Use this skill when the user says "elicit requirements", "gather specs", or mentions a feature with unclear scope. It structures the discovery of what needs to be built, prioritises it, and produces ready-to-use user stories with acceptance criteria.
When to use
Trigger this skill when:
The user asks for requirements or specification gathering
A feature is mentioned but its boundaries are vague
The team needs a shared understanding before planning
Stakeholder needs must be captured and prioritised
The project has multiple unknowns that need structured discovery
Modes
Two modes let you match the depth of elicitation to the situation.
Deep mode — Exhaustive Domain Exploration
Used when the feature is complex, unfamiliar, or has many stakeholders. Use this for new initiatives, architectural decisions, or anything where missing a requirement would be costly.
Limit to 3–7 sub-domains. Too many means the decomposition level is too fine; too few means it's too coarse.
Output: A decomposition tree at the top of the elicitation document.
Phase 3: Question Bank
Ask questions drawn from the domain-specific bank (see below). In deep mode, run through all relevant questions. In fast mode, ask only the 3–5 most important ones for each sub-domain.
For each question:
Ask the question to the user
Capture their answer verbatim or paraphrased
Dig deeper if the answer reveals unknowns — follow the chain
Output: A prioritised requirements list with both RICE scores and MoSCoW categories.
Phase 6: User Stories + Acceptance Criteria
Transform each Must-have and Should-have requirement into a user story with acceptance criteria. Could-have stories are optional.
### [US-NNN] — [Story Title]**As a** [user role],
**I want** [goal/desire],
**So that** [benefit/reason].
**Priority:** [Must / Should]
**RICE:** [score]
**Acceptance Criteria:**- [ ] Given [context], when [action], then [expected outcome]
- [ ] Given [context], when [action], then [expected outcome]
- [ ] Edge case: [description]
- [ ] Error case: [description]
**Notes:**- [implementation hints, constraints, links]
Output: A numbered list of user stories ready for sprint planning.
Phase 7: Review & Handoff
Present the user with a summary:
Total requirements captured: X
Must-haves: X | Should-haves: X | Could-haves: X | Won't-haves: X
Total user stories created: X
Open questions remaining: X
Recommended next step: (e.g., "hand these stories to plan skill", "run spike on F-003", "review with stakeholders")
Domain-Specific Question Banks
Below are question banks organised by domain. Each bank contains 5–15 questions. Pick the relevant bank, ask all questions in deep mode, or select 3–5 in fast mode.
Web / API Services
What API operations are needed (CRUD, webhooks, streaming)?
Who are the API consumers (first-party, third-party, internal)?
What authentication / authorisation model is required?
What are the rate limit and throttling expectations?
What SLAs apply (uptime, latency, throughput)?
What pagination, filtering, and sorting are needed on list endpoints?
What webhook events should be emitted, and to whom?
What error response format should be used (RFC 7807 / Problem Details)?
What versioning strategy is needed (URL, header, query param)?
Are there idempotency requirements for mutating endpoints?
What data retention and purging policies apply?
Is the API expected to be documented (OpenAPI / Swagger)?
Database / Data Layer
What entities need to be stored, and what are their relationships?
What are the expected read/write volumes and patterns?
What query patterns need to be supported (exact match, full-text, geo, graph)?
What consistency and isolation levels are required?
What is the expected data growth rate and retention period?
Are there reporting / analytics queries that need optimisation?
What migration strategy should be used?
What backup and disaster recovery requirements exist?
Are there compliance requirements (GDPR, HIPAA, PCI, SOC2)?
What audit trail / change capture requirements exist?
Should the data layer support multi-tenancy? How is it isolated?
What caching strategy is needed (write-through, cache-aside, CDN)?
User Interface / UX
Who are the target users, and what are their primary goals?
What devices and screen sizes must be supported?
What accessibility standards (WCAG level) are required?
What is the expected user journey / flow from entry to completion?
What feedback mechanisms should be provided (loading, empty, error, success states)?
What i18n / l10n requirements exist (languages, date/number formats)?
What customisation / personalisation is expected?
What onboarding experience is needed?
What keyboard navigation and shortcut support is required?
Are there any offline / low-connectivity requirements?
What notification patterns are needed (toasts, banners, badges)?
What analytics / telemetry should be captured about user interactions?
Authentication & Authorisation
What identity providers need to be supported (SSO, OAuth, SAML, LDAP)?
What role hierarchy or permission model is needed (RBAC, ABAC, ReBAC)?
What self-service capabilities are needed (registration, password reset, profile management)?
What session management requirements exist (JWT, cookies, refresh tokens, expiry)?
What MFA / 2FA requirements apply?
What account recovery and lockout policies should be enforced?
What token scope / delegation model is needed?
Are there API-key / machine-to-machine auth requirements?
What audit logging requirements exist for auth events?
What compliance requirements apply (SOC2, FedRAMP, GDPR Articles)?
DevOps / Infrastructure / Delivery
What deployment environments are needed (dev, staging, production, DR)?
What CI/CD pipeline requirements exist (test stages, approval gates)?
What monitoring / alerting thresholds are expected?
What logging requirements exist (structured, centralised, retention)?
What containerisation / orchestration requirements apply?
What secret management approach is needed?
What are the scalability requirements (auto-scaling, max concurrency)?
What are the disaster recovery requirements (RPO, RTO)?
What cost management / budget constraints exist for infrastructure?
What compliance scanning / security testing is required (SAST, DAST, dependency scanning)?
What feature flag / rollout strategy is needed?
What database migration automation is required?
Integration / Third-Party Services
What external systems need to be integrated, and what do they expose (API, file, webhook)?
What is the expected data flow direction and frequency (real-time, batch, polling)?
What error handling and retry strategy should be used on integration points?
What data transformation / mapping is required between systems?
What circuit breaker / fallback behaviour is needed when an external system is down?
What vendor SLA and deprecation policies apply?
Are there synchronous vs. asynchronous integration preferences?
What idempotency and exactly-once delivery guarantees are needed?
What integration testing strategy should be used (contract tests, sandbox)?
What billing / metering requirements exist for third-party API usage?
AI / ML Features
What model capabilities are needed (classification, generation, embedding, RAG)?
What latency and throughput requirements apply to inference?
What data is needed for training / fine-tuning, and where does it live?
What evaluation / test set exists to measure model quality?
What guardrails and safety filters are required on outputs?
What human-in-the-loop / review workflows are needed?
What explainability / transparency requirements exist?
What model versioning and A/B testing approach is needed?
What cost constraints apply to API calls or compute?
What prompt engineering / template management approach is needed?
What logging and traceability is required for model inputs and outputs?
What privacy requirements apply to data sent to external model providers?
What fallback behaviour should occur when the model is unavailable?
Security & Compliance
What data classification levels apply (public, internal, confidential, restricted)?
What encryption requirements exist (at-rest, in-transit, key management)?
What vulnerability management and patching cadence is required?
What penetration testing and security review cadence is expected?
What third-party vendor security assessment process is needed?
What breach notification and incident response procedures apply?
What compliance frameworks are in scope (SOC2, ISO 27001, PCI-DSS, HIPAA, FedRAMP)?
What data retention and deletion policies apply per regulation?
What user consent and data subject request handling is needed (GDPR / CCPA)?
What network segmentation and firewall rules are required?
Are there BYOK / HYOK expectations for encryption keys?
What secure coding standards should be enforced (OWASP Top 10, CWE)?
Output Format — Elicitation Document
The complete output is a single markdown document saved to docs/elicit/ with this structure:
# Elicitation: [Feature Name]**Mode:** Deep / Fast
**Date:** YYYY-MM-DD
**Stakeholders:** [list]
**Domain:** [primary domain]
---
## Context
[from Phase 1 — what is this feature, key constraints, success metric]
---
## Domain Decomposition
[from Phase 2 — tree or list of sub-domains]
---
## Question Log### Sub-Domain: [name]
Q: [question]
A: [answer]
Q: [question]
A: [answer]
...
---
## Structured Requirements### [Sub-Domain]**Functional:**- F-001: [requirement]
- F-002: [requirement]
**Non-Functional:**- NF-001: [requirement]
---
## Prioritisation
| # | Requirement | Reach | Impact | Confidence | Effort | RICE | MoSCoW |
|---|-------------|-------|--------|------------|--------|------|--------|
| ... | ... | ... | ... | ... | ... | ... | ... |
---
## User Stories### [US-001] — [Title]**As a** [role] **I want** [goal] **So that** [benefit]
**AC:**- [ ] Given ..., when ..., then ...
---
## Summary- Total requirements: X
- Must: X | Should: X | Could: X | Won't: X
- Stories created: X
- Open questions: X
- Recommended next: [plan / spike / review]
Interaction Flow
Starting the elicitation
When the user triggers the skill, respond with:
Confirm mode: "I'll use deep mode for this — is that right, or would you prefer fast mode?"
Ask context questions (Phase 1 or Phase 1 skip in fast mode)
Proceed through phases, presenting each result before moving on
When a sub-domain has many open questions that are independent, you may ask 3–5 questions in a single turn rather than one at a time. Group them by theme and present as a numbered list.
Terminating early
The user may say "that's enough, give me the stories" at any point. Honour that immediately. Skip remaining phases and produce stories from whatever you have captured.
Save location
Save the elicitation document with write_file under:
docs/elicit/YYYY-MM-DD_<feature-slug>.md
Treat that as relative to the repo root (e.g. hermes-cortex/docs/elicit/).
This is the durable home for elicitation artifacts — committed to the shared
repo so the whole fleet benefits. If the runtime provides a specific target
path, use that exact path.
Example: Fast Mode (abbreviated)
User: "I need a simple API to track user bookmarks."
Agent: [Fast mode]
- Domain: Web / API Services
- Questions asked: 5 (auth, CRUD ops, data model, pagination, error format)
- Requirements captured: 4 functional, 2 non-functional
- MoSCoW: 2 Must, 2 Should, 1 Could, 1 Won't
- Stories created: 3
Time: ~3 turns including this summary.
Example: Deep Mode (abbreviated)
User: "We're building an AI-powered customer support system."
Agent: [Deep mode]
- Sub-domains: Intent Classification, Knowledge Base, Conversation History, Escalation, Analytics
- Questions asked: 38 across 5 sub-domains
- Requirements captured: 22 functional, 7 non-functional
- RICE scored, MoSCoW classified: 8 Must, 7 Should, 8 Could, 6 Won't
- Stories created: 12
Time: ~10–15 turns including context and follow-ups.
