# AI + TestSprite PRD Template

> Paste this entire document into your AI workflow, repository, or TestSprite project.
> Goal: Generate deterministic implementation + high-quality automated tests.

---

# MASTER PROMPT

You are building and testing this project using a strict specification-first workflow.

Rules:
- Do NOT invent features outside this PRD
- All acceptance criteria are mandatory
- All invariants must always hold true
- Generate edge-case tests automatically
- Generate regression tests for every discovered defect
- Security requirements are mandatory
- If requirements are ambiguous, ask questions before implementation
- Prefer deterministic behavior over assumptions
- Treat all flows as testable behaviors

Deliverables:
- Production-ready implementation
- Unit tests
- Integration tests
- E2E tests
- Security validation tests
- Edge-case tests
- Regression tests

---

# 1. PROJECT OVERVIEW

## Project Name
[PROJECT NAME]

## Summary
Describe:
- What the application does
- Who uses it
- Why it exists
- Main business value

## Success Criteria
Example:
- Users can complete checkout in under 2 minutes
- API latency below 500ms
- No unauthorized data exposure
- Mobile responsive

---

# 2. USER ROLES

| Role | Description | Permissions |
|---|---|---|
| Admin | | |
| Standard User | | |
| Read Only | | |
| Guest | | |

---

# 3. CORE USER FLOWS

## Flow 1: [NAME]

### Steps
1. User logs in
2. User navigates to dashboard
3. User creates record
4. System validates input
5. System saves record
6. User receives confirmation

### Expected Result
Describe expected final state.

---

## Flow 2: [NAME]

### Steps
1.
2.
3.

### Expected Result
Describe expected final state.

---

# 4. ACCEPTANCE CRITERIA (CRITICAL)

## Functional Requirements

- [ ] Users must authenticate before accessing protected routes
- [ ] Email addresses must be unique
- [ ] API returns HTTP 403 for unauthorized requests
- [ ] Form validation occurs before submission
- [ ] Duplicate submissions are prevented
- [ ] Audit logs are created for sensitive actions

## UI Requirements

- [ ] Mobile responsive down to 320px width
- [ ] Loading indicators shown during async actions
- [ ] Error messages displayed clearly
- [ ] Dark mode supported (if applicable)

## Performance Requirements

- [ ] Dashboard loads within 2 seconds
- [ ] API response time below 500ms
- [ ] PDF exports complete within 5 seconds

---

# 5. EDGE CASES & FAILURE STATES

## Validation Edge Cases

- Empty form submission
- Invalid email format
- Oversized file upload
- Malformed JSON payload
- Duplicate record creation

## Network / Infrastructure

- API timeout during save
- Database unavailable
- Slow network conditions
- Browser refresh during transaction

## Concurrency

- Two users editing same record simultaneously
- Double-click duplicate submissions
- Race conditions during updates

## Recovery Expectations

Describe:
- Retry behavior
- Rollback behavior
- Error handling
- Recovery flows

---

# 6. INVARIANTS (MUST NEVER BREAK)

- Users may only access their own tenant data
- Totals must always match calculated values
- Deleted records remain in audit history
- API keys are never exposed to frontend
- Passwords are never stored in plain text
- Sensitive actions require authorization

Add project-specific invariants below:

- 
- 
- 

---

# 7. API CONTRACTS

## Endpoint: POST /api/example

### Request
```json
{
  "name": "string"
}
```

### Response
```json
{
  "id": "uuid",
  "status": "success"
}
```

### Error Responses

| Code | Meaning |
|---|---|
| 400 | Validation Error |
| 401 | Unauthorized |
| 403 | Forbidden |
| 500 | Internal Error |

---

# 8. DATABASE RULES

## Tables
List important tables/entities.

## Constraints
- Foreign keys enforced
- Soft delete enabled
- Tenant isolation required

## Data Retention
Describe retention policies.

---

# 9. SECURITY REQUIREMENTS

## Authentication
- MFA required/not required
- Session timeout rules
- Password policy

## Authorization
- RBAC required
- Tenant isolation mandatory

## Input Validation
- Sanitize all user input
- Validate uploads
- Prevent SQL injection
- Prevent XSS

## Logging
- Log all authentication attempts
- Log privilege changes
- Log failed API calls

---

# 10. NON-FUNCTIONAL REQUIREMENTS

## Scalability
Describe expected scale.

## Availability
Target uptime requirements.

## Monitoring
Required logs, alerts, dashboards.

## Accessibility
WCAG requirements.

## Browser Support
List supported browsers.

---

# 11. TESTING REQUIREMENTS

## Required Test Coverage

- Unit Tests
- Integration Tests
- API Tests
- E2E Tests
- Security Tests
- Performance Tests
- Regression Tests

## Regression Rules

- Every production bug becomes a permanent regression test
- Every failed edge case becomes a reusable test case

---

# 12. OUT OF SCOPE

Explicitly excluded functionality:

- 
- 
- 

---

# 13. KNOWN RISKS

| Risk | Impact | Mitigation |
|---|---|---|
| | | |

---

# 14. OPEN QUESTIONS

| Question | Owner | Status |
|---|---|---|
| | | |

---

# 15. IMPLEMENTATION NOTES

Optional:
- Preferred frameworks
- Infrastructure
- Deployment targets
- CI/CD
- Coding standards

---

# 16. FINAL AI EXECUTION INSTRUCTIONS

Before implementation:
1. Review all acceptance criteria
2. Review all invariants
3. Generate edge-case tests
4. Generate security tests
5. Validate API contracts
6. Validate authorization rules

During implementation:
- Fail fast on ambiguous requirements
- Do not silently ignore validation errors
- Log meaningful diagnostics

Before completion:
- Run all automated tests
- Validate edge cases
- Validate regression suite
- Validate security requirements
- Validate mobile responsiveness