Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·56 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

44/56 done12 open2 open blockers

Selected taskclear

ROUND 3 · SESSION — Backend: collection generators, multipart wrappers, QR render extraction, MCP coverage

DoneOwner · ait_1ca48393

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**ROUND 3 · SESSION — Backend: collection generators, multipart wrappers, QR render extraction, MCP coverage** · done

Where it sits: TacTile › Inbox — on deck

## The brief on file

BACKEND ROUND 3 — state at handoff. PR #239 (draft), base=main VERIFIED via `gh pr view 239 --json baseRefName`. Branch feature/backend-api, 4 commits.

FIRST, THE RELAND CHECK THE HEADER ASKED FOR — all verified on origin/main before building:
  opIdDerivation.ts present · wifi mask (isSecretCardKey/maskSecretValue) present ·
  input_preview redaction (redactSecrets) present · `git merge-base --is-ancestor 3f999247
  origin/main` OK · #230's carve-out also on main (DESTINATION_ROUTES, sdk-js→destinations-core dep).
  Note feature/backend-api was 21 behind / 2 ahead with DUPLICATES of content already on main;
  reset to origin/main. The brief says the worktree branch is feature/backend-agent-cards; the
  session instruction said feature/backend-api. Used the latter. Both exist — worth deconflicting.

=== ALL THREE CONTRACT ITEMS DONE ===

1. updateDestinationWithMedia (destinations-core) — the multipart half of video/audio/document.
   The three handlers DISAGREE and the wrapper does not hide it: name:"" clears only on audio;
   converted is document-only AND its handler nests converted inside `if (file)` so a
   converted-only PATCH is ignored while file-without-converted NULLs both converted columns;
   viewer_mode/allow_download dropped for video/audio rather than sent.
   ⚠️ SECURITY GAP FIXED: documents' UPDATE path checked size only — no magic-byte sniffing —
   while its CREATE path sniffs and videos/audio sniff on their replace paths. A forged-extension
   binary POST refused could be stored by PATCH. Proven: 16-byte evil.pdf → 415.

2. @tactile/qr-studio — render-carried extracted, desktop unblocked. PROVEN with a depcruise
   probe: importing the package from apps/web passes; importing the old cross-app path errors.
   Deliberately NOT in qr-renderer (its AGENTS.md prime directive is "parity, not improvement").
   Move is verbatim — diff shows 2 changed lines. web-mobile keeps working via a re-export shim.

3. CardSchema.collection for linkhub/form/menu. NO paired iOS merge needed — TOP_KEYS already
   pins "collection", CardSchema.swift already declares it, swift-parity green.
   Found a real pre-existing crash: menuCreatePreview's
   `sections.reduce((n,s)=>n+(s.items?.length??0),0)` guards .items but not s — a null section
   threw and took the proposal with it.

   GALLERY DECIDED — NO items array on destination.create_gallery. Every gallery write path
   rejects non-multipart with real File objects (gallery.ts:400/811/875); an MCP call is JSON, so
   the agent cannot carry image bytes. Adding items needs a URL-ingest route (its own SSRF
   surface) or accepts input the handler rejects. "No items at create time" is correct.

=== TWO BRIEF CLAIMS CORRECTED (measured, not argued) ===
  • "collection gap is a LIVE display-corruption bug — any hub past ~5 links garbled": NO.
    6 links = 347 chars vs a 500 limit; first overflow at 9 links. And iOS returns [] on parse
    failure and renders "Links can't be previewed here — open in the editor before approving".
    A fidelity gap, not corruption.
  • "pnpm verify is green now (spot-checked scannability 15/15)": that spot-check is real but is
    one test file, not the gate. See below.

=== ⚠️ THE GATE WAS FAILING ~50% OF RUNS, AND HIDING A REAL FAILURE ===
Several node verify steps segfault under Node 24 (exit 139) AFTER printing their verdict — ~5%
each, ~14 steps ⇒ ≈50% per full run. Fixed with scripts/verify/retry-on-segv.sh (retries ONLY on
139, ONLY once; a real exit 1/2 passes straight through; a double-segfault fails the gate).

That let the chain reach step 16 for the first time, where it fails for real:
verify:secrets-rotation reports 13 OVERDUE PRODUCTION SECRETS + 2 placeholders referenced by
deployed code. Filed as t_679b46bc (blocker, owner Matthew) with three options. Rotating live
Stripe and Supabase service_role keys is not a mid-session unilateral act.

HONEST GATE STATUS, to be repeated verbatim by anyone reporting on this branch:
  "every check green EXCEPT verify:secrets-rotation, which fails on 13 pre-existing overdue
   rotations" — NOT "verify green".
Unit suite 100 files / 2783 tests all passing. depcruise/knip/sherif/syncpack 0 new.
swift-parity green. tsc clean.

=== NOT STARTED — the MCP surface half of the brief ===
group.* (0/9, t_f96d2a57 — brief verified all 9 map onto existing /api/groups routes, no route
work, and the t_15a78dba warning about a group.reorder op is FALSE); family.* (0/7, t_c19c7880 —
DO NOT wire before remodelling the catalog: ops take destination_hash but the API is
trigger-based, family.tag_by_rule and family.merge have NO backing route, and the API is
plus-gated so tools need minTier); t_31de497b + t_f844f6f3 (close with a registry dump, zero
code); form.field.* (t_3dc4ae01); hosted MCP rate limiting (t_66f02ccb); stale NOT DEPLOYED
banners (t_2ac147c2). Master checklist stays t_15a78dba.

LANDMINE FOR THE NEXT SESSION: tests/unit/qr-pending-design.test.ts has a literal NUL byte at
line 313, so grep/rg/ugrep skip the entire file. It holds 13 renderCarriedDesign call sites — a
grep-based consumer sweep finds none of them.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

ROUND 3 · SESSION — Backend: collection generators, multipart wrappers, QR render extraction, MCP coverage