Module 6: Production Mastery#

Overview#

This module is the closest thing this course has to a code review. Every lesson is grounded in what's actually in backend/app/ — including the topics where the honest answer is "not implemented." You'll get a ranked, source-grounded security audit, three concrete verified performance costs (not generic advice), and a real testing strategy for a codebase that currently has zero tests.

What You'll Learn#

• The ToolCall/AgentRun/WorkflowRun observability model and exactly where its coverage gaps are
• The repeated try/log/re-raise exception pattern, and the one endpoint that breaks it on purpose
• How you'd test each layer of this codebase, starting from the cheapest, highest-value tests
• Three real performance costs found by reading the source: sequential embedding calls, Python-side aggregation, missing indexes
• A ranked security audit: no auth, no CORS, no rate limiting — and what's not actually a risk here (SQL injection)
• Every real os.getenv call in the codebase, and what's hardcoded instead

Prerequisites#

• Module 4: API & Business Logic and Module 5: Advanced AI Engineering — this module audits the code both of those modules cover

Lessons in This Module#

Learning Outcomes#

By the end of this module you can:

• Explain why the dashboard endpoint's cost total systematically undercounts real spend
• Rewrite the dashboard's Python-side aggregation as a single grouped SQL query
• Rank this backend's top three security gaps by actual severity, not by checklist order
• Name all three real environment variables this backend reads, and the two hardcoded values that should be one

Start Module → Back to Module 5