decision-docs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited decision-docs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Code shows what you did. It cannot show what you considered and rejected, which constraint forced your hand, or why a workaround exists. That context decays fast — six months later, even you won't remember, and the next person will relitigate a settled question or repeat a mistake you already made.
Decision docs capture why at the moment of choice. They are cheap to write when the reasoning is fresh; they are expensive to reconstruct from git history and Slack.
This skill covers ADRs (immutable decision history), living docs (updated as the system changes), and pointers (short rules that link to the full record). Pair with [[product-brief]] when a RFC produces a decided approach, [[spec-first]] for requirements that precede design choices, [[migration-path]] when a decision implies a staged rollout, [[context-curation]] for where durable "why" should live in agent memory, and [[launch-readiness]] when shipping needs a changelog and communicated risks.
Skip for trivial choices with no lasting cost — local variable names, one-off scripts, reversible edits with no architectural impact. Don't ADR everything; reserve records for decisions that stick.
Work in order. Not every situation needs a full ADR — step 1 decides the right artifact.
| Situation | Artifact | Mutable? |
|---|---|---|
| Significant, hard-to-reverse technical choice | ADR | Supersede only — never edit in place |
| How the system works today (setup, architecture overview) | Living doc (README, docs/) | Update as code changes |
| Short rule agents/devs see every session | Pointer in CLAUDE.md / rules | Update when ADR superseded |
| Experiment or A/B concluded | Decision note (ADR or experiment log entry) | Immutable once decided |
| Operational "how to" under failure | Runbook | Update when procedure changes |
| Incident revealed a systemic gap | Postmortem + ADR if architecture changes ([[incident-response]]) |
Write an ADR when reversing the choice would require a migration, affect multiple services, or change a public contract. Skip an ADR when the choice is local, easily reversible, and obvious from the code.
Capture the record while alternatives and constraints are still in your head. After shipping, memory compresses to "we chose X" and loses the rejected options.
Minimum timing:
If you discover you shipped without recording: write the ADR now, note it's retrospective, and capture what you still remember of the alternatives.
Keep ADRs short — one to two pages. Long ADRs aren't read.
# ADR-NNN: [Short title in domain language]
- **Status:** Proposed | Accepted | Deprecated | Superseded by ADR-XXX
- **Date:** YYYY-MM-DD
- **Deciders:** [names or roles]
## Context
What problem or constraint forces a choice? Link to ticket, RFC, incident, or metric.
State facts, not opinions — "p95 checkout latency is 800ms" not "checkout is slow."
## Decision
What we will do — one clear statement. Not a design doc; the choice.
## Options considered
| Option | Pros | Cons | Why not |
|--------|------|------|---------|
| A — … | … | … | … |
| B — … | … | … | **Chosen** / rejected because … |
The rejected options and **why they lost** are the highest-value section. Reviewers and future readers
trust the decision when they see what was weighed.
## Consequences
**Positive:** what we gain.
**Negative:** what we give up — cost, complexity, operational burden, consistency limits.
**Follow-ups:** migrations, monitoring, tech debt tickets, review date for "temporary" choices.
## References
Links to RFC, spike code, benchmark results, compliance requirement.For product or experiment decisions, the same shape works — replace "architecture" with "product choice" and link success metrics from the brief.
Readers ask "why this?" before "what is it?" Order matters:
A decision without named trade-offs reads like marketing. Every real choice gives something up — latency for consistency, simplicity for flexibility, cost for speed. Name it.
Decision docs belong in version control, beside what they describe:
docs/adr/0001-use-event-sourcing.md or doc/architecture/decisions/0001) for sort orderREADME, module doc, or architecture overviewFor pointers in standing agent memory ([[context-curation]]):
<!-- Good: short rule + link -->
API errors use `ApiError` in `lib/errors.ts` — see ADR-012 (no raw string throws).
<!-- Bad: full ADR pasted into CLAUDE.md -->Once Accepted, do not edit the body to reflect new reality. The ADR is a record of what was decided then.
When the decision changes:
Editing old ADRs hides evolution and makes audits unreliable. Superseding preserves the trail.
Write in ADRs and living docs:
Do not write:
getUser fetches the user)Code comments are for local non-obvious mechanics at the line level. ADRs are for choices that span files and years. Don't put a novel in a comment; don't put line logic in an ADR.
Living docs (README, docs/architecture.md, setup guides) describe current state. Unlike ADRs, they must be updated when the system changes.
When you touch an area:
Wrong docs are worse than none. They send people down rabbit holes. A missing doc prompts questions; a wrong doc prompts confident mistakes.
Audit triggers:
Decisions should be findable when they matter:
| Moment | Action |
|---|---|
| PR | Link ADR in description for architectural changes; reviewer checks consequences |
| RFC approval | Accepted RFC → ADR or ADR extracted from RFC alternatives section |
| Launch | Changelog + user-facing docs updated ([[launch-readiness]]) |
| Incident | Postmortem action items → ADR if architecture must change |
| Deprecation | ADR or living doc states replacement and timeline ([[migration-path]]) |
| Compliance review | ADR references control requirement and data-handling rationale |
Tech selection (database, queue, framework)
Temporary workaround
RFC → shipped decision
Recurring "why not X?" in PRs
Experiment / product choice
Compliance and audit
Onboarding a new area
CLAUDE.md or rules bloated with full decision prose instead of pointers~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.