@opengsd/get-shit-done-redux 1.0.0

package/get-shit-done/workflows/discovery-phase.md

@@ -0,0 +1,291 @@
+<purpose>
+Execute discovery at the appropriate depth level.
+Produces DISCOVERY.md (for Level 2-3) that informs PLAN.md creation.
+
+Called from plan-phase.md's mandatory_discovery step with a depth parameter.
+
+NOTE: For comprehensive ecosystem research ("how do experts build this"), use /gsd:plan-phase --research-phase instead, which produces RESEARCH.md.
+</purpose>
+
+<depth_levels>
+**This workflow supports three depth levels:**
+
+| Level | Name         | Time      | Output                                       | When                                      |
+| ----- | ------------ | --------- | -------------------------------------------- | ----------------------------------------- |
+| 1     | Quick Verify | 2-5 min   | No file, proceed with verified knowledge     | Single library, confirming current syntax |
+| 2     | Standard     | 15-30 min | DISCOVERY.md                                 | Choosing between options, new integration |
+| 3     | Deep Dive    | 1+ hour   | Detailed DISCOVERY.md with validation gates  | Architectural decisions, novel problems   |
+
+**Depth is determined by plan-phase.md before routing here.**
+</depth_levels>
+
+<source_hierarchy>
+**MANDATORY: Context7 BEFORE WebSearch**
+
+Claude's training data is 6-18 months stale. Always verify.
+
+1. **Context7 MCP FIRST** - Current docs, no hallucination
+2. **Official docs** - When Context7 lacks coverage
+3. **WebSearch LAST** - For comparisons and trends only
+
+See ~/.claude/get-shit-done/templates/discovery.md `<discovery_protocol>` for full protocol.
+</source_hierarchy>
+
+<process>
+
+<step name="determine_depth">
+Check the depth parameter passed from plan-phase.md:
+- `depth=verify` → Level 1 (Quick Verification)
+- `depth=standard` → Level 2 (Standard Discovery)
+- `depth=deep` → Level 3 (Deep Dive)
+
+Route to appropriate level workflow below.
+</step>
+
+<step name="level_1_quick_verify">
+**Level 1: Quick Verification (2-5 minutes)**
+
+For: Single known library, confirming syntax/version still correct.
+
+**Process:**
+
+1. Resolve library in Context7:
+
+   ```
+   mcp__context7__resolve-library-id with libraryName: "[library]"
+   ```
+
+2. Fetch relevant docs:
+
+   ```
+   mcp__context7__get-library-docs with:
+   - context7CompatibleLibraryID: [from step 1]
+   - topic: [specific concern]
+   ```
+
+3. Verify:
+
+   - Current version matches expectations
+   - API syntax unchanged
+   - No breaking changes in recent versions
+
+4. **If verified:** Return to plan-phase.md with confirmation. No DISCOVERY.md needed.
+
+5. **If concerns found:** Escalate to Level 2.
+
+**Output:** Verbal confirmation to proceed, or escalation to Level 2.
+</step>
+
+<step name="level_2_standard">
+**Level 2: Standard Discovery (15-30 minutes)**
+
+For: Choosing between options, new external integration.
+
+**Process:**
+
+1. **Identify what to discover:**
+
+   - What options exist?
+   - What are the key comparison criteria?
+   - What's our specific use case?
+
+2. **Context7 for each option:**
+
+   ```
+   For each library/framework:
+   - mcp__context7__resolve-library-id
+   - mcp__context7__get-library-docs (mode: "code" for API, "info" for concepts)
+   ```
+
+3. **Official docs** for anything Context7 lacks.
+
+4. **WebSearch** for comparisons:
+
+   - "[option A] vs [option B] {current_year}"
+   - "[option] known issues"
+   - "[option] with [our stack]"
+
+5. **Cross-verify:** Any WebSearch finding → confirm with Context7/official docs.
+
+6. **Create DISCOVERY.md** using ~/.claude/get-shit-done/templates/discovery.md structure:
+
+   - Summary with recommendation
+   - Key findings per option
+   - Code examples from Context7
+   - Confidence level (should be MEDIUM-HIGH for Level 2)
+
+7. Return to plan-phase.md.
+
+**Output:** `.planning/phases/XX-name/DISCOVERY.md`
+</step>
+
+<step name="level_3_deep_dive">
+**Level 3: Deep Dive (1+ hour)**
+
+For: Architectural decisions, novel problems, high-risk choices.
+
+**Process:**
+
+1. **Scope the discovery** using ~/.claude/get-shit-done/templates/discovery.md:
+
+   - Define clear scope
+   - Define include/exclude boundaries
+   - List specific questions to answer
+
+2. **Exhaustive Context7 research:**
+
+   - All relevant libraries
+   - Related patterns and concepts
+   - Multiple topics per library if needed
+
+3. **Official documentation deep read:**
+
+   - Architecture guides
+   - Best practices sections
+   - Migration/upgrade guides
+   - Known limitations
+
+4. **WebSearch for ecosystem context:**
+
+   - How others solved similar problems
+   - Production experiences
+   - Gotchas and anti-patterns
+   - Recent changes/announcements
+
+5. **Cross-verify ALL findings:**
+
+   - Every WebSearch claim → verify with authoritative source
+   - Mark what's verified vs assumed
+   - Flag contradictions
+
+6. **Create comprehensive DISCOVERY.md:**
+
+   - Full structure from ~/.claude/get-shit-done/templates/discovery.md
+   - Quality report with source attribution
+   - Confidence by finding
+   - If LOW confidence on any critical finding → add validation checkpoints
+
+7. **Confidence gate:** If overall confidence is LOW, present options before proceeding.
+
+8. Return to plan-phase.md.
+
+**Output:** `.planning/phases/XX-name/DISCOVERY.md` (comprehensive)
+</step>
+
+<step name="identify_unknowns">
+**For Level 2-3:** Define what we need to learn.
+
+Ask: What do we need to learn before we can plan this phase?
+
+- Technology choices?
+- Best practices?
+- API patterns?
+- Architecture approach?
+  </step>
+
+<step name="create_discovery_scope">
+Use ~/.claude/get-shit-done/templates/discovery.md.
+
+Include:
+
+- Clear discovery objective
+- Scoped include/exclude lists
+- Source preferences (official docs, Context7, current year)
+- Output structure for DISCOVERY.md
+  </step>
+
+<step name="execute_discovery">
+Run the discovery:
+- Use web search for current info
+- Use Context7 MCP for library docs
+- Prefer current year sources
+- Structure findings per template
+</step>
+
+<step name="create_discovery_output">
+Write `.planning/phases/XX-name/DISCOVERY.md`:
+- Summary with recommendation
+- Key findings with sources
+- Code examples if applicable
+- Metadata (confidence, dependencies, open questions, assumptions)
+</step>
+
+<step name="confidence_gate">
+After creating DISCOVERY.md, check confidence level.
+
+If confidence is LOW:
+
+**Text mode (`workflow.text_mode: true` in config or `--text` flag):** Set `TEXT_MODE=true` if `--text` is present in `$ARGUMENTS` OR `text_mode` from init JSON is `true`. When TEXT_MODE is active, replace every `AskUserQuestion` call with a plain-text numbered list and ask the user to type their choice number. This is required for non-Claude runtimes (OpenAI Codex, Gemini CLI, etc.) where `AskUserQuestion` is not available.
+Use AskUserQuestion:
+
+- header: "Low Conf."
+- question: "Discovery confidence is LOW: [reason]. How would you like to proceed?"
+- options:
+  - "Dig deeper" - Do more research before planning
+  - "Proceed anyway" - Accept uncertainty, plan with caveats
+  - "Pause" - I need to think about this
+
+If confidence is MEDIUM:
+Inline: "Discovery complete (medium confidence). [brief reason]. Proceed to planning?"
+
+If confidence is HIGH:
+Proceed directly, just note: "Discovery complete (high confidence)."
+</step>
+
+<step name="open_questions_gate">
+If DISCOVERY.md has open_questions:
+
+Present them inline:
+"Open questions from discovery:
+
+- [Question 1]
+- [Question 2]
+
+These may affect implementation. Acknowledge and proceed? (yes / address first)"
+
+If "address first": Gather user input on questions, update discovery.
+</step>
+
+<step name="offer_next">
+```
+Discovery complete: .planning/phases/XX-name/DISCOVERY.md
+Recommendation: [one-liner]
+Confidence: [level]
+
+What's next?
+
+1. Discuss phase context (/gsd:discuss-phase [current-phase])
+2. Create phase plan (/gsd:plan-phase [current-phase])
+3. Refine discovery (dig deeper)
+4. Review discovery
+
+```
+
+NOTE: DISCOVERY.md is NOT committed separately. It will be committed with phase completion.
+</step>
+
+</process>
+
+<success_criteria>
+**Level 1 (Quick Verify):**
+- Context7 consulted for library/topic
+- Current state verified or concerns escalated
+- Verbal confirmation to proceed (no files)
+
+**Level 2 (Standard):**
+- Context7 consulted for all options
+- WebSearch findings cross-verified
+- DISCOVERY.md created with recommendation
+- Confidence level MEDIUM or higher
+- Ready to inform PLAN.md creation
+
+**Level 3 (Deep Dive):**
+- Discovery scope defined
+- Context7 exhaustively consulted
+- All WebSearch findings verified against authoritative sources
+- DISCOVERY.md created with comprehensive analysis
+- Quality report with source attribution
+- If LOW confidence findings → validation checkpoints defined
+- Confidence gate passed
+- Ready to inform PLAN.md creation
+</success_criteria>

package/get-shit-done/workflows/discuss-phase/modes/advisor.md

@@ -0,0 +1,175 @@
+# Advisor mode — research-backed comparison tables
+
+> **Lazy-loaded and gated.** The parent `workflows/discuss-phase.md` Reads
+> this file ONLY when `ADVISOR_MODE` is true (i.e., when
+> `$HOME/.claude/get-shit-done/USER-PROFILE.md` exists). Skip the Read
+> entirely when no profile is present — that's the inverse of the
+> `--advisor` flag from #2174 (don't pay the cost when unused).
+
+## Activation
+
+```bash
+PROFILE_PATH="$HOME/.claude/get-shit-done/USER-PROFILE.md"
+if [ -f "$PROFILE_PATH" ]; then
+  ADVISOR_MODE=true
+else
+  ADVISOR_MODE=false
+fi
+```
+
+If `ADVISOR_MODE` is false, do **not** Read this file — proceed with the
+standard `default.md` discussion flow.
+
+## Calibration tier
+
+Resolve `vendor_philosophy` calibration tier:
+1. **Priority 1:** Read `config.json` > `preferences.vendor_philosophy`
+   (project-level override)
+2. **Priority 2:** Read USER-PROFILE.md `Vendor Choices/Philosophy` rating
+   (global)
+3. **Priority 3:** Default to `"standard"` if neither has a value or value
+   is `UNSCORED`
+
+Map to calibration tier:
+- `conservative` OR `thorough-evaluator` → `full_maturity`
+- `opinionated` → `minimal_decisive`
+- `pragmatic-fast` OR any other value OR empty → `standard`
+
+Resolve advisor model:
+```bash
+ADVISOR_MODEL=$($GSD_SDK query resolve-model gsd-advisor-researcher --raw)
+```
+
+## Non-technical owner detection
+
+Read USER-PROFILE.md and check for product-owner signals:
+
+```bash
+PROFILE_CONTENT=$(cat "$HOME/.claude/get-shit-done/USER-PROFILE.md" 2>/dev/null || true)
+```
+
+Set `NON_TECHNICAL_OWNER = true` if ANY of the following are present:
+- `learning_style: guided`
+- The word `jargon` appears in a `frustration_triggers` section
+- `explanation_depth: practical-detailed` (without a technical modifier)
+- `explanation_depth: high-level`
+
+**Tie-breaker / precedence (when signals conflict):**
+1. An explicit `technical_background: true` (or any `explanation_depth` value
+   tagged with a technical modifier such as `practical-detailed:technical`)
+   **overrides** all inferred non-technical signals — set
+   `NON_TECHNICAL_OWNER = false`.
+2. Otherwise, ANY single matching signal is sufficient to set
+   `NON_TECHNICAL_OWNER = true` (signals are OR-aggregated, not weighted).
+3. Contradictory `explanation_depth` values: the most recent entry wins.
+
+Log the resolved value and the matched/overriding signal so the user can
+audit why a given framing was used.
+
+When `NON_TECHNICAL_OWNER` is true, reframe gray area labels and
+descriptions in product-outcome language before presenting them. Preserve
+the same underlying decision — only change the framing:
+
+- Technical implementation term → outcome the user will experience
+  - "Token architecture" → "Color system: which approach prevents the dark theme from flashing white on open"
+  - "CSS variable strategy" → "Theme colors: how your brand colors stay consistent in both light and dark mode"
+  - "Component API surface area" → "How the building blocks connect: how tightly coupled should these parts be"
+  - "Caching strategy: SWR vs React Query" → "Loading speed: should screens show saved data right away or wait for fresh data"
+
+This reframing applies to:
+1. Gray area labels and descriptions in `present_gray_areas`
+2. Advisor research rationale rewrites in the synthesis step below
+
+## advisor_research step
+
+After the user selects gray areas in `present_gray_areas`, spawn parallel
+research agents.
+
+1. Display brief status: `Researching {N} areas...`
+
+2. For EACH user-selected gray area, spawn a `Agent()` in parallel:
+
+   ```
+   Agent(
+     prompt="First, read @~/.claude/agents/gsd-advisor-researcher.md for your role and instructions.
+
+     <gray_area>{area_name}: {area_description from gray area identification}</gray_area>
+     <phase_context>{phase_goal and description from ROADMAP.md}</phase_context>
+     <project_context>{project name and brief description from PROJECT.md}</project_context>
+     <calibration_tier>{resolved calibration tier: full_maturity | standard | minimal_decisive}</calibration_tier>
+
+     Research this gray area and return a structured comparison table with rationale.
+     ${AGENT_SKILLS_ADVISOR}",
+     subagent_type="general-purpose",
+     model="{ADVISOR_MODEL}",
+     description="Research: {area_name}"
+   )
+   ```
+
+   All `Agent()` calls spawn simultaneously — do NOT wait for one before
+   starting the next.
+
+   > **ORCHESTRATOR RULE — CODEX RUNTIME**: After calling all Agent() calls above to spawn research agents, do NOT independently research or analyze any of the gray areas while the subagents are active. Wait for all subagents to return before synthesizing results. This prevents duplicate work and wasted context.
+
+3. After ALL agents return, **synthesize results** before presenting:
+
+   For each agent's return:
+   a. Parse the markdown comparison table and rationale paragraph
+   b. Verify all 5 columns present (Option | Pros | Cons | Complexity | Recommendation) — fill any missing columns rather than showing broken table
+   c. Verify option count matches calibration tier:
+      - `full_maturity`: 3-5 options acceptable
+      - `standard`: 2-4 options acceptable
+      - `minimal_decisive`: 1-2 options acceptable
+      If agent returned too many, trim least viable. If too few, accept as-is.
+   d. Rewrite rationale paragraph to weave in project context and ongoing discussion context that the agent did not have access to
+   e. If agent returned only 1 option, convert from table format to direct recommendation: "Standard approach for {area}: {option}. {rationale}"
+   f. **If `NON_TECHNICAL_OWNER` is true:** apply a plain language rewrite to the rationale paragraph. Replace implementation-level terms with outcome descriptions the user can reason about without technical context. The Recommendation column value and the table structure remain intact. Do not remove detail; translate it. Example: "SWR uses stale-while-revalidate to serve cached responses immediately" → "This approach shows you something right away, then quietly updates in the background — users see data instantly."
+
+4. Store synthesized tables for use in `discuss_areas` (table-first flow).
+
+## discuss_areas (advisor table-first flow)
+
+For each selected area:
+
+1. **Present the synthesized comparison table + rationale paragraph** (from
+   `advisor_research`)
+
+2. **Use AskUserQuestion** (or text-mode equivalent if `--text` overlay):
+   - header: `{area_name}`
+   - question: `Which approach for {area_name}?`
+   - options: extract from the table's Option column (AskUserQuestion adds
+     "Other" automatically)
+
+3. **Record the user's selection:**
+   - If user picks from table options → record as locked decision for that
+     area
+   - If user picks "Other" → receive their input, reflect it back for
+     confirmation, record
+
+4. **Thinking partner (conditional):** same rule as default mode — if
+   `features.thinking_partner` is enabled and tradeoff signals are
+   detected, offer a 3-5 bullet analysis before locking in.
+
+5. **After recording pick, decide whether follow-up questions are needed:**
+   - If the pick has ambiguity that would affect downstream planning →
+     ask 1-2 targeted follow-up questions using AskUserQuestion
+   - If the pick is clear and self-contained → move to next area
+   - Do NOT ask the standard 4 questions — the table already provided the
+     context
+
+6. **After all areas processed:**
+   - header: "Done"
+   - question: "That covers [list areas]. Ready to create context?"
+   - options: "Create context" / "Revisit an area"
+
+## Scope creep handling (advisor mode)
+
+If user mentions something outside the phase domain:
+```
+"[Feature] sounds like a new capability — that belongs in its own phase.
+I'll note it as a deferred idea.
+
+Back to [current area]: [return to current question]"
+```
+
+Track deferred ideas internally.

package/get-shit-done/workflows/discuss-phase/modes/all.md

@@ -0,0 +1,28 @@
+# --all mode — auto-select ALL gray areas, discuss interactively
+
+> **Lazy-loaded.** Read this file from `workflows/discuss-phase.md` when
+> `--all` is present in `$ARGUMENTS`. Behavior overlays the default mode.
+
+## Effect
+
+- In `present_gray_areas`: auto-select ALL gray areas without asking the user
+  (skips the AskUserQuestion area-selection step).
+- Discussion for each area proceeds **fully interactively** — the user drives
+  every question for every area (use the default-mode `discuss_areas` flow).
+- Does NOT auto-advance to plan-phase afterward — use `--chain` or `--auto`
+  if you want auto-advance.
+- Log: `[--all] Auto-selected all gray areas: [list area names].`
+
+## Why this mode exists
+
+This is the "discuss everything" shortcut: skip the selection friction, keep
+full interactive control over each individual question.
+
+## Combination rules
+
+- `--all --auto`: `--auto` wins for the discussion phase too (Claude picks
+  recommended answers); `--all`'s contribution is just area auto-selection.
+- `--all --chain`: areas auto-selected, discussion interactive, then
+  auto-advance to plan/execute (chain semantics).
+- `--all --batch` / `--all --text` / `--all --analyze`: layered overlays
+  apply during discussion as documented in their respective files.

package/get-shit-done/workflows/discuss-phase/modes/analyze.md

@@ -0,0 +1,44 @@
+# --analyze mode — trade-off tables before each question
+
+> **Lazy-loaded overlay.** Read this file from `workflows/discuss-phase.md`
+> when `--analyze` is present in `$ARGUMENTS`. Combinable with default,
+> `--all`, `--chain`, `--text`, `--batch`.
+
+## Effect
+
+Before presenting each question (or question group, in batch mode), provide
+a brief **trade-off analysis** for the decision:
+- 2-3 options with pros/cons based on codebase context and common patterns
+- A recommended approach with reasoning
+- Known pitfalls or constraints from prior phases
+
+## Example
+
+```markdown
+**Trade-off analysis: Authentication strategy**
+
+| Approach | Pros | Cons |
+|----------|------|------|
+| Session cookies | Simple, httpOnly prevents XSS | Requires CSRF protection, sticky sessions |
+| JWT (stateless) | Scalable, no server state | Token size, revocation complexity |
+| OAuth 2.0 + PKCE | Industry standard for SPAs | More setup, redirect flow UX |
+
+💡 Recommended: OAuth 2.0 + PKCE — your app has social login in requirements (REQ-04) and this aligns with the existing NextAuth setup in `src/lib/auth.ts`.
+
+How should users authenticate?
+```
+
+This gives the user context to make informed decisions without extra
+prompting.
+
+When `--analyze` is absent, present questions directly as before (no
+trade-off table).
+
+## Sourcing the analysis
+
+- Pros/cons should reflect the codebase context loaded in `scout_codebase`
+  and any prior decisions surfaced in `load_prior_context`.
+- The recommendation must explicitly tie to project context (e.g.,
+  existing libraries, prior phase decisions, documented requirements).
+- If a related ADR or spec is referenced in CONTEXT.md `<canonical_refs>`,
+  cite it in the recommendation.

package/get-shit-done/workflows/discuss-phase/modes/auto.md

@@ -0,0 +1,56 @@
+# --auto mode — fully autonomous discuss-phase
+
+> **Lazy-loaded.** Read this file from `workflows/discuss-phase.md` when
+> `--auto` is present in `$ARGUMENTS`. After the discussion completes, the
+> parent's `auto_advance` step also reads `modes/chain.md` to drive the
+> auto-advance to plan-phase.
+
+## Effect across steps
+
+- **`check_existing`**: if CONTEXT.md exists, auto-select "Update it" — load
+  existing context and continue to `analyze_phase` (matches the parent step's
+  documented `--auto` branch). If no context exists, continue without
+  prompting. For interrupted checkpoints, auto-select "Resume". For existing
+  plans, auto-select "Continue and replan after". Log every decision so the
+  user can audit.
+- **`cross_reference_todos`**: fold all todos with relevance score >= 0.4
+  automatically. Log the selection.
+- **`present_gray_areas`**: auto-select ALL gray areas. Log:
+  `[--auto] Selected all gray areas: [list area names].`
+- **`discuss_areas`**: for each discussion question, choose the recommended
+  option (first option, or the one explicitly marked "recommended") **without
+  using AskUserQuestion**. Skip interactive prompts entirely. Log each
+  auto-selected choice inline so the user can review decisions in the
+  context file:
+  ```
+  [auto] [Area] — Q: "[question text]" → Selected: "[chosen option]" (recommended default)
+  ```
+- After all areas are auto-resolved, skip the "Explore more gray areas"
+  prompt and proceed directly to `write_context`.
+- After `write_context`, **auto-advance** to plan-phase via `modes/chain.md`.
+
+## CRITICAL — Auto-mode pass cap
+
+In `--auto` mode, the discuss step MUST complete in a **single pass**. After
+writing CONTEXT.md once, you are DONE — proceed immediately to
+`write_context` and then auto_advance. Do NOT re-read your own CONTEXT.md to
+find "gaps", "undefined types", or "missing decisions" and run additional
+passes. This creates a self-feeding loop where each pass generates references
+that the next pass treats as gaps, consuming unbounded time and resources.
+
+Check the pass cap from config:
+```bash
+MAX_PASSES=$($GSD_SDK query config-get workflow.max_discuss_passes 2>/dev/null || echo "3")
+```
+
+If you have already written and committed CONTEXT.md, the discuss step is
+complete. Move on.
+
+## Combination rules
+
+- `--auto --text` / `--auto --batch`: text/batch overlays are no-ops in
+  auto mode (no user prompts to render).
+- `--auto --analyze`: trade-off tables can still be logged for the audit
+  trail; selection still uses the recommended option.
+- `--auto --power`: `--power` wins (power mode generates files for offline
+  answering — incompatible with autonomous selection).

package/get-shit-done/workflows/discuss-phase/modes/batch.md

@@ -0,0 +1,52 @@
+# --batch mode — grouped question batches
+
+> **Lazy-loaded overlay.** Read this file from `workflows/discuss-phase.md`
+> when `--batch` is present in `$ARGUMENTS`. Combinable with default,
+> `--all`, `--chain`, `--text`, `--analyze`.
+
+## Argument parsing
+
+Parse optional `--batch` from `$ARGUMENTS`:
+- Accept `--batch`, `--batch=N`, or `--batch N`
+- Default to **4 questions per batch** when no number is provided
+- Clamp explicit sizes to **2–5** so a batch stays answerable
+- If `--batch` is absent, keep the existing one-question-at-a-time flow
+  (default mode).
+
+## Effect on discuss_areas
+
+`--batch` mode: ask **2–5 numbered questions in one plain-text turn** per
+area, instead of the default 4 single-question AskUserQuestion turns.
+
+- Group closely related questions for the current area into a single
+  message
+- Keep each question concrete and answerable in one reply
+- When options are helpful, include short inline choices per question
+  rather than a separate AskUserQuestion for every item
+- After the user replies, reflect back the captured decisions, note any
+  unanswered items, and ask only the minimum follow-up needed before
+  moving on
+- Preserve adaptiveness between batches: use the full set of answers to
+  decide the next batch or whether the area is sufficiently clear
+
+## Philosophy
+
+Stay adaptive, but let the user choose the pacing.
+- Default mode: 4 single-question turns, then check whether to continue
+- `--batch` mode: 1 grouped turn with 2–5 numbered questions, then check
+  whether to continue
+
+Each answer set should reveal the next question or next batch.
+
+## Example batch
+
+```
+Authentication — please answer 1–4:
+
+1. Which auth strategy?  (a) Session cookies  (b) JWT  (c) OAuth 2.0 + PKCE
+2. Where do tokens live?  (a) httpOnly cookie  (b) localStorage  (c) memory only
+3. Session lifetime?       (a) 1h  (b) 24h  (c) 30d  (d) configurable
+4. Account recovery?       (a) email reset  (b) magic link  (c) both
+
+Reply with your choices (e.g. "1c, 2a, 3b, 4c") or describe in your own words.
+```