[zwanski-start]

What changed

.claude/commands/create-spec.md, Phase 4L (Derive Feature Count)
Replaced the overlapping "Each CRUD operation / UI interaction / validation / visual requirement = 1 feature" heuristic with the structure proposed in the issue:

• Definition of an atomic feature (one Given/When/Then, one primary assertion, can be built without mockups).
• Seven MECE buckets in a table, each with what it covers and its hard boundary question: Domain Behaviors, UI Composition & Navigation, Input Constraints, Authorization & Access Control, Resilience & Error Recovery, Integration & Data Exchange, Presentation Quality.
• Required fields per atomic feature: Location, Actor + preconditions, Trigger, Expected outcome, Failure behavior.
• Practical counting rules per bucket and atomicity checks (split or reject a feature with multiple triggers, multiple areas, mixed buckets, or multiple "Then"s).
• The "present your estimate" template now breaks the count down by these buckets, plus the 5 mandatory infrastructure features.

.claude/commands/expand-project.md, Phase 3 (Derive Features)
This had the same four overlapping rules. I replaced them with a shorter version of the same model so both flows count features the same way.

Assumptions

• I added a tie-break rule that the issue doesn't spell out. When a behavior seems to fit several buckets, split it. If it really is one behavior, use the most specific bucket: Input Constraints, Authorization, Resilience, Integration and Presentation win over the general Domain Behaviors and UI Composition buckets. Without this, a server-side validation rule would also answer "yes" to "is a domain rule enforced?", and the buckets would no longer be mutually exclusive.
• Infrastructure features (indices 0-4) stay a separate, mandatory group outside the buckets.
• If Location, Trigger or Expected outcome can't be filled in, the agent asks a follow-up question or states an assumption. This fits the existing "DO NOT ASK THE USER" rule, which is about the feature count, not about behavior.
• The spec XML template (<core_features>) is unchanged. The buckets only guide counting and presentation.

Verification

• This only changes prompts. I confirmed that server/services/spec_chat_session.py and expand_chat_session.py load these files whole (read_text), so no code parses the section contents. I reviewed the rendered markdown (table, lists).

Closes #54

🤖 Generated with Claude Code

[zwanski-start]

🔍 QA report: ✅ Passed

Tester: Ken (cubefarm agent, in a fresh session) · Round: 1 · Author: Barbara

This PR changes only two prompt files. It replaces the overlapping CRUD / UI interaction / validation / visual rules in create-spec.md (Phase 4L) and expand-project.md (Phase 3) with the issue's model: atomic Given/When/Then features, seven buckets with hard boundary questions, required fields, counting rules and atomicity checks. A tie-break rule (the most specific bucket wins) keeps the buckets from overlapping. Both prompts still load and are written out as UTF-8 by the spec and expand chat sessions. Lint, build and security tests pass, and the mypy and pytest failures are identical on master.

	Check	Details
✅	Issue acceptance: atomic feature definition	create-spec.md defines an atomic feature as one test case with a single Given/When/Then outcome (one primary assertion) that can be built without mockups. It matches the issue's wording.
✅	Issue acceptance: MECE buckets with boundary questions	A table lists all 7 buckets (Domain Behaviors, UI Composition & Navigation, Input Constraints, Authorization & Access Control, Resilience & Error Recovery, Integration & Data Exchange, Presentation Quality), each with what it covers and its boundary question from the issue. A tie-break rule (the specific buckets win over Domain/UI) keeps a behavior from landing in two buckets.
✅	Issue acceptance: required fields per feature	Location, Actor + preconditions, Trigger, Expected outcome and Failure behavior are all listed. There is guidance for when a feature is under-specified.
✅	Issue acceptance: practical counting rules and atomicity checks	All 7 counting rules and all 4 atomicity checks from the issue are present. The estimate template now breaks the count down by bucket plus the 5 infrastructure features.
✅	Old overlapping rules removed everywhere	A repo-wide grep for 'Each CRUD operation', 'Each UI interaction' and 'visual requirement = 1' finds no matches. expand-project.md got a shorter version of the same model, so both flows count the same way.
✅	Prompt loading and encoding	spec_chat_session.py and expand_chat_session.py use read_text(encoding='utf-8') and replace $ARGUMENTS. The project CLAUDE.md is written with encoding='utf-8'. A script reproducing that load succeeded for both files. The new '→' is the only non-ASCII character, and the UTF-8 handling covers it on every OS. Nothing parses the section contents, and the <core_features> template is unchanged.
✅	Python lint / types / tests vs master	ruff is clean. mypy reports 24 errors and pytest 21 failed / 144 passed on both the PR and a clean checkout of origin/master, with an identical list of failing tests. The failures come from pytest-asyncio missing in the venv ('Unknown pytest.mark.asyncio'), not from this change. test_security.py: ALL TESTS PASSED.
✅	FastAPI boot and key routes	uvicorn on 127.0.0.1:5345: /api/health 200, /api/projects 200, unknown project 404, invalid name 400, SPA / 200.
✅	UI build, lint and browser load	tsc -b && vite build succeeded. ESLint: 0 errors, 6 warnings. The served app rendered the welcome/project selector with 0 console errors or warnings.
⏭️	Live spec-creation chat session	This needs the Claude CLI or an API key, which QA must not depend on. The change is prompt text only, and its loading path was checked above.
⏭️	Playwright e2e	The PR changes no UI code.

🧪 Commands run

Command	Result
git diff origin/master...HEAD	2 files (.claude/commands/create-spec.md, expand-project.md), +67/-15
venv/bin/python -m ruff check .	All checks passed!
venv/bin/python -m mypy .	24 errors in 9 files, same count on origin/master
venv/bin/python -m pytest -q	21 failed, 144 passed. Same failing set on origin/master (pytest-asyncio not installed)
venv/bin/python test_security.py	ALL TESTS PASSED
npm --prefix ui run build	built successfully
npm --prefix ui run lint	0 errors, 6 warnings
venv/bin/python -m uvicorn server.main:app --host 127.0.0.1 --port 5345 + curl route checks	200/200/404/400/200 as expected; server stopped afterwards
python prompt-load probe (read_text utf-8 + $ARGUMENTS replace for both prompts)	both load; new bucket content present

No browser screenshots were taken in this round.

_{Posted by cubefarm · merges automatically once GitHub's checks pass}