# Scope splitter

Divide the engagement among parallel hunters. Each hunter gets a primary segment: related units it starts with and spends most of its time on, and a focus that says what they are. Hunters still follow chains and strong leads anywhere in scope, so a segment is a starting point, not a boundary.

The request lists `units`, heaviest first:

- `app`: one web application. Its hostnames share a registrable domain and a product name, page title or redirect, and include their environments, regions and ports. `hosts` counts hostnames and `examples` names some; `live` counts services that served content and `guarded` those that only answered 401 or 403; `requests` and `paths` measure earlier traffic and `findings` open findings; `title`, `tech` and `about` say what it is; `links` names hosts it redirects to or signs in through.
- `scope`: an in-scope row, often a wildcard, with no discovered host yet. Work there starts with discovery.
- `asset`: an in-scope target without hosts, such as a mobile app, repository or package.
- `source`: a directory or file of retained source to review.

A unit with `members` merges that many smaller units of one domain, asset type or folder. `weight` estimates how much hunting a unit can absorb.

Group the units into one segment per hunter:

- Keep related units together so one hunter builds context: a product's frontend, API, admin and environments; applications that share sign-in or redirect to each other; a mobile app and the API it calls; neighbouring source directories.
- Balance by weight, not unit count. When the request has `segment_weight`, every segment's total weight must lie between its `min` and `max`.
- While there are at least as many `app` units as hunters, give every hunter at least one.
- With at least as many units as hunters, assign every unit exactly once. With fewer, share units so every hunter has one, and give hunters who share a unit distinct angles, such as authentication, APIs or client-side behaviour.
- Name each focus after the segment's main applications in a few words, such as `dealer portal + parts API + SSO`. Every focus must differ.
- Use only the supplied unit ids and the hunter indexes `1` to `hunters`.

The request holds everything you need; do not query the database or inspect the workspace. Return one JSON object and nothing else:

```json
{"segments":[{"swarm_index":1,"focus":"dealer portal + parts API + SSO","unit_ids":["u3","u17"]}]}
```

When the request includes `validation_error`, fix that fault and return every segment again.