skills/feature-manifest/SKILL.md
Manage feature manifests for code traceability. Use when creating new features, updating existing features, checking feature health, or exploring the feature-to-code relationship. Activates for manifest validation, feature creation, changelog updates, and traceability queries.
npx skillsauth add curiositech/windags-skills feature-manifestInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
This skill manages the feature manifest system that tracks the relationship between features and their implementations.
When working with code changes, use this decision tree:
Is this code change happening?
├── Creating new feature directory/component
│ ├── New feature has >5 files OR touches multiple domains
│ │ └── → CREATE new manifest (npm run feature:create)
│ └── Small utility/helper (<5 files, single purpose)
│ └── → ADD to existing related manifest
├── Modifying existing tracked files
│ ├── Files belong to known feature (check with: npm run feature:info -- --files <path>)
│ │ ├── Adding/removing files to feature
│ │ │ └── → UPDATE manifest files list + last_modified date
│ │ └── Just changing file contents
│ │ └── → UPDATE last_modified date only
│ └── Files are orphaned (not in any manifest)
│ └── → Determine owner with npm run feature:health, then UPDATE appropriate manifest
└── Removing/deprecating code
├── Entire feature being removed
│ └── → SET status to 'deprecated', add deprecation changelog entry
└── Some files being removed from feature
└── → UPDATE manifest files list, add changelog entry
For manifest validation failures:
1. Orphan File Syndrome
npm run feature:health shows files in "Orphaned Files" sectionnpm run feature:info -- --files <path> to find logical owner, then add files to appropriate manifest2. Ghost Manifest References
implementation.files, update last_modified, add changelog entry3. Stale Dependency Web
dependencies.internal4. Test Coverage Blind Spot
npm run feature:health shows features in "Without Tests" section5. Manifest Explosion
Example: Adding authentication middleware to existing API feature
Identify impact: New middleware affects multiple API routes
npm run feature:info -- --files src/app/api
# Shows: api-core.yaml owns most API files
Check current manifest:
npm run feature:info -- api-core
# Review current files list and dependencies
Decision: This is modifying existing feature (middleware is part of API infrastructure)
Update manifest: Add new middleware files to api-core.yaml:
implementation:
files:
- src/app/api/middleware/auth.ts # NEW
- src/lib/auth-utils.ts # NEW
# ... existing files
Update metadata:
dependencies:
internal:
- features/user-management.yaml # NEW dependency
history:
last_modified: "2024-12-23" # TODAY
changelog:
- version: "1.2.0" # NEW entry
date: "2024-12-23"
changes:
- "Added authentication middleware for API routes"
Validate: npm run feature:validate confirms no errors
What novice misses: Updating dependencies.internal when middleware uses user auth What expert catches: All affected API routes need the auth dependency listed
Task is complete when ALL conditions are met:
npm run feature:validate passes with no errorsnpm run feature:health shows no new orphaned fileslast_modified date OR manifest updatedDo NOT use this skill for:
git-archaeology skill instead for historical analysisproject-config skill insteaddocumentation skill insteaddevops-automation skill insteadtest-infrastructure skill insteadFor cross-cutting concerns spanning multiple features:
architecture-analysis skill to understand system boundaries firsttools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.