What bmad-architecture
An intent-routed lean-spine model — Create, Update, or Validate —
that fixes only the invariants a future builder can't read off
compliant code, and produces ARCHITECTURE-SPINE.md as
the single source of truth.
The bmad-architecture skill replaces the old fixed
11-step bmad-create-architecture flow (now a
deprecated forwarding shim). Instead of marching through a fixed
sequence of categories, it first detects which of three intents
applies — Create a spine from scratch,
Update an existing one, or
Validate one without changing it — then routes
into a Coaching path (open-ended elicitation,
load-bearing calls shown not silently made) or a
Fast path (draft the whole spine with
[ASSUMPTION] tags for review).
Every decision, constraint, version, assumption, and open question
is logged to an append-only .memlog.md as it's made —
the run's working memory. ARCHITECTURE-SPINE.md is
then distilled from that memlog: invariants first, seed kept
minimal, every AD (architecture decision) carrying
Binds/Prevents/Rule, and Deferred items naming what the spine
deliberately does not decide. A breadth-coverage rubric plus a
Reviewer Gate (deterministic lint + rubric walker + parallel
subagent lenses) runs before the spine is marked final.
- Skill ID
bmad-architecture— supersedes the deprecatedbmad-create-architecture- Role
- Architectural facilitator — coaches decisions out of the user rather than silently inventing them
- Primary Output
-
ARCHITECTURE-SPINE.md— distilled from the memlog, not hand-edited directly - Secondary Outputs
-
ADRs/*.md(immutable, one file per major decision) ·.memlog.md(append-only audit trail) · optional human-facing renderings - Session Resume
-
Detects an existing run folder under
{workflow.spine_output_path}and offers to resume from its memlog instead of restarting - Activation Modes
Why The case for structured architecture
Without a shared architectural blueprint, AI agents make independent decisions — and those decisions conflict.
When multiple AI agents implement different parts of a system
without a single reference document, the same concept gets named
differently across modules, API response formats diverge, error
handling strategies clash, and the project structure becomes
inconsistent. The first agent calls a table users; the
second calls it User; the third stores user IDs as
userId in one service and user_id in
another.
The architecture document prevents this by establishing decisions once, collaboratively, before implementation begins. Every downstream agent reads the same document and implements within the same constraints.
Before Prerequisites & inputs
The input's shape decides the job — a SPEC.md +
memlog is the richest, preferred start, but a raw idea, an
existing codebase, or an existing spine to extend all route to a
working session.
bmad-create-architecture flow, this skill does not
hard-block on a missing PRD. If the real ask is requirements, UX,
or an epic breakdown, Step 1 redirects to bmad-prd,
bmad-ux, bmad-spec, or
bmad-create-epics-and-stories instead.
Required & Optional Documents
{workflow.spine_output_path}, Step 1 offers to
resume from its memlog. Inheriting a parent spine (e.g. one
epic of a feature spine) loads its ADs and paradigm as binding,
read-only Inherited Invariants.
Skills & Knowledge Needed
| Area | Why It Matters | Level Needed |
|---|---|---|
| System Design | Ability to reason about components, boundaries, data flows, and integration points — the core of every architecture decision. | Intermediate+ |
| Technology Stack | Familiarity with the relevant ecosystem (web, mobile, API, CLI). The skill researches versions, but you need to evaluate the options presented. | Working knowledge |
| Security Basics | Step 4 covers auth/security decisions. Understanding authentication patterns, data encryption, and API security helps validate AI proposals. | Basic awareness |
| Infrastructure | Deployment models (cloud, serverless, containers), CI/CD concepts, and environment configuration — covered in Step 4's infrastructure category. | Basic awareness |
| ADR Format | Architecture Decision Records (Nygard format) — the output format for major decisions. The AI generates these, but knowing the format helps review them. | Awareness only |
How The 8-step architecture workflow
Steps 1–2 route the run; steps 3–6 build the spine from the
memlog outward; step 7 is a hard gate; step 8 closes and hands
off. ARCHITECTURE-SPINE.md is written from the
memlog — never hand-patched directly.
{workflow.spine_output_path} and offers to resume
from its memlog instead of restarting. No decisions are lost
between sessions.
references/headless.md end to end; forwarded
calls from the deprecated bmad-create-architecture
shim honor pre-resolved fields verbatim.
-
Resolves customization, loads
bmm/config.yaml, then detects one of three intents -
If a run folder already exists under
{workflow.spine_output_path}, offers to resume from its memlog instead of restarting -
If the real ask is requirements, UX, a capability
contract, or an epic breakdown, redirects to
bmad-prd,bmad-ux,bmad-spec, orbmad-create-epics-and-storiesinstead - A single skill replacing three fixed flows must route correctly on the first turn — misrouting into Create when the user meant Validate wastes the whole session
[ASSUMPTION] tags for review.
- Offered as an activation step, in the user's language, before any drafting
- Coaching path pulls decisions out of the user with open-ended questions; Fast path infers and tags
- Elicitation is the value the skill is coaching toward — silently drafting the whole spine defeats the purpose unless the user explicitly wants speed
- Also asks, mandatory on both paths: is the spine the only deliverable, or does the user need a purpose-scoped human-facing artifact later at Finalize?
-
A
SPEC.md+ memlog is the richest, preferred start -
Brownfield work investigates real code and
project-context.mdto ratify existing conventions rather than invent new ones - The spine's altitude must mirror what it augments (initiative→features, feature→epics, epic→stories) and stay coherent with whatever level sits below it
- Inheriting a parent spine (e.g. one epic of an existing feature spine): its ADs and paradigm load as binding, read-only Inherited Invariants — only the parent's Deferred items are this run's job
- One test decides what belongs in the spine: could two units built independently choose incompatibly, and is the call non-obvious and a real trade-off? If not, it's Deferred
- Everything structural (the seed) is true at cold-start and owned by the code once it exists — over-fixing seed content invites drift between spine and reality
- Verify any named technology's current version and fit on the web before binding it into the spine
.memlog.md — the run's working memory, not the
rendered spine.
-
Each surviving decision becomes an
AD-n(stable ID, Binds / Prevents / Rule); a decision that lives only in a diagram is still logged -
Distilling the spine from a living log — instead of
hand-editing the artifact — lets Update runs amend a
Rule in place and add the next
AD-nwithout ever renumbering or reusing a retired ID -
Writes go through the shared
memlog.py init/append --type <decision|constraint|version|assumption|question|direction|event>script — never a hand-patch to the spine file
ARCHITECTURE-SPINE.md from the memlog —
invariants first, seed minimal, every AD carrying
Binds/Prevents/Rule, Deferred naming what it won't decide.
- Sweeps the breadth the altitude owns — every structural dimension (including the operational/environmental envelope: deployment, infra, operations) is decided, deferred, or an open question
- No placeholders; nothing invented to fill a gap — a whole dimension left silent is the failure mode this breadth-coverage rubric exists to catch
- A subagent per load-bearing input reconciles the draft against its source and flags anything the AD structure quietly dropped, before the Reviewer Gate
lint_spine.py pass + a
good-spine rubric walker + every finalize_reviewers
lens dispatched as parallel subagents against
ARCHITECTURE-SPINE.md.
- Deterministic lint catches structural violations (missing Binds/Prevents/Rule, orphaned AD references, malformed frontmatter) before any subjective review runs
- The rubric walker checks breadth coverage against the altitude's structural dimensions
- Parallel subagent lenses (security, scalability, simplicity, coherence with inherited invariants) surface findings concurrently rather than serially
-
Any critical issue resolved collaboratively before the
spine is marked
status: final
status: final; recommend
bmad-spec, then
bmad-create-epics-and-stories or
bmad-create-story.
- Renderings (C4/ERD/sequence diagrams, a team walkthrough, a board vision doc) are generated only if Step 2's up-front purpose check asked for one
-
Marks the spine
status: finaland closes the memlog - Natural next step: 03·B Epics & Stories — stories are created after the spine so they reference specific binding decisions, not guesses
- Offers to answer questions about the finalized spine
Toolkit Techniques & frameworks used
The architecture skill draws on industry-standard frameworks — each applied at the right step to produce decisions that are defensible, traceable, and actionable.
Decision & Documentation Frameworks ADR · C4 · 12-Factor
| ADR Field | Purpose | Example |
|---|---|---|
| Title | Named decision, numbered for reference | ADR-001: Use PostgreSQL for primary data store |
| Status | Current state of the decision | Proposed / Accepted / Superseded (with link) |
| Context | The problem being solved, constraints forcing the decision | Need ACID transactions + complex relational queries |
| Decision | What was decided, stated concisely | Use PostgreSQL as the primary database |
| Consequences | Trade-offs accepted — both benefits and costs | + ACID compliance + JSON support − requires migration tooling |
| Alternatives | Options considered and why they were rejected | MongoDB rejected: no ACID across documents for our transaction pattern |
| Level | Audience | What It Shows |
|---|---|---|
| Context Diagram | All stakeholders including non-technical | System boundary + external actors (users, 3rd-party systems) |
| Container Diagram | Engineers — highest daily value | Major deployable units: web app, API, DB, queue, CDN — with data flows annotated |
| Component Diagram | Engineers working on a specific container | Major components within each container, their responsibilities and interfaces |
| Code Diagram | Optional — only for critical paths | Class/package level detail — generated from code tools, rarely hand-drawn |
| Factor | Architectural Implication |
|---|---|
| I. Codebase | One repo, many deploys — no per-environment code branches |
| II. Dependencies | Explicitly declare, never assume — lockfiles required |
| III. Config | Environment variables only — no config in code or repo |
| IV. Backing Services | Treat DB, queues, caches as attached resources — swappable |
| V. Build/Release/Run | Strict separation — builds are immutable artifacts |
| VI. Processes | Stateless, share-nothing — state in backing services |
| X. Dev/Prod Parity | Keep development, staging, production as similar as possible |
| XI. Logs | Treat as event streams — no log files, stdout only |
Consistency Pattern Categories Breadth-coverage Rubric
The breadth-coverage rubric (Step 6) sweeps every area where independently-built units could diverge and requires each to be decided, deferred, or logged as an open question — never left silent. The categories below are typical structural dimensions it checks:
| Category | What It Governs | Example Decisions |
|---|---|---|
| Naming Patterns | Database, API, file, and code naming conventions |
table names: users (plural, snake_case) ·
columns: user_id · endpoints:
/users
|
| Structure Patterns | Where things live in the project tree |
Tests co-located as *.test.ts · components by
feature · shared utilities in lib/
|
| Format Patterns | API response shapes, data exchange formats |
Error response:
{"error": {"code", "message"}} · dates: ISO
8601 · pagination: cursor-based
|
| Communication Patterns | Events, state management, async patterns |
Events: user.created (dot-notation) · state:
immutable updates · actions: VERB_NOUN
|
| Process Patterns | Cross-cutting operational concerns | Error recovery: retry with exponential backoff · loading: global + local states · validation: at boundary only |
Validation & Quality Frameworks STRIDE · ATAM · FMEA
| Threat | Description | Architectural Response |
|---|---|---|
| Spoofing | Impersonating another user or system | Strong authentication (MFA, signed tokens, certificate pinning) |
| Tampering | Modifying data or code in transit or at rest | Checksums, HTTPS, signed payloads, data validation at boundaries |
| Repudiation | Denying actions were taken | Audit logs, immutable event stores, signed requests |
| Info Disclosure | Exposing data to unauthorized parties | Encryption at rest + in transit, field-level ACLs, PII masking in logs |
| DoS | Making the service unavailable | Rate limiting, circuit breakers, auto-scaling policies |
| Elevation of Privilege | Gaining unauthorized access | Principle of least privilege, role-based access control, zero-trust patterns |
| ATAM Concept | How Applied in Step 7 |
|---|---|
| Quality Attributes | NFRs mapped to quality attribute scenarios: performance, availability, security, modifiability, testability |
| Architecture Drivers | The highest-impact NFRs surfaced while reading the input (Step 3) that have highest architectural impact — the 'north star' for all decisions |
| Sensitivity Points | Decisions that significantly affect one or more quality attributes — documented in validation results |
| Trade-off Points | Decisions that affect multiple quality attributes in conflicting ways — explicitly acknowledged in ADRs |
| Risk Identification | Potential failure points in the architecture — fed into FMEA analysis |
| FMEA Step | Purpose | Output |
|---|---|---|
| Failure Mode | What could go wrong in the architecture | Ranked list of failure scenarios per component |
| Effect | What happens to the system when this fails | Impact classification: critical / major / minor |
| Cause | Why this failure could occur | Root cause per failure mode |
| Mitigation | Architectural decision that reduces risk | Circuit breakers, redundancy, graceful degradation patterns |
Coaching / Fast Path & Optional Enhancers memlog-gated, not menu-gated
Unlike the old per-step [A] / [P] / [C] menu, the
gate is the memlog itself: nothing reaches
ARCHITECTURE-SPINE.md until it's an append-only line
in .memlog.md, written via
memlog.py append. Advanced elicitation and party mode
remain available as optional enhancers on either path.
- Returns enhanced insights for the decision in play
- User accepts or rejects before it becomes an AD-n
- Does not itself write to the memlog
- Collaborative discussion of the current decision
- User accepts or rejects the resulting proposal
- Accepted outcome is logged as a normal AD-n
.memlog.md.
- Only way a decision survives into the spine
- Never a hand-patch to
ARCHITECTURE-SPINE.md - Step 6 distills the spine from the accumulated log
ARCHITECTURE-SPINE.md directly. Every AD-n keeps a
stable ID for the life of the spine — Update runs amend a Rule in
place or add the next AD-n, never renumbering or
reusing a retired ID.
Applied Toolkit Skills, frameworks & outputs
bmad-create-architecture fixed 11-step flow.
Frameworks Applied
- C4 Model (Simon Brown) — context, container, component, code diagrams
- ADR Format (Michael Nygard) — numbered, immutable architectural decision records
- STRIDE (Microsoft) — threat modeling for security decision coverage
- ATAM (SEI) — architecture tradeoff analysis and NFR validation
- FMEA — failure mode identification and risk mitigation planning
- 12-Factor App (Heroku) — deployment and configuration principles
- Reference-class forecasting — estimates grounded in comparable past projects
- Breadth-coverage Rubric — every structural dimension decided, deferred, or an open question, never silent
-
Reviewer Gate — deterministic lint + rubric
walker + parallel subagent lenses before
status: final