well-architected

# Well-Architected — 6 pillars to verify before shipping Every ARCH document for non-nano work must answer the 6 pillar questions below. Skipping a pillar is allowed only if explicitly justified (e.g. "Sustainability: N/A — backend-only, runs in shared infra."). This is adapted from AWS Well-Architected (lens: small-team SaaS / LLM applications), trimmed to questions that matter at <10 engineer scale. ## Pillar 1 — Operational excellence ### Questions 1. **Observability:** What metrics, logs, traces do we emit? How do we tell from a dashboard if this is working in prod? 2. **Deployability:** How do we ship a change? CI gates? Rollback path? 3. **Runbooks:** When this breaks at 3am, what does on-call read? ### Pass criteria - ✅ One metric per business outcome (e.g. webhook-deliveries-acked) - ✅ One log line per request, with request-id correlatable across services - ✅ Deploy path is documented and tested (rollback dry-run executed) - ✅ Runbook covers top-3 failure modes from pre-mortem ### Common fail ❌ "We'll add monitoring later." Monitoring is part of the feature. ## Pillar 2 — Security ### Questions 1. **Trust boundaries:** Where does untrusted data enter? How is it validated/sanitized? 2. **Authn / authz:** Who can call this? Who can read/write the data? 3. **Secrets:** Where are API keys, DB passwords, JWT signing keys stored? 4. **Data classification:** PII? PHI? PCI cardholder data? What's the retention policy? ### Pass criteria - ✅ Every externa...