Claude makes 20 decisions building your feature. The session ends. The reasoning disappears.
SaferSkills independently audited decision-log (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are about to work on a codebase. Every significant decision you make must be logged to .decisions.md in the project root before the session ends. This is not optional. The log exists so any person — or any future Claude session — can understand why the code is the way it is without asking you.
Claude makes 20 decisions building a feature. Which library to use. Why that data shape. Why not the obvious approach. What it considered and rejected. The code ships. The session ends. The reasoning is gone. The next developer — or the next Claude session — looks at the code and has no idea why anything is the way it is. They refactor the thing you specifically decided not to do. They add the dependency you specifically rejected. They ask the same questions you already answered.
The log fixes this.
Log a decision when you:
Do NOT log:
Append to .decisions.md in the project root. Create it if it doesn't exist.
## [YYYY-MM-DD] [short title]
**What:** [one sentence — what was decided]
**Why:** [one to three sentences — the reasoning]
**Rejected:** [what was considered and not chosen, and why — omit if nothing was seriously considered]
**Revisit if:** [condition that would make this decision wrong — omit if not applicable]
---## [2026-04-06] Use optimistic UI for vote action
**What:** Vote button updates immediately in the UI before the server confirms.
**Why:** The action is low-stakes and near-instant. Waiting for server confirmation adds 200–400ms of perceived lag on every vote. Rollback on failure is acceptable.
**Rejected:** Pessimistic update (wait for server) — makes the interaction feel sluggish for a 99.9% success-rate action.
**Revisit if:** Vote fraud becomes a concern and we need server-authoritative state.
---
## [2026-04-06] Skip pagination on comments for now
**What:** Comments load all at once, no pagination.
**Why:** Current max comment count is ~40. Pagination adds complexity that isn't justified yet.
**Rejected:** Cursor-based pagination — right call at scale, wrong call now.
**Revisit if:** Any post exceeds 100 comments or load time exceeds 500ms.
---
## [2026-04-06] Store session in cookie, not localStorage
**What:** Auth session token stored in httpOnly cookie.
**Why:** httpOnly cookies are inaccessible to JS, which eliminates XSS token theft as an attack surface. localStorage would require manual token management in every fetch call.
**Rejected:** localStorage — simpler to implement but meaningfully less secure.
---.decisions.md first. Do not re-make decisions that are already logged.When starting a new session on an existing project:
.decisions.md exists**Revisit if:** that now applyIf you made the decision, log it. Future you, future Claude, future teammate — they all need to know why. The code shows what. Only this file shows why.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.