Great experiment. The "implied context" problem is real and it kills projects.

One thing I'd push back on slightly: the 5 vs 127 framing makes this feel like a volume win for AI, but I think the actual insight is that AI externalizes the assumptions humans carry silently. That's the useful part.

What worked for us was using AI-generated specs not as a deliverable but as a conversation starter. You print the 127 points, sit with the client for 90 minutes, and the deletions become the spec. "We don't need multi-tenancy" is a real decision, not an oversight, once someone's forced to say it out loud.

To your questions directly: 1. Yes, reusable checklists for auth/RBAC/rate limits are underrated 2. 127 points is too many to hand a dev team, but perfect for a client workshop 3. Filter by "can we launch without this" — ruthlessly

Would love to see those prompts.