Apex Coding AcademyExplore the curriculum
TIER 1 · PRODUCTION CAPSTONE

Authorized Automation Gateway

Ship a three-service automation gateway with runtime contracts, fair rate budgets, resumable checkpoints, an academy-owned Playwright fixture, and auditable outcomes.

Download starter bundle (.zip)Back to course

System architecture

  1. HTTP intake validates signed job envelopes and writes an idempotent operation record.
  2. A Redis-backed dispatcher applies per-tenant and per-host token buckets before execution.
  3. Typed API and browser adapters execute only allowlisted academy fixtures.
  4. PostgreSQL checkpoints support prepare, execute, verify, and commit recovery.
  5. Structured logs and metrics preserve correlation IDs while redacting credentials.

Acceptance requirements

  • Reject malformed, expired, duplicate, and unauthorized jobs before side effects.
  • Enforce global, tenant, and host concurrency with bounded queues and Retry-After responses.
  • Resume safely after an ambiguous upstream timeout without duplicating a write.
  • Automate the supplied portal using roles and labels with no hard-coded sleeps.
  • Expose health, readiness, queue depth, latency, and terminal outcome metrics.
  • Run locally from one command with pinned dependencies and healthy services.

Required failure drills

  • Return a timeout after the mock API commits; reconciliation must detect the existing record.
  • Exhaust one tenant budget; other tenants must continue within their own budgets.
  • Change a fixture selector; the job must fail with bounded artifacts and no retry storm.
  • Restart the worker after execute and before verify; the checkpoint must resume exactly once.

Submission deliverables

  • Runnable gateway, worker, mock services, and academy portal fixture
  • Unit, contract, integration, and browser tests with deterministic seeds
  • Docker Compose stack, environment schema, and locked dependency graph
  • Architecture decision record, threat boundary, dashboard, and recovery runbook
  • Recorded failure-drill evidence keyed by operation ID

Automated verification

$ npm ci$ npm test$ docker compose up --build --wait$ npm run test:integration$ npm run test:browser

100-point professional rubric

End-to-end correctnessAll contract and browser acceptance cases pass.25 pts
Idempotency and recoveryAmbiguous writes and restarts produce one committed effect.25 pts
Admission and fairnessLoad test proves bounded queues and tenant isolation.20 pts
Security and authorizationAllowlist, signature, redaction, and secret tests pass.15 pts
Operations evidenceMetrics, traces, drill evidence, and rollback are reproducible.15 pts

Starter repository contents

DockerfileOPERATIONS.mddocker-compose.ymlpackage.jsonsrc/contracts.mjssrc/orchestrator.mjssrc/server.mjssrc/token-bucket.mjstest/orchestrator.test.mjs