2.4 KiB
2.4 KiB
Phase 2: Bot Skeleton + initData Security - Discussion Log
Audit trail only. Do not use as input to planning, research, or execution agents. Decisions captured in CONTEXT.md — this log preserves the analysis.
Date: 2026-10-22 Phase: 02-bot-skeleton-initdata-security Mode: default (interactive)
Areas Discussed
Bot copy + interaction style
| Question | Options presented | Selection |
|---|---|---|
| Tone | Clinical + honest / Friendly + light / Formal | Clinical + honest |
| /start form | Text-only / reply keyboard / inline button | Text-only minimal |
| Command menu | Phase-2 commands only / v1 stubbed / you decide | Phase-2 only + user freeform added Malay aliases (/mula, /pergi_ke, /cari) |
| Localization | Strings module + ms locale / defer / aliases only | Strings module + ms locale |
Session token mechanics
| Question | Options presented | Selection |
|---|---|---|
| Token shape | Opaque KV id / signed JWT / you decide | Opaque token id in KV |
| Second /start | Rotate-on-new / multi-session / you decide | Rotate-on-new, revocable |
| Claim fields | Minimal / wider / you decide | Minimal bootstrap claim |
Backend repo layout
| Question | Options presented | Selection |
|---|---|---|
| Workspace layout | bot/ / worker/ / flat src | bot/ workspace |
| Language | TypeScript / JS ESM / you decide | TypeScript |
| Internal structure | Explicit src/ tree / flat folder / you decide | Explicit src/ tree |
Validation + test harness
| Question | Options presented | Selection |
|---|---|---|
| Test runner | Hand-rolled / vitest / workers-pool / you decide | Hand-rolled runner |
| Stale policy | ~15 min / 5 min / you decide | ~15 min freshness |
| Rejection logs | Category-only / + payload hash / you decide | Category-only |
Secrets + deploy setup
| Question | Options presented | Selection |
|---|---|---|
| Secret storage | Wrangler secrets / CI-injected / you decide | Wrangler secrets |
| Deploy | Local deploy / CI day one | Local deploy only |
| Hygiene | Secrets separation / dry-run vault / you decide | Secrets separation |
Corrections Made
No corrections — user accepted recommended options throughout; one freeform addition (Malay command aliases D-03/D-04/D-05).
Auto-Resolved
Not applicable.
External Research
Not applicable (research phase follows planning; the grammY initData typings verification was already flagged in ROADMAP.md).