arch-review

Follow a five-step flow: understand business context, verify architecture diagrams, check each quality attribute against checklists, identify and rate risks from P0 to P3, then output a review report with scores, risk list, and improvement roadmap.

Cover seven attributes: scalability, high availability, maintainability, observability, security, cost, and compliance. Each has a checklist with pass criteria and risk signals, such as stateless services for scalability and circuit breakers for availability.

Use Little's Law (L = λ × W) to estimate concurrency, then divide target QPS times average request latency by per-instance concurrency times target utilization (70%). Validate the estimate with load testing to find the actual inflection point.

Draw a data flow diagram, mark trust boundaries, then apply the six STRIDE threat categories (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) to each component. Rate risks by impact times likelihood and define mitigations.

Use canary releases to gradually shift traffic (1%, 10%, 50%, 100%) with monitoring at each stage to reduce release risk. Use blue-green when you can afford double resources and need instant rollback by switching traffic between environments.

Checklists catch common risk patterns but cannot replace domain-specific judgment or validate actual runtime behavior. Combine reviews with load testing, chaos testing, and production monitoring to confirm architectural assumptions.