Nw Po Review DimensionsSAFE

AI agents that guide you from idea to working code, with you in control at every step.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: nw-po-review-dimensions
description: Requirements quality critique dimensions for peer review - confirmation bias detection, completeness validation, clarity checks, testability assessment, and priority validation
user-invocable: false
disable-model-invocation: true
---

# Requirements Quality Critique Dimensions

When invoked in review mode, apply these critique dimensions to requirements documents.

Persona shift: from requirements analyst to independent requirements reviewer.
Focus: detect confirmation bias | validate completeness | ensure clarity and testability.
Mindset: fresh perspective -- assume nothing, challenge assumptions, verify stakeholder needs.

Return complete YAML feedback to calling agent for display to user.

---

## Dimension 0: Elevator Pitch Test (BLOCKING, checked first)

Every user story MUST contain an `### Elevator Pitch` subsection with three lines: Before / After / Decision enabled. The reviewer checks these invariants:

1. **Presence**: the section exists with all three lines. Missing → **BLOCKING**.
2. **Real entry point**: the "After" line references a user-invocable entry point (CLI subcommand, HTTP endpoint path, UI action) — not a service function, internal API, or test runner command. Internal-only → **BLOCKING**.
3. **Concrete output**: the "sees" clause describes observable output (stdout text sample, HTTP response body shape, rendered screen element) — not internal state, "tests pass", or "data is persisted". Internal state → **BLOCKING**.
4. **Job connection**: the "Decision enabled" line names a real decision the user makes with the output. If the story enables no user decision, it is infrastructure — BLOCK with recommendation to merge into a value-producing story.
5. **Slice-level check**: if every story in a slice is `@infrastructure`, the slice has no release value. **BLOCKING** at slice level — recommend re-slicing so that each slice contains at least one user-visible story.

Return this dimension first in the YAML feedback. If any BLOCKING issue is found, the overall review verdict MUST be `BLOCKED` regardless of other dimensions.

---

## Dimension 1: Confirmation Bias Detection

### Technology Bias
Pattern: requirements assume specific technology without stakeholder requirement.
Examples: "Deploy to AWS" when deployment not discussed | "Use PostgreSQL" in requirements instead of architecture.
Detection: check for technology specifics (cloud, database, frameworks). Verify stakeholder interviews mentioned these.
Severity: HIGH (constrains solution space unnecessarily).

### Happy Path Bias
Pattern: requirements focus on successful scenarios, minimal error/exception coverage.
Examples: login documented but account lockout missing | payment success but fraud/timeout/decline not specified.
Detection: count happy path stories vs error scenarios. Check each story has "sad path" alternatives.
Severity: CRITICAL (incomplete requirements, production error handling missing).

### Availability Bias
Pattern: requirements reflect recent experiences or familiar patterns over comprehensive analysis.
Examples: "Same auth as previous project" without validating fit | requirements mirror competitor without stakeholder validation.
Detection: check if requirements justified by stakeholder needs or "like previous project."
Severity: MEDIUM (sub-optimal solution, missed opportunities).

---

## Dimension 2: Completeness Validation

### Missing Stakeholder Perspectives
Stakeholder groups to verify: end users (primary, secondary, occasional) | business owners/sponsors | operations/support teams | compliance/legal | technical teams.
Detection: list stakeholder groups in requirements, check each group's needs represented, verify conflicting needs documented.
Severity: HIGH.

### Missing Error Scenarios
Required: invalid input validation | authentication/authorization failures | network timeouts | external service unavailability | data integrity violations | concurrent modification conflicts | resource exhaustion.
Detection: for each user story, check for corresponding error scenarios.
Severity: CRITICAL.

### Missing Non-Functional Requirements
NFRs to validate: performance (latency, throughput) | security (auth, data protection) | scalability (concurrent users, data volume) | reliability (uptime, error rates) | compliance (regulatory, legal) | accessibility (WCAG).
Detection: check NFR section exists, each NFR has measurable criteria, stakeholders provided expectations.
Severity: CRITICAL.

---

## Dimension 3: Clarity and Measurability

### Vague Performance Requirements
Pattern: qualitative terms without quantitative thresholds.
Vague: "System should be fast" | "User-friendly interface" | "Handle large volumes" | "Highly available."
Detection: identify qualitative adjectives (fast, large, friendly, high, secure). Check for corresponding quantitative threshold.
Severity: HIGH.

### Ambiguous Requirements
Pattern: requirements interpretable multiple ways.
Detection: check if two architects could design differently from same requirements. Look for multi-meaning words. Verify pronouns have clear antecedents.
Severity: HIGH.

---

## Dimension 4: Testability

### Non-Testable Acceptance Criteria
Pattern: AC not observable, measurable, or automatable.
Bad: "System should be easy to use" | "Code should be maintainable."
Good: "User completes checkout in 3 or fewer clicks, 95% success rate" | "Cyclomatic complexity at most 10, test coverage at least 80%."
Detection: for each AC, ask "Can an automated test verify this?" Check if AC specifies observable behavior with measurable pass/fail.
Severity: CRITICAL.

---

## Dimension 5: Priority Validation

### Questions to Ask

**Q1: Is this the largest bottleneck?** Does timing data show this is the primary problem? Is there a larger problem being ignored?

**Q2: Were simpler alternatives considered?** Does the document include rejected alternatives? Are rejection reasons evidence-based?

**Q3: Is constraint prioritiza

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.