# Goal: Manual-First Auth Flow

Use Krypton Execution to execute `docs/goals/manual-first-auth-flow/PLAN.md`.

Core rules:
- Treat PLAN.md as the source plan.
- Preserve intent, ownership, contract, cutover, evidence, and kill criteria.
- Make fresh install and default `vpn` / app connect manual-first.
- Keep the installer understandable for a non-IT user: plain wording, manual mode on Enter, optional conveniences explained as choices.
- Keep Bitwarden, Touch ID, saved TOTP, autosubmit, and headless mode as explicit opt-in features.
- Do not add a new dominant path without deleting, redirecting, demoting, or shimming the displaced Bitwarden/auto-first path.
- Capture acceptance evidence from a clean temporary HOME and the menu-bar app contract.
- Say "implemented but unproven" if that evidence cannot be captured.