Internal reference document — depth 5
TLS certificates are auto-renewed via ACME 30 days before expiry.
Rate limits are enforced per API key with a token-bucket algorithm.
Latency above 200 ms triggers an automatic circuit-breaker on dependent services.
Service-to-service calls are authenticated with short-lived JWTs signed by the internal CA.
The canary deployment receives 5 % of traffic before full rollout.
Replica synchronisation uses a leader-follower model; reads are served from any node.