Specly
Home

Compose Hybrid Spec

Pick features from multiple specs and mix them into a single build. Notifications from Slack + payments from e-commerce? Go.

Source specs

Note-taking / Knowledge Base9 features
Activity Feedhigh

Fan-out Architecture*

Store events once; when a user requests their feed, query and merge sources on demand.
When an event is produced, write a copy into each follower's feed.
Push events to follower feeds up to a follower-count threshold; pull inline for celebrity accounts.

Ordering & Ranking*

Newest first, no ranking model.
Items scored by predicted relevance (affinity, recency, engagement signals).
Split the feed into curated sections (e.g. "Mentions", "Replies", "All activity").

Feed Capabilities

Show 'N new items' while the feed is open; insert on click.
"Alice, Bob, and 12 others liked your post" instead of 14 rows.
Edits and deletions to source content update the feed copies (push model).

Tradeoffs

CostFan-out on write

Read speed gains paid for by write amplification — cost scales with follower counts

ComplexityEngagement ranking

Model training, feedback collection, and trust-and-safety review all expand

ComplexityReal-time updates enabled

Requires a pub/sub layer (overlaps with notifications infra)

fromNote-taking / Knowledge Base
Comments & Discussionsmedium

Threading Model*

All comments under an object are a single chronological list.
Comments are flat, but each comment can open a single-depth thread of replies.
Unlimited reply depth with visual indentation.

Content Features

Bold, italic, lists, code blocks, links.
Type @ to reference a user; triggers a notification for that user.
Lightweight acknowledgment without a full reply.
Attach screenshots or files directly in comments.

Moderation Controls

Authors can edit or delete; admins can always delete.
Users flag comments for moderator review.
Pre-filter new comments via Perspective API, OpenAI moderation, or a rules engine.
Cap comments per minute/hour; prevents drive-by spam and emotional flooding.

Tradeoffs

UXDeep nesting chosen

Mobile UX suffers past 3 levels; pagination and collapse behavior need design attention

ComplexityMentions enabled

Expand notification infrastructure — mention notifications are high-priority and user-visible

CostAutomated moderation enabled

Third-party ML dependency and ongoing tuning of thresholds to balance false positive rate

fromNote-taking / Knowledge Base
File Storagemedium

Storage Backend*

Files stored on the server filesystem
AWS S3, Cloudflare R2, MinIO, etc.
Object storage + edge CDN for global delivery

File Processing

Scan uploads for malware before storing
Auto-generate thumbnails on upload
Verify file type matches declared MIME type

Tradeoffs

ScalabilityLocal disk selected

Not horizontally scalable; lost on server replacement without backup

CostCDN-backed storage selected

Higher monthly cost; requires cache invalidation strategy

LatencyVirus scanning selected

Upload latency increases; requires AV service integration

fromNote-taking / Knowledge Base
Notificationsmedium

Delivery Method*

Push notifications instantly as events occur
Client polls server on a fixed interval
Send email when user is offline
Native push notifications for mobile apps

User Control

Simple global on/off toggle
Separate preferences per event category
Highly granular per-item preferences

Tradeoffs

CostReal-time delivery selected

Requires persistent connection infrastructure (e.g. Redis pub/sub, WebSocket server)

LatencyPolling selected

Higher server request volume; notifications may lag by poll interval

ComplexityMobile push selected

Requires APNs/FCM credentials and certificate management

ComplexityPer-source granularity selected

Significantly more complex preference storage and UI

fromNote-taking / Knowledge Base
Onboarding & Activationmedium

Onboarding Format*

No dedicated onboarding UI — every empty screen contains a clear primary action pointing to the next step.
A dismissible checklist ("Invite teammate • Create project • Connect integration") visible until complete.
Step-through overlays point at UI elements on first use.
User cannot access the product until they complete N configuration screens.

Personalization Signals

Ask one or two questions to route the user to a tailored first experience.
Present starter templates ('Blank', 'Team docs', 'Marketing site') as the first interaction.
Every new workspace starts with an example project the user can play with.

Activation Support

Email nudges when a user signed up but has not yet hit the key activation action (e.g. created their first project).
A persistent help button that opens relevant docs or a short walkthrough based on the current page.
Intercom-style chat surface active for new users in their first few days.

Tradeoffs

UXSetup wizard as format

Controls first-experience but introduces sign-up drop-off proportional to wizard length

ComplexityActivation emails enabled

Requires event tracking + scheduled jobs + segmentation infrastructure

CostLive chat during onboarding

Staffing cost scales with signup volume — not viable for self-serve products below a certain ACV

fromNote-taking / Knowledge Base
Public API & Webhooksmedium

API Type*

Standard JSON REST API — lowest barrier to entry
GraphQL for flexible querying alongside REST
Real-time push alongside REST for event-driven clients

API Authentication*

Simple token-based auth — easy to implement and use
Delegated access — required for third-party app integrations
Keys for server-to-server, OAuth for user-delegated access

Webhooks

No outbound webhooks
POST to a configured URL on key events
Kafka-style event stream with retries, dead-letter queue, and signatures

Tradeoffs

ComplexityGraphQL added

Powerful for clients but requires schema design discipline; N+1 queries are a common pitfall

ComplexityOAuth 2.0 selected

Enables third-party integrations but requires an authorization server and token management

ComplexityWebhook streaming selected

Event ordering, deduplication, and retry logic become your responsibility

fromNote-taking / Knowledge Base
Roles & Permissionshigh

Authorization Model*

A fixed enum on the user record gates admin-only routes.
Users are assigned roles; roles bundle permissions; code checks permissions, not roles.
Permissions derived from attributes or graph relationships (owner, member, parent folder, etc.).

Permission Scope*

Permissions apply across the entire product.
A user has different roles in different workspaces or organizations.
Access lives on the resource itself — share a single document with specific users.

Custom Role Management

Roles (admin / member / viewer) are defined in code; customers cannot change them.
Admins can create roles and assign permissions.

Tradeoffs

ComplexitySimple roles chosen

Fast to build but every 'special case' access rule becomes bespoke code that's hard to audit

ComplexityABAC / ReBAC chosen

Requires a policy engine and relationship store kept in sync with primary data

LatencyPer-resource scope enabled

Every list/read query must filter by ACL — expect query-plan work and caching investment

CostCustomer-defined roles enabled

Support load increases substantially — each customer now has a unique permission configuration

fromNote-taking / Knowledge Base
Searchmedium

Search Approach*

Structured filters on known fields; no free-text
SQLite FTS5 or Postgres tsvector; keyword matching
Embedding-based similarity search

Search Scope*

Search within one list or dataset
Search across multiple resource types simultaneously

Tradeoffs

ComplexityFull-text search selected

Requires FTS index maintenance; adds write-time overhead

CostSemantic search selected

Embedding generation adds latency and API cost per indexed document

ComplexityGlobal search selected

Results must be unified and ranked across disparate data models

fromNote-taking / Knowledge Base
User System & Authlow

Authentication Methods*

Classic credential-based login
One-click login via email link
Sign in with Google
Sign in with GitHub
Enterprise single sign-on

Access Control*

No roles — every authenticated user has the same access
Simple two-tier access control
Custom roles with fine-grained permissions

Multi-factor Authentication

Single-factor only
Time-based one-time passwords

Tradeoffs

ComplexityOAuth providers added

Each provider requires an OAuth app registration and key rotation policy

ComplexitySAML/SSO selected

Requires IdP partnership and XML-based protocol handling; significant integration work

ComplexityRBAC selected

Permission checks must be applied consistently across every data access path

fromNote-taking / Knowledge Base

Summary

9 of 9 composed features enabled

Pulled from 1 source spec

Effort Estimate

10+ weeks

5+ engineers