Starlight Engineering Review
Purpose
Find architectural failure modes while the design is still cheap to change.
When it fires
- A change crosses process, network, repository, runtime, database, or trust boundaries.
- It changes schemas, migrations, authentication, permissions, money, or irreversible state.
- Reliability, scale, or backward compatibility is material.
Inputs
- Architecture and data-flow diagrams or equivalent source evidence.
- State model, API/schema contracts, dependencies, and deployment topology.
- Expected load, failure history, privacy classification, and recovery objectives.
Workflow
- Map inputs, state, side effects, trust boundaries, and owners.
- Check invariants, validation, idempotency, atomicity, and concurrency behavior.
- Walk failures: timeout, retry, duplicate, partial success, stale state, quota, crash, and dependency drift.
- Review authentication, authorization, secret handling, data minimization, and abuse controls.
- Check compatibility, migrations, rollback, and version negotiation.
- Define observability and tests that falsify the design’s critical assumptions.
- Classify findings by severity and recommend blocking landing on unresolved critical risks. The review is advisory; any merge action requires explicit human approval.
Output contract
Return verdict, architecture summary, invariants, trust boundaries, failure table, compatibility/migration findings, resource analysis, required tests, rollback, and residual risks with owners.
Tools & MCP
Inspect actual source, schemas, dependency versions, CI, and deployment configuration. Prefer primary documentation for current protocols. Never paste secrets into the report.
Quality bar
- Every blocking finding cites a concrete boundary or contract.
- Distributed and serverless limitations are not hidden by in-process assumptions.
- Retries and rollbacks are safe, bounded, and testable.
- “Scalable” and “secure” are replaced by explicit mechanisms and limits.
Example
Input: “Expose a stateless MCP endpoint.”
Good output: review origin enforcement, content limits, version negotiation, request validation, rate-limit topology, serverless state limits, tool authority, cache behavior, and reproducible protocol fixtures.
Built on SIP — Starlight Intelligence Protocol
Vertical: starlight-agent-skills · portable capability layer
1---2name: starlight-eng-review3description: Stress-test a technical design across data integrity, trust boundaries, concurrency, failure recovery, compatibility, observability, and resource limits. Use before implementing or landing a change whose failure could corrupt state, expose data, break clients, or create operational toil.4---56# Starlight Engineering Review78## Purpose910Find architectural failure modes while the design is still cheap to change.1112## When it fires1314- A change crosses process, network, repository, runtime, database, or trust boundaries.15- It changes schemas, migrations, authentication, permissions, money, or irreversible state.16- Reliability, scale, or backward compatibility is material.1718## Inputs1920- Architecture and data-flow diagrams or equivalent source evidence.21- State model, API/schema contracts, dependencies, and deployment topology.22- Expected load, failure history, privacy classification, and recovery objectives.2324## Workflow25261. Map inputs, state, side effects, trust boundaries, and owners.272. Check invariants, validation, idempotency, atomicity, and concurrency behavior.283. Walk failures: timeout, retry, duplicate, partial success, stale state, quota, crash, and dependency drift.294. Review authentication, authorization, secret handling, data minimization, and abuse controls.305. Check compatibility, migrations, rollback, and version negotiation.316. Define observability and tests that falsify the design’s critical assumptions.327. Classify findings by severity and recommend blocking landing on unresolved critical risks. The review is advisory; any merge action requires explicit human approval.3334## Output contract3536Return verdict, architecture summary, invariants, trust boundaries, failure table, compatibility/migration findings, resource analysis, required tests, rollback, and residual risks with owners.3738## Tools & MCP3940Inspect actual source, schemas, dependency versions, CI, and deployment configuration. Prefer primary documentation for current protocols. Never paste secrets into the report.4142## Quality bar4344- Every blocking finding cites a concrete boundary or contract.45- Distributed and serverless limitations are not hidden by in-process assumptions.46- Retries and rollbacks are safe, bounded, and testable.47- “Scalable” and “secure” are replaced by explicit mechanisms and limits.4849## Example5051Input: “Expose a stateless MCP endpoint.”5253Good output: review origin enforcement, content limits, version negotiation, request validation, rate-limit topology, serverless state limits, tool authority, cache behavior, and reproducible protocol fixtures.5455---5657Built on SIP — Starlight Intelligence Protocol58Vertical: starlight-agent-skills · portable capability layer
frankxai