Context for the agent, not the repo

auth/session.rq

session_expiry {
    expired tokens must reject requests
    refresh must not resurrect a revoked session
    implemented in ["./src/auth/session.ts".validateSession]
    proven by ["./src/auth/session.test.ts:rejects expired access token"]
    @status done
    @tags (
        auth
        security
    )
}

session_refresh {
    refresh tokens rotate on use
    aligns with [session_expiry]
    @status pending
}

logout {
    clears access and refresh cookies
    aligns with [session_expiry]
    @status done
}

auth_surface (
    session_expiry,
    session_refresh,
    logout
)

naive

$ grep -R session src/ | head -200

src/auth/session.ts
src/auth/cookies.ts
src/auth/oauth.ts
src/middleware.ts
src/routes/me.ts
… 34 more files

token cost: ~18k  ·  signal: low

mcp file_context

$ file_context({ filePath: "src/auth/session.ts" })

→ session_expiry   status=done
→ session_refresh  status=pending
→ logout           status=done
  edges: file_reference, references, comment_link
  slice: 3 ideas · ~400 tokens

plan the agent writes

session_refresh_plan {
    finish [session_refresh] against [session_expiry]
    @plan {
        steps (
            - rotate refresh token in ["./src/auth/session.ts".rotateRefresh]
            - reject reuse of the old refresh token
            - prove with ["./src/auth/session.test.ts:rejects reused refresh token"]
        )
    }
    @status in-progress
}