Automatically invoked when writing formal documentation (specs, ADRs, reviews, plans). Ensures consistent structure, appropriate detail level, and proper file location.
This skill activates when you need to create or update formal project documentation.
Automatically engage when:
docs/features/[feature-name].mddocs/features/_template.mddocs/architecture/decisions.md (or individual ADR files)docs/architecture/_decision-template.mddocs/architecture/interfaces/[api-name].mddocs/architecture/interfaces/_template.mdai_docs/reviews/[type]-[subject]-[date].mdai_docs/reviews/_template.mdai_docs/plans/[feature-name]-plan.mddocs/architecture/models/[model-name].mdai_docs/knowledge/[topic]/ai_docs/knowledge/_template/Determine what kind of documentation is needed
Use the template for consistency:
Feature Spec → docs/features/_template.md
ADR → docs/architecture/_decision-template.md
Interface → docs/architecture/interfaces/_template.md
Review → ai_docs/reviews/_template.md
Complete all required sections:
# Document Title (H1 - once per document)
## Major Section (H2)
### Subsection (H3)
#### Detail (H4)
```language
code here
#### Lists
```markdown
- Unordered item
- Unordered item
1. Ordered item
2. Ordered item
| Column 1 | Column 2 | Column 3 |
|----------|----------|----------|
| Data | Data | Data |
[Link Text](relative/path/to/doc.md)
[External Link](https://example.com)
**bold** for strong emphasis
*italic* for emphasis
`code` for inline code
Add document metadata at the top:
**Version:** 1.0.0
**Last Updated:** 2024-01-15
**Status:** Draft | In Review | Approved | Deprecated
**Owner:** Team/Person
Link to:
Follow the location guidelines above
Before finalizing documentation:
Good: "The system validates user input" Avoid: "User input is validated by the system"
Good: "The function returns a Promise" Avoid: "The function will return a Promise"
Good: "Response time must be less than 200ms" Avoid: "Response should be fast"
Good: "Use JWT tokens for authentication." Avoid: "In order to provide authentication capabilities, the system should utilize JWT tokens."
Purpose: Define what to build Key Sections: Overview, requirements, user flows, acceptance criteria, technical considerations
Purpose: Record important decisions Key Sections: Context, decision drivers, options considered, decision, consequences
Purpose: Define API contract Key Sections: Endpoints, request/response formats, error handling, examples
Purpose: Document review findings Key Sections: Summary, findings by area, issues by severity, recommendations
Purpose: Break down implementation Key Sections: Steps, considerations, risks, success criteria
## User Flow
### Happy Path: User Registration
1. User navigates to `/signup`
2. User fills registration form:
- Email (validated: must contain @, max 254 chars)
- Password (min 10 chars, must include uppercase, lowercase, number)
- Name (min 2 chars, max 100 chars)
3. User clicks "Sign Up"
4. System validates input (client-side)
5. System submits to `POST /api/auth/register`
6. System sends verification email
7. System displays "Check your email" message
8. User clicks verification link in email
9. System activates account
10. System redirects to dashboard
### Error Path: Invalid Email
1-3. [Same as happy path]
4. System detects invalid email format
5. System displays error: "Please enter a valid email address"
6. Focus returns to email field
7. User corrects and resubmits
# ADR 003: Use JWT for Authentication
**Date:** 2024-01-15
**Status:** Accepted
## Context
We need to authenticate users across our web app and mobile apps. We require:
- Stateless authentication
- Support for multiple clients
- Token expiration and refresh
- Scalability to millions of users
## Decision Drivers
- Horizontal scalability (no server-side session storage)
- Mobile app support
- API-first architecture
- Security requirements
## Decision
Use JWT (JSON Web Tokens) for authentication with:
- 15-minute access token expiration
- 7-day refresh token expiration
- RS256 signing algorithm
- Tokens stored in httpOnly cookies for web, secure storage for mobile
## Consequences
### Positive
- Stateless - easy to scale horizontally
- Works across all clients
- Industry standard with good library support
- Self-contained - no database lookup per request
### Negative
- Cannot revoke tokens before expiration
- Token size larger than session IDs
- Need to implement refresh token rotation
- More complex than session-based auth
## Implementation Notes
- Store refresh tokens in database for revocation capability
- Implement token rotation on refresh
- Use short access token expiration for security
- Add token to request header: `Authorization: Bearer {token}`