Scope

Scope settles intent and authority so a fresh agent can build and verify the work.

Spec gate

Produce a one-screen digest and ask for one approval:

• outcome, and the number of criteria
• risk tier and authority (paths, effects, expiry)
• one-way doors: release, publish, send, spend, destroy, widening authority
• assumptions made, and open calls with a recommended default for each

Only the user can downgrade risk. Approval covers the digest; a changed criterion needs a new revision and a new approval. Implementers cannot weaken criteria.

Size to the class

A bug is repro, expected, observed and a regression check. A task has 2 to 5 criteria, a feature about 10. Anything larger is an epic: a Done when plus backlog lines, not a mega-spec. Over-specifying a small change is a defect.

State what and why, plus one-way-door constraints. Leave design to the implementer unless a decision has a rejected alternative. An architectural one becomes an ADR; record any other settled decision in the durable doc that owns the area.

Write each criterion as one observable statement, When <event>, <behaviour>, tagged with how it is verified: [test], [command], [capture] or [review]. Check premises against the tree, give each deletion or move one owner, and say how verification catches a wrong implementation; test behaviour, not wording. Add must-not-change behaviour and the verify command. The readiness test: could a fresh agent build and verify this without asking? If not, it is not ready.

Questions

Ask only when uncertainty and stakes are both high. The ladder:

1. Engineering call: decide and record Decided (<source>): <reason>.
2. Reversible owner call: assume, record, flag in the digest.
3. Irreversible owner call: provenant ask --file Q.json --session S with options and a recommendation (file shape in the human-inbox runbook). Park only that branch; continue the rest.

Never leave a Spec gap: line or a guess.

Modes

• Interview (the user asks to be grilled): one question at a time, highest leverage first, each with evidence and a recommendation. Answer from the workspace instead of asking. Stop when criteria are clear.
• Spike: one falsifiable question, a timebox, kill criteria, a registered scratch worktree. Harvest the answer into the spec and discard the code. Read interview and spike.
• Kept prototype: when it is a reference, own the repo file and index it through engineering-docs. Publishing a private Claude artifact copy is fine; the repo file stays the source. For UI, see ui-ux-design.

Fan-out

Use plan by default to shape unsettled work, explore over named areas to map evidence, research for dated primary sources and design for options:

provenant run --use plan --file brief.md --explain
provenant run --use explore --route junior --over src --file questions.md --explain

Compose nodes with after and inputs; use synthesise to reconcile returns. Read-only scoping grants no build authority. A later implement node starts only after scope and write authority hold. The briefs in references/ supply scouting, research, architecture, acceptance and critique questions.

Land

The spec lives where the repository's process says: by default the issue body, which dies with the delivering PR (tracker owns the template); a repository with project docs or no tracker names its own spec home. Cite path#Symbol, never scratch files.