26. ConvBI / Ylogx full codebase — how it was built, every module, algorithms, deploy

A. How the product was built

ConvBI is conversational business intelligence for operators who are not SQL experts and still sit on shared warehouse facts. The product problem is three things at once: custom reports, natural-language analysis, and known KPI tiles — without one organizational tier reading another.

Why REST, not a message bus. Browser → Nest is request/response. Dashboard tiles are deterministic GETs with month/year query strings. Report builder is POST join SQL. Chat is POST NL, then POST-generated SELECT on the same request. There is no intern Kafka topic, no EKS control plane, no Datadog agent in this tree.

Keep this split straight. Resume metrics (40% faster reports, 99.9% uptime, SQL RAG +65%, RLS+RBAC 3 tiers, Redis −35% bot DB latency, 30 dashboards +60% ops, sub-210 ms, CloudFront / ECS / Docker / ALB / Route 53) belong to the Ylogx intern. This repo is how ConvBI is implemented. IQVIA is LangGraph + Azure hybrid RAG. Horizon is ROS2. Argus is YOLOv9. GiftedBooks is PDF RAG. One product per spoken answer.

B. Directory map of the three packages

convbi-backend (Nest)

convbi-backend/src/
  main.ts                 bootstrap: CORS, 50mb body, ValidationPipe, FinishTransaction, Swagger /api
  app.module.ts           15 feature modules + JwtMiddleware + RLSMiddleware excludes
  config.module.ts
  auth/                   signup, activate, signin, refresh, profile
  middleware/             jwt.middleware.ts, rls.middleware.ts, finish-transaction.middleware.ts
  queryDB/                tables, joins, raw SELECT guards, chat-query
  dashboards/             9 dashboard types, SQL aggregations
  reports/                save/load JSON configs
  chat/                   conversations; executeWithoutRLS for persistence
  fileUpload/             Tally ZIP → S3 → gateway
  organization/ roleManagement/ policyManagement/ featureManagement/
  userHierarchy/ moduleRegistry/ overview/
  models/                 18 Sequelize model files
  dbModules/sequelize.module.ts   pool max 20
  interceptors/logging.interceptor.ts
  filters/http-exception.filter.ts
  healthCheck/            Terminus pingCheck + /health/simple
  common/applicationTables.ts
Dockerfile                node:18.18.2-alpine3.18, USER node, EXPOSE 5000
docker-compose.yml        service convbi-backend :5000
.github/workflows/        convbi-prod.yml (main), convbi-qa.yml (qa)
.aws/task-definition.json Fargate family convbi-backend (do not paste secrets)

convbi-ai (FastAPI)

convbi-ai/
  main.py                 FastAPI POST /chatbot, GET /health
  extractor.py            SQLQueryAndDetailsExtractor, ChatOpenAI, allow-list
  engine.py               SQLAlchemy create_engine from DB_* env
  config.py               table_descriptions for 10 fact tables
  schema_validator.py     drift detect vs live get_table_info()
  output_parser.py        CustomReActSingleInputOutputParser
  parser_prompt_generator.py
  prompts.py              SQLQueryAndDetails Pydantic + system prompt
  prompt_constants.py
Dockerfile                python:3.12-slim, gunicorn 8 Uvicorn workers, timeout 180, port 80

convbi-frontend (React)

convbi-frontend/src/
  App.tsx                 Router + ChatProvider + FeatureAccessProvider + DashboardFiltersProvider
  modules/auth/           SignIn, SignUp, Activate, Forgot/Reset, authService, apiClient
  modules/dashboard/      predefined 9 types + custom canvas (localStorage)
  modules/chatbot/        ChatbotPage → POST /queryDB/chat-query
  modules/reportBuilder/  canvas, dnd, slicers, save JSON
  modules/upload/         TallyUploadPage
  modules/admin/          roles, policies, users, tables, features, expressions
  contexts/               Chat, FeatureAccess, DashboardFilters
  hooks/useTokenRefresh.ts
  utils/axiosInterceptor.ts, jwtUtils.ts
Dockerfile                node:20-alpine build → nginx:stable-alpine, port 80

Latex architecture-docs/08_data_layer.tex draws a local compose triangle (frontend 5173, backend “3000”, Postgres 5432). Live Nest listens on 5000 (main.ts). Production serving is ECS Fargate, not that compose sketch. Show the conflict; do not pick a fake “the AUTA port.”

C. Request lifecycle with exact file names

Live order from main.ts + app.module.ts (not the slightly rearranged latex boxes):

1. NestFactory.create(AppModule) in src/main.ts.
2. Global AllExceptionsFilter (filters/http-exception.filter.ts).
3. Global LoggingInterceptor (interceptors/logging.interceptor.ts) wraps controller execution.
4. enableCors: origin CORS_ORIGIN or *, credentials: true.
5. body-parser JSON + urlencoded, 50mb (report JSON).
6. Global ValidationPipe: whitelist, forbidNonWhitelisted, transform.
7. app.use(FinishTransactionMiddleware) — registers res.on('finish') before the handler runs.
8. AppModule.configure applies JwtMiddleware then RLSMiddleware to * except the excluded list.
9. Controller → service → Sequelize query on req.dbTransaction when present.
10. Response goes out; finish callback COMMIT or ROLLBACK.

Conflict, show it. backend-docs chapter 3 draws FinishTransaction as step 4 inside AppModule.configure(). Live code registers it in main.ts with app.use, and AppModule only applies JWT + RLS. The idea is the same: register finish first, open the RLS transaction later, commit after the HTTP response.

Swagger Bearer scheme is named JWT-auth. Profile, dashboards, queryDB, chat, reports, admin all require the header.

D. Auth algorithm (tokens, refresh, excluded routes)

Resume-derived Standard CS Live files: auth.service.ts, auth.controller.ts, utils/jwt.util.ts, middleware/jwt.middleware.ts, frontend authService.tsx, axiosInterceptor.ts, useTokenRefresh.ts.

Signup → activate

1. POST /auth/signup with email. Domain must includes(ORGANISATION_EMAIL) (substring, not a parsed hostname).
2. Duplicate email → 400. Else 6-digit OTP, signToken({ email }), insert User isActive: false, empty password, role USER.
3. SMTP HTML with OTP and FRONTEND_HOST:FRONTEND_PORT/activateAccount/{token}.
4. POST /auth/activate: verify token, match OTP, bcrypt.hashSync with 10 salt rounds, set isActive: true, clear OTP.

Signin → tokens

1. POST /auth/signin: lookup email lowercased; inactive → 401 “User not verified”; bcrypt.compareSync; invalid → 401 “Invalid credentials”. Same message for missing user so enumeration is not a separate 404.
2. Access token payload: email, guid, role, isActive, passwordUpdatedAt, client_id, organizationId. Secret JWT_ACCESS_SECRET, expiry JWT_EXPIRATION_TIME (docs default 1h).
3. Refresh token payload: guid, email. Secret JWT_REFRESH_SECRET, expiry JWT_REFRESH_TOKEN_EXPIRATION_TIME (docs default 7d).
4. Response body returns both as Bearer <jwt> strings. Frontend setAuthData stores token and refreshToken in localStorage.

JwtMiddleware (live)

1. Require Authorization header.
2. Split; must be Bearer + token.
3. jwt.verify(token, JWT_ACCESS_SECRET).
4. Set req.user = { userId: guid, role, email, client_id, organizationId }.

Refresh

Frontend initTokenRefresh schedules every VITE_TOKEN_REFRESH_INTERVAL or 15 minutes. Architecture latex also draws a 30s isAuthenticated poll in App.tsx (that interval exists) plus focus-triggered refresh. POST /auth/refresh-token is excluded from JWT middleware; body carries the refresh JWT; service verifies with the refresh secret, reloads the user, signs a new pair.

E. RLS algorithm (role resolution, SET ROLE, fail-closed, pool leftover)

File: src/middleware/rls.middleware.ts (~509 lines). This is the intern isolation mechanism. Generated SQL and dashboard SQL both ride the same transaction.

Resolution by JWT role

Postgres can only have one active role, so multiple assigned db roles collapse to the first db_role_name. Policies still union modules/tables onto req.user.

Session variables (transaction-local third argument true)

• app.is_SUPER_ADMIN
• app.is_admin
• app.current_user_id
• app.user_role
• app.organizationId
• app.admin_hierarchy_filter (ADMIN path)

An example policy shape from backend-docs (not a pasted production policy): USING (current_setting('app.organizationId', true) = organization_id::text OR current_setting('app.is_SUPER_ADMIN', true) = 'true').

Fail-closed

Users with zero roles, or roles without db_role_name, get PostgreSQL role rls_no_access (documented as zero table permissions). That is the safety net so “HTTP 200 and empty” beats “HTTP 200 and the other org.”

Pool leftover class

SET ROLE is session-level. set_config(..., true) is local to the transaction. FinishTransaction only commit()/rollback() — it does not RESET ROLE. Chat persistence opens a new transaction and runs RESET ROLE inside executeWithoutRLS. The leftover-role class is: a pooled connection reused with a previous SET ROLE still attached if a path forgets to run queries on the request transaction or skips RESET. I speak that as a class I test against, not a named outage.

Do not say generated SQL ran as table owner or superuser. Dashboard and chat-query execution use req.dbTransaction.

F. QueryDB algorithms

Controller: src/queryDB/queryDB.controller.ts. Service: queryDB.service.ts.

Table listing — GET /queryDB/tables

1. GUEST → 401.
2. SUPER_ADMIN: information_schema.tables in public, excluding application/system names (users, roles, policies, flyway_schema_history, …).
3. ADMIN: getAdminAllowedTables — SQL join user_roles → roles → role_policies → policies, union allowedModules, load ModuleRegistry.tables.
4. USER: prefer req.user.allowedTables from RLS middleware. Fallback: pg_policies overlap roles && ARRAY[policyRoleNames] without the RLS transaction (restricted role may not see the catalog). If still empty, chatbot feature can expose chat tables only.

Join execute — POST /queryDB/execute-query

1. hasTableAccess on mainTable and joinTable.
2. Quote identifiers: SELECT "main"."col" AS "col" … FROM "main".
3. Join keyword: if joinType already ends with JOIN, use it; else append JOIN. Types in enum: INNER, LEFT, RIGHT, FULL.
4. Optional date BETWEEN ? AND ?. Optional org filter if the table has organizationId (information_schema check).
5. LIMIT: default 1000, max 5000.
6. Run on dbTransaction. If dataType is MONTHLY/YEARLY, processDataForPeriod groups in process (high/low/avg of numeric columns).

Raw SQL guards — POST /queryDB/execute-raw-sql (also used by chat-query)

1. Trim; must start with select (case-insensitive). No INSERT/UPDATE/DELETE path.
2. Regex extract FROM/JOIN table names (quoted, schema.table).
3. hasTableAccess per table.
4. If the caller has an organizationId, inject WHERE (alias."organizationId" = '…') AND … before GROUP BY / ORDER BY / LIMIT / HAVING / UNION.
5. Execute on the RLS transaction.

The SELECT-prefix check is a shape guard, not a full SQL parser. A SELECT that hides writes via CTE tricks is a residual class; RLS still applies to the session role. Do not claim a proven SQL firewall.

Chat-query — POST /queryDB/chat-query

1. Body: { query, options }.
2. fetch(CHATBOT_API_URL || https://chatbot.projas.in/chatbot) JSON POST.
3. If eventQuery present, executeRawSelectQuery on the same RLS transaction.
4. Return data rows plus chart metadata; strip the SQL from the client payload. On SQL error, still return the chatbot message with showChart: false and error.

Dataset fields cache (not Redis)

fieldsCache: Map<string, { etag, data, expiresAt }>, TTL 5 minutes, key fields:${tableName}, SHA-1 etag of JSON. This is the only cache in the Nest service. Package.json has no redis / ioredis.

Slicer filters

buildWhereClauseFromFilters: operators in / equals / greater / less / between / contains / starts_with / ends_with, bound via named replacements, ILIKE for text. Distinct values endpoint supports search.

G. AI sidecar algorithms

FastAPI main.py: CORS allow-all, POST /chatbot constructs SQLQueryAndDetailsExtractor and returns parsed data. GET /health → { status: ok }.

Allow-listed tables

Hardcoded in extractor.py SQLDatabase(include_tables=[...]) and described in config.py:

1. accounting_transaction
2. bs (balance sheet)
3. cashflow_bank
4. cashflow_others
5. inventory_stk_masters
6. inventory_stk_vouchers
7. outstanding_payable
8. outstanding_receivable
9. pl
10. sales

Chain

1. Build SQLAlchemy engine from DB_USER/PASS/HOST/PORT/NAME (engine.py).
2. validate_and_sync_schema: parse get_table_info() CREATE TABLE lines, diff vs table_descriptions; optionally rewrite config.py. On failure, log and continue.
3. Prompt: system rules in prompts.py (read-only SELECT, no trailing semicolon, ROUND(x::NUMERIC, 2) for Postgres, chart-type rules) + table_info + table_descriptions.
4. LLM: ChatOpenAI(model="gpt-4.1", temperature=0) in the override (base class comments mention gpt-4o-2024-08-06).
5. Parse into Pydantic SQLQueryAndDetails: eventQuery, chatMessage, toFormat, showChart, dataPeriod, chartType, relevantColumns, xAxis, yAxis, series, interval, has_explicit_limit.
6. Post-process: collapse whitespace; if the SQL is a WITH-CTE that does not start with SELECT, wrap SELECT * FROM (cte) q.

output_parser.py is a ReAct Action/Action Input parser used by the older parallel-retry path in BaseExtractor; the live SQL extractor override is prompt | llm | Pydantic parser.

H. Dashboard algorithms (9 types, SQL aggregations, filters)

Registry lives in frontend modules/dashboard/App.tsx as PREDEFINED_DASHBOARDS. Backend DashboardsController under /dashboards. Service comment: access control is purely Postgres RLS on req.dbTransaction; empty result, not an app 403, if the role cannot see the table.

Filter translation

buildCommonDateFilter(months, years, dateColumn):

• empty / all → no extra AND (all data).
• years only → EXTRACT(YEAR FROM col) IN (...).
• months only → EXTRACT(MONTH FROM col) IN (...).
• both → year IN and month IN (Cartesian of selected months across selected years, not a pair list).

Controller accepts singular month/year or plural months/years comma strings; plural wins if both sent. Architecture latex also maps month=0 / year=0 to “all months 01–12” / years 2021–2025 on the client API helper; the Nest filter parser treats missing as all.

Client / org filter

getClientFilter: SUPER_ADMIN → empty; ADMIN or USER with dbRoleNames → empty (RLS will filter); ADMIN without RLS roles → AND "organizationId" = org if the column exists; USER without roles → org AND or AND 1=0 (block). That last clause is fail-closed at SQL level when RLS roles were never attached.

Frontend filter context

Live DashboardFiltersContext is per dashboard page id, persisted as dashboardFiltersState_v2, default years/months empty, currencyFormat default lakhs. Architecture 06 simplified this to one global months/years/currency. Speak the live per-page key.

Custom dashboards

Card layout (chart|text|image, x/y/width/height) is stored in localStorage dashboardState on the client. Predefined dashboards always hit Nest. KPI GETs do not call the LLM — that is how sub-210 ms stays a resume sentence.

Admin-style system counts are a separate module: GET /overview (OverviewController), not /dashboards/overview.

I. Report builder algorithms (joins, canvas, save JSON)

Frontend module modules/reportBuilder/. Phases from architecture-docs 04, matched to live APIs:

1. Data source. Utilitybar step 1 → GET /queryDB/tables (RLS-visible names only).
2. Joins and columns. INNER/LEFT/RIGHT/FULL → GET /queryDB/tables/:table/columns-with-types.
3. Fetch. Single table → GET .../data; with join → POST /queryDB/execute-query with selectedColumns map, joinType, joinCondition, optional dates, limit.
4. Chart building. react-dnd draggable columns onto ChartDropZone (x/y). ElementRenderer uses Chart.js (Bar/Line/Pie/Doughnut). Pivot bits also import Recharts. Both libraries are in package.json.
5. Canvas. Canvas.tsx + react-rnd, 15px grid snap, PageManager for multi-page, PowerBICustomizationPanel for titles/axes/colors.
6. Slicers. fields → distinct values → POST /queryDB/dataset/:table/query → setFilteredData to every element. Reset clears filters and remounts.
7. Save. POST /reports with name + JSON (pages, elements, canvasSize). ReportsService.createReport stores JSONB, createdBy = userId, soft-delete flag.
8. Load. GET /reports, GET /reports/:id (UUID guid).
9. Export. Client-side html2canvas + jsPDF in ExportModal — not a Nest PDF service.

Chatbot charts reuse the same ElementRenderer with isChatbotChart=true. Architecture 05 lists a normalizeChartType() map (stackedcolumn → stackedColumn, donut → hollowPie, unknown → bar).

J. Tally ingest

Files: fileUpload.controller.ts, fileUpload.service.ts, file-validation.util.ts, DTO tally-upload.dto.ts. Route POST /file-upload/tally (JWT + RLS apply — not in the exclude list).

1. Multer memoryStorage; max 2 files; 200MB each; extension .zip; MIME zip / x-zip-compressed / octet-stream.
2. Magic-byte check PK (0x50 0x4b …) plus AdmZip parse so a renamed PDF does not pass.
3. sanitizeFilename then S3 key tally-uploads/{timestamp}-{name} via @aws-sdk/lib-storage Upload (multipart for large buffers). Region default ap-south-1 from env.
4. Build gateway JSON: client_id, uploaded_by, software_type tally, period_in_years, single_tally, zip_files.current_year / previous_year S3 URIs, credential blocks, inventory flags. Do not recite passwords from DTOs or examples.
5. POST TALLY_GATEWAY_URL with header x-api-key, 30s timeout.
6. Response: step1 S3 success, step2 gateway instanceId.

This is ingest, not dashboard SQL. Tally Gateway is an external processor; Nest does not unpack the ledger into Postgres itself in this module.

K. Admin RBAC graph (18 Sequelize models)

backend-docs chapter 2: “18 Sequelize models.” Live src/models/ has 18 files. base.model.ts is an abstract timestamps/soft-delete mixin (createdBy, updatedBy, deletedBy, deletedAt, isDeleted). user-without-base.model.ts is a variant. Mapped tables in the ER:

Resolution chain: User → UserRole → Role.db_role_name (SET ROLE) → RolePolicy → Policy.allowedModules → ModuleRegistry.tables. Policy.policyRole is what pg_policies.roles overlaps in getAllowedTables.

Three JWT tiers plus GUEST: SUPER_ADMIN / ADMIN / USER / GUEST. Hierarchy ops (user-hierarchy) use client_id: SUPER_ADMIN creates ADMINs; ADMIN manages USERs. Feature flags are a second axis: SUPER_ADMIN always true in the React context; everyone else must have userFeatures.some(f.route === route).

Live admin HTTP prefixes (latex often wrote /roles, /policies, /features — live controllers differ):

• /role-management
• /policy
• /feature-management (GET features, GET users, PUT user-feature, POST bulk-update/:userId, GET user-features/:userId, PUT organization-feature)
• /organizations
• /module-registry
• /user-hierarchy
• /dashboard/admin/* on the SPA

L. Frontend routing and feature flags

App.tsx wraps the tree: ChatProvider → FeatureAccessProvider → DashboardFiltersProvider.

ProtectedRoute waits for feature loading, then hasFeatureAccess(route) or redirects to /dashboard. Feature fetch: GET /feature-management/user-features/:userId, 30s debounce, 2-minute interval, refreshFeatures custom event after login.

Axios instance timeout 10s, attaches Bearer from localStorage, 401 clears token/guid/role and sends the browser to /login. Chat send uses raw fetch to /queryDB/chat-query with the stored token (already may include the Bearer prefix).

M. Deployment

Backend Dockerfile (backend-docs ch7 = live file)

1. FROM node:18.18.2-alpine3.18
2. ENV NODE_ENV=production
3. apk add curl (health)
4. COPY package*.json first (layer cache)
5. global @nestjs/cli, npm install --force
6. COPY source, npm run build
7. EXPOSE 5000, USER node, CMD node dist/main

Comment in Dockerfile: env comes from the task definition, not a baked .env.

Compose

docker-compose.yml one service, maps 5000:5000, interpolates POSTGRES_*, JWT_*, SMTP_*, FRONTEND_*, ORGANISATION_EMAIL from the host env file. Local Postgres is not in this compose file.

Frontend image

Multi-stage: node:20-alpine npm ci --force + Vite build → nginx:stable-alpine serves /usr/share/nginx/html, wget health on :80. Docs claim ~30–40MB vs a Node image.

AI image

python:3.12-slim, pip from requirements.txt, HEALTHCHECK curl :80/health, gunicorn main:app --workers 8 --worker-class uvicorn.workers.UvicornWorker --bind 0.0.0.0:80 --timeout 180.

GitHub Actions vs older CodeBuild diagram

Conflict, show it. backend-docs chapter 1 and 7 still draw “push development → AWS CodeBuild → Docker → backend.projas.in”. Live workflows:

• convbi-prod.yml: push main, environment production, region ap-south-1, ECR repo convbi-backend, cluster convbi-cluster, service convbi-backend-service, build+push sha and latest, render task def, manual approval (approver listed in the workflow; 3 minute timeout), then ECS deploy with wait-for-service-stability.
• convbi-qa.yml: push qa, tag qa, same cluster/service names, no approval step.

Resume serving path remains CloudFront / ALB / ECS / Docker / Route 53. I do not invent EKS as what I operated.

ECS task (structure only — no secrets)

• family convbi-backend, Fargate, cpu 1024, memory 3072, X86_64 Linux, awsvpc.
• container port 5000, awslogs group /ecs/convbi-backend.
• health: curl -f http://localhost:5000/health, interval 30s, timeout 5s, retries 3.
• POSTGRES_PASSWORD from Secrets Manager (valueFrom ARN — do not paste). Other env names match the compose list: JWT expiry 1h / 7d, SMTP, FRONTEND_HOST, ORGANISATION_EMAIL, NODE_ENV.

Pool max 20

sequelize.module.ts pool max 20, min 0, acquire 30000, idle 10000. Docs warn: each authenticated request holds an open transaction until finish, so concurrent HTTP ≈ concurrent connections. Postgres max_connections must exceed tasks × 20. Scale by ECS desired count, not by sharding this intern system.

N. Observability — logging interceptor, Terminus, no Datadog

There is no Datadog/New Relic client in Nest package.json. What exists:

• LoggingInterceptor: inbound method/URL/user email/IP; outbound status + duration ms; debug body with password/token/secret/apiKey/authorization redacted to ***REDACTED***.
• CustomLogger: sql() with timing, slow-query warning path in the logging guide (>1s), transaction/performance helpers.
• Sequelize benchmark: true; SQL echo when SQL_LOGGING=true or NODE_ENV=development.
• AllExceptionsFilter: JSON { statusCode, timestamp, path, method, message }.
• Terminus: GET /health and /healthcheck ping Sequelize as postgresDB; GET /health/simple returns ok + timestamp without a DB ping (useful if the DB is the outage).
• ECS awslogs driver to CloudWatch. QueryDB logs chatbot HTTP status and SQL duration. I do not invent a p95 SLO document.

O. Security slice

• Passwords: bcrypt 10 rounds. argon2 is in package.json; live hash/compare is bcrypt — listed ≠ shipped for passwords.
• JWT two secrets. Refresh endpoint is public; possession of the refresh token is the credential.
• ValidationPipe whitelist + forbidNonWhitelisted.
• CORS credentials true; production should set CORS_ORIGIN (default * is a class, not a boast).
• Container USER node; AI/FE healthchecks; S3 ZIP magic bytes.
• RLS fail-closed rls_no_access. Chat CRUD RESET ROLE so persistence is not blocked when the fact-table role has no chat grants — data questions still go through chat-query + RLS.
• applicationTables vs fact tables: QueryDB hides org/user/role tables from the public table list.
• Sequelize synchronize: true is a schema-sync class in this snapshot; flyway_schema_history is excluded from table listing. Do not claim a perfect migration story.
• InstaRecon if they open GitHub: awareness demo, consent, no attack steps, then return to Ylogx.

P. One-request walks

Q. Failure classes

Classes, not invented tickets. Companion: chapter 15.

1. Legal JOIN, wrong org. App-only WHERE is not enough; SET ROLE + RLS must deny the other tenant’s rows.
2. LLM on a KPI GET. Breaks sub-210 ms; dashboards must stay deterministic REST.
3. Cache identity. This Nest snapshot caches dataset fields in a process Map keyed by table name, not by role — a class. Resume Redis −35% is role-scoped cache-aside on the bot path; do not say Nest ioredis exists here.
4. Pool leftover SET ROLE. Commit without RESET; next borrower on the same connection.
5. Admin with no SYSTEM db_role_name. Old path RESET ROLE leaked; live path rls_no_access.
6. Chat persistence vs facts. executeWithoutRLS is required for chat tables; using it for sales would skip RLS — never.
7. SELECT-prefix only. Raw SQL guard is not a parser.
8. QA vs prod CI. qa branch auto-deploys; main waits for approval. A tag is not a three-tier fixture.
9. Health vs simple health. /health dies if Postgres dies; /health/simple can still 200.
10. Cookie notes vs Bearer live. Speaking HTTP-only cookies as shipped in this snapshot is a mismatch.
11. CloudFront 403 vs ALB 502 vs origin 5xx vs RLS empty. Different hops.
12. synchronize: true plus Flyway history table — schema ownership class.

R. Honest 10×

S. Deep questions with spoken answers

Labels: IE-asked means another candidate’s loop reported a similar probe. Resume-derived is from the Aug 2026 resume plus this repo. Standard CS is CS you should still be able to say. Other candidates; not a Job 10454435 forecast.

T. Keep-straight metric lanes

Education: CUSAT CSE 8.42; IEDC Tech Team; 8 hackathons (CodeRecet 1st, MLH Best Project, Magnathon 2.0 runner-up). No invented missed ERC, missed 99.9%, manager fight, mentee count, AWS bill, Qdrant, p95, cache TTL as a resume number, student headcount.

Companions: 15 Ylogx live path, 14 why-stack, 09 projects, 20 stack defense, Round 4 projects, Answer-BIBLE.md, Question-Research-BIBLE.md, R3-R4-Answer-Bible.md.