01 Effortless requirements editing
A spreadsheet-fast table for your SRS and VTP. The editor opens files straight from your repo — no server, no import, nothing leaves your machine.
$ git log docs/specpad/srs.json
Design-control evidence for medical device software — kept in your git repo.
Requirements, detailed design, software risk, third-party software, cybersecurity and verification — one traced chain, as schema-validated JSON in your repo, captured by a Claude skill as you build and reviewed by humans in a visual editor. Conformity reported clause by clause against IEC 62304 and the FDA software, cybersecurity and off-the-shelf guidances. The core is domain-neutral, so it works anywhere; the regulated depth is what it was built for.
MIT Free and open source — github.com/pizzaow/specpad
## How it works
One contract. Two ways to edit. Git in the middle.
The skill edits programmatically; humans review visually. Both obey the same schema and governance rules — and git keeps the history.
## In depth
The parts worth a longer look.
Each of these is a page rather than a paragraph, because each is a decision with a reason behind it — and the reasons are what a reviewer asks about.
Traceability
Product need → requirement → design → verification, with risk and threat controls resolved backwards onto the requirement. Stored once, by stable identifier.
Read moreStandards conformity
IEC 62304 and three FDA guidances, clause by clause, with each status derived from the project rather than asserted. Nothing is ever reported as a gap.
Read moreCybersecurity
A threat model rated on exploitability, controls grouped by FDA category, architecture views with labelled diagrams, and the §V.C security testing taxonomy.
Read moreRisk, SOUP & design
The clause 7 slice with no probability on it, third-party software with real end-of-life dates, and units that carry acceptance criteria.
Read moreSelf-hosted server
Your repository, your identity provider, per-user working copies, a server-side commit gate, and merging that never touches text.
Read moreDeployment
A browser editor with nothing to install and nothing stored, or one container image you run yourself. Both open the same documents.
Read more## Features
Seven registers. One contract. Every link checked.
Each capability twice over — what you see in the editor, and the mechanism behind it.
02 Docs that keep up with your code
The Claude skill reads and writes the same files. Finish a change, say “update the spec” — requirements and tests stay current without leaving the terminal.
claude — your repo
> update the spec for the new export flow
✓ updated specpad.srs.json (2 requirements)
✓ updated specpad.vtp.json (2 tests)
✓ validation + governance clean03 Traceability by construction
Every test declares what it verifies, linked by stable ids that survive renames. Governance checks flag untested requirements before an auditor does.
04 Redlines, automatically
The editor diffs your working copy against the released baseline — see exactly what changed since the last release, with no hand-maintained change tables.
05 Version history from your tags
Releases are just git tags. SpecPad snapshots each one, so any past revision is one click away — author and date come from the commit itself.
06 Tied to your ticket
Associate working changes with a job — a ticket key, an issue number — so every requirement edit traces back to why it happened.
07 Validated twice: structure and policy
JSON Schema catches malformed files; governance rules catch broken links, missing expected results, and untraceable requirements. The skill and the editor run the same checks from one shared module.
## The full picture
One traceable chain, captured as you build.
Every artifact a design-controls reviewer expects — and that good engineering wants anyway — living in your repo, kept current by the working loop.
- Product requirementsUser needs and product intent (PRD) — the top of the trace matrix, with proposed vs implemented status.
- Requirements & verificationTestable “shall” requirements (SRS), each proven by a verification test with a defined expected result (VTP).
- Traceability matrixProduct requirement → requirement → verification, with each requirement’s result rolled up and gaps flagged.
- Auditor design-control mapIEC 62304 & 21 CFR 820.30 elements → the exact place each piece of evidence lives. Answer “where are your design inputs?” in one click.
- ArchitectureAn arc42 document with draw.io diagrams, co-versioned with the spec and diffed per change.
- Change controlEvery change tied to a job; see a job’s in-progress and released SRS/VTP/architecture diffs, derived from git.
- ReleasesVersioned design-control checkpoints — a full-document snapshot and the jobs that shipped in each.
- Governance, enforced twiceStructure (JSON Schema) then policy (traceability, coverage) — the same gates run by the skill and the editor.
- ThemesDeveloper, editorial, or blueprint — pick the look; your choice follows you.
- eQMS export soonA versioned evidence package for your external quality system.
## Who it’s for
Built for regulated work. Useful everywhere.
Medical device software
IEC 62304 clause by clause, ISO 13485 §7.3 design controls, the FDA software, cybersecurity and off-the-shelf guidances — with the evidence traced end to end, and without standing up heavyweight tooling.
Everyone else
The same rigor is just good engineering practice: specs that can’t silently rot, tests that can’t silently detach.
## Get started
Installed in under a minute.
-
Download the skill
-
Unzip it
into
~/.claude/skills/ -
Say the words
set up specpadin your repo