Enterprise

Frontend:
- Next.js 14+ (Turborepo monorepo)
- TypeScript
- Tailwind CSS
- TanStack Query
- Zustand
- Sentry Browser SDK (@sentry/nextjs) — Error tracking + Session Replay

Backend:
- Python FastAPI (microservices) — default
- PostgreSQL (schema separation)
- Redis (cache, Pub/Sub)
- RabbitMQ / SQS (message queue)
- Sentry Server SDK (sentry-sdk[fastapi]) — Error tracking + APM

Infrastructure:
- AWS (EKS, RDS, S3, CloudFront)
- Kubernetes (Kustomize)
- Terraform (IaC)
- ArgoCD (GitOps)
- ALB + NGINX Ingress Controller (L7 load balancing)
  - CORS: Ingress annotation으로 처리
    nginx.ingress.kubernetes.io/enable-cors: "true"
  - NLB(L4)는 gRPC/WebSocket 전용 서비스에만 사용

CI/CD:
- GitHub Actions
- Docker
- Semgrep (SAST) + Trivy (Container Scan)

Monitoring & Error Tracking:
- Sentry — Error tracking, grouping, regression detection
- Prometheus + Grafana — Metrics & dashboards
- Loki + Promtail — Log aggregation
- Tempo + OpenTelemetry — Distributed tracing
- Alertmanager → PagerDuty (critical) / Slack (warning)

Self-Healing Pipeline:
- Sentry Webhook → Self-Healing Agent trigger
- 4-Layer Living Context (Scenarios, Invariants, Impact, Incidents)
- Auto-fix (max 5 iterations) → Auto PR → Canary Deploy
- Auto-Rollback on error rate spike

project/
├── apps/                        # Frontend apps (Turborepo)
│   ├── web/                    # Main web app
│   ├── admin/                  # Admin
│   └── docs/                   # Documentation site
│
├── packages/                    # Shared packages
│   ├── ui/                     # UI components
│   ├── api-client/             # API client
│   └── config/                 # Shared config
│
├── services/                    # Backend microservices
│   ├── auth/                   # Auth service
│   ├── user/                   # User service
│   ├── {domain}/               # Domain-specific services
│   └── shared/                 # Shared modules
│
├── infra/                       # Infrastructure code
│   ├── terraform/
│   │   ├── modules/            # Reusable modules
│   │   └── environments/       # Environment-specific config
│   └── k8s/
│       ├── base/               # Common manifests
│       └── overlays/           # Environment-specific patches
│
├── docs/                        # PDCA documents
│   ├── 00-requirement/
│   ├── 01-development/         # Design documents (multiple)
│   ├── 02-scenario/
│   ├── 03-refactoring/
│   └── 04-operation/
│
├── scripts/                     # Utility scripts
├── .github/workflows/           # CI/CD
├── docker-compose.yml
├── turbo.json
└── pnpm-workspace.yaml

┌─────────────────────────────────────────────────────────┐
│                    API Layer                             │
│  - FastAPI routers                                       │
│  - Request/Response DTOs                                 │
│  - Auth/authz middleware                                 │
├─────────────────────────────────────────────────────────┤
│                  Application Layer                       │
│  - Service classes                                       │
│  - Use Case implementation                               │
│  - Transaction management                                │
├─────────────────────────────────────────────────────────┤
│                    Domain Layer                          │
│  - Entity classes (pure Python)                          │
│  - Repository interfaces (ABC)                           │
│  - Business rules                                        │
├─────────────────────────────────────────────────────────┤
│                 Infrastructure Layer                     │
│  - Repository implementations (SQLAlchemy)               │
│  - External API clients                                  │
│  - Cache, messaging                                      │
│  - Sentry SDK integration (error capture)                │
└─────────────────────────────────────────────────────────┘

Dependency direction: Top → Bottom
Domain Layer depends on nothing

Exception 발생 (Frontend/Backend)
  ↓
Sentry SDK 자동 캡처 (stack trace + breadcrumbs + user context)
  ↓
Sentry Alert Rule (new issue / regression / spike)
  ↓
Webhook → Self-Healing Agent trigger
  ↓
Living Context 4-Layer 로딩
  ├── Scenario Matrix: 테스트 시나리오
  ├── Invariants: 불변 조건 (critical = 수정 차단)
  ├── Impact Map: blast radius 계산
  └── Incident Memory: 과거 장애 교훈
  ↓
Claude Code Fix (max 5 iterations)
  ↓
4중 검증 (scenarios + invariants + impact + anti-patterns)
  ↓
Pass → Auto PR → Human Review → Canary Deploy (10%→25%→50%→100%)
Fail → Escalation → PagerDuty + Slack + Auto-Rollback
  ↓
Post-deploy: Sentry에서 issue resolved 확인 + error_rate 모니터링

ALB + NGINX Ingress Controller (기본, 권장)
─────────────────────────────────────
- L7 로드밸런싱 (HTTP/HTTPS/gRPC)
- CORS: Ingress annotation으로 처리 (앱 코드 불필요)
- Path-based routing (/api/auth/*, /api/users/*)
- AWS Certificate Manager (ACM) TLS 연동
- WAF 연동 가능

NLB (특수 케이스만)
─────────────────────────────────────
- L4 로드밸런싱 (TCP/UDP)
- 극도의 저지연 필요 시 (< 1ms)
- WebSocket/gRPC 전용 서비스
- CORS 처리 불가 → 앱단에서 직접 처리 필요

# domain/repositories/user_repository.py (interface)
from abc import ABC, abstractmethod

class UserRepository(ABC):
    @abstractmethod
    async def find_by_id(self, id: str) -> User | None:
        pass

    @abstractmethod
    async def save(self, user: User) -> User:
        pass

# infrastructure/repositories/user_repository_impl.py (implementation)
class UserRepositoryImpl(UserRepository):
    def __init__(self, db: AsyncSession):
        self.db = db

    async def find_by_id(self, id: str) -> User | None:
        result = await self.db.execute(
            select(UserModel).where(UserModel.id == id)
        )
        return result.scalar_one_or_none()

# Synchronous (Internal API)
async def get_user_info(user_id: str) -> dict:
    async with httpx.AsyncClient() as client:
        response = await client.get(
            f"{USER_SERVICE_URL}/internal/users/{user_id}",
            headers={"X-Internal-Token": INTERNAL_TOKEN}
        )
        return response.json()

# Asynchronous (message queue)
await message_queue.publish(
    topic="user.created",
    message={"user_id": user.id, "email": user.email}
)

# modules/eks/main.tf
resource "aws_eks_cluster" "this" {
  name     = "${var.environment}-${var.project_name}-eks"
  role_arn = aws_iam_role.cluster.arn
  version  = var.kubernetes_version

  vpc_config {
    subnet_ids = var.subnet_ids
  }

  tags = merge(var.tags, {
    Environment = var.environment
  })
}

# k8s/base/backend/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  replicas: 2
  template:
    spec:
      containers:
        - name: user-service
          image: ${ECR_REGISTRY}/user-service:${TAG}
          resources:
            requests:
              cpu: "100m"
              memory: "256Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          livenessProbe:
            httpGet:
              path: /health
              port: 8000

✅ Allowed
- Retrieve secrets from Secrets Manager
- IAM role-based access
- VPC internal communication
- mTLS (inter-service)

❌ Prohibited
- Hardcoded secrets
- DB in public subnet
- Using root account
- Excessive IAM permissions

Push to feature/*
    ↓
GitHub Actions (CI)
    - Lint
    - Test
    - Build Docker image
    - Push to ECR
    ↓
PR to staging
    ↓
ArgoCD Auto Sync (Staging)
    ↓
PR to main
    ↓
ArgoCD Manual Sync (Production)

1st Priority: Codebase
  - scripts/init-db.sql (source of truth for DB schema)
  - services/{service}/app/ (each service implementation)

2nd Priority: CLAUDE.md / Convention docs
  - services/CLAUDE.md
  - frontend/CLAUDE.md
  - infra/CLAUDE.md

3rd Priority: docs/ design documents
  - For understanding design intent
  - If different from code, code is correct