Good morning, Matthew.
NNova313 need you · 5 to hand off · 450 shipped overnight
Overnight · 2026-08-02
Much quieter night, and for a real reason rather than a lucky one. Four lanes ran — TacTile, Just Electrolyte, Release Timer and command-hub — and escalations fell from 728 to 235 because last night's check fixes held; command-hub went to zero, which is what it should have been all along. I took one more bite tonight: colour literals inside test files are fixture data, not design violations, since qr-scannability.test.ts asserts contrast ratios with literal hexes and a token would destroy the test. That cleared another 23. What's left is 212 findings I deliberately did not touch, because the check itself says they need you — it rates them hard on the grounds that choosing between an existing token and a new one is a judgement about design intent. They cluster on three self-contained pages: TacTile's health-map, its hub auth screen, and Release Timer's site index, each carrying its own local palette. Nothing was auto-fixed anywhere for the third night running, which by now looks less like nothing being fixable and more like auto-fix never actually firing.
Paste into a new session — it has the context to work through this.
Needs you now313
01
AtAthletic · Cadence
Confirm Thursday points race
Registration closes 6pm.
Blocked
02
JEJust Electrolyte · Sol
Sign the co-packer RFQ
Needs signature today to hold the slot.
Blocked
03
JEJust Electrolyte · Sol
Size container, scoop and induction seal
Gated on bulk density.
Blocked
04
TtTacTile · Viv
Approve: Deep link & handoff
Blocked
05
TtTacTile · Viv
NEEDS MATTHEW: staging STRIPE_WEBHOOK_SIGNING_SECRET
Staging Stripe webhooks still 500. The signing secret exists nowhere I can reach it — 1Password's Stripe.test_webhook_secret is empty and Cloudflare secrets are write-only.
Blocked
06
TtTacTile · Viv
NEEDS MATTHEW: privacy-policy §6 publishes an admission against interest
A visible editorial blockquote in privacy-policy.md §6 names internal files, hub task ids, and states in public that a published retention promise is not enforced.
Blocked
07
TtTacTile · Viv
Seed a demo account — it blocks BOTH the Play screenshots and Caitlin's QA pass
Screenshots and QA are blocked by the same missing thing: an account with representative data, and the only database available is backup-less production.
Blocked
08
TtTacTile · Viv
MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as public
Blocked
09
TtTacTile · Viv
The production account's data is 42 days stale — Analytics renders empty at any default window
Measured read-only against production: the newest scan event is 2026-07-05. 7-day and 30-day windows both return zero events; 90-day returns 9,388. Any Analytics screenshot at a default window is empty regardless of build configuration or who is signed in.
Blocked
10
TtTacTile · Viv
Enable branch protection on main
Blocked
11
TtTacTile · Viv
QA: Subscription / Billing
Blocked
12
TtTacTile · Viv
QA: Billing hand-off to web/Stripe QR
Blocked
13
TtTacTile · Viv
web-mobile staging has no DNS record — the worker has been deploying into the void
Blocked
14
TtTacTile · Viv
NEEDS MATTHEW: decide whether resolve_trigger_destination keeps anon EXECUTE
Split out of t_449fbef0 in round 14. It is the one anon-executable SECURITY DEFINER function whose call sites could not be settled by grep, and revoking it wrongly breaks the core scan flow against a zero-backup database.
Blocked
15
AtAthletic · Cadence
Ship the Lanes module
Code is written and verified in the working tree at ~/Command/cycling/athletics-hub. Needs commit + push; CI deploys on push to main.
Done
16
AtAthletic · Cadence
N2a — Set Cronometer secrets
Matthew-only. Blocks the scheduled pull from working, though the code can be written first.
To do
17
CSClearSource · Clara
Send the 103.31 request to CBP National Finance Center, Indianapolis
To do
18
CSClearSource · Clara
DECIDE: accept CBP's price and terms, or fall back to a paid vendor
To do
19
CSClearSource · Clara
DECIDE: sign a vendor contract (recurring spend)
To do
20
CSClearSource · Clara
DECIDE: how many brands must resolve to real shipments before going public
To do
21
CSClearSource · Clara
DECIDE: the domain
To do
22
CSClearSource · Clara
DECIDE: the host (Vercel is the only verified path; Cloudflare is buildable, not deployable)
To do
23
CSClearSource · Clara
Push the repo to GitHub; this is what activates the daily-pipeline cron
To do
24
CSClearSource · Clara
Approve: final read of the live site before anyone is told about it
To do
25
CSClearSource · Clara
CLEARSOURCE LIVE ON REAL DATA
To do
26
CSClearSource · Clara
Announce on X, LinkedIn, HN and Reddit
To do
27
CSClearSource · Clara
DECIDE: buy historical backfill, or start from today forward
To do
28
CSClearSource · Clara
Approve: Data Acquisition (CBP / vendor)
To do
29
CSClearSource · Clara
Approve: Ingest & Incoming Format
To do
30
CSClearSource · Clara
Approve: Entity Resolution & Review Queue
To do
31
CSClearSource · Clara
Approve: Findings & §10 Legal Posture
To do
32
CSClearSource · Clara
Approve: Pipeline Operations & Daily Cron
To do
33
CSClearSource · Clara
DECIDE: implement PostgresAdapter for v1, or leave it a phase-2 stub
To do
34
CSClearSource · Clara
Approve: Data Layer & Adapters
To do
35
CSClearSource · Clara
Approve: Site, Routes & Components
To do
36
CSClearSource · Clara
Approve: SEO, Metadata & Structured Data
To do
37
CSClearSource · Clara
Approve: Accessibility & Cross-device
To do
38
CSClearSource · Clara
Approve: Content & Editorial Standards (read every public page end to end)
To do
39
CSClearSource · Clara
Approve: Affiliate / Resale Layer
To do
40
CSClearSource · Clara
DECIDE: self-serve API key issuance for v1, or keep it manual
To do
41
CSClearSource · Clara
Approve: Public API
To do
42
CSClearSource · Clara
Approve: Deploy, Hosting & Domain
To do
43
CSClearSource · Clara
Approve: Observability, Health & Incident Response
To do
44
CSClearSource · Clara
DECIDE: who meets the 2-day acknowledge and 7-day resolve correction SLA
To do
45
CSClearSource · Clara
Approve: Legal, Policy & Corrections Intake
To do
46
CSClearSource · Clara
Approve: Security, Secrets & Rate Limiting
To do
47
CSClearSource · Clara
Approve: Testing
To do
48
CSClearSource · Clara
Approve: Repo Hygiene & Docs
To do
49
CSClearSource · Clara
DECIDE: pricing for the keyed API tier
To do
50
CSClearSource · Clara
Call CBP Collections (317) 614-4514 for the real 103.31 price and electronic-delivery answer
To do
51
CSClearSource · Clara
Get a real ocean bill-of-lading extract in hand
To do
52
CSClearSource · Clara
Set PIPELINE_AUTOCOMMIT=true so daily releases actually reach production
To do
53
CSClearSource · Clara
DNS, HTTPS and redirects verified on the real domain
To do
54
CSClearSource · Clara
Hand-verify resolved brands against the raw customs records
To do
55
CSClearSource · Clara
Verify FINDINGS_AUTOPUBLISH is unset or false in every environment
To do
56
CSClearSource · Clara
Work the findings review queue on the first real batch
To do
57
CSClearSource · Clara
Practice a rollback: repoint CURRENT and redeploy, before relying on it live
To do
58
CSClearSource · Clara
Cross-device and screen-reader pass on the real deployed site
To do
59
CSClearSource · Clara
Apply to eBay Partner Network (no traffic minimum, covers every category)
To do
60
CSClearSource · Clara
Create an Impact.com publisher account and apply to The RealReal
To do
61
CSClearSource · Clara
Create a CJ Affiliate publisher account and apply to Vestiaire Collective
To do
62
CSClearSource · Clara
Apply to Skimlinks and confirm ThredUp is live in its merchant list
To do
63
CSClearSource · Clara
Reconfirm every commission rate and cookie window inside each network's own dashboard
To do
64
CSClearSource · Clara
Create the host account and link the repo (Root Directory = apps/web)
To do
65
CSClearSource · Clara
Set the four launch env vars in the host project
To do
66
CSClearSource · Clara
Set NEXT_PUBLIC_CONTACT_EMAIL to a real, monitored inbox
To do
67
CSClearSource · Clara
Point an uptime monitor at /api/health and alert on a non-ok body, not the status code
To do
68
CSClearSource · Clara
Read /privacy and /disclosures against the real-data posture
To do
69
JEJust Electrolyte · Sol
Confirm Venice Unit B zoning permits food manufacturing
Call LA City Planning. Ask specifically whether the unit permits food processing/manufacturing as a use. BINARY GATE: if this fails the entire in-house path collapses and all downstream work is wasted. One phone call, $0.
To do
70
JEJust Electrolyte · Sol
Magnesium citrate GRAS determination
HIGHEST RISK. As a supplement, trimagnesium dicitrate is fine under DSHEA. As a conventional food, every ingredient must be GRAS or an approved additive, and magnesium citrate has no FDA GRAS affirmation for general food use. Needs a self-GRAS determination (literature review + expert panel) or a food attorney opinion letter. Gates the label, the listing, and arguably the first batch. 3-6 weeks, $3k-$15k.
To do
71
JEJust Electrolyte · Sol
Convert cGMP build from 21 CFR 111 to 21 CFR 117
PRODUCTION-CONTEXT.md specs batch records under Part 111 (supplement rule). Conventional food runs under Part 117 Subpart C: written Food Safety Plan (HARPC), hazard analysis, preventive controls, sanitation controls, supply-chain program, recall plan. Different document set. 4-8 weeks.
To do
72
JEJust Electrolyte · Sol
Trademark clearance search on Just Electrolyte
Never run. Real risk: the mark is highly descriptive for an electrolyte powder and invites a §2(e)(1) descriptiveness refusal on the Principal Register. Know this before spending filing fees.
To do
73
JEJust Electrolyte · Sol
File trademark via Amazon IP Accelerator
Critical: Brand Registry accepts a registered trademark OR one pending specifically through IP Accelerator. A direct USPTO filing does NOT qualify while pending, and direct registration runs 10-14 months. IP Accelerator costs more up front and buys ~a year of earlier Brand Registry access. ~$700 attorney + $350/class.
To do
74
JEJust Electrolyte · Sol
Log the in-house manufacturing decision in STATUS.md
The 2026-07-31 analyses (self-manufacture-options.html, self-manufacture-vs-copacker.xlsx) recommend a co-packer and model self-manufacture at $25k-$90k/yr negative. Overridden but never reconciled in writing. Write the decision entry with reasoning so the repo stops contradicting itself.
To do
75
JEJust Electrolyte · Sol
Close out or park the co-packer RFQ pipeline
118 RFQs sent, 18 replies, 0 selected, task t_je_rfq blocked on signature. Either formally close it or keep 1-2 warm as fallback. Stop it sitting blocked.
To do
76
JEJust Electrolyte · Sol
Complete PCQI certification (FSPCA course)
Part 117 requires a Preventive Controls Qualified Individual. Must be Matthew. ~2.5 days, ~$700. Prerequisite to a valid food safety plan.
To do
77
JEJust Electrolyte · Sol
Rebuild label panel as Nutrition Facts (21 CFR 101.9)
RACC-driven serving size, ingredient statement in descending order by weight, allergen statement. Existing Supplement Facts panels are the wrong format and carry an unresolved Calcium %DV error (declares 2%, actual 2.3%). Note repo conflict: PRODUCTION-CONTEXT.md §7 marks this DONE, FOOD-REPOSITIONING-CONTEXT.md marks it must-rebuild.
To do
78
JEJust Electrolyte · Sol
Rewrite claims guardrails for conventional food
Food claims are tighter than supplement claims; DSHEA disclaimer no longer applies. 'Supports hydration' needs re-evaluation in a food framing.
To do
79
JEJust Electrolyte · Sol
Prop 65 heavy-metals screen (ICP-MS)
On the mineral ingredients. Doubles as Prop 65 exposure check. $300-$800.
To do
80
JEJust Electrolyte · Sol
FDA Food Facility Registration
Required now that JE manufactures and holds. Free, biennial renewal, online, same day.
To do
81
JEJust Electrolyte · Sol
CDPH Processed Food Registration
California requirement for a food processing facility. ~$200-$500/yr.
To do
82
JEJust Electrolyte · Sol
LA City BTRC registration
Business tax registration certificate.
To do
83
JEJust Electrolyte · Sol
Product liability insurance ($1M CGL)
Amazon requires $1M commercial general liability above $10k/mo, but carry it before the first unit ships. ~$500-$1,500/yr.
To do
84
JEJust Electrolyte · Sol
Correct trademark class from IC 005 to IC 032
Repo plans IC 005 (pharmaceutical/supplement). Food repositioning moves this to IC 032 (non-alcoholic beverages, powders for making beverages). Wrong class wastes the fee and the priority date.
To do
85
JEJust Electrolyte · Sol
Buy GS1 US Company Prefix (1-10 tier)
Direct from gs1us.org, never a barcode reseller. Amazon cross-checks Verified by GS1; a resold UPC shows the wrong registrant and blocks listing creation (error 5665). $250 + $50/yr.
To do
86
JEJust Electrolyte · Sol
Assign GTIN and register in Verified by GS1
Brand name string must match the Amazon listing brand exactly.
To do
87
JEJust Electrolyte · Sol
Enroll in Amazon Brand Registry
Once the IP Accelerator filing lands. Unlocks A+ content.
To do
88
JEJust Electrolyte · Sol
Open Amazon Professional Seller account
Entity: Just Electrolyte LLC. EIN 42-3305529. Chase business account. $39.99/mo.
To do
89
JEJust Electrolyte · Sol
Pass Amazon identity and video verification
Most common new-account failure is a name/address mismatch across government ID, bank statement, and business formation docs. Make all three read identically before starting. Days to 3 weeks.
To do
90
JEJust Electrolyte · Sol
Enter CDTFA seller's permit in Amazon tax settings
Permit #244-732128, retrieved 2026-09-09.
To do
91
JEJust Electrolyte · Sol
Complete Amazon tax interview
W-9, LLC taxed as partnership (Form 1065).
To do
92
JEJust Electrolyte · Sol
Confirm grocery category gating requirements in Seller Central
Do this inside the live account rather than trusting secondhand summaries. Gating scope changes and the application form is ground truth.
To do
93
JEJust Electrolyte · Sol
Get bulk density from ADM TDS
1-3 week supplier lead time. Gates jar size, scoop size, fill percentage, slack-fill exposure.
In progress
94
JEJust Electrolyte · Sol
Complete dehumidified room buildout
Blender, induction sealer, precision balance, dehumidifier. Pails ordered 2026-09-12.
In progress
95
JEJust Electrolyte · Sol
Run first batch with Part 117 batch records
Gated on the Part 117 conversion, PCQI cert, and container sizing.
To do
96
JEJust Electrolyte · Sol
Finished-product COA from ISO/IEC 17025 lab
Not strictly required for grocery gating, but needed for Prop 65, for the purity claims currently pulled from the site, and as insurance if Amazon challenges the category. $400-$1,200.
To do
97
JEJust Electrolyte · Sol
Establish expiration dating with a stability basis
Amazon requires the date on the exterior, MM-DD-YYYY or MM-YYYY, 36pt minimum, with 90+ days shelf life remaining on arrival at the fulfillment center. Needs a stability basis, not a guess.
To do
98
JEJust Electrolyte · Sol
Rewrite Amazon listing files for food/grocery, single SKU
Currently four SKUs targeting dietary supplements. Reduce to the one launch SKU (Tub Normal 60-serving) and rewrite for food/grocery with food-compliant claims.
To do
99
JEJust Electrolyte · Sol
Decide FBA vs FBM
FBA small-standard runs ~$3.20-$3.38/unit plus 3.5% fuel surcharge. Storage $0.78/cu ft/mo Jan-Sep but $2.40 Oct-Dec (3x peak penalty). Realistic timeline puts first inbound in Q1 2027, which avoids it. Do not rush inventory in during Q4 to hit a date.
To do
100
JEJust Electrolyte · Sol
Create the Amazon listing
Gated on GTIN, gating approval, and account verification.
To do
101
JEJust Electrolyte · Sol
Build A+ content
Requires Brand Registry.
To do
102
PePersonal · Ivy
Renew passport
Expires in under 6 months.
To do
103
RTRelease Timer · Piper
Set up Release Timer domain email (support@)
Done
104
RTRelease Timer · Piper
Create + deploy the public Release Timer website
Done
105
RTRelease Timer · Piper
WEBSITE SIGNED OFF
To do
106
RTRelease Timer · Piper
Approve exporters
To do
107
RTRelease Timer · Piper
Approve roster + sessions flow
To do
108
RTRelease Timer · Piper
Approve settings page
To do
109
RTRelease Timer · Piper
VELODROME APPROVED
To do
110
RTRelease Timer · Piper
Submit velodrome for review
To do
111
RTRelease Timer · Piper
DECIDE: Sheets/Excel sync in v1?
To do
112
RTRelease Timer · Piper
Approve Sheets/Excel sync
To do
113
RTRelease Timer · Piper
Approve speed-skating mode
To do
114
RTRelease Timer · Piper
Approve swimming mode
To do
115
RTRelease Timer · Piper
Approve athletics mode
To do
116
RTRelease Timer · Piper
Approve rowing mode
To do
117
RTRelease Timer · Piper
Approve equestrian mode
To do
118
RTRelease Timer · Piper
SPORT FAMILY APPROVED
To do
119
RTRelease Timer · Piper
Submit the 5 sport apps for review
To do
120
RTRelease Timer · Piper
DECIDE: PDF exporter — keep or kill?
To do
121
RTRelease Timer · Piper
Approve PDF export
To do
122
RTRelease Timer · Piper
Submit velodrome to Play review
To do
123
RTRelease Timer · Piper
Create Google Play Console app + app signing
To do
124
RTRelease Timer · Piper
Test + approve: on-device timing at a real track session
To do
125
RTRelease Timer · Piper
Test + approve: watch app on device
To do
126
RTRelease Timer · Piper
Create Google Cloud OAuth client + Azure AD app registration
To do
127
RTRelease Timer · Piper
Test + approve: on-device timing on Android at a real track session
To do
128
RTRelease Timer · Piper
Test + approve: Wear OS watch app on device
To do
129
RTRelease Timer · Piper
DNS / HTTPS / redirects verified
Done
130
RTRelease Timer · Piper
good-night design check parses only HSL tokens — hex-form token files resolve to zero
Shared-runner gap found during the 2026-07-25 /good-night run. release-timer's first successful nightly produced 136 escalations, 126 of them design findings — all false positives caused by this. Not a release-timer-only bug; filed here because this is where it surfaced.
To do
131
TtTacTile · Viv
Approve: Legal & Compliance
[approve] Matthew's final sign-off gate for the legal package.
To do
132
TtTacTile · Viv
Approve: Security & Secrets
Matthew's final sign-off gate for security.
To do
133
TtTacTile · Viv
Approve: Shared Packages
Matthew's sign-off that the shared UI layer is ready for surfaces to build on.
To do
134
TtTacTile · Viv
Review anon-executable SECURITY DEFINER functions
35 RPC functions callable by anon/authenticated; confirm each is intentional (several analytics_group_* look wrong). Found by live audit.
Done
135
TtTacTile · Viv
Approve: Database & Supabase
Matthew's sign-off gate for the database.
To do
136
TtTacTile · Viv
Approve: Backend API
To do
137
TtTacTile · Viv
Approve: Auth & User Management
To do
138
TtTacTile · Viv
Approve: Email & Notifications
To do
139
TtTacTile · Viv
Approve: Custom Domains
To do
140
TtTacTile · Viv
Approve: Billing & Payments
To do
141
TtTacTile · Viv
Approve: Workers & Durable Objects
To do
142
TtTacTile · Viv
Approve: Supabase Edge Functions
To do
143
TtTacTile · Viv
Approve: DevOps Foundation
To do
144
TtTacTile · Viv
Approve: DevOps Launch Readiness
To do
145
TtTacTile · Viv
Approve: iOS QA — Core surfaces
To do
146
TtTacTile · Viv
Approve: iOS destination editing
To do
147
TtTacTile · Viv
Approve: iOS QA — Settings
To do
148
TtTacTile · Viv
Submit iOS build for review
To do
149
TtTacTile · Viv
Approve: iOS destination viewers
To do
150
TtTacTile · Viv
Approve: iOS release
To do
151
TtTacTile · Viv
Approve: iOS iPad adaptation
To do
152
TtTacTile · Viv
Approve: iOS QA — Destinations
To do
153
TtTacTile · Viv
Approve: Android pre-submission blockers
To do
154
TtTacTile · Viv
Approve: Android tablet support
To do
155
TtTacTile · Viv
Approve: Android feature parity
To do
156
TtTacTile · Viv
Approve: Android QA sign-off
To do
157
TtTacTile · Viv
Submit Android build for review
To do
158
TtTacTile · Viv
Approve: Android release
To do
159
TtTacTile · Viv
Approve: Web public destination viewer
To do
160
TtTacTile · Viv
Approve: Web desktop destination creation
To do
161
TtTacTile · Viv
Approve: Web app shell & dashboard
To do
162
TtTacTile · Viv
Approve: Web QA sign-off
To do
163
TtTacTile · Viv
Approve: NFC/QR Core Pipeline
To do
164
TtTacTile · Viv
Approve: Video & Media
To do
165
TtTacTile · Viv
Approve: AI Agent
To do
166
TtTacTile · Viv
Approve: RAG / Semantic Search
To do
167
TtTacTile · Viv
Approve: Analytics UI
To do
168
TtTacTile · Viv
Approve: Contacts & Leads
To do
169
TtTacTile · Viv
Approve: Admin & Support
To do
170
TtTacTile · Viv
GO / NO-GO decision
This is the last decision before shipping.
To do
171
TtTacTile · Viv
TacTile v1.0 LAUNCHED
To do
172
TtTacTile · Viv
Approve: Marketing website
To do
173
TtTacTile · Viv
Approve: Business & documentation
Matthew's final sign-off gate for the Business & documentation package.
To do
174
TtTacTile · Viv
Approve: iOS Dashboard, Canvas & Assets
To do
175
TtTacTile · Viv
Approve: iOS Settings, Analytics & tools
To do
176
TtTacTile · Viv
Approve: iOS QR build
To do
177
TtTacTile · Viv
Approve: iOS QA — iPad
To do
178
TtTacTile · Viv
Approve: Web → app handoff
Matthew — Gate. Done when: all handoff tasks (deep-link infra, design, build, QA) are done and Matthew has reviewed the end-to-end experience.
To do
179
TtTacTile · Viv
Approve: Dashboard, Canvas & Assets build
To do
180
TtTacTile · Viv
Approve: Settings, Analytics & tools build
To do
181
TtTacTile · Viv
DECISION: Shop — ship a real store or pull it to match iOS's dead-code status
Done
182
TtTacTile · Viv
Approve: Destinations build
Done
183
TtTacTile · Viv
Approve: Settings, Analytics & agent build
To do
184
TtTacTile · Viv
Approve: Surface build
To do
185
TtTacTile · Viv
Approve: Android QA — Tablet
To do
186
TtTacTile · Viv
Approve: Dead code removal
To do
187
TtTacTile · Viv
Approve: Destination editing
To do
188
TtTacTile · Viv
Approve: Proposal card data layer
To do
189
TtTacTile · Viv
Approve: Approvals & sessions
To do
190
TtTacTile · Viv
Approve: Android parity
To do
191
TtTacTile · Viv
Approve: Quality bar
To do
192
TtTacTile · Viv
Approve: QR management
me — Final approval that desktop and mobile web QR management reaches native parity per Matthew's 2026-07-26 decision ('manage all the destinations and QR codes... everything except physically encode the NFC'). Done when: all QR management wave tasks are done and QA sign-off is verified.
To do
193
TtTacTile · Viv
Approve: Hardware & fulfillment
To do
194
TtTacTile · Viv
Decide: RAG stays internal-only or becomes the agent's retrieval layer
To do
195
TtTacTile · Viv
Decide: will RAG ever index per-account/customer content?
To do
196
TtTacTile · Viv
Approve: MCP surface
To do
197
TtTacTile · Viv
NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grant
A systemic grant bug found while applying the audit-log migration. Several destructive SECURITY DEFINER functions are executable by PUBLIC or by anon in production right now.
To do
198
TtTacTile · Viv
Gallery save: verify the real 3-phase HTTP round trip (needs a session)
The gallery edit save decision is unit-tested and the rendering is device-verified, but no gallery has ever been saved through the real three-phase sequence against a live API.
Done
199
TtTacTile · Viv
verify:secrets-rotation is red — VideoTranscoder secret is a placeholder in 1Password
The video transcoder's shared secret works in production but was never recorded in 1Password, so a CI gate fails for every PR until someone updates the vault entry.
To do
200
TtTacTile · Viv
MATTHEW — 8 decisions that unblock the four sessions
To do
201
TtTacTile · Viv
Provision apps/android/local.properties so the Android app can reach a backend
To do
202
TtTacTile · Viv
GitHub Actions is off for the whole repo — billing wall fails every job in 2s
To do
203
TtTacTile · Viv
PROD INCIDENT: sign-in and sign-up are dead on tactile.to
tactile.to/signin and /signup render "Something went wrong". Every conversion path from the marketing site dead-ends. Cause found and fixed; the fix is on feature/web and needs merging + a prod deploy.
Done
204
TtTacTile · Viv
MATTHEW — approve applying migration 0901 to prod (link-channel analytics)
Done
205
TtTacTile · Viv
ESCALATE → Matthew: 13 critical secrets 31-57 days overdue, hidden because verify short-circuits and CI is down
To do
206
TtTacTile · Viv
MATTHEW — irreversible before first Play upload: the signing cert says "TapTile Inc"
To do
207
TtTacTile · Viv
Rotate the leaked Supabase service_role key + provision the release iOS plist
To do
208
TtTacTile · Viv
MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketing
To do
209
TtTacTile · Viv
MATTHEW: add db_url to the 1Password Supabase item — two RLS audits have never been runnable
verify:db-grants and verify:rls-snapshot both need a Postgres connection string. No db_url field exists on the Supabase vault item, and none ever has — so the only detector for RLS fixture staleness has never run, by anyone.
Done
210
TtTacTile · Viv
Approve: iOS dead code removal
To do
211
TtTacTile · Viv
Approve: Web responsive depth
To do
212
TtTacTile · Viv
Approve: web-mobile parity
To do
213
TtTacTile · Viv
iOS build sign-off
Final QA pass + submit iOS build.
Done
214
TtTacTile · Viv
QA: Delete account
Done
215
TtTacTile · Viv
Verify in-app purchase products match Stripe/App Store Connect
To do
216
TtTacTile · Viv
QA: Delete account and sign out
To do
217
TtTacTile · Viv
QA: Subscription + billing
To do
218
TtTacTile · Viv
QA: Account deletion
To do
219
TtTacTile · Viv
Decide whether the AI agent ships enabled at launch
Done
220
TtTacTile · Viv
Define what 'basic analytics' means for the v1.0 cut line
To do
221
TtTacTile · Viv
Decide whether a contacts/leads inbox ships in v1.0
To do
222
TtTacTile · Viv
Decide what to do with form_submissions as lead capture (surface, export, retention)
To do
223
TtTacTile · Viv
Decide whether destination sharing / collaborator permissions ship in v1.0
To do
224
TtTacTile · Viv
Run the cut-list checkpoint
The ladder, in drop order: (1) AI Agent + RAG, (2) advanced Analytics UI, (3) tablet/iPad adaptive polish, (4) non-core Video & Media, (5) Admin/Support depth, (6) lean marketing page. Never cut: Legal, Security, Auth, Billing, NFC/QR core, iOS, Web shell, CI/CD, Testing.
To do
225
TtTacTile · Viv
Plan the rollout
To do
226
TtTacTile · Viv
Resolve the marketing site vs (marketing) route-group split
Two marketing surfaces with unclear ownership is a launch hazard.
To do
227
TtTacTile · Viv
Write the go-to-market plan
Strategic — Matthew's call.
To do
228
TtTacTile · Viv
Decide the in-app purchase strategy
CRITICAL: audits found neither iOS nor Android has any in-app purchase path — no StoreKit, no Play Billing, no RevenueCat. Billing today is Stripe web checkout only. Apple requires in-app purchase for digital goods sold inside an app — both a store-review risk and a margin decision (Apple/Google take ~15-30%).
Done
229
TtTacTile · Viv
Decide fate of ProfilePhotoCropReviewView (ship or delete)
To do
230
TtTacTile · Viv
Decide fate of Analytics Overview tab (ship or delete)
To do
231
TtTacTile · Viv
Decide fate of legacy Dashboards widget system (~15 files)
To do
232
TtTacTile · Viv
Decide Goals v2 scope (recurrence, prefill, streak history, sort, status, taxonomy)
To do
233
TtTacTile · Viv
Decide routing for 'Program NFC Tag' hub tile
To do
234
TtTacTile · Viv
Define real scope of the destination-analytics pipeline before it's built blind
To do
235
TtTacTile · Viv
Design the handoff experience
Matthew — Decide what a web user sees when they need to program a physical tag. Done when: a documented decision covers (a) desktop QR-to-phone, (b) mobile-web direct app-open, (c) app-store fallback preserving intent, (d) the return path after programming — ready to hand to engineering. File: apps/web-mobile/features/nfc/components/NfcExplainerSection.tsx, apps/web-mobile/features/nfc/constants.ts.
To do
236
TtTacTile · Viv
me — Decide whether CSP enforcement (CSP_ENFORCE=1) is set in the production deployment environment, and confirm it before next release.
Done when: CSP is verified either intentionally report-only or actually enforced in prod, not silently defaulting to report-only because an env var was never set. File: apps/web/middleware.ts:30-56.
To do
237
TtTacTile · Viv
QA: Shop cart and checkout
Done
238
TtTacTile · Viv
QA: web-mobile subscription
To do
239
TtTacTile · Viv
Define what "pristine" means for the AI agent
To do
240
TtTacTile · Viv
Decide how customers buy hardware at launch
To do
241
TtTacTile · Viv
Select hardware supplier(s) and confirm pricing at real order volumes
To do
242
TtTacTile · Viv
Place the initial hardware inventory order
To do
243
TtTacTile · Viv
Secure product liability insurance
To do
244
TtTacTile · Viv
Reconcile investor deck's "Contact — SHIPPED" claim with reality
To do
245
TtTacTile · Viv
Reconcile gross margin figures (92.6% vs 86.1% vs 80.2%)
Highest-signal reconciliation item — three margin figures in circulation, Section 6 contradicts itself.
To do
246
TtTacTile · Viv
Reconcile pre-seed raise tiers ($340/470/729K vs $539/691/993K)
Two tier sets nine days apart — investor-facing, needs one canonical answer.
To do
247
TtTacTile · Viv
Confirm TAM framing: $45.8B (business plan) vs $137M (Investor Plan v2 wedge)
Likely intentional (broad TAM vs narrow wedge) but needs explicit confirmation and consistent labeling.
To do
248
TtTacTile · Viv
DECIDE: AI Assistant/MCP "SHIPPED" claim in Investor Plan v2 vs reality
Highest-priority item in this wave — investor-facing claim the product cannot currently perform.
To do
249
TtTacTile · Viv
DECIDE: competitive matrix self-score (14/14) vs actual destination coverage
Investor-honesty item — self-score does not match shipped destination coverage.
To do
250
TtTacTile · Viv
DECIDE: "Contact" listed as SHIPPED content type — no contacts feature exists
Investor-honesty item — claimed shipped feature does not exist.
To do
251
TtTacTile · Viv
DECIDE: "no third-party data sales" pledge dropped from canonical S13
Confirmed drift from the Section 13 audit — real policy weakening, not cosmetic.
To do
252
TtTacTile · Viv
Add IP-assignment and NDA agreements to S13's pre-launch checklist
Confirmed drift — trade-secret strategy depends on agreements the checklist doesn't require.
To do
253
TtTacTile · Viv
Add product liability + workers' comp to S13's insurance plan
Confirmed drift — hardware company with a gap in coverage that matters.
To do
254
TtTacTile · Viv
Fix cap table misstatement: S13 says "no SAFEs" while one is actively being raised
Confirmed drift — active fundraising document contains a factual misstatement.
To do
255
TtTacTile · Viv
DECIDE: revisit Marketing website's cut-list position now it's the only purchase path
Flagged by Nova: no-IAP decision materially changes this wave's risk profile.
To do
256
TtTacTile · Viv
Honesty check — reconcile investor deck MCP claims against what ships
To do
257
TtTacTile · Viv
Decide: restore or drop the "no third-party data sales, ever" pledge
Done
258
TtTacTile · Viv
Execute IP assignment and NDA agreements
To do
259
TtTacTile · Viv
Reconcile the three conflicting gross margin figures
To do
260
TtTacTile · Viv
Reconcile the two pre-seed ask tiers
To do
261
TtTacTile · Viv
Reconcile investor-deck claims against what actually ships
To do
262
TtTacTile · Viv
Build the hardware purchase path now that Shop is cut
To do
263
TtTacTile · Viv
Plan for store rejection
To do
264
TtTacTile · Viv
Appoint an Article 27 EU representative
To do
265
TtTacTile · Viv
Execute SCCs with all seven sub-processors
To do
266
TtTacTile · Viv
NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes it
delete_account_cascade is SECURITY DEFINER with an explicit anon EXECUTE grant and no caller check. Unauthenticated, unrecoverable account deletion. Live right now.
Done
267
TtTacTile · Viv
NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed live
Exploit confirmed against production: the publishable anon key returns all 20 accounts with billing state. Fix is written and verified; applying it is blocked by policy.
Done
268
TtTacTile · Viv
NEEDS MATTHEW: GitHub Actions billing wall — all CI is blocked
Every GitHub Actions job now refuses to start. Separate from, and discovered by, fixing the tactile-hub deploy.
Done
269
TtTacTile · Viv
EMIT LEG: send method:\"link\" from the clients, or the Link bucket stays at zero
To do
270
TtTacTile · Viv
POST /api/events/open is documented public+unauth but 401s anonymously
Done
271
TtTacTile · Viv
verify:one-contact-address is red on main — design/card-creation-flow.html publishes kaitlynn@tactile.to 14 times
Done
272
TtTacTile · Viv
MenuCard + GalleryCard ignore schema.collection — the backend has been sending it
Done
273
TtTacTile · Viv
Demo account for screenshots + QA — seeder is live, shape is frozen
To do
274
TtTacTile · Viv
Decide the triggers for the 6 system error screens — all are unreachable
All six system sheets (loading, no internet, server error, scan failed, scan permissions, action not found) are built and wired into RootView but nothing ever triggers them. Needs a product decision on what each should respond to before anyone wires them.
To do
275
TtTacTile · Viv
Decide fate of Map breadcrumb drill-down feature
To do
276
TtTacTile · Viv
Decide fate of multi-entity Compare dashboard widget concept
To do
277
TtTacTile · Viv
Decide fate of Sources dashboard tile (needs new API endpoint)
To do
278
TtTacTile · Viv
Decide whether dashboard share/export is in scope
To do
279
TtTacTile · Viv
Decide Pro-lock widget scope for Dashboards palette
To do
280
TtTacTile · Viv
Decide real scope for QRLaunchpad Share & Export
To do
281
TtTacTile · Viv
Sign off: Settings surfaces not flagged in this audit
To do
282
TtTacTile · Viv
Sign off: Analytics files/widgets confirmed clean in this audit
To do
283
TtTacTile · Viv
Sign off: ConnectCard field editors and models confirmed clean
To do
284
TtTacTile · Viv
Sign off: AI stubbed-banner behavior confirmed working as intended
To do
285
TtTacTile · Viv
Sign off: QR generator and NFC stamp-test harness confirmed clean outside tracked gaps
To do
286
TtTacTile · Viv
me — Decide whether to complete the orphaned device-trust / verify-device feature on web-mobile or delete the dead scaffolding.
Done when: a decision is made and either (a) lib/auth/device-trust.ts is wired to a real /verify-device page and post-signin gate, or (b) the unused module is deleted. File: apps/web-mobile/lib/auth/device-trust.ts (getDeviceTrust/setDeviceTrust/clearDeviceTrust/clearAllDeviceTrust, zero call sites anywhere in the codebase).
To do
287
TtTacTile · Viv
Confirm .gitkeep scaffold folders are intentional, not abandoned work
To do
288
TtTacTile · Viv
Decide and document the web-mobile desktop story
To do
289
TtTacTile · Viv
Decide: is missing camera QR scanning in iOS/Android intentional?
To do
290
TtTacTile · Viv
Pick a support ticket tool
To do
291
TtTacTile · Viv
Decide: LegacyURLPill wiring
To do
292
TtTacTile · Viv
Decide: delete dead GroupDetailView.swift
Done
293
TtTacTile · Viv
Decide whether Compare tab should be Pro-gated
Done
294
TtTacTile · Viv
Decide fate of orphaned AnalyticsKitRealtimeScreen.swift
Done
295
TtTacTile · Viv
Decide fate of AI Q&A dashboard widget stub
To do
296
TtTacTile · Viv
Decide fate of ConnectCard photo field type
To do
297
TtTacTile · Viv
Decide when to build the real Webhook destination connector
To do
298
TtTacTile · Viv
Decide whether Approvals Inbox needs Tweak support
Done
299
TtTacTile · Viv
Decide the account-timezone plan for analytics day-boundaries
To do
300
TtTacTile · Viv
DECISION: AI agent — build typed proposal cards to match iOS's 13, or confirm one generic card is acceptable for v1
Done
301
TtTacTile · Viv
DECISION: build merge-into-group / group-expand UI parity on Android, or confirm intentional gap
To do
302
TtTacTile · Viv
Reconcile LTV:CAC (6.0–7.2:1) and payback (3.4–5.3mo) ranges
Depends conceptually on the gross-margin reconciliation task landing first.
To do
303
TtTacTile · Viv
Resolve retention conflict: S13's 90-day blanket vs indefinite Pro analytics retention
Confirmed drift from the Section 13 audit.
To do
304
TtTacTile · Viv
Fix the cap table's "no SAFEs" claim and document the former co-founder
To do
305
TtTacTile · Viv
Decide: gallery at exactly 30 items cannot swap in one save
A user whose gallery is full has to remove an item and save, then add the new one as a second save. That is a deliberate safety trade, but it is a product decision that should be confirmed rather than inherited.
To do
306
TtTacTile · Viv
Webhook signing secret: add the one surface that can reveal it
Done
307
TtTacTile · Viv
tile_nfc_profiles RLS exists in production but in no migration — the migrations do not describe prod
To do
308
TtTacTile · Viv
iOS has no destinations write path — name/description and mute are read-only from the client
To do
309
TtTacTile · Viv
Decide whether the instrumented paint tier becomes a required gate (needs an emulator CI job)
To do
310
TtTacTile · Viv
5 proposal-only MCP ops are advertised with no task row building them
Found 2026-08-12 by deriving the MCP inventory (#371). Decide build-or-cut for each; they are advertised to every connected MCP client today.
To do
311
TtTacTile · Viv
NFC metadata returns hardcoded tap_count: 0 — buildable now, but blocked on a privacy decision
Round-20 item 3, investigated 2026-08-13. The two technical blockers previously believed to hold are BOTH false. What actually blocks it is a product/security call that is Matthew's.
Done
312
TtTacTile · Viv
MATTHEW: CI capacity — one Mac, two runners, and a full Xcode build now runs on every push
To do
313
TtTacTile · Viv
QR picker reuses the DESTINATION filter panel — wrong content, unscrollable
QRPickerView drives DestinationFilterViewModel/ActionFilterPanel, so picking a QR code offers "Search destinations" and a grid of 13 destination types. The panel also cannot be scrolled, so Sort By is cut off.
To do
→
JEJust Electrolyte · → Sol
Chase the 4 open quotes
Follow up on anything quiet 5+ days.
In progress
→
RTRelease Timer · → Piper
Set the real App Store URL on the site
To do
→
TtTacTile · → Viv
Verify point-in-time recovery is enabled
Confirm PITR/backup retention is actually on in Supabase settings — unverified in the audit, and it gates the backup policy doc.
To do
→
CSClearSource · → Clara
Refresh the homepage hero: three options, preview first
To do
→
AtAthletic · → Cadence
N1 — Migration 0002: daily_metrics + food_log
Narrow/EAV shape deliberately: one row per reading so Health's 9 metrics, nutrition macros and aero checks all fit without ALTER TABLE. Everything else in this wave waits on it.
To do
TodayCalendar →
Tt
Weekly with Tess — ship review
TacTile · Meet
09:00
JE
Co-packer call — PureBlend
Just Electrolyte · Phone
14:00
At
Track session — peak block
Athletic · Velodrome
07:00
Tt
Enterprise demo — Northloop
TacTile · Zoom
11:00
At
Points race — Velo Sports Center
Athletic · Velodrome
18:00
Inbox peekOpen all →
Dana Whitfield
Re: Enterprise plan for 50 seats
07:52
Marco (PureBlend)
Quote — 5,000 units, revised pricing
07:19
RTApp Store Connect
Release Timer 1.4.2 is ready for testing
01:40
Priya Anand
Loved the new case study — could we be next?
Yesterday
AtVelo Sports Center
Thursday points race — start list posted
Yesterday