Sample handoff pack

What ships in every ZIP, beyond the code.

Below is a section-by-section tour of the docs/ tree that lands in your generated ZIP next to the source code. Real examples drawn from a task-tracker generation — not a marketing mockup.

Generate your own See the full showcase

Section-by-section

docs/README.md

Handoff index

5-question index: Why each decision · Does every requirement connect to code · What does the architecture look like · What legal needs · What the UI should look like.

Example

README.md for a generated task-tracker references 7 ADRs, 5 diagrams, and 1 compliance doc.

docs/decisions/ADR-*.md

Architecture Decision Records (MADR v4)

Always generated: backend stack choice, frontend stack choice, database (Postgres), auth pattern (JWT httpOnly cookies), ORM (SQLAlchemy + Alembic). Plus one ADR per selected vendor and per compliance flag.

Example

ADR-0003-database-postgresql.md: Decision + Rationale + Consequences (positive / negative) + Alternatives Considered (MySQL, SQLite, MongoDB) with reason each was rejected.

docs/traceability.md + .csv

Traceability matrix

Every user story → functional requirement → screen → entity → generated file path. Orphan-FR detection surfaces coverage gaps explicitly (auditors need the gaps visible, not hidden).

Example

US-01 (Manager creates task) → FR-01.1 (POST /tasks) → Task List screen → Task entity → app/models/task.py, app/blueprints/task_bp.py, frontend/app/(protected)/tasks/page.tsx.

docs/diagrams/*.mmd

Mermaid architecture diagrams

C4 context (system + users + integrations), C4 containers (frontend / API / DB / workers / cache), entity-relationship diagram, sequence diagrams per priority screen, state-machine diagrams per stateful entity. Renders natively on GitHub.

Example

context.mmd, container.mmd, data-model.mmd, request-flow-task-list.mmd, state-task.mmd (task: draft → active → done transitions with guards).

docs/compliance/*.md

Populated compliance documents

Per-flag: GDPR DPIA (Article 35), HIPAA risk assessment (§164.308), PCI-DSS scope statement, SOX §404 COSO ITGC matrix. Populated from the data model and integrations; human-judgement fields marked TBD.

Example

compliance/dpia.md enumerates every PII-candidate field from your entity model, lists every third-party processor needing a DPA, references Archiet's baseline technical controls.

docs/cost-estimate.md

Cost estimate + growth projections

Monthly TCO per stack (compute + DB + cache + storage + egress + monitoring), per-vendor integration cost, per-compliance overhead. Growth projections to 1M MAU with scaling inflection points.

Example

Flask + Next.js monolith, 3 integrations (Stripe + Sendgrid + Slack), GDPR flag: $155/mo baseline, ~$400/mo at 10k MAU, $1,200/mo at 100k MAU.

docs/security-posture.md

Security posture

Attack surface (routes × entities × integrations). Auth control table keyed to real files. Pre-launch security checklist. Per-integration DPA / min-scope / region-compliance tracking.

Example

Authentication table shows bcrypt password hashing (app/services/auth_service.py), JWT httpOnly cookies (app/blueprints/auth_bp.py), CSRF double-submit tokens (app/__init__.py middleware).

docs/performance-notes.md

Performance notes

Baseline throughput per stack (sync vs async). DB scaling profile. Caching strategy. External-call latency budget per integration. Mobile client considerations. Scaling ceilings by architecture style.

Example

Flask + 4 gunicorn workers = ~100 req/s per container. Bottleneck at ~200 concurrent requests/container (connection pool). Mitigation: pgbouncer + tune max_connections.

Four honest caveats

—The actual files in your ZIP will differ based on your stack choice, compliance flags, and integrations.
—Human-judgement fields (lawful basis, retention periods, DPO signoff, QSA signoff) are explicitly marked TBD. Archiet populates structure; humans populate legal interpretation.
—Every document is deterministic. Same genome produces identical documents — regeneration is audit-safe.
—No content is fabricated. If a piece of information doesn't exist (no PII detected, no compliance flag set), the relevant section says so explicitly rather than inventing placeholder content.

See it with your own data

Free trial. No credit card. Describe a product, pick a stack, hit generate. The handoff pack shown above lands in your ZIP, populated with the entities, integrations, and compliance flags you set.

Start trial How the quality score works

Loading…

Section-by-section

docs/README.md

Handoff index

5-question index: Why each decision · Does every requirement connect to code · What does the architecture look like · What legal needs · What the UI should look like.

Example

README.md for a generated task-tracker references 7 ADRs, 5 diagrams, and 1 compliance doc.

docs/decisions/ADR-*.md

Architecture Decision Records (MADR v4)

Example

ADR-0003-database-postgresql.md: Decision + Rationale + Consequences (positive / negative) + Alternatives Considered (MySQL, SQLite, MongoDB) with reason each was rejected.

docs/traceability.md + .csv

Traceability matrix

Every user story → functional requirement → screen → entity → generated file path. Orphan-FR detection surfaces coverage gaps explicitly (auditors need the gaps visible, not hidden).

Example

US-01 (Manager creates task) → FR-01.1 (POST /tasks) → Task List screen → Task entity → app/models/task.py, app/blueprints/task_bp.py, frontend/app/(protected)/tasks/page.tsx.

docs/diagrams/*.mmd

Mermaid architecture diagrams

Example

context.mmd, container.mmd, data-model.mmd, request-flow-task-list.mmd, state-task.mmd (task: draft → active → done transitions with guards).

docs/compliance/*.md

Populated compliance documents

Example

compliance/dpia.md enumerates every PII-candidate field from your entity model, lists every third-party processor needing a DPA, references Archiet's baseline technical controls.

docs/cost-estimate.md

Cost estimate + growth projections

Monthly TCO per stack (compute + DB + cache + storage + egress + monitoring), per-vendor integration cost, per-compliance overhead. Growth projections to 1M MAU with scaling inflection points.

Example

Flask + Next.js monolith, 3 integrations (Stripe + Sendgrid + Slack), GDPR flag: $155/mo baseline, ~$400/mo at 10k MAU, $1,200/mo at 100k MAU.

docs/security-posture.md

Security posture

Attack surface (routes × entities × integrations). Auth control table keyed to real files. Pre-launch security checklist. Per-integration DPA / min-scope / region-compliance tracking.

Example

Authentication table shows bcrypt password hashing (app/services/auth_service.py), JWT httpOnly cookies (app/blueprints/auth_bp.py), CSRF double-submit tokens (app/__init__.py middleware).

docs/performance-notes.md

Performance notes

Example

Flask + 4 gunicorn workers = ~100 req/s per container. Bottleneck at ~200 concurrent requests/container (connection pool). Mitigation: pgbouncer + tune max_connections.

Four honest caveats

—The actual files in your ZIP will differ based on your stack choice, compliance flags, and integrations.
—Human-judgement fields (lawful basis, retention periods, DPO signoff, QSA signoff) are explicitly marked TBD. Archiet populates structure; humans populate legal interpretation.
—Every document is deterministic. Same genome produces identical documents — regeneration is audit-safe.
—No content is fabricated. If a piece of information doesn't exist (no PII detected, no compliance flag set), the relevant section says so explicitly rather than inventing placeholder content.