Context for the agent, not the repo

Six ideas and their edges beat forty files. Hand the agent a shaped slice.

Ask about session expiry. Dump the repo, or query the graph.

auth/session.rq

session_expiry {
  expired tokens must reject requests
  refresh must not resurrect a revoked session
  implemented in ["./src/auth/session.ts".validateSession]
  proven by ["./src/auth/session.test.ts:rejects expired access token"]
  @status done
  @tags (
      auth
      security
  )
}

session_refresh {
  refresh tokens rotate on use
  aligns with [session_expiry]
  @status pending
}

logout {
  clears access and refresh cookies
  aligns with [session_expiry]
  @status done
}

auth_surface (
  session_expiry,
  session_refresh,
  logout
)

naive

$ grep -R session src/ | head -200

src/auth/session.ts
src/auth/cookies.ts
src/auth/oauth.ts
src/middleware.ts
src/routes/me.ts
… 34 more files

token cost: ~18k  ·  signal: low

mcp click

$ click({ target: "src/auth/session.ts" })

sessionKey: clk-1  kind: unique
file: src/auth/session.ts
backlinks (3): session_expiry, session_refresh, logout
commentRefs (1): validateSession
  slice: 3 ideas · ~400 tokens

plan the agent writes

session_refresh_plan {
  finish [session_refresh] against [session_expiry]
  @plan {
      steps (
          - rotate refresh token in ["./src/auth/session.ts".rotateRefresh]
          - reject reuse of the old refresh token
          - prove with ["./src/auth/session.test.ts:rejects reused refresh token"]
      )
  }
  @status in-progress
}