From pm-ai-shipping
The durable documentation set that makes an AI-built (vibe-coded) app reviewable before shipping. A small core every app needs — architecture, user/permission flows, permissions, variables/secrets, and a test-coverage map — plus conditional docs added only when they apply: emails, scheduled work, SEO, and embedded agents/automation. Defines what each doc must capture and how a reviewer or auditor uses it. Use when documenting a codebase for handoff, mapping user journeys and trust-boundary crossings, planning test coverage, or preparing for a security or performance audit.
How this skill is triggered — by the user, by Claude, or both
Slash command
/pm-ai-shipping:shipping-artifactsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
AI agents write code fast, but they leave no durable record of *intent* — what the system is supposed to do, who is allowed to do what, where the secrets live, which rules are actually verified. Without that record, no human (and no auditing agent) can tell whether the code is safe to ship. This skill defines the small set of documents that restore reviewability.
AI agents write code fast, but they leave no durable record of intent — what the system is supposed to do, who is allowed to do what, where the secrets live, which rules are actually verified. Without that record, no human (and no auditing agent) can tell whether the code is safe to ship. This skill defines the small set of documents that restore reviewability.
These docs live in /documentation/ and are written for two readers: a human reviewer and the next AI coding agent. They are the intended-state half of every later audit — a security or performance review is only as good as the intent it can compare the code against.
The set is not a fixed list — it is a small core plus conditional docs you add only when the capability exists.
architecture.md ("No scheduled work — no cron.md.") rather than inventing an empty document. Reviewability comes from an honest map, and "we don't do X" is part of the map./document-app. The one exception is tests.md, which is derived from the other docs by /derive-tests — it is the verification map, not a description of a subsystem.Be brutally honest about the current state without being paranoid. The job is an accurate map, not a clean bill of health. Each doc is short, table-and-bullet heavy, and skips generic theory.
Each entry: file · one-line purpose · what it must capture · how a reviewer uses it.
architecture.md — what the system is and how it hangs together.
flows.md — the journeys where permissions and side effects are actually exercised.
permissions.md matrix can't show — where and in what order authorization is enforced, and where it can be skipped.permissions.md — who is allowed to do what.
flows.md shows it in motion; this is the static reference.variables.md — configuration and secrets, mapped to risk.
tests.md — the verification map: which documented rules are actually checked, which are only proposed, and which are checked by nothing.
main./derive-tests (not /document-app), because it is derived from the other docs and the existing test suite rather than read off a subsystem.emails.md — every notification the system sends. Include only if the app sends transactional or automated email.
cron.md — all scheduled work and how to operate it safely. Include only if scheduled or background jobs exist.
seo.md — how a single-page app handles SEO and social previews. Include only if there are public/indexable or bot-facing routes.
automation.md — embedded agents and other automation paths. Include only if the app embeds AI agents, LLM workflows, tool-calling, webhooks, or external automation.
architecture.md under a "Related Documents" section, so the set stays discoverable.CLAUDE.md / AGENTS.md) is a different artifact — instructions derived from these docs, not system documentation. It is produced at the handoff step by /ship-check, not here.tests.md is produced by /derive-tests; the rest are produced by /document-app.npx claudepluginhub gaoflyx-ux/rpg-0.1 --plugin pm-ai-shippingProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.