Essential|~6 min read

1. Getting Started & System Overview

Executive architecture, value proposition, 5-minute fast-track quickstart, and BYOK multi-provider setup.

01

Executive System Overview

Why traditional one-shot prompting fails for software specifications, and how SRA treats requirements engineering as a precision manufacturing process.

The Paradigm Shift in Requirements Engineering

Modern enterprise software projects frequently fail or experience massive scope creep due to ambiguous, untraceable, or contradictory specifications. Traditional AI tools attempt "one-shot" prompt generation, resulting in generic, ungrounded text that lacks architectural rigor, adherence to industry standards, or bi-directional traceability to the actual codebase.

The SRA (Smart Requirements Analyzer) platform re-engineers requirements engineering into a multi-layered manufacturing pipeline. Raw stakeholder intent is systematically ingested, validated across multi-agent systems, benchmarked against rigorous quality standards, refined through interactive human-in-the-loop loops, and indexed into a vector knowledge base for enterprise-wide reuse.

Key Enterprise Capabilities:

  • Multi-Standard Synthesis: Generates specifications formatted strictly according to IEEE 830-1998, ISO/IEC/IEEE 29148:2018, Volere, or Agile PRD.
  • Bi-Directional Code Traceability: The SRA CLI bridges cloud specifications and local Git repositories, verifying that requirements are implemented without link rot.
  • Granular RAG & Knowledge Recycling: Historical requirements are shredded into semantic vectors and indexed via Supabase pgvector to accelerate new projects.
  • Zero-Trust BYOK Security: User provider API keys are encrypted at rest with AES-256-GCM and never retained in server logs.

Core Architectural Guarantees

SRA is built upon four non-negotiable architectural invariants:

  1. Immutability & Recursive Version Trees: Every modification or chat refinement branches a new analysis node (rootId and parentId). Prior versions are preserved forever for regulatory auditability.
  2. Deterministic Quality Gates: No specification is marked complete without undergoing a reflection loop scoring Clarity, Completeness, Conciseness, Consistency, Correctness, and Context (6Cs score ≥ 85/100).
  3. Multi-Tenant Scoping: All database reads, RAG context queries, and session management are isolated strictly by userId at the query layer.
  4. Resilient Serverless Checkpointing: Asynchronous jobs execute through Upstash QStash with self-checkpointing budgets (pipelineBudget.js), preventing serverless timeout drops.
02

5-Minute Fast-Track Quickstart

Get up and running with your first requirements specification in under 5 minutes using the Web Workspace or Terminal CLI.

You can generate, inspect, and export your first software specification using either the Web Workspace or the Developer CLI.

Option A: Web Workspace Quickstart

  1. Sign In: Navigate to /auth/login and authenticate via Google OAuth or Email.
  2. Add Provider Key: Go to Settings → AI Provider Keys and enter your Google Gemini, OpenAI, Claude, or Grok API key.
  3. Create Analysis: Click New Analysis (⌘N), enter your project title (e.g., "Healthcare Patient Intake Portal"), and paste your unstructured business requirements or user stories.
  4. Select Standard: Choose your target specification standard (IEEE 830-1998, ISO 29148, Volere, or Agile PRD).
  5. Monitor Live Stream: Watch the multi-agent system process through Intake Mapping, Architecture Synthesis, and the 6Cs Quality Audit in real time.
  6. Refine & Export: Switch between Conversation mode (to prompt changes) and Document mode to download your specification in DOCX, Markdown, LaTeX, or Typst.

Option B: Developer CLI Quickstart

Install the global SRA CLI and generate specifications directly from your local terminal workspace:

# 1. Install CLI globally
npm install -g @sra-srs/sra-cli

# 2. Authenticate session
sra auth login

# 3. Analyze intent file and watch live progress
sra analyze --input requirements.md --format ieee830 --watch

# 4. Sync requirements specification locally
sra sync --output sra.spec.json
03

BYOK (Bring Your Own Key) Multi-Provider Configuration

Configure your own API keys for Google Gemini, OpenAI GPT-4o, Anthropic Claude, or xAI Grok with AES-256-GCM zero-trust encryption.

Zero-Trust BYOK Security Model

SRA operates on a strict Bring Your Own Key (BYOK) architecture for all generation workloads. Your API keys are encrypted at rest using AES-256-GCM symmetric encryption with unique initialization vectors (IVs) and authentication tags.

Note

The platform's built-in Gemini key is used strictly for vector embeddings (text-embedding-004, dimension 768) to maintain dimensional consistency in the Supabase pgvector database. All generation, reasoning, and reflection workloads run through your own nominated provider key.

Supported Providers & Recommended Models:

ProviderDefault ModelBest Used For
Google Geminigemini-2.5-flashUltra-fast drafting, large context window (1M+ tokens), low latency
OpenAIgpt-4oStructured JSON synthesis, detailed technical schemas
Anthropic Claudeclaude-3-5-sonnetComplex domain reasoning, deep code architecture, formal methods
xAI Grokgrok-betaRapid alternative analysis, high-speed reflection audits

Cryptographic Key Storage & Lifecycle

When you save an API key in Settings:

  1. The backend providerKeyService.js generates a cryptographically random 12-byte IV.
  2. The key is encrypted via AES-256-GCM using the server's master encryption key (ENCRYPTION_KEY).
  3. Only the ciphertext and auth tag are persisted in PostgreSQL.
  4. During an analysis job, keys are decrypted temporarily in ephemeral memory and discarded immediately after HTTP calls to the AI provider.
  5. Server logs and error handlers automatically scrub and redact any credential-shaped strings.
Was this page helpful?

Help us improve the SRA enterprise documentation.

NextAnalysis Pipeline