ambek .planning

.planning/phases/02-bot-skeleton-initdata-security/02-DISCUSSION-LOG.md

@@ -0,0 +1,58 @@
+# Phase 2: Bot Skeleton + initData Security - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions captured in CONTEXT.md — this log preserves the analysis.
+
+**Date:** 2026-10-22
+**Phase:** 02-bot-skeleton-initdata-security
+**Mode:** default (interactive)
+
+## Areas Discussed
+
+### Bot copy + interaction style
+| Question | Options presented | Selection |
+|---|---|---|
+| Tone | Clinical + honest / Friendly + light / Formal | Clinical + honest |
+| /start form | Text-only / reply keyboard / inline button | Text-only minimal |
+| Command menu | Phase-2 commands only / v1 stubbed / you decide | Phase-2 only + user freeform added Malay aliases (/mula, /pergi_ke, /cari) |
+| Localization | Strings module + ms locale / defer / aliases only | Strings module + ms locale |
+
+### Session token mechanics
+| Question | Options presented | Selection |
+|---|---|---|
+| Token shape | Opaque KV id / signed JWT / you decide | Opaque token id in KV |
+| Second /start | Rotate-on-new / multi-session / you decide | Rotate-on-new, revocable |
+| Claim fields | Minimal / wider / you decide | Minimal bootstrap claim |
+
+### Backend repo layout
+| Question | Options presented | Selection |
+|---|---|---|
+| Workspace layout | bot/ / worker/ / flat src | bot/ workspace |
+| Language | TypeScript / JS ESM / you decide | TypeScript |
+| Internal structure | Explicit src/ tree / flat folder / you decide | Explicit src/ tree |
+
+### Validation + test harness
+| Question | Options presented | Selection |
+|---|---|---|
+| Test runner | Hand-rolled / vitest / workers-pool / you decide | Hand-rolled runner |
+| Stale policy | ~15 min / 5 min / you decide | ~15 min freshness |
+| Rejection logs | Category-only / + payload hash / you decide | Category-only |
+
+### Secrets + deploy setup
+| Question | Options presented | Selection |
+|---|---|---|
+| Secret storage | Wrangler secrets / CI-injected / you decide | Wrangler secrets |
+| Deploy | Local deploy / CI day one | Local deploy only |
+| Hygiene | Secrets separation / dry-run vault / you decide | Secrets separation |
+
+## Corrections Made
+
+No corrections — user accepted recommended options throughout; one freeform addition (Malay command aliases D-03/D-04/D-05).
+
+## Auto-Resolved
+
+Not applicable.
+
+## External Research
+
+Not applicable (research phase follows planning; the grammY initData typings verification was already flagged in ROADMAP.md).