freeze eval slice before a fourth tool.

T1.9 GraphDB hops — speak GraphDB; Neo4j is skills Resume-derived

TECHNOLOGY. FACT intern bullet: GraphDB with Hybrid RAG. Skills: Graph DB (Neo4j). Speak GraphDB for the intern. Do not fake Cypher-as-prod-DBA or a cluster diagram.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

Structured chunks have clause IDs → graph nodes/edges → router: clause ID → Azure lexical-heavy; depends-on question → GraphDB hop; meaning-only → hybrid+semantic. Writer gets chunks plus neighbors. LangSmith fails generated tests with no span. Cosine will not follow DEPENDS_ON. Recursive SQL can express a tree; intern story is GraphDB hops plus Azure — do not invent a warehouse graph.

3. Why we used it on this intern/project

Problem: tests generated from the wrong section. Why not bigger k in vector search: more similar prose, still no edge. LP: Invent + Backbone with hybrid.

4. Where in architecture

Azure hit on clause
  → [GraphDB hop 1–2]
  → neighbor chunks
  → writer

5. Before / after / why simpler failed

Before: vector-only ‘related paragraph in wrong annex.’ After: hop. Unbounded expansion is the failure.

6. Core concepts

7. Internal flow

match clause → walk DEPENDS_ON
  → fetch neighbor text
  → cap depth
  → generate with cites

8. How integrated

Beside Azure in LangGraph adaptive retrieval.

Shipped-pattern sketch. Not a Neo4j cluster config.

# Interview sketch — bounded hop (Python intern)
neighbors = graph.neighbors(clause_id, edge="DEPENDS_ON", max_depth=2)
ctx = azure_chunks + neighbor_chunks

Standard CS illustration — not a manifest/config I shipped on an intern bullet.

// Standard CS illustration — not a manifest I shipped
// MATCH (r:Req {id:$id})-[:DEPENDS_ON*1..2]->(n) RETURN n

9. Config that matters

MISSING: vendor confirmation if Neo4j was actually the intern GraphDB, hop SQL vs Cypher, cluster size. Speak GraphDB. [YOU NEED TO PREPARE THIS] only if you remember the real vendor — do not invent Neo4j-ops to match the skills line.

10. Runtime: one request/data path

Impact question → hop → cited neighbors + Azure chunks.

11. Scale 10× honest / 100×

10×. Bounded hops. More BRDs = more indexed nodes, not a fourth search tool without eval.

100×. MISSING: graph cluster sharding, 100× hop QPS.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Wrong child requirement: edge quality.
2. Slow answers: hop depth too high.
3. Skills-line Neo4j grilling: CS MATCH then redirect intern GraphDB.
4. Test pack from annex: LangSmith span fail.
5. 10× BRDs: freeze eval slice.

14. Monitoring

FACT: LangSmith. MISSING: graph metrics vendor.

15. Security slice

Confidential graph of requirements; no full BRD in traces.

16. Performance / Frugality

Frugality: hop cheaper than another LLM call for relational Q.

17. Alternatives

18. When NOT to use

Do not hop the open web Deep Research like a BRD graph. Do not claim cosine is a FK.

19. Limitations

MISSING: exact edge types beyond DEPENDS_ON-shaped language.

20. What I vs we vs must-not-claim

I: hop in the adaptive router. We: graph hosting. Must-not-claim: Neo4j DBA, shard, Cypher performance tuning novel.

21. What would the interviewer ask next?

Why not just bigger k? Still no DEPENDS_ON.

22. Mini follow-up chain

Why GraphDB? Dependencies. Why not cosine? Neighbor ≠ edge. Feature? Bounded hop. If graph down? Impact Q degrade; hybrid may still answer meaning Q. Monitor? LangSmith tests. YOU? Router+hop. Redesign? Still cap depth; still speak GraphDB.

T1.10 LangSmith — FACT: IQVIA evals and test-case generation tracing Resume-derived

TECHNOLOGY. FACT: evals, test case generation with LangSmith tracing on IQVIA. Not Ylogx, GiftedBooks, or Stratify. No extra %.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

Every node traced: query, retrieval set, tool order, answer. Eval fails if no overlapping span. Do not log full confidential BRDs. Secrets not in traces. Deep Research: traces catch empty scrape → writer. Ylogx eval is SQL shape + denied-tier fixtures. Argus eval is mAP. Do not steal LangSmith there.

3. Why we used it on this intern/project

Problem: analysts trust a wrong citation; wrong-section tests look professional. Why not BLEU: wrong family. Why not ‘it sounded good.’ LP: Highest Standards analog on IQVIA quality; Learn/Invent. Argus owns Are Right/Highest Standards primary on 73% — do not double-primary LangSmith as Argus.

4. Where in architecture

LangGraph run
  → [LangSmith trace]
  → gold citation ids
  → pass/fail span overlap

5. Before / after / why simpler failed

Before: fluency as QA. After: traced evals. Grammar-only eval failed the product.

6. Core concepts

7. Internal flow

run → export spans
  → compare answer to gold cites
  → fail if no overlap
  → human samples tests

8. How integrated

Wrap LangGraph invoke with tracing. Env keys, not in Git.

Shipped-pattern sketch. Pass-rate % MISSING.

# Interview sketch — fail if ungrounded (Python intern)
trace = run_graph(q)
if not overlap(trace.answer, trace.retrieved_spans):
    fail_eval(q, expected_citation_ids)

9. Config that matters

MISSING: pass rate, gold-set size, project name in LangSmith, bill. FACT: tracing + evals + test-case gen.

10. Runtime: one request/data path

A BRD or research run is traced; writer blocked conceptually if empty retrieval.

11. Scale 10× honest / 100×

10×. More gold on a frozen slice, not more scrapers. Tracing cost: ids not raw annexes.

100×. MISSING: enterprise LangSmith org admin, 100× eval QPS I ran.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Fluent wrong cite: gold id miss.
2. Empty docs in trace: writer still ran.
3. Prod wants traces of full PDF: refuse.
4. Ylogx quality: denied-tier fixtures not LangSmith.
5. Argus: mAP not traces.

14. Monitoring

FACT: LangSmith is the monitoring for IQVIA LLM path. MISSING: dashboards beyond that, Datadog.

15. Security slice

No secrets in traces; no full BRD; credentials in env.

16. Performance / Frugality

Frugality: fail a sentence instead of adding a fifth scraper. Eval before scale.

17. Alternatives

18. When NOT to use

Do not use LangSmith as a substitute for RLS. Do not claim it on dashboards.

19. Limitations

MISSING: pass rate. [YOU NEED TO PREPARE THIS] only if you remember an internal rate — do not invent one.

20. What I vs we vs must-not-claim

I: eval design (span/cites) and tracing the graph. We: LangSmith account. Must-not-claim: company-wide eval platform owner.

21. What would the interviewer ask next?

Isn’t the model’s confidence enough? No.

22. Mini follow-up chain

Why LangSmith? Fluent≠cited. Why not BLEU? Citations. Feature? Span-overlap fail. If LangSmith down? Blind on fluency bugs; still must not ship uncited. Monitor? This is the monitor. YOU? Gold ids + fail rule. Redesign? More gold slice; still no full BRD in traces.

T1.11 Docker — FACT: Ylogx ECS containers; Argus containerized 20+ cameras Resume-derived

TECHNOLOGY. FACT: Ylogx deployed Docker containers on ECS; Argus containerized solution supporting 20+ camera feeds. Kubernetes is not this card. Image ≠ orchestrator.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

CI builds an image → push → ECS task definition references image, CPU/memory, ports, env → service keeps desired count → ALB health. Secrets at runtime, not baked in. Local Compose is for dev. Prod serving is ECS. Argus: one worker per stream or batched workers — I describe honestly without drawing k8s control planes. MISSING: registry name (ECR vs Docker Hub), base image, exact CPU.

3. Why we used it on this intern/project

Problem: SSH snowflake host cannot defend 99.9%. Why not k8s: listed skill; intern orchestrator is ECS. LP: Ylogx Ownership of deploy path; Frugality = not operating a control plane you do not need.

4. Where in architecture

CI → image
  → [Docker]
  → ECS task
  → ALB
Argus: camera worker containers → YOLO → Postgres events

5. Before / after / why simpler failed

Before: mutable VM. After: repeatable image + desired count. Compose-on-one-box forever failed replacement of sick copies.

6. Core concepts

7. Internal flow

build → push
  → task starts container
  → listen port
  → ALB health
  → serve

8. How integrated

Ylogx: Docker+ECS+CI/CD. Argus: containerized feeds. No EKS.

Standard CS illustration — not a manifest/config I shipped on an intern bullet.

# Standard CS illustration — not a Ylogx Dockerfile I shipped
FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

9. Config that matters

MISSING: CPU/mem numbers, launch type, image registry, Argus compose vs k8s. FACT: Docker + ECS; Argus containerized 20+.

10. Runtime: one request/data path

Ylogx request hits a healthy container task. Argus frame hits a worker container then Postgres.

11. Scale 10× honest / 100×

10×. Same image, more tasks (Ylogx) or more workers (Argus). Check pools. Do not explode microservices I did not ship.

100×. MISSING: 100× node cluster, service mesh, multi-arch build farm I ran.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Task crash loop: logs on the task (MISSING vendor); health fails; ECS replaces. Not CrashLoopBackOff unless they ask k8s CS.
2. Healthy but RLS broken: health is not policy.
3. Argus camera 12 late: worker/FPS, not Ylogx ECS.
4. CI failed tests: do not roll.
5. Interviewer k8s: listed; this card is Docker.

14. Monitoring

FACT: ALB health checks. MISSING: container CPU dashboards, Datadog.

15. Security slice

No secrets in image; task role not long-lived keys in Git.

16. Performance / Frugality

Frugality: one app image, more tasks — not a microservice explosion. Not k8s control plane cost.

17. Alternatives

18. When NOT to use

Do not use Docker as an excuse to skip RLS tests. Do not claim Kubernetes desired count.

19. Limitations

MISSING: Dockerfile contents. [YOU NEED TO PREPARE THIS] base image/runtime if you remember.

20. What I vs we vs must-not-claim

I: containerize and roll path I owned. We: registry/account. Must-not-claim: platform owner, EKS, Istio.

21. What would the interviewer ask next?

Task vs service? Task = running copy; service = keep N healthy.

22. Mini follow-up chain

Why Docker? Repeatable artifact. Why not k8s? ECS shipped. Feature? Image+task def. If image bad? Rollback previous definition. Monitor? ALB health. YOU? Image+roll. Redesign? Same; pin digest; still no EKS.

T1.12 AWS serving — CloudFront → ALB → ECS + Route 53/GoDaddy + CI/CD/GitHub Actions Resume-derived

TECHNOLOGY. FACT: CloudFront, ECS, Docker, automated CI/CD, sub-210 ms, GoDaddy DNS with Route 53 through an ALB, 99.9% uptime. Not EKS. Not Nginx-as-named-edge. Not Lambda. Fargate vs EC2 launch MISSING. GitHub Actions is on the skills line with CI/CD — workflow filename MISSING.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

Client DNS → GoDaddy NS → Route 53 → CloudFront (static React) and/or ALB (API) → healthy ECS NestJS/FastAPI → Redis/Postgres. Do not cache tenant JSON at the edge. CloudFront 403 ≠ ALB 502 ≠ origin 5xx ≠ RLS 403. NLB is L4; we used ALB. Tasks private; users never speak task IPs (VPC layout names MISSING).

3. Why we used it on this intern/project

Problem: one VM, no edge, no L7 health replace. Why not Lambda: cold start, time cap, always-on BI, long RAG. Why not k8s: T3. LP: Ownership of serving path; 99.9% without SRE theatre.

4. Where in architecture

Browser
  → GoDaddy (registrar)
  → Route 53 (zone)
  → CloudFront (static)
  → ALB (L7 + health)
  → ECS tasks (Docker)
  → Redis / Postgres

5. Before / after / why simpler failed

Before: snowflake host. After: 99.9% + sub-210 on dashboards. Hitting ECS for every JS bundle would waste origin. Caching private JSON at CloudFront would leak.

6. Core concepts

7. Internal flow

DNS → edge static
  API → ALB → healthy task
  deploy: build image → new task → health → drain

8. How integrated

See Docker card. GitHub Actions listed as the CI flavor; do not invent 20 stages.

Standard CS illustration — not a manifest/config I shipped on an intern bullet.

# Conceptual ECS task def fields — not a dumped JSON I shipped
# family, cpu, memory, image, portMappings, environment, healthCheck
# Standard CS illustration — not a manifest/config I shipped on an intern bullet.

Standard CS illustration — not a manifest/config I shipped on an intern bullet.

# CI shape (GitHub Actions listed) — not a real workflow file
# on: push
# jobs: test → docker build → push → ecs service update

9. Config that matters

MISSING: desired count, health path/interval, launch type, ACM ARN, CloudFront cache TTLs, Actions yaml. FACT: hops + 99.9% + sub-210 + CI/CD.

10. Runtime: one request/data path

Dashboard: JS from CloudFront, JSON via ALB to NestJS. Bot: ALB to FastAPI. DNS misconfig never reaches app.

11. Scale 10× honest / 100×

10×. CloudFront offload static; raise desired count after pool check; still one primary Postgres+RLS. Do not cache tenant JSON at edge.

100×. MISSING: 100× multi-region, Global Accelerator, 99.99, AWS bill I quoted.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Site down, curl IP of ALB works: DNS/delegation.
2. HTML loads, API 502: ALB/targets.
3. API 403: RLS/RBAC not CloudFront.
4. After deploy 5xx: new image; rollback task def.
5. Slow tiles: origin N+1 vs CF miss vs LLM wrongly added.

14. Monitoring

FACT: ALB health checks are how you talk 99.9% without a vendor. MISSING: SLO window, incident CSV, CloudWatch-as-claimed (do not invent CloudWatch either unless you confirm — treat as MISSING).

15. Security slice

TLS at edge/ALB; private tasks; no tenant cache at CF; IAM task role; secrets runtime.

16. Performance / Frugality

Frugality: CDN + more tasks vs bigger EC2 vs EKS. Lambda not for this always-on BI.

17. Alternatives

18. When NOT to use

Do not use CloudFront as RLS. Do not claim you ran EC2 by hand as the architecture.

19. Limitations

MISSING: launch type, desired count. [YOU NEED TO PREPARE THIS] if you remember Fargate vs EC2 — else say MISSING.

20. What I vs we vs must-not-claim

I: path configuration and health-aware roll I owned. We: AWS account. Must-not-claim: org-wide landing zone, Terraform (not on resume), SRE on-call novel.

21. What would the interviewer ask next?

CloudFront vs Redis? Edge static vs app cache −35%.

22. Mini follow-up chain

Why this path? Edge+health+tasks. Why not k8s? ECS shipped. Feature? ALB health. If ALB down? API down; classify vs origin. Monitor? Health checks FACT. YOU? DNS+roll+health. Redesign? Same hops; still no multi-region fiction.

T1.13 React.js + Recharts — FACT: 30 real-time KPI dashboards, +60% ops, sub-210 ms Resume-derived

TECHNOLOGY. FACT: Designed 30 real-time KPI dashboards with React.js, Recharts; +60% operational efficiency; sub-210 ms; no LLM on this path. Redux/Next/Tailwind/ShadCN are not the named bullet libraries.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

Browser loads JS from CloudFront → GET tile JSON via ALB NestJS → RBAC → Postgres RLS → Recharts. Optional app cache for hot aggregates (not the −35% bot Redis claim as the dashboard number). +60% protocol MISSING — speak mechanism (live KPIs vs ad-hoc reports) then resume number then ‘I do not have the study protocol on the resume.’

3. Why we used it on this intern/project

Problem: operators waited on ad-hoc SQL. Why not LLM-fill-the-chart: sub-210 becomes a lie. Why not GraphQL first: over-fetch was not why tiles were slow. LP: Deliver Results adjacent via ops efficiency number — primary Deliver is Horizon 17th; do not steal. Customer impact is operators.

4. Where in architecture

CloudFront React bundle
  → ALB NestJS GET /tiles
  → Postgres RLS
  → [Recharts]
  no FastAPI LLM

5. Before / after / why simpler failed

Before: ad-hoc reports. After: 30 tiles, sub-210, +60%. ‘Ask the bot to fill the chart’ failed latency and isolation.

6. Core concepts

7. Internal flow

load JS (CF)
  → GET JSON (ALB/Nest)
  → setState
  → Recharts render
  → poll later (described, not invented bus)

8. How integrated

React SPA + NestJS REST. FastAPI not on this GET.

Shipped-pattern sketch.

// Interview sketch — tile fetch, no LLM (TypeScript intern)
const json = await fetch("/api/kpis", { headers: { Authorization: `Bearer ${t}` } });

9. Config that matters

MISSING: poll interval, bundle size, Redux usage. FACT: 30, Recharts, sub-210, +60% with protocol MISSING.

10. Runtime: one request/data path

Operator opens dashboard: static from edge, data from RLS JSON, charts locally.

11. Scale 10× honest / 100×

10×. Aggregate in SQL; cache hot aggregates; still no LLM. 10× tiles is N+1, not SQL RAG.

100×. MISSING: 100× concurrent operators, websocket fan-out I built, micro-frontend platform.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Slow dashboard, bot fine: this path N+1/origin.
2. Empty charts, 200: RLS empty vs bug.
3. After ‘AI tooltip’: check 210 still true — if not, revert.
4. GitHub Actions front-end only fail: still do not skip RLS tests.
5. Redux question: listed; bullet is React+Recharts.

14. Monitoring

FACT: sub-210 is the performance claim. MISSING: RUM vendor, +60% protocol.

15. Security slice

Auth on APIs; no public unauthenticated KPI; no edge cache of private JSON.

16. Performance / Frugality

Frugality: charts from JSON vs LLM tokens per tile. Invent and Simplify: REST tiles.

17. Alternatives

18. When NOT to use

Do not use React as the isolation layer (RLS is). Do not steal Argus 24 FPS into tiles.

19. Limitations

MISSING: poll interval. [YOU NEED TO PREPARE THIS] how tiles refreshed, from memory.

20. What I vs we vs must-not-claim

I: dashboard UI+API JSON path. We: ops outcome +60%. Must-not-claim: randomized ops trial, Datadog RUM.

21. What would the interviewer ask next?

Real-time means WebSockets? I describe poll/REST unless they ask WS as CS.

22. Mini follow-up chain

Why React+Recharts? 30 KPIs. Why not LLM? sub-210. Feature? JSON tiles. If Nest down? Charts empty. Monitor? sub-210 claim; no RUM vendor. YOU? UI+GET path. Redesign? Aggregate SQL; still no sockets fiction.

T1.14 ROS2 + GStreamer + ZED 2 + costmap — FACT: Horizon ERC 17th/80+ TEAM Resume-derived

TECHNOLOGY. FACT: ROS2 semi-autonomous Mars rover; 17th globally / 80+ ERC 2024 TEAM; 60 FPS GStreamer; +40% obstacle; ZED 2 2M+ pts/s; RViz; Gazebo; costmap −55% collision; sensor fusion; predictive algorithms. Core software, not team lead. mAP is Argus. No missed ERC.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

Camera → GStreamer → operator. ZED → mapping node → dense occupancy → costmap → predictive planning → actuators. Other sensors fuse into the same map. Gazebo ≠ dirt. Time-sync: live video can mask stale occupancy — that is the live bug class. 17th is we. I owned camera, mapping, costmap as core software. Mechanical/electrical not mine.

3. Why we used it on this intern/project

Problem: TCP MJPEG stalls; pretty cloud is not a planner; bump-and-turn is not −55%. Why not extra hardware first: Bias for Action + date. Why not YOLO on rover: Argus owns YOLO. LP: Horizon Bias/Deliver/Earth’s Best. Frugality optional here; Redis remains Ylogx Frugality primary.

4. Where in architecture

camera → GStreamer 60 FPS → operator
ZED 2M+ pts/s → dense occupancy → [costmap] → planner → actuators
              ↘ downsampled → RViz
Gazebo = sim, not field

5. Before / after / why simpler failed

Before: freeze-cam / viz-as-map / extra PO. After: 60 FPS, +40%, −55%, 17th/80+. Pixel-red stop failed planning.

6. Core concepts

7. Internal flow

frame now → operator (GStreamer)
points now → occupancy → costmap (must be time-aligned)
stale map + live video = collision class

8. How integrated

ROS2 graph; GStreamer elements; ZED driver; RViz/Gazebo for viz/sim.

Shipped-pattern sketch. Launch XML not dumped.

# Interview sketch — two consumers of ZED (Python intern / ROS2)
# dense → local costmap; thin → RViz
# Standard CS illustration of the split, not a dumped launch file.

Standard CS illustration — not a manifest/config I shipped on an intern bullet.

# GStreamer idea — not a radio spec
# src → convert → payloader → UDP sink
# Standard CS illustration — not a manifest/config I shipped on an intern bullet.

9. Config that matters

MISSING: exact pipeline string, voxel size, costmap resolution, radio BER, ROS2 distro. FACT: 60 FPS, 2M+, +40%, −55%, 17th/80+.

10. Runtime: one request/data path

One camera frame to operator in 60 FPS path; simultaneously occupancy must not be last second’s rocks.

11. Scale 10× honest / 100×

10×. Rover is not SaaS MAU. 10× points: thin viz more, keep local density. 10× sensors: still one costmap. 10× speed: time-sync first.

100×. MISSING: 100× rover fleet, offboard GPU cluster, 120 FPS.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Operator sees rock, rover drives: stale map class.
2. Video freeze: transport, not YOLO.
3. Gazebo OK, field fail: lighting/dust.
4. Hardware wanted new LiDAR week-of: fuse existing.
5. mAP question: Argus, not here.

14. Monitoring

FACT: 60 FPS is the video monitor; collision −55% is outcome. MISSING: bag-file study protocol, Datadog-on-rover.

15. Security slice

Do not expose unauthenticated field telemetry. Safety stays deterministic — no LLM occupancy.

16. Performance / Frugality

Frugality: software fusion vs PO. Bias for Action: ship 60 FPS+costmap under date.

17. Alternatives

18. When NOT to use

Do not use ROS2 as Ylogx orchestrator metaphor in the AWS card. Do not skip safety for speed.

19. Limitations

MISSING: radio spec. [YOU NEED TO PREPARE THIS] ROS2 distro / which nodes you wrote, from memory.

20. What I vs we vs must-not-claim

I: camera, mapping, costmap software. We: 17th and hardware. Must-not-claim: chassis design, team lead, missed ERC, mentee count.

21. What would the interviewer ask next?

Gazebo = field? No.

22. Mini follow-up chain

Why ROS2? Node graph. Why GStreamer? 60 FPS. Feature? Costmap fusion. If ZED down? Occupancy degrades; do not pretend video is the map. Monitor? 60 FPS + field. YOU? Core software slice. Redesign? More dust lighting tests; still no YOLO-on-rover.

T1.15 YOLOv9 — FACT: Argus 73→89% mAP, 15k images, 24 FPS, 20+ cameras Resume-derived

TECHNOLOGY. FACT: YOLOv9 89% mAP from 73%, training 15,000+ images, 24 FPS, −50% violations, 20+ cameras, Postgres logs, 2× compliance, containerized. OpenCV decodes. TensorFlow listed-not-the-quoted-jump. No Haar as confirmed first attempt. No EKS. Site protocol for −50%/2× MISSING.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

Frame → OpenCV decode/resize → YOLOv9 → conf filter → NMS → event {camera, class, conf, ts, box} → Postgres → alert. Prefer drop stale frame over delayed alert. Video stays off the DB. Containers for workers. Auth the dashboard; 404 README — no invented routes. I did not print a Faster R-CNN bake-off on 20 cameras.

3. Why we used it on this intern/project

Problem: two-stage wins laptop accuracy, loses 24×20+. LLM caption is not mAP. Why data not architecture for 73→89: lighting/PPE color. LP: Are Right / Highest Standards / Success and Scale (gate then multiply).

4. Where in architecture

camera feeds (20+)
  → OpenCV
  → [YOLOv9]
  → NMS
  → Postgres event
  → alert

5. Before / after / why simpler failed

Before: 73% demo GIF. After: 89% then 20+ at 24 FPS. Scaling 73% scales alarm fatigue.

6. Core concepts

7. Internal flow

decode → infer → NMS
  → persist event
  → alert if still timely
  drop stale frames

8. How integrated

Python CV stack; container workers; Postgres. OpenCV preprocess.

Shipped-pattern sketch.

# Interview sketch — infer then event (Python intern)
frame = cv2.resize(decode(cam), size)
dets = yolo(frame)
dets = nms(dets)
for d in dets:
    db.insert(camera, d.cls, d.conf, ts, d.box)  # not the JPEG

9. Config that matters

MISSING: train/val split, input size, GPU model, confidence threshold, retention days. FACT: 73→89, 15k, 24 FPS, 20+, Postgres.

10. Runtime: one request/data path

One frame from camera 7 → boxes → event row → alert if PPE missing after NMS.

11. Scale 10× honest / 100×

10×. Do not scale 73%. Hold 24 FPS; more workers; events not video; wrong alerts at 20 cams = fatigue.

100×. MISSING: 200 cameras, multi-region plants, 99% mAP I already hit.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. Late alerts camera 12: FPS/budget, drop stale.
2. Wrong PPE class: data/lighting, not ‘add TF.’
3. No audit row: persist path.
4. Public /stream: auth; no invented routes.
5. k8s question: containerized; Ylogx ECS is the intern orchestrator story.

14. Monitoring

FACT: mAP is the detector monitor; 24 FPS budget. MISSING: plant dashboard vendor, site study protocol.

15. Security slice

Auth streams; events not public; no exploit on cameras. Safety alerts after NMS.

16. Performance / Frugality

Frugality: one-stage vs two-stage GPU tax. Success and Scale: 89% then 20+.

17. Alternatives

18. When NOT to use

Do not use YOLO on Horizon costmap. Do not page a floor at 73%.

19. Limitations

MISSING: split/threshold. [YOU NEED TO PREPARE THIS] conf threshold and how you computed mAP, from memory — do not invent COCO-oral extras.

20. What I vs we vs must-not-claim

I: detector pipeline, gate, events. We: site −50%/2×. Must-not-claim: Haar, EKS, F1 invented, Purplle YOLOv8 as this bullet.

21. What would the interviewer ask next?

mAP vs −50%? Detector gate vs site outcome.

22. Mini follow-up chain

Why YOLOv9? 24 FPS × 20+. Why not two-stage? Budget. Feature? One-pass boxes. If GPU down? Alerts stop; do not silently page on 73% CPU fallback unless you had it — MISSING. Monitor? mAP+FPS. YOU? Train/eval/infer path. Redesign? Held-out camera would-do; still gate 89%.

T1.16 Java — Live Code FACT; internships were not JVM — honesty card Resume-derived Standard CS

TECHNOLOGY. FACT: Languages line includes Java. This loop’s Live Code is Java. FACT internships: Python FastAPI, TypeScript NestJS/React, ROS2 Python/C++, Argus Python YOLO. Must-not-claim: Spring Boot IQVIA, JVM warehouse, Java LangGraph in prod.

1. 30-second what-is-it

2. Two-minute how it works + where it fits

If they paste DSA: write Java. If they ask why Java on the resume: language I code in this loop + skills line. If they ask to rewrite Ylogx in Spring: ideas yes, intern ship no. If Fluency slot pastes a tree: write the tree first (Distance K was reported under Fluency in another loop — not a 10454435 prediction).

3. Why we used it on this intern/project

Listed, not this intern’s production runtime. Why list it: Live Code + coursework/skill. Why not pretend: senior interviewers open GitHub and bullets. Constraint: honesty is the bar. LP: none forced; Earn Trust is the meta (do not fake the stack).

4. Where in architecture

Live Code editor: [Java]
IQVIA/Ylogx/Argus: Python/TS
Horizon: ROS2 Python/C++
Do not draw Spring in the AWS ASCII

5. Before / after / why simpler failed

Before (trap): ‘I am a Java intern.’ After (honest): Live Code Java, prod Python/TS. Simpler lie fails GitHub.

6. Core concepts

7. Internal flow

Interviewer pastes prompt
  → Java in editor
  → if they still want stack: Python/TS intern honestly

8. How integrated

Not integrated into intern ECS images. Transfer is conceptual.

Same idea in Live Code. Internships were not JVM.

// Live Code analog — role-bound query idea, NOT a Ylogx intern file
// Same idea in Live Code; intern path was Python.
try (Connection c = ds.asRole(userRole)) {
  try (PreparedStatement ps = c.prepareStatement(sql)) { /* bind */ }
}

Standard CS illustration — not a manifest/config I shipped on an intern bullet.

// Standard CS illustration — not a Spring Boot app I shipped
// @RestController class BotController { }

9. Config that matters

MISSING: Java version in the Live Code environment until they show it. FACT: Java on skills; intern languages as above.

10. Runtime: one request/data path

There is no intern Java request path. The runtime path is the editor.

11. Scale 10× honest / 100×

10×. 10× Live Code skill is faster correct Java, not ‘I already ran Spring at 100×.’

100×. MISSING: production JVM tuning, GC pause budgets, Kubernetes Java sidecars.

12. Failure modes (classes, not fake tickets)

13. Five troubleshooting scenarios

1. They ask ‘show Ylogx in Java’: analog then stop.
2. Compile error on local: definite assignment.
3. They open GitHub Python: expected.
4. They ask Spring security: RBAC+RLS analog, not intern Spring.
5. Fluency+tree: write tree, Fluency sentence only if still asked.

14. Monitoring

N/A intern APM. Live Code correctness is the monitor.

15. Security slice

Do not dump secrets in Java snippets. No exploit code.

16. Performance / Frugality

Frugality: do not rewrite intern systems onto JVM for the interview story.

17. Alternatives

18. When NOT to use

Do not use Java as proof you operated production. Do not refuse the editor language.

19. Limitations

MISSING: years of Java in industry — you are intern-honest. [YOU NEED TO PREPARE THIS] coursework/projects in Java besides Live Code, from memory, without inventing intern bullets.

20. What I vs we vs must-not-claim

I: Java in the editor. We: intern products in Python/TS. Must-not-claim: Spring Boot production, JVM 99.9%.

21. What would the interviewer ask next?

Why list Java if internships were Python? Live Code + skills; ideas transfer; syntax is not architecture.

22. Mini follow-up chain

Why Java? This loop Live Code. Why not intern JVM? Ecosystem of RAG/CV/ROS. Feature needed? DSA+OOP in editor. If they want Spring Ylogx? Analog only. Monitor? Tests in the editor. YOU? Write Java now. Redesign intern? Would not fake JVM for a JD.

Next.js

30s. React framework with routing/SSR options. Why listed. Skills; StratifyLabs is a Next-shaped client in adjacent GitHub default README — resume wins on product claims. Evidenced redirect. Ylogx dashboards bullet is React.js + Recharts, not Next. IQVIA is FastAPI. Resume-derived

SSR vs SPA? Ylogx I describe as SPA JSON tiles. App router internals? CS if pushed, not intern novel. Stratify default README vs resume? Resume wins.

Trap: Next.js was the Ylogx 99.9% host (it was ECS).

Node.js + JavaScript

30s. Node runs JavaScript/TypeScript servers; JS is the language of the browser. Evidenced. NestJS (Node) + React. FastAPI is Python, not Node. FACT NestJS intern API.

Trap: LangGraph ran on Node. FastAPI is Node.

WebSockets

30s CS. Full-duplex browser connection. Listed. Resume says real-time KPI dashboards — I describe poll/REST. I will not invent Redis pub/sub for 30 tiles or a socket that bypasses RLS. MISSING: whether any intern socket existed. [YOU NEED TO PREPARE THIS] only if you actually shipped one — else do not invent.

Trap: WebSockets were how RLS was enforced. Sockets are not a row filter.

OAuth 2.0

30s CS. Delegated authorization; state on redirects is CSRF protection. Listed. Ylogx evidence is JWT-shaped identity at NestJS → RBAC → DB role → RLS. Auth0 is T3. Do not give exploit recipes.

OpenCV

FACT-adjacent. Argus decode/resize. Detector is YOLOv9. OpenCV color/HOG is not the 89% mAP story. Horizon camera is GStreamer, not OpenCV-as-60-FPS-claim.

Three.js / WebGL / URDF

FACT Stratify: URDF editor with WebGL; 3D sim lab; marketplace 50+ catalog items. GiftedBooks VR labs. Not Horizon Gazebo. Three.js is skills; resume claim is URDF+WebGL+lab.

Trap: 50+ GPUs. 50+ is catalog. Trap: Gazebo = Three.js.

Gemini / OpenAI API / Local LLMs

FACT Stratify: Gemini RAG bots on sim state. OpenAI API and Local LLMs are listed. IQVIA/Ylogx bullets do not name the model vendor. MISSING: which model IQVIA/Ylogx called. [YOU NEED TO PREPARE THIS] from memory — do not invent OpenAI-as-IQVIA-FACT if the PDF is silent. Never Qdrant. Never claim local LLM as Ylogx 99.9%.

HTML / CSS / Tailwind / ShadCN

Listed UI. Named chart library on Ylogx is Recharts. Honest: I built React UIs. I will not claim Tailwind as the 30-KPI FACT or a design-system novel.

Git / GitHub / Linux / Postman / OpenAPI

Everyday tools. OpenAPI is how I describe REST contracts, not a billed API gateway. GitHub Actions sits with CI/CD (T1.12). Linux is ECS/rover/dev. Postman for REST. GiftedBooks GitHub AegisAI mismatch: volunteer it. InstaRecon: consent demo, no exploit steps, redirect.

Pandas / NumPy

Listed Python data/eval glue around CV and intern analysis. Warehouse is PostgreSQL, not a Pandas lake. Argus mAP eval may use Python numeric stack — I will not claim Pandas was the 15k trainer.

Web Scraping

FACT IQVIA tools: Firecrawl, Bing, DDG, Playwright. Redirect to T1.7. Legal: research for analysts, no production attacks, no InstaRecon mix.

Generative AI (meta) and RAG Systems (meta)

Same shape: retrieve small context, then generate. Four lanes: (1) Ylogx SQL RAG + RLS + Redis. (2) IQVIA Deep Research 200+ ranked web. (3) IQVIA Hybrid RAG Azure+GraphDB+LangSmith on 200+ page BRDs. (4) GiftedBooks student PDF sub-300 ms; Stratify Gemini bots on sim state. Do not say RAG-is-RAG. Do not one index for all.

Trap: FAISS at IQVIA. Qdrant. Superuser SQL. Azure on GiftedBooks.

GraphQL

30s. Query language: client asks a graph of fields; one endpoint. Listed. Ylogx intern path is REST. 30 KPIs did not die from over-fetch. Redirect: NestJS REST JSON.

1 Schema/types? CS. 2 N+1 resolvers? CS risk — another reason we did not start here. 3 vs REST? REST shipped. 4 AuthZ per field? We did RBAC+RLS. 5 Subscriptions vs WS? Do not invent. 6 Intern warehouse protocol? REST. 7 When GraphQL later? Nested over-fetch becomes the pain. 8 Federation? Not intern.

Trap: GraphQL was the BI API. When NOT: do not pretend nested dashboard+bot+users tree shipped.

# Standard CS illustration — not a manifest/config I shipped on an intern bullet.
# type Dashboard { kpis: [Kpi] }  # we did not ship this as the intern API

[YOU NEED TO PREPARE THIS] any course exercise — not a Ylogx bullet.

ProtoBuf

30s. Typed binary serialization. Listed. Dashboards stayed JSON. Honest maybe: high-frequency metadata (Argus events), not the JPEG. Redirect: JSON tiles; Postgres event rows.

1 vs JSON? Size/schema vs debug. 2 gRPC? Not intern. 3 FastAPI↔Nest? Do not claim ProtoBuf bus. 4 Schema evolution? CS. 5 Argus frames? JPEG not protobuf payload I claimed. 6 Ylogx chatbot? JSON. 7 Kafka + proto? Kafka not on resume. 8 Why list? Lab/adjacent.

Trap: ProtoBuf between FastAPI and NestJS.

[YOU NEED TO PREPARE THIS] where you actually used .proto files, if at all.

Nginx

30s. Reverse proxy / static server. Listed. Named Ylogx edge is CloudFront → ALB → ECS. Redirect: T1.12.

1 TLS terminate? Named: CF/ALB. 2 vs ALB? ALB is AWS L7. 3 reverse_proxy? CS. 4 rate limit in nginx? Did not ship rate limiter. 5 Compose nginx? Dev maybe MISSING. 6 99.9% mechanism? ECS+ALB health. 7 EC2+nginx architecture? Rejected. 8 Ingress controller? k8s CS, not intern.

Trap: Nginx terminated TLS at Ylogx.

# Standard CS illustration — not a manifest/config I shipped on an intern bullet.
# server { listen 80; location / { proxy_pass http://app:8000; } }

[YOU NEED TO PREPARE THIS] any lab nginx — not the intern named hop.

Auth0

30s. Hosted IdP: login, OAuth/OIDC. Listed. Intern evidence: tokens at NestJS + RBAC + RLS. Redirect: T1.4. Auth0 is NOT the RLS card.

1 Authorization Code flow? CS. 2 PKCE? CS. 3 JWT vs Auth0? Vendor vs pattern. 4 RLS in Auth0? No — Postgres. 5 Tenant admin you were? Must-not. 6 Social login intern? MISSING. 7 Secrets in rules? Must-not dump. 8 Why list? Skill, not Ylogx prod claim.

Trap: We used Auth0 for three-tier RLS.

[YOU NEED TO PREPARE THIS] whether any personal project used Auth0 — do not move it onto Ylogx.

Redux

30s. Client state container. Listed. Bullet: React.js, Recharts. Redirect: T1.13.

1 Store/actions? CS. 2 vs Context? CS. 3 30 KPIs in Redux? Not FACT. 4 Server facts in Redux? Facts stay Postgres. 5 RTK? Do not invent. 6 Time-travel debug intern? No. 7 Why list? Course/UI adjacent. 8 Next.js store? T2.

Trap: Redux shipped the 30 KPIs.

[YOU NEED TO PREPARE THIS] any app that actually used Redux.

Prisma ORM

30s. TypeScript ORM. Listed. Warehouse bullet is PostgreSQL + RLS. Redirect: T1.3. ORM does not replace RLS; owner connection still bypasses.

1 vs raw SQL? SQL RAG emits SQL anyway. 2 migrations? MISSING intern. 3 RLS with Prisma? Easy to get wrong if you use owner. 4 Ylogx ORM? Do not claim Prisma shipped intern warehouse. 5 Mongo Prisma? Mongo listed-not-warehouse. 6 GraphQL Prisma stack? Fashion, not intern. 7 N+1? Same as tiles. 8 Why list? Skill.

Trap: Prisma was the intern ORM for RLS.

[YOU NEED TO PREPARE THIS] personal Prisma projects only.

Flask

30s. Minimal Python HTTP. Listed. Intern apps were FastAPI (+ NestJS). Flask webcam is the thing GStreamer beat for 60 FPS — not a Ylogx intern framework claim.

1 vs FastAPI? Typed/async intern choice. 2 IQVIA Flask? No. 3 Gunicorn? MISSING. 4 MJPEG rover? Rejected. 5 Why list? Course/lab. 6 Blueprints as Nest modules? Analogy only. 7 SQLAlchemy warehouse? Postgres RLS is the claim. 8 Flask on ECS? Not the bullet.

Trap: Ylogx/IQVIA were Flask.

[YOU NEED TO PREPARE THIS] class Flask apps — not intern bullets.

MySQL

30s. Relational DB. Listed. Intern warehouse and Argus logs: PostgreSQL. RLS story is Postgres.

1 vs Postgres? RLS/BI intern is PG. 2 InnoDB CS? Fine. 3 Ylogx MySQL? Must-not. 4 Replication? MISSING. 5 JSON type? Not the point. 6 Why list? Course. 7 Argus MySQL? Resume says PostgreSQL logging. 8 Shard MySQL? Did not shard.

Trap: MySQL was Ylogx.

[YOU NEED TO PREPARE THIS] coursework DBs only.

MongoDB

30s. Document store. Listed. BI facts need joins, aggregations, transactions, RLS → Postgres. Redis is cache, not SoR.

1 Flexible schema? Wrong for warehouse facts. 2 Transactions? PG. 3 Ylogx Mongo? Must-not. 4 Argus events document-shaped? Still Postgres FACT. 5 Atlas you operated? Must-not. 6 vs FAISS? Different. 7 Why list? Skill. 8 Change streams as Kafka? Kafka not on resume.

Trap: Mongo was Ylogx for speed.

Firebase

30s. Hosted app backend (auth/DB/hosting flavors). Listed. Not GiftedBooks FACT (PDF does not name Firebase). Not Ylogx. 99.5% host unnamed — do not assign Firebase to invent a vendor.

1 Firestore vs PG? Different. 2 GiftedBooks Firebase? Not on PDF. 3 Auth vs JWT Nest? Ylogx is Nest. 4 Why list? Hobby/lab. 5 Security rules as RLS? Do not steal Ylogx. 6 99.9% on Firebase? No — ECS. 7 99.5% on Firebase? MISSING vendor. 8 Realtime DB as 30 KPIs? Must-not.

Trap: GiftedBooks was Firebase because 99.5%.

[YOU NEED TO PREPARE THIS] personal Firebase use; do not move onto PDF products.

Supabase

30s. Hosted Postgres+auth+storage. Listed. Intern RLS is Ylogx Postgres you engineered, not a Supabase checkbox claim.

1 Supabase RLS vs yours? Same Postgres idea; intern evidence is Ylogx. 2 Used Supabase for BI? Must-not claim. 3 Auth vs Auth0 vs JWT? T1.4. 4 Why list? Skill/hobby. 5 Vector in Supabase? IQVIA is Azure. 6 Realtime? WS T2. 7 99.9%? ECS. 8 Prisma+Supabase stack fiction? No.

Trap: Ylogx RLS was Supabase.

FAISS

30s. Library for vector similarity search. Listed as Vector DB (FAISS). IQVIA intern retrieval is Azure AI Search Hybrid+Semantic + GraphDB. GiftedBooks is vector+metadata on the student’s PDF — skill-lane store, not a FAISS-ops cluster novel. Never Qdrant.

1 IVF/HNSW CS? If they want CS, keep short. 2 IQVIA FAISS? Must-not. 3 Why not FAISS for BRDs? Misses clause IDs; Azure hybrid. 4 GiftedBooks FAISS topology? Do not fake. 5 GPU FAISS? MISSING. 6 vs GraphDB? Similarity vs edges. 7 LangChain FAISS loader intern IQVIA? Redirect Azure. 8 Index on disk? MISSING GiftedBooks ops.

Trap: FAISS shipped the BRD system. Qdrant.

# Standard CS illustration — not a manifest/config I shipped on an intern bullet.
# index = faiss.IndexFlatIP(d); index.add(xb)  # not IQVIA prod

[YOU NEED TO PREPARE THIS] any notebook that actually called FAISS — not IQVIA Azure.

TensorFlow

30s. ML framework. Listed. Argus resume is YOLOv9 + OpenCV, 73→89. Stratify is browser inference + Gemini bots. I will not fake TF Extended serving or ‘I trained YOLOv9 in TensorFlow’ as the quoted jump.

1 vs PyTorch? Resume says YOLOv9 not TF. 2 TF Serving intern? Must-not. 3 Keras PPE? Must-not as 89%. 4 Why list? Course/CV adjacent. 5 Stratify TF.js? MISSING unless you confirm. 6 Haar in TF? Omit Haar. 7 mAP in TF board? mAP is the metric; vendor MISSING. 8 Horizon TF? No.

Trap: I trained YOLOv9 in TensorFlow. Haar we tried first (off-resume).

[YOU NEED TO PREPARE THIS] actual TF coursework only.

Vercel / Render / Railway

30s. PaaS hosts for frontends/small APIs. Listed tools. Ylogx 99.9% is ECS+ALB+CI/CD+CloudFront. GiftedBooks 99.5% vendor unnamed — do not assign Vercel to invent it. Jupyter is listed notebooks, not production serving.

1 Ylogx on Vercel? Must-not. 2 Preview deploys intern? MISSING. 3 Railway Redis as −35%? Redis is Ylogx cache; host MISSING. 4 Render 99.9%? No. 5 Why list? Hobby deploys. 6 Next on Vercel vs React on CF? T1.13/T2. 7 Jupyter as Argus trainer UI? MISSING. 8 Serverless 99.9%? Lambda rejected for always-on BI.

Trap: 99.9% was Vercel. Jupyter in production ECS.

[YOU NEED TO PREPARE THIS] which personal apps went to which host — not Ylogx.

Jupyter Notebook

30s. Interactive Python. Listed. Not the intern serving path. Argus/IQVIA evals may have used notebooks — MISSING as a claimed prod artifact. Do not say production was a notebook.

1 vs FastAPI? Service vs explore. 2 15k training in Jupyter? Possible glue MISSING. 3 LangGraph in notebooks? Intern is FastAPI service. 4 Why list? Data/CV workflow. 5 Secrets in notebooks? Must-not. 6 Horizon Jupyter? Field was ROS2. 7 Papermill prod? Must-not. 8 Replace LangSmith with notebook vibes? No.

Trap: IQVIA Deep Research ran as a notebook in prod.

IQVIA — Deep Research

Exact. Architected a multi-agent Deep Research platform using LangGraph, LangChain, FastAPI, Firecrawl, Bing, Duck Duck Go, Google Playwright scraping researching over 200+ websites and properly ranking information for Result generation.

Normal. Walk the graph. Follow-up. Why four tools? Hard. What is “properly ranking” as a number?

Red flag: nDCG invented; k8s crawlers; Ylogx mix; latency %. Must know: reducer, cap, LangSmith empty scrape class.

IQVIA — Hybrid RAG

Exact. Architected a Hybrid RAG Agent with Azure AI Search (Hybrid + Semantic), GraphDB, and LangGraph for adaptive retrieval to process 200+ page BRD/PDF documents, stateful agent orchestration and evals, test case generation with LangSmith tracing.

Normal. Hybrid vs semantic. Follow-up. Why GraphDB. Hard. You were intern — who architected?

Red flag: FAISS-prod; full BRD traces; steal sub-210. Must know: lexical hits IDs; speak GraphDB.

Ylogx — reports + 99.9%

Exact. Built Full Stack AI Business Intelligence app with custom report builder using Python, FastAPI, NestJS, RESTful APIs and PostgreSQL serving users with 40% faster report generation and handling daily queries with 99.9% uptime.

Normal. Why two frameworks. Follow-up. 40% faster than what? Hard. 99.9% dashboard.

Red flag: Flask; GraphQL; EKS; missed 99.9% invented. Must know: hop classify 403/502.

Ylogx — SQL RAG + RLS + Redis

Exact. AI chatbot using LangChain SQL RAG architecture increasing data analysis productivity by 65% and engineered Row-Level Security (RLS) and RBAC for 3 organizational tiers as role, and reducing bot database latency by 35% via caching.

Normal. NL→SQL as role. Follow-up. Cache key. Hard. JOIN leak demo.

Red flag: LangGraph here; LangSmith here; rate limiter; superuser. Must know: fail-open DB never RLS.

Ylogx — 30 KPIs + AWS

Exact. Designed 30 real-time KPI dashboards with React.js, Recharts improving operational efficiency by 60%, and deployed on AWS with CloudFront, ECS, and Docker containers, automated CI/CD pipelines, achieving sub-210 ms response times, and configured GoDaddy DNS with Route 53 to route traffic through an ALB.

Normal. Draw the hops. Follow-up. Real-time = WebSockets? Hard. +60% protocol.

Red flag: Nginx edge; k8s; Vercel; LLM tiles; Redis as 210. Must know: do not cache tenant JSON at CF.

Horizon — rover + camera

Exact. Developed an semi-autonomous Mars rover using the ROS2 framework, securing 17th place globally at the European Rover Challenge 2024, with real-time camera feed at 60 FPS with Gstreamer and a 40% improvement in obstacle detection accuracy.

Normal. What you owned. Follow-up. 17th I or we? Hard. TCP vs GStreamer.

Red flag: I placed 17th; YOLO on rover; missed ERC; team lead. Must know: stale occupancy class.

Horizon — ZED + costmap

Exact. Constructed 3D environmental mapping with ZED 2 camera processing 2M+ data pts/sec connected with RViz and Gazebo, engineered costmap path planning reducing collision risk by 55% through sensor fusion and predictive algorithms.

Normal. Viz vs plan. Follow-up. Gazebo = field? Hard. Extra LiDAR week-of.

Red flag: all points offboard; chassis; Haar; GPU bill. Must know: time-sync.

Education / leadership

Exact. CUSAT CSE 8.42; Hackathons 1st CodeRecet, MLH Best Project, Magnathon 2.0 runner-up, 8 events; ERC 17th/80+ core software; Software Team Member Horizon; Tech Team IEDC CUSAT.

Normal. GPA once. Follow-up. IEDC what you did. Hard. Mentee count / team lead.

Red flag: invented prizes; GPA as Ownership; hackathons justify shipping 73%.

StratifyLabs

Exact. CV SaaS; 3D sim lab; −30% ML iteration via browser inference; marketplace 50+ models/datasets/community; URDF+WebGL; 3D character Gemini RAG bots on simulated environments.

Normal. Why browser inference. Follow-up. 50+ GPUs? Hard. Default README vs resume.

Red flag: Argus mAP steal; Horizon 60 FPS; LangSmith claimed; SageMaker novel.

GiftedBooks

Exact. VR labs, AI avatars, RAG PDF Q&A, sub-300 ms, 99.5% uptime, PYQ topics, +35% reading, +50% engagement, 2.5× comprehension, doubts hours → 3–10 min.

Normal. Student PDF not syllabus guess. Follow-up. AegisAI README. Hard. Student N / Azure steal.

Red flag: AegisAI as product; LangSmith; 3-tier RLS steal; 200+ steal.

Argus

Exact. YOLOv9 89% mAP from 73%, 15,000+ images, PPE and attendance, 24 FPS; −50% violations; containerized 20+ cameras; PostgreSQL logging; 2× compliance.

Normal. Why 73% not ship. Follow-up. mAP vs site %. Hard. Haar / EKS / LLM frames.

Red flag: 89% of people; scale 73%; Kafka; TF serving as the jump.

Class 1 — Wrong-org JOIN

Symptoms: report shows another org’s SKU. Checks: deny fixture; owner DSN; new table without policy. Mitigate: stop privileged DSN; enable RLS; RESET ROLE on pool. LP: Dive Deep / Earn Trust (isolation).

Class 2 — Cache without tier

Symptoms: identical NL, wrong tenant answer after Redis. Checks: key = raw NL. Mitigate: include tier; flush. Never fail-open RLS. LP: Frugality still holds if isolation holds; Dive Deep on key.

Class 3 — LLM on dashboard

Symptoms: tiles miss sub-210; nondeterministic KPIs. Checks: FastAPI on GET /tiles. Mitigate: revert to Nest JSON; refuse. LP: Ownership of the latency number.

Class 4 — Sick ECS task

Symptoms: intermittent 5xx; some users. Checks: ALB target health (FACT mechanism). Mitigate: unhealthy removed; service replaces; rollback image if new. Not k8s CrashLoop name unless CS. LP: Ownership of serving path. No fake war room hours.

Class 5 — Empty scrape still writing

Symptoms: fluent research, no sources. Checks: LangSmith docs empty. Mitigate: do not write; retry tool; empty is non-doc. LP: Invent (graph) / Learn (evals).

Class 6 — Fluent uncited BRD

Symptoms: professional paragraph, wrong clause. Checks: gold citation fail; no span. Mitigate: abstain; fix retrieval/hop. LP: Backbone hybrid vs ship-vector-only.

Class 7 — Stale occupancy

Symptoms: operator sees rock; rover drives. Checks: tf/time; RViz healthy. Mitigate: gate planner on freshness; do not thin costmap for viz. LP: Bias/Deliver/Earth’s Best — field not Gazebo.

Class 8 — 73% mAP at 20 cameras

Symptoms: alarm fatigue; wrong PPE pages. Checks: you scaled before 89%. Mitigate: stop multiply; data+eval gate; hold 24 FPS. LP: Are Right / Highest Standards / Success and Scale.

Class 9 — GiftedBooks wrong-PDF

Symptoms: answer from another student’s notes. Checks: retrieval not user-scoped. Mitigate: isolate index per user; do not steal Ylogx 3-tier wording as if printed here. LP: Customer / Earn Trust. Volunteer AegisAI mismatch if GitHub is open.