CLOSED: "File input: 1MB-100MB, UTF-8 text, non-empty"
OPEN: "File input: any file the user provides"

CLOSED: "Output: sorted array of tuples (name, score), score ∈ [0,100], alphabetical by name"
OPEN: "Output: processed data"

CLOSED:
  - Scenario 1: Normal case with 5 items → returns sorted list
  - Scenario 2: Empty list → returns empty
  - Scenario 3: File >100MB → returns error "File exceeds maximum size"

OPEN:
  - "Handle various inputs"

CLOSED:
  - Performance: Parse 1000 files in <5s (p99)
  - Memory: <100MB resident
  - Concurrency: Thread-safe, allow 10 concurrent operations
  - Security: Validate all file paths, reject directory traversal

OPEN:
  - "Should be fast"
  - "Keep memory low"

CLOSED: "Cache strategy: LRU with 10,000 entry limit, 30min TTL"
OPEN: "Cache entries appropriately"

CLOSED: "Error handling: All Result<T, E> with custom Error enum. Never panic."
OPEN: "Handle errors gracefully"

User: "Add validation to the API"

YOU: Specification is incomplete. Before implementation:
  - Which fields require validation? (email only? username? all?)
  - What validation rules? (format, length, character set?)
  - What happens on validation failure? (error response format?)
  - Performance target? (validate <10ms per request?)

Please clarify these, then we proceed to implementation.

1. User: [Task description]
2. You: [Run specification validator agent]
3. Agent: [Report closure status]
4. If OPEN: [Request clarifications]
5. If CLOSED: [Proceed to EPIC 9 fan-out]

"Process CSV files and output results"

Input: CSV files (max 10MB, UTF-8, comma-delimited)
  - Fields: name (string, 1-100 chars), age (int, 0-150), email (string, valid email)
  - Invalid rows: Reject with detailed error message

Output: Processed data
  - Format: JSON array of objects with same fields
  - Ordering: By name, alphabetically ascending
  - Success: File fully parsed or error reported for first invalid row

Performance: Parse 10 files of 1MB each in <5s (p99)
Concurrency: Thread-safe, allow 5 parallel files
Errors:
  - Invalid CSV format → error with line number
  - Missing required field → error with row number
  - File >10MB → error "File exceeds 10MB limit"

Acceptance Scenarios:
  1. Normal: 100-row CSV → output 100 objects, sorted
  2. Edge case: Single row → output 1 object
  3. Edge case: Empty file → output empty array
  4. Error: Missing email field → error message "Row 5: missing email field"
  5. Error: File 15MB → error "File exceeds maximum size"

"Add user authentication"

Input: Username (string), password (string, ≥8 chars, ≥1 uppercase, ≥1 digit)
Behavior:
  1. Correct credentials → session token valid for 24h
  2. Incorrect credentials → reject after 3 attempts, lock for 15min
  3. Invalid format → reject immediately
Output: Session token (JWT, signed with RS256, include exp claim)
Storage: Passwords hashed with Argon2, never stored plaintext
Invariant: All inputs sanitized (reject SQL special chars, XSS payloads)
Acceptance Scenarios:
  - Scenario 1: Valid credentials → token issued, valid 24h
  - Scenario 2: Invalid password (1st attempt) → reject, allow retry
  - Scenario 3: Invalid password (3rd attempt) → lock account
  - Scenario 4: Locked account login attempt → reject "Account locked"
  - Scenario 5: SQL injection in username → reject "Invalid characters"