Engineering

Google Cloud's own migration guidance states the constraint every cut-over plan has to accept: genuinely zero downtime is impossible. This guide works through the decision a legacy data migration actually turns on, big bang against outbox-based trickle against log-based change data capture, why a dual write without a transactional outbox can silently diverge two databases, reconciliation tiered from row counts to field-level checks and the rehearsal and rollback discipline AWS's own cutover guidance describes.

An IFC file can validate against the schema and still disagree with the last one about which storey a wall belongs to. This guide works through the decisions a construction platform makes when it ingests IFC: which encoding to accept, what identity is keyed on, how the spatial tree is discovered, where properties and quantities really live, how uploads are validated and how models are placed against each other.

What an MVNO or a connectivity platform has to build to move a profile from an SM-DP+ into a subscriber's eUICC: the consumer architecture and the components that own each step, an activation code whose positional fields fail quietly, two client paths that decompose that code differently and the authorization each platform demands before your app may download anything. With the failure we expect named at every step.

What a fitness platform has to build to accept device uploads and hand them back: a decoder that reads definition messages before data, a timestamp path that knows the FIT epoch from a relative value, an integrity check the specification owner makes the case for skipping on activity files, an identity key that survives a re-upload and an export path that is honest about what TCX and GPX drop.

A HACCP plan is not a document a platform stores. Treated as a data model it becomes a set of entities: hazards joined to process steps with their reasoning, critical limits that carry a version history, monitoring records naming a person and a device, corrective action as a workflow with states, verification events that point at the records they reviewed and retention expressed as a rule with a named party rather than a number.

What a first-party platform has to get right when it reads an IAB TCF TC String: three version counters that are not the same number, purpose bitfields indexed from zero while purposes are numbered from one, a vendor list that must be pinned to the version the string names rather than to the newest one, an event-driven read path on web and in app and a consent log that keeps the string itself.

The four decisions that decide whether an OPC UA integration holds: a published companion specification or a custom nodeset; a decoder that reads structures instead of storing opaque bytes; subscriptions and queues sized against a server that revises what you ask for; certificates and roles that are administered rather than coded. Around them the northbound leg, the historian mapping and the gateway question.

Computational pipeline monitoring read as a software specification: the definition 49 CFR 195.2 gives it, the design rule at 195.134 and the operating rule at 195.444 that bind an operator to API RP 1130, the seven method families of section 4.1.2 with the data each one demands in engineering practice, plus the sensitivity against false alarms trade that no numerical performance standard in the regulation settles for you.

What a crew rostering engine has to compute under EASA Subpart FTL: the acclimatization state it derives before any table can be read, the maximum flight duty period looked up in reference time, the cumulative duty limits held as rolling windows beside a calendar-year flight time total and standby, reserve and rest on their own counters. Around them, the duties and rest data model, recomputation on disruption and the audit trail every verdict needs.

The platform half of an LTI Advantage integration, which the tool-side tutorials never cover: the identifiers a learning platform mints, the login it issues, the token it signs, the key set it publishes and the gradebook and roster endpoints it exposes. With the service table, the migration claim that keeps existing records attached and why the Complete certification level is required for platforms.

The two halves of an ISOXML integration that no standard hands you: the mapping between a task data set and a platform's own model, and the validation that stops a bad export before it reaches a cab. Around them, the two transfer directions, where Part 10 and Part 11 sit, the dictionary lookup behind every logged value, what a task controller functionality actually warrants and the import failures the AEF names.

CAMARA Location Verification answers TRUE, FALSE or PARTIAL rather than a plain boolean, and a SIM Swap null can mean the operator would not disclose a date rather than no swap occurred. This guide works through the four CAMARA network APIs a product team actually integrates, the identity and consent layer behind all of them and the error model that treats its own published codes as incomplete by design.

In a CBAM annual declaration the certificate count is the embedded emissions after the carbon-price reduction and the free-allocation adjustment, and every other element of the filing is stated here as a data model with its article, its data source and its validation check.

The two parts of an OpenADR integration that sit outside the certified VTN to VEN interface: how each OpenADR 3 event interval becomes an OCPP 2.0.1 SetChargingProfile, with a capacity ceiling and a per-transaction schedule stacked on one station, and what the platform does when the VTN stops answering. Around them, the VTN and VEN roles, registration and OAuth, reporting, 2.0b coexistence and certification as a process.

Lloyd's mandates the data set and the Delegated Data Manager is listed as an elective LIMOSS service. A procedural guide to bordereaux reporting for coverholders and MGAs: the risk, premium and claims bordereaux and who produces and receives them, the Coverholder Reporting Standards field set stated by version, then the pipeline from extraction through mapping, validation, exception handling and cadence to delivery and the audit trail.

A build guide to Regulation (EU) 2023/988 for marketplace platforms: the four listing information blocks and the conditional responsible-person rule as seller-onboarding validation, the two contact points, the clocks on authority orders and notices with their working-day outer bounds, Safety Gate ingest, the recall-notice pipeline with the seven elements Article 36(2) lists, some of them conditional and an evidence log derived from the duties to inform, each mapped to its article.

A requirement-by-requirement reading of the Gambling Commission's Remote gambling and software technical standards as platform behavior: what RTS 1 to 17 ask the software to do, which rows an approved test house certifies and which the licensee tests itself, the ISO/IEC 27001:2022 security requirements and their audit, the GAMSTOP check cadence and how the Malta Gaming Authority's system audit compares.

RFC 8216 spends exactly one sentence on protecting an HLS decryption key, and says nothing about who may ask for one. This guide works through the decisions that actually secure a stream: the key request as an authorization decision, signed manifests against signed segment URLs, CDN caching rules that can silently leak a key response and the boundary past which AES-128 stops helping and a licensed DRM system takes over.

Khronos's own specification defines OpenXR's extension model around one rule: every extension is optional per runtime, so a codebase has to query extensions with xrEnumerateInstanceExtensionProperties, and optional core features such as STAGE with their own enumeration call, before depending on them. This guide works through the decisions that follow from that rule: action-based input bound to interaction profiles instead of raw controller state, reference spaces with no shared origin, engine-level OpenXR coverage that depends on each engine's own gap list and why visionOS is a separate platform with no OpenXR runtime to target, not another runtime to detect.

RESO's own wiki defines ListingKey as a local key of the system that issued it, not the durable, cross-system identifier most integration plans assume. This guide works through the ten decisions a RESO Web API integration gets wrong on the second MLS: ModificationTimestamp polling against the EntityEvent alternative, a Lookup layer that resolves a local synonym back to one standard value and what a "RESO certified" server actually promises to expose.

NIS2 puts two different filings behind one word. Member States build the list and require entities to submit identifying information for it, on a two-week update clock, while a narrower set of digital entity types files a longer record with its national authority, corrects it on a three-month clock and has it forwarded to ENISA without its IP ranges. This guide separates the two, marks who is bound by each, and shows what national portals add on top.

NIS2 contains no prohibition on outsourcing any security measure, so the real question is which parts of Article 21 the market can supply and which acts sit with management bodies under Article 20 and the implementing regulation rather than with a provider. A decision guide for an entity whose scope is already settled, covering the supply chain duty that buying anything creates and the evidence a supervisory authority asks the entity, not the vendor, to produce.

Hotel channel manager integration as a catalog of failure modes: ARI drift, overbooking from inventory races, rate and room mapping errors, reservation desync and the certification gates standing between a connector and a live OTA channel.

A wallet user taps erase and what reaches you is a GDPR Article 17 request. This is the boundary between the wallet's machinery and the controller's own obligations, the one-month clock the recital's word immediate does not shorten, and the refusal path most build estimates miss.

A wallet-presented SCA Attestation is an OpenID4VP presentation carrying transactional data, and TS12 states that its verified jti claim serves as the Authentication Code PSD2 requires for electronic payments. This guide walks a payment service through the processing order: reading type metadata, signing and encrypting the request, surviving the locale check, verifying the Key Binding JWT and gating on the amr array. Written throughout as a second acceptance path alongside an existing implementation, never as a replacement for one.

AI travel agent development for an OTA, TMC or booking platform: what a tool-calling agent can and cannot book today, how it stays grounded on live inventory, the guardrails a mis-booking risk requires and an evaluation protocol before launch.

The crypto-asset white paper under MiCA Title II is a disclosure document nobody approves and whose content the offeror is solely responsible for. This guide sets out who must draw one up and who is exempt from precisely which obligations, what Annex I forces into the document, the Inline XBRL format rule and its application date, and the notification, publication, modification and withdrawal clocks that run around it.

An item-by-item walkthrough of the MiCA CASP authorization file: the nineteen points of Article 62(2), what Delegated Regulation (EU) 2025/305 adds on top of them, the annex form and contact point set by the implementing regulation, and the completeness and assessment periods stated as rules rather than as a countdown.

The MiCA transitional period was over everywhere by 1 July 2026, earlier in Member States that shortened it. A third-country crypto firm serving EU clients without a CASP authorization now has exactly one legal basis left, Article 61 reverse solicitation, and two years of ESMA guidance have narrowed it to a keyhole. We work through the statute, the 26 February 2025 guidelines, the broker-model opinion on routing and letter-box entities and ESMA's freshest compliance table dated 10 July 2026, which shows Poland and Romania still without a designated authority for these guidelines ten days after grandfathering ended. Then we cover what an engineering team actually builds to prove a client showed up on its own.

Tour operator software development as a phased migration off a legacy reservation system: supplier contracting, allotments and release rules, quotes and vouchers, data cutover and what the Package Travel Directive, both the 2015 text and the 2026 amendment, requires the platform to encode.