Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·36 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Real scans are never recorded: nothing calls POST /api/events/openBlocked · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageDone Suppress analytics event writes for free-tier accountsDone Unify the four conflicting hash validation patternsDone Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Triage the "couldn't connect to the server" preview clusterDone Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tagsDone Public scan landing page polishTo do Replace the duplicate web hash-shape copies with one shared import once #658 or #681 landsTo do Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blankDone iOS Program NFC Tag read path rejects 7 and 8 character hashes; spec says accept 7-9Done ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode tableTo do CI gives no per-suite proof for the NDEF suites: iOS prints totals only, Android's newest main run was a Gradle cache hitTo do Fix tap_count hardcoded to 0 in NFC metadata endpointDone Add hash exhaustion alertingDone Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingDone Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsDone Close the check-then-insert race on hash claimingDone Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsDone Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failureTo do API: validate the hash shape in the four /content handlers (documents, notes, videos, audio) like destinationsPublic.ts doesTo do Android NfcWriter has no post-write read-back verify (spec 4a step 5)Done NDEF parity corpus: iOS asserts 1 of 5 vectors and no https://www. vector exists; generator and Kotlin disagree on wwwTo do ndef-format.md section 5 contradicts itself on empty + read-only; NFCTagClassifier.classify and diagnose order them oppositelyTo do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

18/36 done18 open2 open blockers

Selected taskclear

Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tags

DoneOwner · Vivt_191475f3

Android treats https://evil.example/t/123ABCD7Q as a TacTile tag; the spec calls the unanchored host match a live bug and iOS anchors it.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tags** · done

Android treats https://evil.example/t/123ABCD7Q as a TacTile tag; the spec calls the unanchored host match a live bug and iOS anchors it.

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## The brief on file

[2026-10-16 · Viv] DONE on draft PR #765 (https://github.com/TacTile-dev/TacTile/pull/765, branch r32/native-agent-ndef, commit 22492b02, off origin/main 4f2c1d6b). Not merged, not deployed, nothing written to production. The anchoring is shipped; the custom-domain product call stays open in the DECISION block directly below (the "not pushed yet" in it is now stale: the commit is on #765).

WHAT CHANGED: NdefUriDecoder.extractHash now returns null unless isTacTileHost (host == tactile.to or endsWith .tactile.to, case-insensitive; a mirror of iOS NFCChipCatalog.isTacTileHost). iOS needed no code change; its test_isTacTileHost_matrix now pins the same hosts. docs/nfc/ndef-format.md is untouched (held by #658 and #687).

EVIDENCE: Android NdefUriDecoderTest 11/11, including hostMatrixMatchesIos and hostMatrixHoldsThroughExtractHash (tactile.to and a.tactile.to accepted; eviltactile.to, tactile.to.evil.example and evil.example rejected), userInfoDoesNotMakeAForeignHostLookLikeTacTile, and rejectsWhiteLabelHost (was extractsHashFromWhiteLabelHost: the one assertion removed, the intended flip). iOS xcodebuild NFCChipCatalogTests (iPhone 17 Pro, iOS 26.5): 21 tests, 0 failures, the matrix test now pins a.tactile.to, tactile.to.evil.example and evil.example too (test-only). Mutations: unanchored endsWith("tactile.to") (the original bug) gave 2 red; isTacTileHost call removed from extractHash gave 3 red; iOS isTacTileHost changed to contains() turned test_isTacTileHost_matrix red; all restored. Callers read: extractHash runs only in NfcScanAnalysis.kt:67 (in-app scanner) and NfcEncoderViewModel.kt:115-119 (encoder diagnose); OS tap dispatch is manifest-based and unaffected.

BEHAVIOUR CHANGE (disclosed in the PR body): a tag written with a custom or white-label domain moves from DYNAMIC (cloud lookup) to STATIC "holds third-party data" in the Android in-app scanner, and from DiagnosedCompatible to DiagnosedNonTacTile in the encoder, until Matthew answers the DECISION below. No Android caller of reserveUniqueHash passes a custom host today.

GATE (bash scripts/verify/gate.sh on the branch tip 689d45e1, two full runs): run 1 red only on verify:ts-source-coverage, the known tsc --showConfig SIGSEGV flake (the log named apps/internal-hub/tsconfig.json failing twice); pnpm verify:ts-source-coverage alone then passed (rc 0, 1214/1293 sources). Run 2: exit 0, 55 of 56 passed, ending "gate: passing with known-red: verify:secrets-rotation" (the sanctioned red, Matthew's t_3e28c5b5). Gate logs: scratchpad gate-ndef-run1.log, gate-ndef-run2.log, ts-src-cov-alone.log.
CI on #765 at head 689d45e1 (settled 01:55 Fri 16 Oct): build & test (Android) pass, build & test (iOS) pass, playwright pass, swift-parity pass, semgrep pass, dep-scan pass, static-firewall pass, signed release bundle skipped; verify red at exactly one step, "Secrets rotation audit" (the sanctioned red, t_3e28c5b5). PR is MERGEABLE against origin/main 4f2c1d6b.
READERS: acceptance CONFIRMED (matrix on both sides, both mutations, iOS 21/21, DECISION block read on the task), safety CONFIRMED (3 files, none in an open PR, the host sets really match, white-label flip disclosed). Neither repairable.

UI CHECK: QA card t_0929db96 (owner Kaitlynn, blocked until #765 is merged and an Android build containing 22492b02 is on her phone; dep edge t_191475f3 -> t_0929db96).

[2026-10-15 · Viv] DECISION (product scope): should a customer's own custom domain count as a valid NFC tap host, on Android and iOS?
RECOMMEND: not by host alone. Anchor to tactile.to and *.tactile.to now (built on local branch r32/native-agent-ndef, commit 22492b02, not pushed yet), and add custom domains later as a separate rule that checks the host against the scanning account's own verified custom domain.
IF YES, NEXT: I file the owner-check task: extractHash needs the account's verified domain list on both platforms, spec section 1 in docs/nfc/ndef-format.md gets a custom-domain paragraph after #658 and #687 land, and each side pins a matrix with a verified and an unverified custom host.
COST IF YES: one feature across both apps plus a spec edit; until it ships, a tag written with a custom domain reads as third-party data in the Android in-app scanner (STATIC bucket, "holds third-party data") instead of a dynamic TacTile tag.
COST IF NO: nothing to build. Custom-domain NFC tags are already unsupported in practice: iOS shows "coming soon" for NFC re-encode, and no Android caller of NfcRegistrationService.reserveUniqueHash passes a custom host.
SAFE TO ASSUME: the anchoring ships either way, and OS tap dispatch is unaffected (the Android manifest claims only tactile.to/auth/callback, tactile-connect.com/auth/callback and tactile.to/app/*; extractHash only runs in the in-app scanner and the encoder diagnose screen).

[2026-10-15 · Viv] Where the audit doc is: docs/audit/2026-10-ndef-signoff.md exists only on draft PR #759 (branch r31/tooling-docs-ship, https://github.com/TacTile-dev/TacTile/pull/759) until Matthew merges it. Any "r31/tooling-docs draft PR" pointer in this task means #759.

[2026-10-15 · Viv] Found by the NDEF sign-off (t_92603a30), audit doc docs/audit/2026-10-ndef-signoff.md section 3 row D1 (lands with the r31/tooling-docs draft PR). Line cites are origin/main 4f2c1d6b.

PROBLEM: docs/nfc/ndef-format.md section 1 says the host must be exactly tactile.to or end with .tactile.to, and that an unanchored match "was a live bug". iOS enforces it (NFCChipCatalog.isTacTileHost, pinned by test_isTacTileHost_matrix). Android does not: NdefUriDecoder.extractHash (apps/android/app/src/main/java/com/tactile/app/core/nfc/NdefUriDecoder.kt:44-58) contains `if (!host.endsWith("tactile.to")) { /* comment only */ }`, so no host is ever rejected. extractHash("https://evil.example/t/123ABCD7Q") returns "123ABCD7Q" and isTacTileUrl (:60) is true. NdefUriDecoderTest.extractsHashFromWhiteLabelHost pins https://cards.acme.com/t/5XY9ABCDE as accepted, so the permissive behaviour looks deliberate for white-label domains. The same tag therefore classifies differently on the two platforms.

DONE WHEN: Android and iOS accept the same host set, and a test on each side pins the same matrix (tactile.to, a.tactile.to accepted; eviltactile.to, tactile.to.evil.example, evil.example rejected). If custom (white-label) domains are valid NFC tap hosts, the spec section 1 and BOTH platforms say how they are recognised (for example the account's own verified custom domain) rather than any host. That choice is product scope: write the six-line block for Matthew with a recommendation (recommend: anchor Android to the spec now, add custom domains as a separate, owner-checked rule), and ship the anchoring either way.

FILES: NdefUriDecoder.kt, NdefUriDecoderTest.kt; spec edit waits for #658 and #687 (both edit docs/nfc/ndef-format.md).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tags