Planning Workflow

{
  "functional_requirements": [
    {
      "id": "FR-001",
      "description": "User can authenticate via OAuth",
      "priority": "HIGH",
      "source": "stakeholder-interview-2026-03-01"
    }
  ],
  "non_functional_requirements": [
    {
      "id": "NFR-001",
      "category": "performance",
      "description": "API response time < 200ms p95",
      "measurable": true,
      "acceptance_threshold": "200ms"
    }
  ],
  "constraints": [
    {
      "id": "CON-001",
      "description": "Must use existing authentication service",
      "type": "technical"
    }
  ]
}

# Specification: {Feature Name}

## Overview
[High-level description derived from requirements]

## Functional Requirements
- **FR-001:** [Requirement description]
  - Acceptance: [Testable criteria]
  
## Non-Functional Requirements
- **NFR-001:** [Performance/Security/etc requirement]
  - Measurement: [How to verify]
  
## Technical Approach
- **System A:** [Changes required] ← Derived from CON-001
- **System B:** [Integration points] ← From research findings

## Data Model
[Schema changes if applicable]

## API Contract
[Endpoint definitions if applicable]

## Testing Strategy
- Unit tests: [Coverage targets]
- Integration tests: [Scenarios]
- Performance tests: [NFR validation]

## Rollout Plan
[Deployment strategy derived from constraints]

feature: oauth-authentication
complexity: STANDARD
estimated_effort: M

stories:
  - id: "3.1"
    title: "OAuth Provider Integration"
    effort: 3
    dependencies: []
    files:
      - src/auth/oauth-provider.ts
      - src/auth/oauth-config.ts
      
  - id: "3.2"
    title: "User Session Management"
    effort: 5
    dependencies: ["3.1"]
    files:
      - src/auth/session-manager.ts
      - src/middleware/auth.ts

technical_decisions:
  - decision: "Use Passport.js for OAuth"
    rationale: "Aligns with CON-001 constraint"
    alternatives_considered:
      - "Custom OAuth implementation (rejected: too complex)"
      
risks:
  - risk: "OAuth provider rate limiting"
    mitigation: "Implement token caching (NFR-002)"
    severity: MEDIUM