User: "Add auth to the app"
AI: *immediately writes 500 lines of code*

User: "Add auth to the app"
AI: "Let me understand requirements first..."
   → Questions → Design → Plan → Execute → Review

1. Ask clarifying questions
2. Explore existing codebase
3. Understand constraints
4. Validate assumptions

1. Create isolated workspace (git branch)
2. Break work into 2-5 minute tasks
3. Define exact specifications
4. Get approval before coding

1. RED: Write failing test
2. GREEN: Minimum code to pass
3. REFACTOR: Clean up
4. Review before next task

1. Specification compliance check
2. Code quality review
3. Integration verification
4. Branch completion decision

RED → GREEN → REFACTOR

┌─────────────────────────────────────┐
│ Systematic          vs.    Ad-hoc  │
├─────────────────────────────────────┤
│ Plan then execute   │ Jump in      │
│ Verify with tests   │ Hope it works│
│ Review each step    │ Review at end│
│ Evidence-based      │ Assumption   │
└─────────────────────────────────────┘

1. Reproduce the issue
2. Isolate the cause
3. Root cause analysis
4. Verify the fix
5. Prevent regression

I want to add user authentication.

Help me think through:
1. What auth mechanism?
2. Session vs JWT?
3. Where to store credentials?
4. What existing code to modify?

I'm implementing the login endpoint.

Current state:
- User model exists
- Password hashing ready

Next: Create POST /login endpoint

Tests first, then implementation.

Review my changes:
[paste diff]

Check against:
- Original spec
- Test coverage
- Code quality
- Security concerns

User: "Add forgot password feature"

Agent: "Before we start, let me understand:
1. How should the reset link be delivered? (email?)
2. What's the token expiry? (1 hour?)
3. Should we rate limit attempts?
4. Any existing email infrastructure?"

Tasks:
1. Create password_reset_tokens table
2. Add POST /forgot-password endpoint
3. Add POST /reset-password endpoint
4. Create email template
5. Add rate limiting middleware

## Task: Create password_reset_tokens table

### Test (RED)
- Test migration creates table
- Test table has correct columns

### Implementation (GREEN)
- Create migration file
- Define schema

### Verify
- Run migration
- Check table exists

## Task 1 Complete

✓ Migration runs successfully
✓ Table has: id, user_id, token, expires_at
✓ Foreign key constraint works

Ready for Task 2?