Retire a legacy message bus without losing or duplicating business effects

• Document actual delivery, acknowledgment, ordering, retention, replay, and failure semantics by topic. Identify consumers whose business correctness depends on legacy quirks.

• Measure volume, partition skew, retention, lag, poison rates, and migration bandwidth. Size the bridge for peak plus replay without starving live traffic.

• No business event is lost, duplicates remain safe, ordering guarantees are explicit, producers and consumers move independently, and rollback is possible during a bounded window.

• Introduce a versioned event envelope and migration bridge that writes one authoritative log then forwards idempotently. Run dual consumers or shadow compares, with per-topic state and checkpointed offsets.

• Preserve event ID, key, source offset, schema, and causation; map partitions deliberately rather than assuming equivalence. Consumers store business outcome and consumed identity atomically.

• At-least-once bridging is expected; exactly-once labels do not span two brokers and databases. Ordering is defined per business key and validated after repartitioning.

• Bridge lag alarms before retention loss, poison messages quarantine with ownership, and duplicate delivery is tested. A topic cutover freezes producer routing briefly or records a terminal old-log position.

• Recreate topic authorization, encryption, residency, and audit before payload movement. Do not grant the bridge global read and write longer than migration requires.

• Track old and new offsets, event-set hashes, lag, duplicate effects, ordering violations, consumer version, and remaining dependencies. Completion requires zero legacy traffic and exercised replay.

• Dual infrastructure and egress are temporary migration costs. Prioritize topics by risk and business value and time-box retention overlap.

• Producer dual-publish is simple locally but creates partial success; log-to-log bridging centralizes that complexity. A bridge is safer if it has durable checkpoints, idempotency, and finite life.

• Standardize envelopes, migrate low-risk consumers, shadow high-risk consumers, move producers topic by topic, drain retained history, revoke legacy access, and decommission after rollback expiry.

• Staff candidates migrate semantics, not brand names. They define log positions, event identity, consumer effects, partition mapping, and the exact bridge-removal proof.

Interviewer evaluation rubric