What problem does it solve? AI coding agents produce code fast but leave no durable record of intent—what the system should do, who is allowed to do what, where secrets live, and which rules are actually verified. Without these records, no human reviewer or audit agent can judge whether the code is safe to ship. This Skill defines a small, honest documentation set that restores reviewability before release. ## Core Features & Use Cases - Core document set: Defines five mandatory documents—architecture.md, flows.md, permissions.md, variables.md, and tests.md—each with explicit requirements for what must be captured and how a reviewer uses it. - Conditional documents: Adds emails.md, cron.md, seo.md, and automation.md only when the application actually has those capabilities, with one-line notes instead of fabricated empty docs. - Trust-boundary mapping: Captures authorization checks, trust-boundary crossings, side effects, and agent tool surfaces so security and performance audits have an expected-state baseline to compare code against. - Use Case: Before shipping a vibe-coded SaaS app, run this Skill to produce a documentation/ folder that a security auditor can use to verify RLS policies, secret scoping, cron idempotency, and embedded agent guardrails against the actual code. ## Quick Start Ask the AI to generate the shipping-artifacts documentation set for this repository so the app can be reviewed before release.
