59 lines
2.4 KiB
Markdown
59 lines
2.4 KiB
Markdown
# Phase 2: Bot Skeleton + initData Security - Discussion Log
|
|
|
|
> **Audit trail only.** Do not use as input to planning, research, or execution agents.
|
|
> Decisions captured in CONTEXT.md — this log preserves the analysis.
|
|
|
|
**Date:** 2026-10-22
|
|
**Phase:** 02-bot-skeleton-initdata-security
|
|
**Mode:** default (interactive)
|
|
|
|
## Areas Discussed
|
|
|
|
### Bot copy + interaction style
|
|
| Question | Options presented | Selection |
|
|
|---|---|---|
|
|
| Tone | Clinical + honest / Friendly + light / Formal | Clinical + honest |
|
|
| /start form | Text-only / reply keyboard / inline button | Text-only minimal |
|
|
| Command menu | Phase-2 commands only / v1 stubbed / you decide | Phase-2 only + user freeform added Malay aliases (/mula, /pergi_ke, /cari) |
|
|
| Localization | Strings module + ms locale / defer / aliases only | Strings module + ms locale |
|
|
|
|
### Session token mechanics
|
|
| Question | Options presented | Selection |
|
|
|---|---|---|
|
|
| Token shape | Opaque KV id / signed JWT / you decide | Opaque token id in KV |
|
|
| Second /start | Rotate-on-new / multi-session / you decide | Rotate-on-new, revocable |
|
|
| Claim fields | Minimal / wider / you decide | Minimal bootstrap claim |
|
|
|
|
### Backend repo layout
|
|
| Question | Options presented | Selection |
|
|
|---|---|---|
|
|
| Workspace layout | bot/ / worker/ / flat src | bot/ workspace |
|
|
| Language | TypeScript / JS ESM / you decide | TypeScript |
|
|
| Internal structure | Explicit src/ tree / flat folder / you decide | Explicit src/ tree |
|
|
|
|
### Validation + test harness
|
|
| Question | Options presented | Selection |
|
|
|---|---|---|
|
|
| Test runner | Hand-rolled / vitest / workers-pool / you decide | Hand-rolled runner |
|
|
| Stale policy | ~15 min / 5 min / you decide | ~15 min freshness |
|
|
| Rejection logs | Category-only / + payload hash / you decide | Category-only |
|
|
|
|
### Secrets + deploy setup
|
|
| Question | Options presented | Selection |
|
|
|---|---|---|
|
|
| Secret storage | Wrangler secrets / CI-injected / you decide | Wrangler secrets |
|
|
| Deploy | Local deploy / CI day one | Local deploy only |
|
|
| Hygiene | Secrets separation / dry-run vault / you decide | Secrets separation |
|
|
|
|
## Corrections Made
|
|
|
|
No corrections — user accepted recommended options throughout; one freeform addition (Malay command aliases D-03/D-04/D-05).
|
|
|
|
## Auto-Resolved
|
|
|
|
Not applicable.
|
|
|
|
## External Research
|
|
|
|
Not applicable (research phase follows planning; the grammY initData typings verification was already flagged in ROADMAP.md).
|