skills/feature-manifest/SKILL.md
Manage feature manifests for code traceability. Use when creating new features, updating existing features, checking feature health, or exploring the feature-to-code relationship. Activates for manifest validation, feature creation, changelog updates, and traceability queries.
npx skillsauth add curiositech/windags-skills feature-manifestInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
This skill manages the feature manifest system that tracks the relationship between features and their implementations.
When working with code changes, use this decision tree:
Is this code change happening?
├── Creating new feature directory/component
│ ├── New feature has >5 files OR touches multiple domains
│ │ └── → CREATE new manifest (npm run feature:create)
│ └── Small utility/helper (<5 files, single purpose)
│ └── → ADD to existing related manifest
├── Modifying existing tracked files
│ ├── Files belong to known feature (check with: npm run feature:info -- --files <path>)
│ │ ├── Adding/removing files to feature
│ │ │ └── → UPDATE manifest files list + last_modified date
│ │ └── Just changing file contents
│ │ └── → UPDATE last_modified date only
│ └── Files are orphaned (not in any manifest)
│ └── → Determine owner with npm run feature:health, then UPDATE appropriate manifest
└── Removing/deprecating code
├── Entire feature being removed
│ └── → SET status to 'deprecated', add deprecation changelog entry
└── Some files being removed from feature
└── → UPDATE manifest files list, add changelog entry
For manifest validation failures:
1. Orphan File Syndrome
npm run feature:health shows files in "Orphaned Files" sectionnpm run feature:info -- --files <path> to find logical owner, then add files to appropriate manifest2. Ghost Manifest References
implementation.files, update last_modified, add changelog entry3. Stale Dependency Web
dependencies.internal4. Test Coverage Blind Spot
npm run feature:health shows features in "Without Tests" section5. Manifest Explosion
Example: Adding authentication middleware to existing API feature
Identify impact: New middleware affects multiple API routes
npm run feature:info -- --files src/app/api
# Shows: api-core.yaml owns most API files
Check current manifest:
npm run feature:info -- api-core
# Review current files list and dependencies
Decision: This is modifying existing feature (middleware is part of API infrastructure)
Update manifest: Add new middleware files to api-core.yaml:
implementation:
files:
- src/app/api/middleware/auth.ts # NEW
- src/lib/auth-utils.ts # NEW
# ... existing files
Update metadata:
dependencies:
internal:
- features/user-management.yaml # NEW dependency
history:
last_modified: "2024-12-23" # TODAY
changelog:
- version: "1.2.0" # NEW entry
date: "2024-12-23"
changes:
- "Added authentication middleware for API routes"
Validate: npm run feature:validate confirms no errors
What novice misses: Updating dependencies.internal when middleware uses user auth What expert catches: All affected API routes need the auth dependency listed
Task is complete when ALL conditions are met:
npm run feature:validate passes with no errorsnpm run feature:health shows no new orphaned fileslast_modified date OR manifest updatedDo NOT use this skill for:
git-archaeology skill instead for historical analysisproject-config skill insteaddocumentation skill insteaddevops-automation skill insteadtest-infrastructure skill insteadFor cross-cutting concerns spanning multiple features:
architecture-analysis skill to understand system boundaries firstdata-ai
license: Apache-2.0 NOT for unrelated tasks outside this domain.
development
Use when designing caching strategies (cache-aside, write-through, write-behind), implementing distributed locks, building rate limiters, leaderboards, real-time streams (XADD/consumer groups), pub/sub, or tuning eviction policies. Triggers: thundering-herd on cache miss, dogpile on key expiry, Redlock vs SET-NX-PX choice, sliding-window rate limiter, hot-key on a single cluster slot, big-key blowup, MULTI/EXEC across slots, KEYS in production. NOT for Redis Cluster operations/admin (different domain), embedded KV (SQLite, leveldb), in-process LRU caches, or Memcached.
tools
Drawing the `'use client'` boundary correctly in React Server Components apps (Next.js App Router, RSC frameworks) — leaf-pushing, slot composition, serialization rules, and environment poisoning prevention. Grounded in react.dev and Next.js 16 docs.
development
Use when designing rate limiting for an API, choosing between token bucket / sliding window / leaky bucket / fixed window, implementing it in Redis, deciding edge (Cloudflare/Upstash) vs origin enforcement, sizing per-user vs per-IP vs per-endpoint quotas, returning the right 429 response with Retry-After, or fixing the boundary-burst bug in fixed-window limiters. Triggers: 429 too many requests, INCR + EXPIRE, ZADD + ZREMRANGEBYSCORE + ZCARD, X-RateLimit-Remaining header, Cloudflare WAF rate limiting rules, Upstash @upstash/ratelimit, leaky bucket shaping vs policing, distributed rate limiter consistency. NOT for DDoS mitigation specifically (different scale), CAPTCHA / bot management, full WAF design, or per-user quota billing.