Use Requirement Decomposition Prover with your AI.

Validate requirement decomposition

This eliminates the 80% Problem. You must: (1) HAPPY PATH. define exact inputs, outputs, state transitions, and success criteria. "Should work" is not a spec. Specific values, specific types, specific responses, (2) ERROR STATES. for EVERY external dependency: what if it is slow? Down? Returns garbage? For every user input: what if it is malformed? Missing? Hostile? Each error state requires: detection, user response, recovery, alerting, (3) EDGE CASES. empty, null, max-length, unicode, emoji, zero, negative, concurrent access, timezone boundaries, DST transitions, leap years. If a field accepts strings, test the full Unicode range, (4) SECURITY. every input is untrusted. OWASP Top 10 for every endpoint. Password hashing from Day 1. Rate limiting from Day 1. Input validation is a REQUIREMENT, (5) OBSERVABILITY. structured logging (not console.log), metrics (latency, throughput, error rate), alerting (threshold-based), distributed tracing for async flows. If you cannot measure it in production, you cannot fix it in production. If rejected, decompose further before writing any code. Structured reflection capability that forces COMPLETE requirement decomposition before code generation. eliminates the "80% Problem" where AI delivers the happy path but omits error handling, edge cases, security, and observability. Based on IEEE 830 requirements specification, Gause & Weinberg "Exploring Requirements" (1989), and the "Swiss Cheese Model" of failure prevention. Catches Happy-Path-Only (building the success case and ignoring every failure mode. "Build a user registration endpoint." Happy path: POST /register with name, email, password → create user → return 201. Shipped. Then: Week 1: 400 users register with "password123". no strength validation. Account takeovers begin. Week 2: someone registers with the same email twice. duplicate users, login resolves to first-created user, second user cannot access their data. Week 3: bot registers 50,000 accounts in 12 hours. no rate limiting. Database grows 4GB. Week 4: user registers with email "admin@company.com". no email verification. They reset the admin password and access the admin panel. Every one of these was predictable. Every one was in the requirements. just unwritten. The "80% Problem": the happy path IS 80% of the code. The other 20% is 80% of the bugs), Error Amnesia (no systematic mapping of what goes wrong. "What if the database is down?" "That won't happen." AWS RDS has 99.95% uptime SLA. which means 4.38 hours of downtime PER YEAR. If registration handles 200 requests/hour, that is 876 failed registrations per year. Each failed registration with no error handling: user sees a 500 error with a stack trace (information disclosure. CWE-209), retries 3 times (tripling the load on a struggling DB), then abandons. Recovery: nothing. no retry queue, no graceful degradation, no user notification. Systematic error mapping: for EVERY external dependency (database, email service, payment gateway, third-party API), answer: what happens when it is slow (>2s)? Unavailable? Returns garbage? Each answer requires: detection method, user-facing response, retry strategy, alerting), Edge-Case Ignorance (not testing boundary conditions that WILL occur in production. The registration form accepts "name" as a string. What is tested: name="John Smith." What is NOT tested: Empty string: name="". does validation catch it? What error message? Maximum length: name="A" × 10,000 characters. does the DB column handle it? Denial of service? Unicode: name="José María García-López". does the system handle accented characters? RTL: name="محمد". does the UI render correctly? Does search work? Emoji: name="Alex 🚀 Smith". does the DB column support utf8mb4? Script injection: name="<script>alert(1)</script>". XSS? SQL injection: name="'; DROP TABLE users; --". is input parameterized? Null byte: name="John\x00Smith". does the application truncate at null? Every field. Every input. Every boundary. If you only test "John Smith," you only support "John Smith"), Security-as-Afterthought (treating security as a phase, not a requirement. "We will add security later." The registration endpoint stores passwords in plain text: users.password = request.password. "We will add hashing in the security sprint." Before the security sprint: database backup is stolen from an unsecured S3 bucket. 50,000 passwords in plain text. Users reuse passwords. their bank accounts, email, and social media are now compromised. Cost: $150 per record (IBM Cost of a Data Breach 2024) = $7.5M liability. Plus mandatory breach notification (GDPR Article 33: 72 hours). Security requirements must be defined WITH functional requirements. not after. OWASP Top 10 is not optional. Input validation is not a feature. it is a requirement), and Observability Void (shipping code with no visibility into production behavior. "The registration endpoint is slow." How slow? For whom? Since when? Without observability: "We don't know." console.log("user registered") tells you: nothing useful. No timestamp, no user ID, no latency, no success/failure, no request ID for correlation. Structured logging: logger.info("user_registered", {user_id: "uuid", latency_ms: 142, email_sent: true, source: "web", ip_country: "US"}). queryable, alertable, traceable. Metrics: registration_count (rate), registration_latency_p95 (performance), registration_failure_rate (reliability). Alert: if failure_rate > 5% for 5 minutes → PagerDuty. Without observability, every production issue starts with: "Let me add some logs and redeploy"). Call once per feature before writing any code