Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›DevOps›DevOps Foundation·35 in this wave

Approve: DevOps FoundationTo do · blocker NEEDS MATTHEW: staging STRIPE_WEBHOOK_SIGNING_SECRETBlocked · blocker main is RED — 8 unit tests failing on origin/main, so pnpm verify cannot gate any PRDone · blocker The production account's data is 42 days stale — Analytics renders empty at any default windowBlocked · blocker MATTHEW: add db_url to the 1Password Supabase item — two RLS audits have never been runnableDone · blocker Wire apps/api test suite into CIDone Wire Playwright specs into CIDone Wire verify:swift-parity into CIDone Enable branch protection on mainBlocked Verify the staging environment is actually liveDone Web deploy workflow (manual trigger only)To do API deploy workflow (manual trigger only)To do Add post-deploy smoke test to the deploy workflowsTo do Write the rollback procedureTo do Add Sentry to iOSTo do Add Sentry to AndroidTo do Configure uptime monitoringTo do Set the three missing staging secrets on tactile-api-stagingDone Playwright is failing on main and producing no report — every run that gets a runner failsTo do Playwright job must free port 3000 BEFORE its first suite — a watchdog-killed job leaks its server and fails every later runDone Add CHANGELOG.mdTo do Automate release tagging on mainTo do Fix stale Vercel references in the observability runbookDone Add apps/api typecheck to CIDone Clean the SAST baselineTo do Flip SAST to blockingTo do Edge function deploy workflow (manual trigger only)To do Supabase migration check in CITo do Write the release procedureTo do Configure Supabase log drainTo do Centralize Cloudflare Workers logsTo do Replace console.* with structured logging in apps/apiTo do Two runners share one ~/.gradle — scope it per runner without losing the warm cacheTo do MATTHEW: CI capacity — one Mac, two runners, and a full Xcode build now runs on every pushTo do Auto-cancel queued CI runs whose head branch was deletedTo do

Wave

DevOps Foundation

Unblocked now — nothing waits on the surfaces. Wiring existing tests into CI, deploy automation, base observability.

TacTile › Launch TacTile › DevOps › DevOps Foundation

10/35 done25 open3 open blockers

Selected taskclear

The production account's data is 42 days stale — Analytics renders empty at any default window

BlockedOwner · met_21f58d9dBlocker

Measured read-only against production: the newest scan event is 2026-07-05. 7-day and 30-day windows both return zero events; 90-day returns 9,388. Any Analytics screenshot at a default window is empty regardless of build configuration or who is signed in.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**The production account's data is 42 days stale — Analytics renders empty at any default window** · blocked · blocker

Measured read-only against production: the newest scan event is 2026-07-05. 7-day and 30-day windows both return zero events; 90-day returns 9,388. Any Analytics screenshot at a default window is empty regardless of build configuration or who is signed in.

Where it sits: TacTile › Launch TacTile › DevOps › DevOps Foundation

## The brief on file

MEASURED READ-ONLY against production 2026-08-16 (GET only, Prefer: count=exact, no writes),
using credentials that were in 1Password the whole time.

THE FINDING: the account's data is 42 DAYS STALE. Newest scan event is 2026-07-05.
  7D  -> 0 events
  30D -> 0 events
  90D -> 9,388 events
So an Analytics capture at the app's DEFAULT window renders an empty state regardless of
build configuration or who is signed in — and the gap widens by a day per day.

This is the THIRD distinct diagnosis of the "screenshot blocker", and the first one
measured against the database rather than inferred:
  1. "It is a build config" (Debug vs Release)      — was true, and is now fixed.
  2. "The account is empty"                          — false; it has real data.
  3. "The data is 42 days old"                       — this one, and it is measurable.

TWO WAYS OUT, and the choice is Matthew's:
  (a) Select 90D before every Analytics frame. Cheapest, but every marketing frame then
      silently advertises a 90-day window, and this stops working entirely once the data
      passes 90 days old — which is 2026-10-03.
  (b) Put fresh traffic on the account. Durable, and it is the only option that survives
      the 90-day cliff.

THE DISCREPANCY THAT BLOCKED THREE ROUNDS IS SETTLED, and NEITHER SOURCE WAS WRONG — they
measured different things and the labels were imprecise:
                    measured      brief said   doc 6b said
  destinations      285 total     282          143
                    283 live
                    144 public                 <- the doc counted the PUBLIC subset
  distinct types    14            14           —
  triggers          65            65           65
  events all-time   18,246        18,246       —
  events 90D        9,388         —            9,388        <- different WINDOW
The brief counted all destinations and quoted all-time events; the doc counted the public
subset (what the app lists) and quoted 90D.

THE CREDENTIALS WERE NEVER MISSING. Account 88ff3481-27be-4ec8-abc9-194351643079 is
ben@tactile.to — the 1Password item "TacTile QA - Ben Ari (Pro)". It is a QA account, not
a separate production login, and it has been in the vault the whole time. Only the
id-to-item MAPPING was missing, which is why three separate rounds asked for credentials
that already existed. That mapping is now written into the punch-list doc 6b so it cannot
be lost again. (Use the item UUID, not the title — the em dash breaks `op read`.)

WHAT STILL NEEDS MATTHEW, and it is 30 seconds: sign the app in as ben@tactile.to once on
the booted iPad Pro 13" simulator. The session persists across `simctl launch`, so it is
needed once, not per capture. Entering a password into a login field is off-limits for an
agent regardless of authorization. Do it with 90D pre-selected on Analytics given the
staleness above.

TWO TRAPS FOR WHOEVER DRIVES THE CAPTURE AFTERWARDS:
  · Do not capture while `xcodebuild test` is running on the same simulator.
  · XCUIDevice.shared.orientation PERSISTS after a test run, so a stray landscape state
    yields 2752x2064 frames that App Store Connect rejects.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

DevOps Foundation

The production account's data is 42 days stale — Analytics renders empty at any default window