Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Auth & User Management·14 in this wave

Approve: Auth & User ManagementTo do · blocker Remove Ben Ari hardcoded credentialsDone Confirm NEXT_PUBLIC_ALLOW_BEN_ARI_LOGIN unset in productionTo do Build /forgot-password routeDone Build /reset-password routeDone Wire email verification on signupDone Build account deletion UIDone Test JWT exp + refresh lifecycleDone Wire iOS native Google sign-inTo do Sign off: the seven completed Auth flowsTo do Add MFA optionTo do Build onboarding flowDone Wire orphan auth screens into navTo do Add biometric unlock to iOS and AndroidTo do

Wave

Auth & User Management

Depends on Backend API. Two hardcoded-credential items are security-critical and should run first.

TacTile › Launch TacTile › Backend & Infrastructure › Auth & User Management

7/14 done7 open1 open blocker

Selected taskclear

Approve: Auth & User Management

To doOwner · met_1c3c10c8Blocker

Waiting on 12 · 5 still openRemove Ben Ari hardcoded credentials Confirm NEXT_PUBLIC_ALLOW_BEN_ARI_LOGIN unset in production Build /forgot-password route Build /reset-password route Wire email verification on signup Build account deletion UI Build onboarding flow Wire orphan auth screens into nav Test JWT exp + refresh lifecycle Wire iOS native Google sign-in Add biometric unlock to iOS and Android Sign off: the seven completed Auth flows

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Approve: Auth & User Management** · to do · blocker

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Auth & User Management

## Waiting on 12

- Remove Ben Ari hardcoded credentials — done
- Confirm NEXT_PUBLIC_ALLOW_BEN_ARI_LOGIN unset in production — to do
- Build /forgot-password route — done
- Build /reset-password route — done
- Wire email verification on signup — done
- Build account deletion UI — done
- Build onboarding flow — done
- Wire orphan auth screens into nav — to do
- Test JWT exp + refresh lifecycle — done
- Wire iOS native Google sign-in — to do
- Add biometric unlock to iOS and Android — to do
- Sign off: the seven completed Auth flows — to do

5 of those are still open. If one genuinely blocks this, say so and stop rather than working around it.

## The brief on file

Viv — compile the finished Auth & User Management package for review; surface anything needing Matthew's sign-off.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Auth & User Management

Approve: Auth & User Management