Sounds about right.
> 1. Bugs around traits meant we had issues around password change, password recovery and email change/reverifications for our use-case
Can't comment much on these as I haven't experienced those issues, but I'm curious to hear what the issues were.
> 2. Lack of documentation prevented us making progress on 2FA/WebAuthn
Things have moved on in the last months, and the 2FA/WebAuthn implementation seems more mature and documented.
> 3. Bearer token/Oauth consent flow wasn't available without a lot of work because Kratos and Hydra are not "integrated" [1]. Someone shows how they rolled their own integration [2].
That's right, sadly there's no 'integration' available officially. There've been at least two pull requests (I made one of them) to add Hydra integration to the official demo Kratos UI, which for different reasons weren't merged. I'm not sure I'd say it's so much work (essentially, it's getting the existing Kratos session and translating those into a Hydra session, with a couple of API calls), but it's not something very well documented (or at all) and you're left to figure it out by yourself from the API documentation. I hope that integration between the two is improved, at least with an official demo showcasing the calls needed in order and with the right parameters.