Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·49 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

39/49 done10 open3 open blockers

Selected taskclear

ESCALATE → Matthew: 13 critical secrets 31-57 days overdue, hidden because verify short-circuits and CI is down

To doOwner · met_185119c7Blocker

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**ESCALATE → Matthew: 13 critical secrets 31-57 days overdue, hidden because verify short-circuits and CI is down** · to do · blocker

Where it sits: TacTile › Inbox — on deck

## The brief on file

RE-MEASURED 2026-08-16 by running `pnpm verify:secrets-rotation` on main (rc=1). The title's "13 secrets 31-57 days overdue" is STALE — current truth is 12 findings, 39-62 days overdue, i.e. fewer items and each one three-to-five weeks worse.

Named in the check output:
  op://TacTile/Anthropic/tier_2_console_key      55d overdue  critical
  op://TacTile/GitHub/personal_access_token      59d overdue  critical
  op://TacTile/Resend/api_key                    62d overdue  critical
  op://TacTile/Sentry/auth_token                 39d overdue  critical
  op://TacTile/Stripe/live_publishable_key       42d overdue  critical
  op://TacTile/OpenAI/api_key                    PLACEHOLDER referenced by deployed code
  (+6 more — run the check for the full list rather than quoting this prompt,
   which is exactly how the "13 / 31-57" figures went stale)

WHY THIS IS THE ONLY ALLOWED-RED. scripts/verify/gate.sh:29-31 lists
`verify:secrets-rotation` as its single ALLOWED_RED entry, owned by Matthew and
pointing here. Every PR merged in rounds 20-25 merged with this red. That is a
deliberate, documented position — but it means the gate has run for weeks with one
permanently-red check, and the longer that lasts the more it trains readers to skim
past red.

BLOCKED ON: 1Password availability. Matthew is frequently remote from his phone with
no Touch ID, so `op read` fails and rotation cannot proceed. This is not something an
agent can do — the rotation writes new values into the TacTile vault.

ACTION FOR MATTHEW: sit at the Mac with 1Password unlocked and run the rotation
runbook (docs/secrets/ROTATION.md). The placeholder OpenAI key is the sharpest item:
it is referenced by DEPLOYED code, so that path is broken in production right now,
not merely overdue.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

ESCALATE → Matthew: 13 critical secrets 31-57 days overdue, hidden because verify short-circuits and CI is down