# Phase 2: Bot Skeleton + initData Security - Discussion Log

> **Audit trail only.** Do not use as input to planning, research, or execution agents.
> Decisions captured in CONTEXT.md — this log preserves the analysis.

**Date:** 2026-10-22
**Phase:** 02-bot-skeleton-initdata-security
**Mode:** default (interactive)

## Areas Discussed

### Bot copy + interaction style
| Question | Options presented | Selection |
|---|---|---|
| Tone | Clinical + honest / Friendly + light / Formal | Clinical + honest |
| /start form | Text-only / reply keyboard / inline button | Text-only minimal |
| Command menu | Phase-2 commands only / v1 stubbed / you decide | Phase-2 only + user freeform added Malay aliases (/mula, /pergi_ke, /cari) |
| Localization | Strings module + ms locale / defer / aliases only | Strings module + ms locale |

### Session token mechanics
| Question | Options presented | Selection |
|---|---|---|
| Token shape | Opaque KV id / signed JWT / you decide | Opaque token id in KV |
| Second /start | Rotate-on-new / multi-session / you decide | Rotate-on-new, revocable |
| Claim fields | Minimal / wider / you decide | Minimal bootstrap claim |

### Backend repo layout
| Question | Options presented | Selection |
|---|---|---|
| Workspace layout | bot/ / worker/ / flat src | bot/ workspace |
| Language | TypeScript / JS ESM / you decide | TypeScript |
| Internal structure | Explicit src/ tree / flat folder / you decide | Explicit src/ tree |

### Validation + test harness
| Question | Options presented | Selection |
|---|---|---|
| Test runner | Hand-rolled / vitest / workers-pool / you decide | Hand-rolled runner |
| Stale policy | ~15 min / 5 min / you decide | ~15 min freshness |
| Rejection logs | Category-only / + payload hash / you decide | Category-only |

### Secrets + deploy setup
| Question | Options presented | Selection |
|---|---|---|
| Secret storage | Wrangler secrets / CI-injected / you decide | Wrangler secrets |
| Deploy | Local deploy / CI day one | Local deploy only |
| Hygiene | Secrets separation / dry-run vault / you decide | Secrets separation |

## Corrections Made

No corrections — user accepted recommended options throughout; one freeform addition (Malay command aliases D-03/D-04/D-05).

## Auto-Resolved

Not applicable.

## External Research

Not applicable (research phase follows planning; the grammY initData typings verification was already flagged in ROADMAP.md).