Test retry storms

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R03 — API resource & rate controls

   R25 — Container resource limits

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Add circuit breakers, retry jitter, queue backpressure limits, and per-tenant concurrency governors across P1–P3.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Simulate retry storms, queue flooding, recursive agent tool loops, and expensive top-k/reranking bursts.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Economic-abuse and circuit-breaker resilience test report.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R03OWASP API Security Top 10↗ owasp.org

  BOLA (API1), Broken Auth (API2), Unrestricted Resource Consumption (API4), SSRF (API7), Misconfiguration (API8).

• R25Docker Security Docs↗ docs.docker.com

  Daemon surface, Linux namespaces/capabilities, rootless/non-root containers, read-only FS, and secrets.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsDocker (official docs)
  Docker Engine security

  Covers namespaces, capabilities, and per-container CPU/memory limits plus rootless and read-only filesystem options — the resource ceiling that keeps a runaway tenant worker from starving the queue.

  R25checked 2026-11-11
• videoCodeLucky
  Retry Strategies: Exponential Backoff & Jitter Explained

  Derives the backoff formula and then shows why synchronized clients still produce a thundering herd, comparing full, equal, and decorrelated jitter for retry storms.

  R03checked 2026-11-11
• videoSystemDR - Scalable System Design
  Retry Logic Done Right: Exponential Backoff + Jitter

  Implements retry classification for 429/5xx, jitter, and circuit breakers in one pass, which is the code-level shape of the per-tenant governor and breaker you need.

  R03checked 2026-11-11
• articleBaeldung
  Better Retries with Exponential Backoff and Jitter

  Shows with measurements how backoff alone keeps retries in lockstep and how jitter decorrelates them, including the wait-interval formula to implement.

  R03unchecked 2026-11-11
• articleAWS Builder Center
  Timeouts, retries, and backoff with jitter

  First-party guidance on combining timeouts, capped exponential backoff, jitter, and retry budgets so retries stop amplifying overload — the backpressure budget for P1–P3.

  R03checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.