Question
You're asking an AI agent to write a Go function that generates password-reset tokens, emails them, and later verifies a presented token against the stored one. Write the spec that makes token generation and verification cryptographically sound. What RNG, encoding, storage, and comparison rules do you mandate, and what acceptance criteria prove it? Then describe what a naive prompt ('generate a reset token and check it on use') gets wrong — there are several traps.
Treat the AI’s output as a draft to verify, not an answer to trust. Name the specific flaw and the input that triggers it, say how you’d catch it — tests, edge cases, reading critically — and how you’d re-prompt or decompose to get it right.
Vibe coding: describe the solution in plain language (or narrate it) and the coach grades your approach. Generating runnable code from your description is coming next.