Cascading Failure Prevention Review Prompt

Complete system design document describing all services, data stores, message queues, and their interactions

Architecture Decision Record v2.3 including service topology diagram and data flow descriptions

Schema check: must contain service names, dependency directions, and communication protocols. Reject if only high-level diagrams without textual descriptions

Machine-readable representation of service dependencies with direction, protocol, and criticality metadata

{"service-a": {"depends_on": ["service-b", "cache-c"], "protocol": "gRPC", "criticality": "high"}}

Parse check: valid JSON with required keys 'depends_on', 'protocol', 'criticality'. Reject if missing transitive dependencies or contains circular references without explicit annotation

Configuration parameters for all retry mechanisms across service boundaries including max attempts, backoff strategy, and timeout windows

Service A to Service B: max_retries=3, backoff=exponential, initial=100ms, max=2s, jitter=true

Schema check: each entry must specify source, target, max_retries, backoff strategy, and timeout. Flag missing jitter configuration as high-risk. Reject if retry budgets exceed downstream capacity

Circuit breaker settings for all protected service calls including failure thresholds, timeout windows, and half-open state behavior

Service B circuit breaker: failure_threshold=5, success_threshold=2, timeout=30s, half_open_max_requests=1

Parse check: each entry must include failure_threshold, timeout, and half-open configuration. Flag configurations where timeout exceeds upstream deadline. Reject if circuit breaker is absent for any dependency marked critical

Liveness and readiness probe configurations for all services including check depth, dependency ordering, and timeout values

Service C readiness probe: HTTP GET /health/ready, checks DB+Cache, timeout=5s, interval=10s, failure_threshold=3

Schema check: each probe must specify check type, dependencies verified, timeout, and failure threshold. Flag probes that don't verify all critical dependencies. Reject if startup probes missing for services with slow initialization

Load shedding rules and priority tiers for all API gateways and service entry points

Gateway tier definitions: critical=payment-auth, high=user-profile, normal=search, low=analytics. Shed at 80% capacity

Parse check: must define priority tiers and shedding thresholds. Flag missing critical path identification. Reject if no differentiation between read and write operations in shedding rules

End-to-end timeout allocations across service call chains including per-hop deadlines and total request budgets

User request budget: 2000ms. Hop allocations: Gateway=100ms, ServiceA=500ms, ServiceB=800ms, ServiceC=400ms

Schema check: must specify total budget and per-hop allocations. Flag mismatches where downstream timeout exceeds upstream deadline. Reject if any hop has no explicit timeout

Resource isolation configuration including thread pools, connection pools, and deployment unit partitioning

Service B bulkheads: thread_pool_primary=50, thread_pool_secondary=20, db_connections=30, cache_connections=20

Parse check: each service must define resource pools and limits. Flag shared pools across critical and non-critical paths. Reject if any critical service lacks resource isolation from noisy neighbors

JSON Object (nodes, edges)

Must parse as valid JSON. Nodes array must contain at least one entry. Edges must reference valid node IDs.

string

Non-empty, unique within the nodes array. Must match the regex ^[a-zA-Z0-9_-]+$.

string

Non-empty. Should match a service or datastore name from the provided [SYSTEM_ARCHITECTURE_CONTEXT].

string

Must match an existing node.id. Represents the calling or dependent component.

string

Must match an existing node.id. Represents the component being called or depended upon.

Array of Objects

If empty, the array must be present but empty. Each object must contain a 'component_id' and 'rationale' field.

Array of Objects

If empty, the array must be present but empty. Each object must contain 'loop_description' and 'trigger_condition' fields.

Object

Must contain a 'risk_level' field with one of the allowed enum values: ['low', 'medium', 'high', 'critical']. Must contain a 'vulnerable_paths' array.

string (enum)

Must be one of: 'low', 'medium', 'high', 'critical'. If 'critical', the 'vulnerable_paths' array must not be empty.

Object

Must contain a 'risk_level' field with one of the allowed enum values: ['low', 'medium', 'high', 'critical']. Must contain an 'affected_resources' array.

Array of Objects

Must contain at least one recommendation. Each object must have a 'priority' field (integer 1-5) and a 'recommendation' field (non-empty string).

integer

Must be an integer between 1 and 10, inclusive. Represents the aggregate system fragility score.

Output identifies all direct and transitive dependencies listed in [SYSTEM_ARCHITECTURE_DOC]. No dependency present in the input is omitted from the graph.

A known dependency from the input document is missing from the generated dependency graph or risk analysis.

Diff the set of components in the input doc against the set of nodes in the output graph. Flag any missing nodes.

Every component with a fan-out of 1 and no redundancy annotation is flagged as a SPOF. No false positives on components with documented redundancy.

A SPOF is not flagged, or a component with an active-active pair is incorrectly marked as a SPOF.

Inject a test architecture with one known SPOF and one known redundant pair. Check for exact match on SPOF list.

Output flags any cycle in the call graph where a downstream service retries to an upstream caller, creating a potential amplification loop.

A known retry cycle (A calls B, B retries to A) is not reported in the amplification loops section.

Provide a call graph with a documented retry cycle. Assert the cycle appears in the output's amplification loop list.

Output identifies any component that fans-in from 3+ upstream callers with synchronized retry or cron-based triggers.

A component with 5 upstream cron-triggered callers is not flagged as a thundering herd risk.

Inject a component with a high fan-in and synchronized trigger description. Verify it appears in the thundering herd section.

Each mitigation recommendation references a concrete pattern (e.g., circuit breaker, jitter, shuffle sharding) and the specific component it applies to.

A mitigation says 'add resilience' without naming a pattern or target component.

Parse the mitigation list. Assert each entry has a non-empty pattern field and a non-empty target component field.

Output ranks risks by blast radius, where a dependency failure affecting 5+ downstream components is ranked Critical or High.

A dependency with 8 downstream consumers is ranked Low or Medium without justification.

Provide a dependency with a known high blast radius. Assert its risk ranking is Critical or High in the output.

Output is valid JSON matching the [OUTPUT_SCHEMA] with all required fields present and no extra top-level keys.

Output is missing the 'amplification_loops' array or contains an unexpected 'summary' key at the top level.

Validate the raw output against the expected JSON Schema. Reject on any schema violation.

Every risk claim includes a reference to a specific component or connection from the input [SYSTEM_ARCHITECTURE_DOC]. No hallucinated component names.

Output warns about a failure in 'payment-service' but no such component exists in the input document.

Extract all component names from the output. Assert each is a substring or exact match of a component in the input document.