Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·56 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

44/56 done12 open2 open blockers

Selected taskclear

MATTHEW — irreversible before first Play upload: the signing cert says "TapTile Inc"

To doOwner · Vivt_23918198Blocker

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**MATTHEW — irreversible before first Play upload: the signing cert says "TapTile Inc"** · to do · blocker

Where it sits: TacTile › Inbox — on deck

## The brief on file

[DECIDED 30 Sep 2026 — Matthew: KEEP the existing key. Do NOT regenerate. Back it up.]
Why (verified 30 Sep): under Play App Signing (automatic for new apps) this is only the UPLOAD key. Users never see its DN, and Google can replace it via an upload-key reset request (approval + unknown delay). "Irreversible at first upload" was wrong. The only permanent path is supplying your OWN app signing key (allowed until the first open-testing/production release), so do NOT do that.
Play account: Matthew says it is an ORGANISATION account, so the 12-tester/14-day closed-test rule for personal accounts should not apply. Confirm in Play Console when first used.
VIV, TO DO:
1. Add a step to the rotation-night runbook (draft PR #657, decided yes this week on t_185119c7): Matthew puts apps/android/tactile-release.keystore (as a file attachment) + the four keystore.properties fields into 1Password item Android-Signing. Today the only copies are two identical files inside git working trees (~/Command/tactile and ~/TacTile-dev/TacTile-android), with no Time Machine. A `git clean -x` or worktree removal would destroy it. Filling the three Android-Signing placeholders also clears 3 of the 6 CI-failing rows in verify:secrets-rotation.
2. Correct the "cannot be rotated / irreversible" wording in AGENTS.md entry 54 (+ CLAUDE.md mirror: cp -f AGENTS.md CLAUDE.md), scripts/verify/entity-name.mjs:64-68 comment, and docs/runbooks/android-upload-key-regenerate.md (mark it NOT NEEDED, keep for reference).
3. After the first Play upload: switch assetlinks.json (tactile.to) and the Google OAuth Android client SHA-1 to Google's APP SIGNING cert. Until then Play-installed builds won't verify App Links or return from OAuth.
4. Watch-outs: the package name com.tactile.app becomes permanent when the Play app is created. Never hand out a release-signed APK outside Play, because that would make this key permanent for those installs.
Then close this task.
[/DECIDED]

[overnight 29→30 Sep — DECISION, read this first]
DECISION (IRREVERSIBLE at the first Play upload): regenerate the Android upload key so the cert says the real entity instead of "O=TapTile Inc"?
RECOMMEND: Yes, ~20 min — but only after Play Console → App integrity shows no upload key registered yet (the repo can't prove nothing was uploaded).
IF YES → docs/runbooks/android-upload-key-regenerate.md in draft PR #657, §1 then §3. Back up the old keystore FIRST: 1Password's Android-Signing fields are empty, so the local file is probably the only copy.
IF NO → "TapTile Inc" is in every upload cert forever (users never see it); close this task. FYI the Supabase org is also named "TapTile, Inc".
[/overnight]

DECISION FOR MATTHEW, and it expires at the first upload.

The release signing cert's distinguished name reads:
  CN=TacTile Connect, OU=Mobile, O=TapTile Inc, L=Minneapolis, ST=Minnesota, C=US

"TapTile", not "TacTile". Confirmed again on 2026-08-07 by the fastlane bundle lane's verify_release_signature step, which prints the signer on every build.

WHY IT MOSTLY DOES NOT MATTER: Play App Signing re-signs the app with a Google-held key, so what end users verify is not this cert. This is the UPLOAD key — it authenticates you to Play, and its DN is not shown on the store listing.

WHY IT MATTERS ANYWAY: once an upload key is registered against the app on the first upload, it cannot be swapped without going through Play's upload-key reset flow (a support request, with a delay). The typo is also visible to anyone inspecting the artifact, and it contradicts t_de6002de, which is separately tracking "verify the entity name 'TacTile Connect, Inc.' across docs".

THE CHOICE, and it is only cheap right now:
(a) Regenerate the keystore with a corrected DN before the first upload. Cheap today, needs the new keystore + keystore.properties updated + 1Password updated. Nothing has been uploaded yet, so nothing breaks.
(b) Accept it. Functionally fine forever; a permanent small inaccuracy in the signing chain.

RECOMMENDATION: (a), because it costs one command now and a support ticket later, and because the entity name is already being cleaned up elsewhere.

If (a): keep the OLD keystore until the new one has produced a verified AAB — apps/android/tactile-release.keystore is gitignored and untracked, and losing it before the swap completes would be unrecoverable.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

MATTHEW — irreversible before first Play upload: the signing cert says "TapTile Inc"