Quick Reference: Definitions & Frameworks

Lecture 1: Mindset & Failure

Term	Definition
Brooks’s Law	Adding manpower to a late project makes it later. Communication paths $= \frac{n(n-1)}{2}$
80/20 Rule	~20% of lifetime cost is initial development; ~80% is maintenance and evolution
Technical Debt	Principal (cost to fix properly) + Interest (extra cost of future changes while debt remains unpaid). Quadrant = Reckless/Prudent × Deliberate/Inadvertent
Iron Triangle	Fast, Good, Cheap — pick two
Bit Rot	Software that is never changed becomes obsolete because its environment changes around it (libraries, APIs, security protocols)
Key case studies	Therac-25 (race condition, no hardware interlock), Mars Climate Orbiter (unit mismatch, no integration testing), London Ambulance Service (socio-technical, no phased rollout), Post Office Horizon (no audit trail, ignored engineers), Boeing 737 MAX (single point of failure, hidden complexity)

Lecture 2: Requirements

Term	Definition
FR	An action the system performs — a verb. “The system shall calculate VAT”
NFR	A quality constraint — an adjective/adverb. The “-ilities”: Scalability, Reliability, Maintainability, Portability, Usability
Elicitation methods	Interviews (scoping, but users describe solutions) vs Ethnography (reveals invisible workarounds)
MoSCoW	Must / Should / Could / Won’t have — structured prioritisation
UML relationships	Association (line), Inheritance (hollow triangle, “is-a”), Aggregation (hollow diamond, “has-a”, independent lifecycle), Composition (solid diamond, “has-a”, dependent lifecycle)
Boehm’s Cost Curve	Design $1\times$, Coding $5$–$10\times$, Testing $10\times$, Production $100\times+$ — the cost of fixing a defect rises exponentially by phase

Lecture 3: Process

Term	Definition
Waterfall phases	Requirements → Design → Implementation & Unit Testing → Integration & System Testing → Operation & Maintenance. Strictly sequential; no going back.
Spiral quadrants	Objectives → Risk Assessment → Development → Planning (repeat). Risk-driven.
Agile Manifesto	(1) Individuals/interactions over processes/tools. (2) Working software over documentation. (3) Customer collaboration over contract negotiation. (4) Responding to change over following a plan.
Scrum artifacts	Product Backlog (master to-do list), Sprint Backlog (this Sprint’s selected items), Increment (potentially releasable Done work)
Scrum events	Sprint (timebox, usually 2 weeks), Sprint Planning, Daily Scrum (15 min), Sprint Review, Sprint Retrospective
Scrum roles	Scrum Master (servant-leader, facilitates, removes blockers), Product Owner (owns backlog, prioritises by value), Developers (self-organising, own the “how”)
Kanban	Continuous flow, WIP limits per column, no fixed Sprints. Best for ops/maintenance with continuous incoming work.

Lecture 4: QA & Delivery

Term	Definition
Testing Pyramid	Unit (many, fast, isolated) → Integration (some, test boundaries) → E2E (few, slow, expensive). Moving up: cost ↑, speed ↓, isolation ↓, confidence ↑
Stub	Returns a hardcoded value. “The answer is always ‘success’.”
Mock	Records and verifies interactions. “Was charge() called exactly once with amount 100?”
Coverage	% of lines executed by tests. Does NOT measure correctness. The average([]) trap: 100% coverage, but crashes on empty input.
Mutation testing	Inject artificial bugs. Killed mutant = tests caught it (good). Survived mutant = tests missed it (bad). Computationally expensive; typically not run on every CI build.
TDD	Red (write failing test) → Green (minimal code to pass) → Refactor (clean up, tests stay green). 100% test coverage by construction.
CI	Merge to main at least daily. Every merge triggers automated build + full test suite. Fast feedback. Eliminates Merge Hell.
CD (Delivery)	Every green build auto-deploys to staging. A human decides when to push to production.
CDP (Deployment)	Fully automated: passing pipeline → auto-deploy to production. Relies on automated monitoring and rollback.
Blue-Green	Two identical environments. Switch all traffic from Blue (old) to Green (new) instantly. Instant rollback: switch back.
Canary	Deploy new version to a small % of users first; monitor; expand progressively. Better for high-risk changes (smaller blast radius). Not the same as A/B testing (business validation, not technical health).
Feature Flags	Decouple deployment (code on servers) from release (feature visible). Enables emergency shutoff without code rollback.
Error Budget	$= 100\% - \text{SLO}$. Exhausted budget → freeze all risky feature releases → redirect to reliability work.
DevOps	”You build it, you run it.” Merge Dev (rewarded for shipping change) and Ops (rewarded for stability) into one team.
Cloud models	IaaS (VMs, you manage OS) < PaaS (upload code, provider manages platform) < SaaS (full app, no management). Shared responsibility: provider secures the cloud; you secure your data/apps within it.
Containers vs VMs	Containers share the host OS kernel (light, boot in ms). VMs each run a full guest OS (heavy, boot in minutes). Docker containers; K8s orchestrates fleets of them.
K8s	Self-healing (restart failed containers), auto-scaling (add replicas under load), load balancing. Control Plane → Worker Nodes → Pods → Containers.

Lecture 5: Evolution

Term	Definition
Maintenance split	Perfective 50%, Adaptive 25%, Corrective 20%, Preventive 5%. Most maintenance is perfective — keeping the system relevant, not fixing bugs.
SemVer	MAJOR.MINOR.PATCH: breaking / new feature (backwards-compatible) / bug fix (backwards-compatible). ^ (caret) allows minor+patch; ~ (tilde) allows patch only.
Postel’s Law	Be conservative in what you send (strict to the spec), liberal in what you accept (ignore unrecognised fields — enables forward compatibility).
Hyrum’s Law	With enough users, every observable behaviour — including undocumented quirks and bugs — will be depended on by somebody.
Deprecation path	Announce → Deprecate (mark as @Deprecated, both old and new coexist) → Wait (6–12 months) → Remove (in a new MAJOR version).
Code smells	Long Method, God Object, Feature Envy, Data Clumps. Signals of decaying design, not bugs.
Characterisation test	Record current output; assert it stays identical after refactoring. Tests for consistency, not correctness. Used when no test suite and no understood specification exist.
Strangler Fig	Proxy/facade → build new service alongside legacy → route traffic incrementally → decommission legacy. Avoids Big Bang rewrite risk (Netscape).
SRE	Treat operations as a software problem. 50% toil rule. Focus on MTTR (recover fast) over MTBF (prevent failure). SLI (what you measure), SLO (the target), SLA (contractual promise to customers).
Golden Signals	Latency, Traffic, Errors, Saturation. Saturation is harder to measure than latency (requires knowing the true capacity ceiling).
Chaos Engineering	Steady state → Hypothesis → Experiment → Verify. Chaos Monkey (kills servers), Chaos Gorilla (kills availability zones), Chaos Kong (kills regions).
Supply chain	Transitive dependency (your dependency’s dependency). Left-Pad (11-line npm package deletion broke thousands of projects). Log4Shell (ubiquitous logging library vulnerability). SBOM (machine-readable component inventory). CVE (public vulnerability database).

Lecture 6: AI Era

Term	Definition
Building WITH AI	AI is a tool during development; the final product contains no AI logic (e.g. using Copilot to write a standard web app)
Building FOR AI	An LLM is a core runtime component of the product (e.g. an automated legal assistant that generates advice at runtime)
Reliability Paradox	Traditional code: $f(x) \to y$, deterministically. AI code: $f(x) \to y$, probabilistically. How do you build a reliable system on a non-deterministic foundation?
Ground truth	Code has a compiler and tests — an objective right/wrong oracle. Medicine and law do not. This is why AI coding advances faster than AI in subjective domains.
Generator/Verifier	A Generator model writes code; a separate Verifier model tries to find bugs. Adversarial pairing reduces hallucinations.
Reasoning Ceiling	LLMs lack: long-horizon strategic judgement, accountable ownership of consequences, tacit organisational context.
Jevons Paradox	Efficiency gains increase total consumption, not reduce it. Cheaper software → 100× more software demanded, not fewer engineers.

Security Appendix

Term	Definition
ACLs	Column-centric: each object lists which subjects may access it. Easy to audit “who can access this file?” Hard to answer “what can this user access?”
Capabilities	Row-centric: each subject holds unforgeable tokens per accessible object. Easy delegation; hard revocation.
STRIDE	Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
One-way flow	Confidentiality: information flows low → high. Integrity: information flows high → low.
Password auth	Secret transmitted over network (via TLS); familiar; easy recovery. Vulnerable to phishing and server-breach offline cracking.
Public-key auth	Challenge-response: no secret transmitted; phishing-resistant; no server-side credential database to steal. Harder key management and recovery. Ideal for cross-server signed-content verification in decentralised systems.