# Goal: Two Auth Modes

Use Krypton Execution to execute `docs/goals/two-auth-modes/PLAN.md`.

Core rules:
- Treat PLAN.md as the source plan.
- Preserve intent, ownership, contract, cutover, evidence, and kill criteria.
- Keep exactly two public modes: `manual-keychain` and `bitwarden-auto`.
- Do not introduce a third first-class user mode; old flags/env may exist only as compatibility shims mapped to one of the two modes.
- Manual-keychain stores only LDAP username/password in macOS Keychain and always leaves OTP manual.
- Bitwarden-auto preserves the old personal Bitwarden + Touch ID + full autofill/submit path.
- Capture acceptance evidence from both checkout source and installed local paths.
- Say "implemented but unproven" if installed-path or launch evidence cannot be captured.