doccraft-adr-bd6512 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited doccraft-adr-bd6512 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Managed by doccraft —doccraft updateregenerates this file. Local edits will be overwritten. Seedoccraft.jsonto override project-specific vocabulary and paths without touching this file.
Not every brainstorm needs an ADR — only decisions you want git history and agents to reuse.
Use valid YAML between --- delimiters at the top of the file, or an inline **Status:** line immediately after the title. If the project sets adr.require_frontmatter: true in doccraft.yaml, frontmatter is mandatory — otherwise either form is acceptable, but frontmatter is preferred for machine-readability.
| Field | Required | Values / notes | |||
|---|---|---|---|---|---|
adr | yes | Three-digit zero-padded string matching the filename number (e.g. "007"). MUST be unique — verify before writing. | |||
status | yes | One of the values in adr.status config (default: Proposed \ | Accepted \ | Superseded by NNN-slug \ | Deprecated). If the user does not specify, default to Proposed. |
updated | yes | ISO date YYYY-MM-DD. MUST be set on creation and updated on every meaningful edit. | |||
supersedes | optional | YAML list of ADR filenames this record supersedes (e.g. [005-old-approach.md]). Omit or [] if none. | |||
superseded_by | optional | Filename of the ADR that replaced this one. Set to null or omit when active. |
Do not invent new values forstatuswithout first adding them to theadr.statuslist indoccraft.yaml— that is the single source of truth. One-off nuance belongs in the body, not as a new enum value.
001-managed-postgres.md).NNN- prefix, no required Nygard sections.Use markdown with a top-level title, then these sections. MUST use these headings for grep-ability. Order MUST follow the sequence below:
Problem, forces, constraints, what question was being answered.
Clear statement of what was chosen (including "we will not implement X").
Positive and negative effects, follow-up work, coupling introduced.
Optional but MUST include when multiple options existed. Brief bullets: what was considered and why it was not chosen.
Do not add other top-level sections. Put additional context in Consequences or inline under the relevant heading.
Record status near the top (after the title) as an inline **Status:** line, in YAML frontmatter, or both. Every ADR MUST have a status.
| Status | Meaning |
|---|---|
Proposed | Draft; not yet agreed. |
Accepted | This is the active record (including "rejected feature" outcomes). |
Superseded by NNN-other-slug | Replaced; link to the new ADR file by name. |
Deprecated | No longer applies; one line why. |
When superseding:
Superseded by NNN-new-slug.docs/stories/ andreference the ADR filename in the story's adr_refs frontmatter field (see doccraft-story if installed).
adr_refs when thestory implements or is constrained by a decision.
---
adr: "008"
status: Accepted
updated: 2026-05-30
supersedes: []
superseded_by: null
---
# ADR 008: Adopt managed Postgres for primary datastore
**Status:** Accepted
## Context
We need durable transactional storage for user and billing data. Running our
own Postgres adds oncall burden that doesn't match current team size.
## Decision
Use a managed Postgres offering (initial target: the cloud provider already
hosting the app). Review annually or when egress costs cross $X/month.
## Consequences
- + Backups, failover, and point-in-time recovery handled by the provider.
- + One less service to include in the oncall rotation.
- - Vendor lock-in on specific extension availability; portability audit
required before any future migration.
## Alternatives considered
- **Self-hosted on VMs** — lower monthly cost but higher operational load;
revisit if the team grows past a single platform engineer.
- **Serverless Postgres (e.g. Neon)** — attractive pricing model but
connection-pooling behaviour didn't fit our long-lived worker pattern.Title can state the outcome:
# ADR 009: Do not introduce a separate event bus (for now)Decision: Keep using direct service-to-service calls. Revisit when a second consumer of any given event emerges, or when queue durability becomes a hard requirement.
This kind of ADR is valuable even though nothing ships from it — the next time someone proposes "let's add Kafka", the record explains why it was deferred and what would change the answer.
the next available number.
Draft, Approved, Closed — use the canonicalvalues only (Proposed, Accepted, Superseded by …, Deprecated).
and Alternatives considered — put extra detail under an existing heading.
Before writing or updating an ADR file, MUST complete these checks:
docs/adr/NNN-*.md files and pickthe next unused three-digit number. NEVER reuse or renumber existing ADRs.
existing file. If it does, adjust the slug.
status MUST be one of: Proposed, Accepted,Superseded by NNN-slug, Deprecated. No other values unless extended in doccraft.yaml.
verify the old ADR exists and update its status line to Superseded by NNN-new-slug in the same turn.
MUST all be present. Alternatives considered MUST be included when multiple options existed.
The task is complete when:
docs/adr/NNN-slug.md)with the correct next number.
**Status:** line, or both).turn.
docs/adr/README.md index has been updated with the new entry.Read doccraft.yaml at invocation. The adr: section is this skill's customisation surface; override the defaults in the tables above with the values found there. If the file is missing or the adr: section is absent, use the defaults as-is.
Relevant keys:
docsDir — root folder for all docs, relative to project root. Default:docs. ADRs live at {docsDir}/adr/.
adr.status — allowed values for the status: field. Default:[Proposed, Accepted, Deprecated] (plus the Superseded by … form). Extend if your project uses additional states.
adr.require_frontmatter — when true, YAML frontmatter is mandatoryon every ADR. Default: false (inline **Status:** line is also acceptable).
adr.number_format — digit padding for the NNN prefix. Default: 3(zero-padded to three digits).
Adding to a list in doccraft.yaml teaches the skill a new valid value without touching this file (which doccraft update regenerates). That is the intended way to extend vocabulary for a project.
For monorepo projects, ADRs may live at the project root or under a declared package's docs/adr/ tree (a Known package roots block appears above when packages are declared). For single-root projects no block appears, every ADR lives at the project-root docs/adr/, and the namespace rules below do not apply.
When the project declares packages, decide which scope to write to:
under that package's docs/adr/.
declared package path, default to that package's docs root.
docs/adr/.
ADR numbering is per-scope: root and each package have independent number sequences. audio-engine/003-foo.md and the root 003-bar.md are both valid concurrent ADRs.
References in Status: Superseded by … and a story's adr_refs: may use the namespaced form <slug>/NNN-slug.md. Unprefixed filenames always refer to the project-root docs/adr/.
P2.1) or story ids when it clarifies scope.docs: scope is fine forADR-only commits (e.g. docs(adr): add 008 managed postgres).
docs/stories/ with adr_refs pointing to this ADR (use doccraft-story if installed).
adr_refs still pointsonly to the old ADR — update references to include the new one.
docs/adr/README.mdindex in the same turn.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.