Real-world bridge projects

Consolidated from all three per-range reviews, de-duplicated, and sequenced. Each closes a specific gap above using code the curriculum already built — none of these ask you to start from zero.

Track A — Backend / distributed systems

A1. Persist the capstone's auth store to Postgres. Replace MemAPIKeyStore (Week 11) and the abuse-lockout counters with pgx + connection pooling + golang-migrate migrations; add bcrypt password hashing (closes the glaring gap in Week 11's CreateUserRequest); wrap lockout-counter writes in real transactions. Mirrors: Auth0/Okta-style credential store. Forces: the DB gap, transaction semantics, durability across restarts.

A2. gRPC-ify the stack with real tracing. Build 3 gRPC services (orders/inventory/payments or auth/waf-admin/threat-intel) with protobuf codegen, unary + streaming RPCs, and gRPC interceptors (the RPC analog of the HTTP middleware chain already mastered in Week 9). Export spans via the real OpenTelemetry SDK to Jaeger/Tempo — not the hand-rolled W3C trace-context ring buffer from Week 15. Forces: the total gRPC gap and real distributed tracing.

A3. Distributed rate limiter — close ADR-003 for real. Rebuild the Week 13 token bucket as a Redis-backed limiter using atomic Lua scripts (EVAL) and client-side consistent hashing across a small Redis cluster; back it with real client_golang Prometheus metrics and a Grafana dashboard instead of expvar. Mirrors: the exact gap the curriculum's own ADR-003 explicitly deferred. Forces: first real external-datastore integration plus the metrics stack a real SRE org expects.

A4. Test-and-fuzz retrofit. Convert the two best fuzz targets already built — the Week 9 hand-rolled HTTP/1.1 parser and the Week 8 binary KV protocol parser — into real _test.go table-driven tests plus go test -fuzz corpora, and wire a GitHub Actions pipeline (vet + -race + fuzz + bench) against the Week 8/12 gateways. Forces: closing the 81-day testing-culture gap.

Track B — Infra / DevOps tooling

B1. Kubernetes operator for the proxy's live config. Build a RateLimitPolicy or BackendPool CRD with client-go/ controller-runtime: a reconcile loop that replaces the SIGHUP/polling-file reload (Weeks 8, 12, 15) with real informers + workqueues, feeding live Pod endpoints into the Week 7 load balancer's backend list. Add leader election for HA. Mirrors: cert-manager, ingress-nginx, AWS Load Balancer Controller. Forces: the single largest gap in the entire curriculum — Kubernetes as producer, not just a source of analogies.

B2. edgectl — a Cobra/Viper control-plane CLI. Build a kubectl-style CLI (edgectl block <ip>, edgectl waf tail, edgectl threat top --format=json) talking to a small gRPC/REST admin API exposed by the capstone proxy, with shell completion and a goreleaser release pipeline. Forces: the CLI-tooling gap despite it being a named target niche.

B3. Containerize and ship. Multi-stage Dockerfile producing a distroless/scratch image of the Week 17 capstone binary, plus a GitHub Actions pipeline that builds, scans (trivy), and pushes it, and a minimal Helm chart wiring the liveness/readiness probes Week 15 already built into real Kubernetes manifests. Forces: the container/IaC gap; cheap to do, high payoff for "shippable" credibility.

Track C — High-performance / low-latency systems

C1. Make the WAF fast, and prove it. Add testing.B benchmarks for the Week 10 normalization pipeline and rule matcher; introduce sync.Pool for the per-request buffers it currently allocates; replace the sequential regex chain with a compiled Aho-Corasick multi-pattern scanner for single-pass detection; drive the before/after comparison with pprof + benchstat. Forces: the GC/allocation/profiling literacy the curriculum only gestures at, using code you already own.

C2. Nanosecond-budget matching engine. A separate, deliberately harder project: an in-memory limit-order-book matching engine (price-time priority) fed by a lock-free SPSC ring buffer, with GOMAXPROCS pinning, GOGC/GOMEMLIMIT tuning, zero-allocation hot path validated by testing.B + benchstat + escape analysis (-gcflags=-m), and p99.9 tail-latency tracking under load. Mirrors: a trading-system tick handler. Forces: the real nanosecond-to-low-microsecond discipline that Week 16's 100–500µs HTTP profiling doesn't reach.

C3. Authoritative UDP game server. Extend the Week 13 anti-amplification UDP work into a real bidirectional, tick-based (30–60Hz) protocol with client-side prediction, server reconciliation, and snapshot interpolation, enforcing a strict per-tick frame budget measured via pprof. Optionally orchestrate a fleet with Agones on Kubernetes, tying Track B and Track C together. Forces: real low-latency UDP protocol design under hard per-tick budgets.