B3 (containerize) — cheapest, immediately makes the existing capstone
demoable and deployable.
A4 (test/fuzz retrofit) — pays down risk before adding more surface area.
A1 (Postgres persistence + bcrypt) — closes the most embarrassing gap
(no DB, no password hashing) with the smallest new-concept load.
B1 (Kubernetes operator) — the single highest-leverage project for the
"infra tooling" domain; reuses the config-reload logic already built.
A3 (distributed rate limiter) — directly resolves the curriculum's own
ADR-003, and introduces Redis + real Prometheus in one project.
A2 (gRPC + OpenTelemetry) — closes the RPC and tracing gaps together.
B2 (edgectl CLI) — lower effort, high resume/portfolio value once
there's a real admin API (from A2/B1) to point it at.
C1 (WAF performance pass) — cheap, uses existing code, teaches the
profiling discipline needed before attempting C2.
C2 or C3 (low-latency capstone) — pick based on target sub-domain
(trading vs. gaming); this is the deepest, most specialized addition and
should come last.
