Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic
TacTile›Launch TacTile›Backend & Infrastructure›Backend API·33 in this wave
Approve: Backend APITo do · blocker Implement /api/profile or remove routeDone Implement /api/uploadDone Implement destination analyticsDone Add upload size limits and file validationDone Define the API versioning strategyDone Verify all 14 destination content read endpointsDone Verify the five existing destination update endpoints workBlocked Fix the stale SENTRY_RELEASE on tactile-apiDone iOS decodes payment_destinations as an array — a latent whole-list decode failureDone Add staging.tactile.to to the API CORS allowlistDone Emit CardSchema (not bare ActionPreview) from the 12 non-QR tool preview generatorsDone pnpm verify is red on main, and CI hides 9 more failures by excluding three test filesDone EMIT LEG: send method:\"link\" from the clients, or the Link bucket stays at zeroTo do POST /api/events/open is documented public+unauth but 401s anonymouslyDone Staging has no RATE_LIMIT_DO binding — both rate limiters fail open thereDone Mask the Wi-Fi password before it reaches agent proposal cards (blocks WifiCard)Done link_hub.ts has the identical partial-drop hole contact.ts just hadDone Add /health endpointDone Replace link-click placeholder zeroDone Verify documents/gallery/audio routes completeDone Add structured logging via pino-compatible APITo do Add request-id middlewareDone Add Sentry to WorkersDone Verify the four completed Backend API items in productionDone Build update endpoint for menu destinationsDone Build update endpoint for link_hub destinationsDone Build update endpoint for payment destinationsDone Build update endpoint for wifi destinationsDone Build update endpoint for bluetooth destinationsDone Build update endpoint for action destinationsDone Build the webhook MCP module (tools/webhook.ts) — Matthew chose SHIP over cutDone Derive per-type opIds for destination.create/edit so Website + Gallery cards can renderDone
Wave
Backend API

The long pole — Auth, Billing, Email, Custom Domains and Edge Functions all wait on this gate.
TacTile › Launch TacTile › Backend & Infrastructure › Backend API
29/33 done4 open1 open blocker
Selected taskclear
Verify the five existing destination update endpoints work

BlockedOwner · Vivt_27b2c3f2
Unlocks 1Approve: Backend API
Show the prompt
You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Verify the five existing destination update endpoints work** · blocked

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Backend API

## Unlocks 1

- Approve: Backend API

## The brief on file

[2026-10-15 · Viv] WAITING ON MATTHEW (PRODUCTION, IRREVERSIBLE). Fresh block. Supersedes the 5 Oct block below (its main SHA, "no PR" and "never parsed" are stale) and the 8 Oct ask on t_2451cca5 (its "by Sun 11 Oct" lapsed, and it bundled approving Backend API: "go" here is the run only).
DECISION: PRODUCTION, IRREVERSIBLE: authorise ONE bounded production QA write run of scripts/qa/verify-destination-updates-prod.sh, pinned to PR #736 head 0d998a39, as QA accounts Quinn (owner) and Ben Ari (attacker), covering gallery, video, audio and document updates, with everything it creates hard-deleted at exit?
RECOMMEND: Yes, this week. Only a real write shows whether the gallery and video editors iOS ships on 8 Dec work against real PostgREST and R2: audio PATCH 400'd on every call for weeks with every test green (#202), no test drives a successful gallery or video PATCH, and replaceGalleryItem has no test. Run it from the pinned worktree before merging #736, so the committed script is the one that proved it.
IF YES, NEXT: Reply "go". Then in Terminal: cd ~/TacTile-dev/TacTile-api-observability-1009 && CONFIRM_PROD_WRITE=yes /bin/bash scripts/qa/verify-destination-updates-prod.sh --live (5 s abort window; unlock 1Password at the Touch ID prompt; never under bash -x), or Viv runs that same command in a session allowed to write prod. About 10 min. Viv pastes the PASS/FAIL here, triages any FAIL (script expectation or API defect: the script has only ever run against a fake API), and closes this task on green.
COST IF YES: $0 and about 2 min of you. Writes: 2 Supabase sign-ins; 4 Quinn destinations (gallery, video, audio, document) with their updates (gallery edit, item replace and delete; video rename and replace; audio rename; document rename and replace); 2 transcode jobs; 4 destination.deleted audit rows. Deletes are hard with no backups (pitr_enabled false), but only of the 4 hashes this run created, as Quinn, shape-checked, then re-read as 404; the one PATCH aimed at Ben's existing gallery is scoped by destination_hash and cannot match or change a Ben row (gallery.ts:749,768,780). A hard-killed run leaves rows named "QA 27b2c3f2 <timestamp> ..." under Quinn.
COST IF NO: $0, but 54 days to 8 Dec: gallery and video PATCH, item replace, video replace, audio and document PATCH all stay unproven live (iOS calls each: ActionContentService.swift:555,1045,1101,1156,1164,1187); both direct downstream gates (t_2451cca5 Approve: Backend API, t_d997bb65 Approve: iOS destination editing) cannot be approved on evidence; 79 open tasks wait behind this one (45 yours, 27 Kaitlynn's, 7 Viv's). A defect found late needs a handler fix, a production deploy (yours) and an iOS recheck in a shrinking window.
SAFE TO ASSUME: Viv writes nothing to prod until your "go". The script defaults to dry run and exits 64 on --live without CONFIRM_PROD_WRITE=yes. Prod runs 938b9a6c and main is 4f2c1d6b, and the gallery, videos, audio, documents, form and contact routes plus the transcoder entrypoint are identical between them, so the run speaks for both. #736's one red check is main's own (Secrets rotation audit), not the PR's.

EVIDENCE, read 2026-10-15 (script not re-run; the only write anywhere is this note):
- PR #736: draft, open, MERGEABLE, head 0d998a39 on base 4f2c1d6b = origin/main (main has not moved since 6 Oct); 0 reviews, 0 comments, last updated 9 Oct. CI 6 of 7 pass; verify fails only at "Secrets rotation audit", the same step that fails main's scheduled verify (run 38748098474, 15 Oct); "Shell scripts parse (bash -n)", "Test API" and "ts-source-coverage" pass on the PR head. It also carries the logger redaction fix (t_50dbeb17) and the Sentry error-path test (6 files, +759/-3, no migration, no deploy).
- Script read at 0d998a39: tokens travel in 0600 header files; cleanup deletes only hashes it created, as Quinn; preflight aborts with zero writes at exit 3 (Quinn owns 24+ videos) or 4 (Ben owns no gallery); fixture preflight (exit 5) reads the transcoder's poster seek from entrypoint.sh (-ss 1 at line 233; ladder 1080/720/480 at line 199, hence 854x480, 3 s fixtures). Worktree ~/TacTile-dev/TacTile-api-observability-1009 is clean at 0d998a39; jq, curl, ffmpeg, ffprobe and op are installed.
- Prod: /api/health reports 938b9a6c (main is 2 API commits ahead, #653 scan recording and b602f443 profile visibility, neither on these routes); public GETs still 200 (gallery 9BTBFO5PP content, video 13OJU6GI3 meta).
- Not re-read today (needs prod or Touch ID): Quinn owns 0 destinations (SELECT 5 Oct; the script re-reads it and aborts at 24+ videos) and the two 1Password item UUIDs (5 Oct metadata read).
- Downstream, recomputed from the live map: 86 descendants, 79 open (45 Matthew, 27 Kaitlynn, 7 Viv). The run closes this task only: Approve: Backend API still has 5 other open inputs (t_50dbeb17, t_bfcc3651, t_6d3c02a5, t_0383f11c, t_482e824a) and Approve: iOS destination editing also waits on Kaitlynn's t_3c9ba08c and t_9b89f590.

NAMED FOLLOW-UPS (none are part of the yes):
1. Merge #736 after a green run: your call, name the PR (the draft says do not merge unnamed).
2. POST /api/gallery/:hash/items (iOS "add photos", ActionContentService.swift:1068) is in neither the script nor any test (addGalleryItems is unreferenced in tests): to file as one extra leg or a separate check; a second write run needs a fresh yes.
3. Videos under 480 px high can never reach ready (entrypoint.sh:199,227: zero variants, exit 1). Product finding from 5 Oct, still no task; fix is one variant at source height.
4. Draft #611 (wrong-kind refusal on PATCH handlers) is still CONFLICTING since 3 Sep; if it lands before launch, re-run only the VIDEO block, on a fresh yes.
5. The 8 Oct text on t_2451cca5 is stale (Sunday deadline, 75/26 counts, "closes the gate"); not touched from here.

[2026-10-08 · Viv] PREPARED, not done. Branch r30/api-observability (unpushed, base 4f2c1d6b); 0d998a39 + 146096af add scripts/qa/verify-destination-updates-prod.sh. Re-review of 0d998a39 passed: video fixtures now 3 s; preflight reads -ss from entrypoint.sh and refuses (exit 5, nothing sent) unless each fixture exceeds ss+1 s. Entrypoint's poster command: 1 s clip exit 234, no poster; 3 s exit 0, 5624 B poster. New document PATCH leg (rename, multipart replace, 401, 403), cleaned up by the existing hard-delete. Checks: bash -n 3.2.57, shellcheck -S warning, dry run 50 EXPECT PASS / 0 failures, verify:shell-parse 0 failures. --live never run; without CONFIRM_PROD_WRITE it exits 64. Remains: push + PR (orchestrator), merge (Matthew), the one prod run needs Matthew's named yes. Document-leg codes are read from the handler, first proven live. Task open until that run is green. Draft PR https://github.com/TacTile-dev/TacTile/pull/736.

[2026-10-05 · Viv (workflow agent)] STILL BLOCKED, and the blocker is real: it needs Matthew's go for a bounded production write. Re-verified today against primary sources (below). Status unchanged.

DECISION: Authorise ONE bounded production run as the QA accounts (Quinn = owner, Ben Ari = attacker) to prove the gallery and video update paths live: 4 creates, 2 transcodes, everything deleted afterwards?
RECOMMEND: Yes, once, after applying the 4 script corrections below. Quinn owns 0 destinations (read-only SELECT 2026-10-05), so there is nothing of his to lose, and every delete is of a hash the script created. Audio PATCH was 100% broken for weeks with every test green, for exactly this gap: mocks never reach a real PostgREST.
COST IF YES: ~10 min. 2 Supabase password-grant sign-ins (auth session rows), 4 creates as Quinn (gallery, video, audio, document), 2 container transcode jobs (create + replace), ~5 destination.deleted audit rows. Deletes are hard and there are no backups, so a script bug that deleted the wrong hash could not be undone; mitigated because DELETE is owner+hash scoped and Quinn owns nothing else. Needs 1Password readable (op read resolves on this Mac right now) and a session allowed to write to prod: an automation session's permission classifier blocks that, so Matthew either says "go" in chat to a prod-permitted session or runs it himself.
COST IF NO: gallery/video happy-path PATCH, gallery item replace, video replace reaching ready, and the item-id scope predicate (eb679a60) all stay unproven against real PostgREST; the iOS estimate for the gallery and video editors stays unpriced; v1.0 (8 Dec) ships those two editors never exercised live.
FLAGS: irreversible (hard deletes, pitr_enabled false). No money, no legal text, no secret written (op read only; values never printed).
DRAFT: the bash script embedded at the bottom of this prompt (original, unmodified) plus corrections 1-4 below. NOT executed. There is no standalone file or PR: creating a script file that signs in as the QA accounts and writes to prod was denied by this session's permission classifier, so nothing was committed, and the corrected script has not had even a `bash -n`.

VERIFIED 2026-10-05 (read-only):
- origin/main = 938b9a6c. Prod API GET /api/health reports version 938b9a6c, so prod now runs main exactly (stop-note below says fa8b25f4 vs main 1d960865). Tests on main therefore speak for the prod handlers.
- No PR covers the live legs: `gh pr list --search t_27b2c3f2` finds only merged #202. Draft #611 (r20-dest-updates) adds a wrong-KIND refusal to the PATCH handlers in videos.ts, form.ts, contact.ts and others, but not gallery.ts, audio.ts or documents.ts. If #611 changes video PATCH behaviour when it lands, re-run just the VIDEO block afterwards.
- Test gap unchanged on main: no test invokes replaceGalleryItem (only gallery.ts and a comment in destination-route-contract.test.ts name it). The only gallery/videos PATCH tests are the two non-owner 403 cases, cross-tenant-owner.test.ts:383 and :451. No test drives a successful gallery or video PATCH.
- The READ half works live on real rows (public GETs on prod, no auth, no writes): /api/gallery/9BTBFO5PP/content 200 with 4 items carrying sort_order/span_w/span_h/caption, /meta 200; /api/videos/13OJU6GI3/meta and /content 200 status ready; /api/videos/8V236103F/meta 200 status error. So the gallery_items!inner and videos!inner embeds read correctly; only the WRITES remain unproven.
- Precondition holds: Quinn owns 0 destinations, so the "fewer than 24 videos" guard passes. Ben Ari owns 294 live destinations incl. 27 galleries and 2 videos (real seeded data; do not write to them).
- 1Password: items found by metadata only. Field labels are `username` and `password` on both; the username is email-shaped; op://TacTile/Supabase/url and /anon_key both resolve.

SCRIPT CORRECTIONS (desk-checked against code and real data; script still never run):
1. Item ids: OWNER_ITEM=ib2qn32ooeipsshx52mkrenbcm (TacTile QA Quinn, Plus), OTHER_ITEM=2shhvchaaw7qtgr7hj44pvcmwy (TacTile QA Ben Ari, Pro). Replaces both placeholders.
2. The video fixture must be at least 480 px high: change both `s=320x240` to `s=854x480`. The transcoder ladder is only 1080/720/480 (apps/video-transcoder/cf-container/entrypoint.sh:199-228) and it exits 1 "No variants were generated" for a shorter source, leaving status `error`. Prod already holds one such row: Ben's "Test clip" 8V236103F is status error, "Source display height: 1". With 320x240 the "video back to ready after replace" check would FAIL for a transcoder reason, not a PATCH bug.
3. settle(): the terminal statuses are `ready|error` (CHECK videos_status_check: pending, processing, ready, error). There is no `failed`, so `case $s in ready|failed)` spins the whole timeout on a transcode error. Change it to `ready|error` and raise `seq 1 36` to `seq 1 60` for container cold start.
4. Fewer prod writes: drop the "attacker gallery" create (the `call "$B" POST /api/gallery ...` line and `mk B "$G2"`). Ben already owns 27 galleries (e.g. 9BTBFO5PP): take the first type=gallery row of `GET /api/destinations` as Ben and use it as G2. The foreign-id PATCH matches rows on id AND destination_hash, so a correct API touches no Ben row, and nothing of Ben's ever enters cleanup.
Optional: write the Bearer header to a 0600 temp file and pass `curl -H @file` so tokens never appear in `ps`; after each cleanup DELETE assert `GET /api/destinations/$h` is 404; add anonymous `GET /api/gallery/$G/content` and `GET /api/videos/$V/meta` expecting 404 (private is invisible to the public, #258) and an unauthenticated PATCH expecting 401.

PRODUCT FINDING (separate from this decision): any video under 480 px high can never reach `ready` on prod, because the ladder produces zero variants and the job exits 1. Phone clips are 720p+ so it is rare, but screen recordings and old clips will fail. Read from code plus Ben's 8V236103F error row; not reproduced with a fresh upload. Worth its own task: fall back to one variant at source height.

NEXT STEP once Matthew says go: apply corrections 1-4, `bash -n` it (macOS bash 3.2), run it, paste the PASS/FAIL output here, then mark this done and close t_081dcf20's audio + documents leg from the same run.

----- previous prompt, unchanged -----

Viv — confirm the five pre-existing update endpoints actually work end to end.

3 of 5 EXERCISED LIVE against production 2026-08-03, signed in as the Quinn QA account. Two work, one was completely broken and is fixed in PR #202. gallery and video remain.

METHOD. All three QA accounts had ZERO destinations, so there was no existing test data — I created one destination per type as the QA account, exercised it, and deleted it afterwards (all three cleaned up, confirmed 200 {"ok":true}). Signed in via the Supabase password grant using op://TacTile/Supabase/{url,anon_key} plus the QA item credentials.

RESULTS

✅ FORM — PUT /api/form/:hash. Works.
   Created, GET returned full usable content, PUT title → 200, re-GET showed the new
   title persisted. Cross-tenant: Ben Ari PUT against Quinn's form → 403 "You are not
   authorized to update this form.", title unchanged. Ownership is enforced.
   Also confirmed with REAL data that GET /api/form/:hash/content 404s — the gap PR
   #200 fixes. Previously only shown with a bogus hash.

✅ CONTACT — PATCH /api/contact/:hash. Works.
   PATCH name → 200 {"success":true,"updated":true}, re-GET showed it persisted, and
   crucially the single contact field SURVIVED a metadata-only PATCH — that is the
   2026-07-29 data-loss regression (parseFieldsInput wiping contact_card_fields on
   every PATCH) confirmed genuinely fixed in production. Cross-tenant → 403.

🔴 AUDIO — PATCH /api/audio/:hash. HAS NEVER WORKED. Fixed in PR #202.
   Returned 400 "Destination is not audio." for a destination created seconds earlier
   via POST /api/audio. Root cause: three places in audio.ts index [0] into a PostgREST
   to-one embed, which PostgREST returns as an OBJECT. Verified directly against the
   prod database — the row holds {"name":"QA Verify Audio","type":"audio",...} while
   row.destinations[0] is None. Consequences, all live:
     - PATCH /api/audio/:hash: 100% non-functional, every call 400s.
     - GET /api/audio/:hash/content: name and description null for EVERY audio
       destination, and visibility always reported as the "public" fallback regardless
       of what the owner set. The data was in the database the whole time; the fallback
       is why this looked healthy.
     - GET /api/audio/:hash/file: every download named from the fallback, not the
       destination name.
   Fix uses the normalisation form.ts:224 already had. Scope-checked: grepped all 37
   route modules, this shape exists ONLY in audio.ts.

STILL TO DO — gallery and video. Both need a multipart create with a real media file;
video additionally kicks off a transcode, so it is worth doing deliberately rather than
casually. Same method as above. Watch for:
  - PATCH /api/gallery/:hash AND the separate PATCH /api/gallery/:hash/items/:id.
  - Cross-tenant on gallery especially — eb679a60 was "any user could rewrite another
    tenant's gallery layout", so that check is not hypothetical on this exact surface.

BEARING ON THE iOS ESTIMATE, which is why this task exists: form and contact are pure
client work as assumed. Audio was NOT — it needed a backend fix first. Two types left
to price honestly.

[overnight 29→30 Sep] READ-ONLY PASS DONE; THE LIVE LEGS ARE BLOCKED. Status -> blocked.
NEEDS MATTHEW: authorise a QA-account create/PATCH/delete for gallery + video against production (or hand to a prod-permitted session). Staging is NOT a safer venue: it shares the production database (no staging DB, t_a2ccb527).
✅ #202 (audio) merged 08-05 18:14Z; merge commit 4d3e27f5 IS an ancestor of the deployed prod SHA fa8b25f4 (live as Cloudflare version 01afa1e8, 09-25). audio.ts at fa8b25f4 reads all three embeds through one() (lines 360/537/596). Form + contact were live-proven 08-03; #200's form /content is live today (real hash 15PL2M2UZ -> 200).
✅ The deployed handlers ARE main's: gallery/videos/audio/contact/form/documents route files are identical between fa8b25f4 and origin/main 1d960865 (only routes/triggers.ts and a dep bump differ), so tests on main speak for prod.
✅ `pnpm verify:api-test` at 1d960865: 950 tests / 192 suites, 950 pass, 0 fail. `pnpm verify:unit`: 220 files, 4302 pass.
PROVEN BY TESTS (mocked Supabase/R2, never a database): PATCH /api/gallery/:hash and /api/videos/:hash reach a Bearer-gated handler (destination-route-contract, 40 tests); a non-owner gets 403 with a spoofed owner_account_id on both (cross-tenant-owner UPDATE cases; the videos fixture uses the real object embed shape); every gallery_items statement in gallery.ts carries destination_hash= (gallery-tenant-scoping, a SOURCE scan) and every id=eq/in filter in the API is tenant-scoped (scoped-id-filters, #627); no [0] into a to-one embed (embed-indexing); a video replace cannot park at 'processing' without launching a job (video-processing-launches-job).
NOT PROVEN, ONLY A LIVE WRITE CAN: (1) the happy path: owner PATCH returns 200 AND persists on real PostgREST (gallery name/description, item sort/span/caption, delete_item_ids; video name/description) — no test drives a successful gallery or video PATCH; (2) PATCH /api/gallery/:hash/items/:id — NO test invokes replaceGalleryItem at all (multipart parse, R2 put+delete, scoped PostgREST PATCH); (3) video multipart replace against the real container (ENABLE_VIDEO_TRANSCODE=true in prod, so create and replace EACH start a transcode job); (4) the item-id scope predicate and R2 cleanup against the real DB (the eb679a60 regression, live).
PRECONDITIONS + SIDE EFFECTS: 1Password unlocked; the owner QA account must own fewer than 24 videos (POST /api/videos prunes the OLDEST at >=25: pruneVideoActionsForOwner); sign-in is a Supabase password grant (auth session rows); 2 container transcode jobs; one destination.deleted audit row per cleanup; deletes are hard (no backups) but only of hashes the script itself created. Never run under `bash -x` (it prints the Bearer tokens).
SCRIPT — UNTESTED: desk-checked only. I could not run even `bash -n` on it (a classifier denied the parse), and the two 1Password item UUIDs and their username/password field labels are placeholders/assumptions. Each step prints PASS/FAIL with the expected code; cleanup DELETEs everything it created on any exit. It also closes t_081dcf20's audio + documents leg (creates both public, reads them unauthenticated).

```bash
#!/bin/bash
# WRITES TO PRODUCTION. Tools: op curl jq ffmpeg. Owner=Quinn (Plus), attacker=Ben Ari (Pro).
set -u
API=https://whitelabel.tactile.to
OWNER_ITEM='<QUINN_1P_ITEM_UUID>'   # UUID, not the em-dash title; labels assumed username/password (check: op item get <uuid>)
OTHER_ITEM='<BEN_1P_ITEM_UUID>'
SB_URL=$(op read 'op://TacTile/Supabase/url'); ANON=$(op read 'op://TacTile/Supabase/anon_key')
[ -n "$SB_URL" ] && [ -n "$ANON" ] || { echo "1Password locked or read failed"; exit 2; }
FX=$(mktemp -d); FAILS=0; MADE=""
echo 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==' | base64 -d > "$FX/a.png"
ffmpeg -loglevel error -f lavfi -i color=c=red:s=8x8 -frames:v 1 "$FX/b.png"
ffmpeg -loglevel error -f lavfi -i color=c=blue:s=320x240:d=1 -pix_fmt yuv420p "$FX/a.mp4"
ffmpeg -loglevel error -f lavfi -i color=c=green:s=320x240:d=1 -pix_fmt yuv420p "$FX/b.mp4"
ffmpeg -loglevel error -f lavfi -i sine=frequency=440:duration=1 -q:a 9 "$FX/a.mp3"
printf 'qa\n' > "$FX/a.txt"

login() { # $1=1P item uuid -> access token on stdout
  local u p; u=$(op read "op://TacTile/$1/username") && p=$(op read "op://TacTile/$1/password") || return 1
  QA_E="$u" QA_P="$p" jq -n '{email:env.QA_E,password:env.QA_P}' |
    curl -sS "$SB_URL/auth/v1/token?grant_type=password" -H "apikey: $ANON" -H 'Content-Type: application/json' -d @- | jq -r '.access_token // empty'
}
Q=$(login "$OWNER_ITEM"); B=$(login "$OTHER_ITEM")
[ -n "$Q" ] && [ -n "$B" ] || { echo "sign-in failed"; exit 2; }

call() { # call <token|-> <METHOD> <path> [curl args] -> $CODE $BODY
  local t=$1 m=$2 p=$3; shift 3; local auth=(); [ "$t" != "-" ] && auth=(-H "Authorization: Bearer $t")
  BODY=$(curl -sS -m 180 -X "$m" "$API$p" ${auth[@]+"${auth[@]}"} "$@" -w $'\n%{http_code}'); CODE=${BODY##*$'\n'}; BODY=${BODY%$'\n'*}
}
want() { if [ "$CODE" = "$2" ]; then echo "PASS $1 ($CODE)"; else echo "FAIL $1: want $2 got $CODE :: ${BODY:0:200}"; FAILS=$((FAILS+1)); fi; }
is()   { if [ "$2" = "$3" ]; then echo "PASS $1"; else echo "FAIL $1: want '$3' got '$2'"; FAILS=$((FAILS+1)); fi; }
mk()   { MADE="$MADE $1:$2"; }     # remember owner-token-name:hash for cleanup
cleanup() { for e in $MADE; do t=$Q; [ "${e%%:*}" = B ] && t=$B; h=${e#*:}; [ -n "$h" ] && call "$t" DELETE "/api/destinations/$h" && echo "cleanup $h -> $CODE"; done; }
trap cleanup EXIT
J='Content-Type: application/json'

echo "== GALLERY (Quinn owns) =="
call "$Q" POST /api/gallery -F name='QA r27 gallery' -F visibility=private -F "item0_file=@$FX/a.png;type=image/png" -F item0_media_type=image -F "item1_file=@$FX/b.png;type=image/png" -F item1_media_type=image
want "gallery create" 200; G=$(jq -r '.hash_id // empty' <<<"$BODY"); mk Q "$G"; [ -n "$G" ] || exit 1
call "$Q" GET "/api/gallery/$G/content"; want "gallery owner read (private)" 200
I1=$(jq -r '.items[0].id' <<<"$BODY"); I2=$(jq -r '.items[1].id' <<<"$BODY")
call "$Q" PATCH "/api/gallery/$G" -H "$J" -d "{\"name\":\"QA r27 renamed\",\"description\":\"d\",\"items\":[{\"id\":$I1,\"sort_order\":1,\"span_w\":2,\"span_h\":1,\"caption\":\"c1\"},{\"id\":$I2,\"sort_order\":0}]}"
want "gallery PATCH meta+items" 200
call "$Q" GET "/api/gallery/$G/content"
is "gallery name persisted" "$(jq -r .name <<<"$BODY")" "QA r27 renamed"
is "gallery item order persisted (I2 first)" "$(jq -r '.items[0].id' <<<"$BODY")" "$I2"
is "gallery span_w/caption persisted" "$(jq -r --argjson i "$I1" '.items[]|select(.id==$i)|"\(.span_w)/\(.caption)"' <<<"$BODY")" "2/c1"
call "$Q" PATCH "/api/gallery/$G/items/$I1" -F "item0_file=@$FX/b.png;type=image/png" -F caption=replaced; want "gallery item replace" 200
curl -sS -H "Authorization: Bearer $Q" "$API/api/gallery/$G/items/$I1/file" -o "$FX/got.png"; cmp -s "$FX/got.png" "$FX/b.png" && echo "PASS replaced bytes served" || { echo "FAIL replaced bytes differ"; FAILS=$((FAILS+1)); }
echo "-- cross-tenant (Ben)"
call "$B" PATCH "/api/gallery/$G" -H "$J" -d '{"name":"HACKED"}'; want "non-owner gallery PATCH" 403
call "$B" PATCH "/api/gallery/$G/items/$I1" -F "item0_file=@$FX/a.png;type=image/png"; want "non-owner item replace" 403
call "$B" POST /api/gallery -F name='QA r27 attacker gallery' -F visibility=private -F "item0_file=@$FX/a.png;type=image/png" -F item0_media_type=image; G2=$(jq -r '.hash_id // empty' <<<"$BODY"); mk B "$G2"
call "$B" PATCH "/api/gallery/$G2" -H "$J" -d "{\"items\":[{\"id\":$I1,\"sort_order\":99,\"span_w\":3,\"span_h\":3,\"caption\":\"HACKED\"}],\"delete_item_ids\":[$I1]}"; echo "(attacker PATCH on OWN gallery with victim item id: $CODE)"
call "$Q" GET "/api/gallery/$G/content"
is "victim item untouched by foreign id (eb679a60)" "$(jq -r --argjson i "$I1" '.items[]|select(.id==$i)|"\(.span_w)/\(.caption)"' <<<"$BODY")" "2/replaced"
call "$Q" PATCH "/api/gallery/$G" -H "$J" -d "{\"delete_item_ids\":[$I2]}"; want "gallery delete_item_ids" 200
call "$Q" GET "/api/gallery/$G/content"; is "one item left" "$(jq '.items|length' <<<"$BODY")" 1

echo "== VIDEO (ENABLE_VIDEO_TRANSCODE=true in prod => create AND replace each launch a container job) =="
call "$Q" GET /api/destinations; N=$(jq '[.rows[]|select(.type=="video")]|length' <<<"$BODY")
[ "${N:-99}" -lt 24 ] || { echo "ABORT: owner has $N videos; POST /api/videos prunes the OLDEST at >=25"; exit 3; }
call "$Q" POST /api/videos -F "file=@$FX/a.mp4;type=video/mp4" -F name='QA r27 video' -F visibility=private; want "video create" 200
V=$(jq -r '.hash_id // empty' <<<"$BODY"); mk Q "$V"; [ -n "$V" ] || exit 1
settle() { local s i; for i in $(seq 1 36); do call "$Q" GET "/api/videos/$V/meta"; s=$(jq -r .status <<<"$BODY"); case $s in ready|failed) echo "video status=$s"; return;; esac; sleep 5; done; echo "video still $s after 180s"; }
settle
call "$Q" PATCH "/api/videos/$V" -H "$J" -d '{"name":"QA r27 video renamed","description":"d"}'; want "video PATCH json" 200
call "$Q" GET "/api/videos/$V/meta"; is "video name persisted" "$(jq -r .name <<<"$BODY")" "QA r27 video renamed"
call "$Q" PATCH "/api/videos/$V" -F "file=@$FX/b.mp4;type=video/mp4"; want "video PATCH replace (multipart)" 200
settle; call "$Q" GET "/api/videos/$V/meta"; is "video back to ready after replace" "$(jq -r .status <<<"$BODY")" ready
call "$B" PATCH "/api/videos/$V" -H "$J" -d '{"name":"HACKED"}'; want "non-owner video PATCH" 403
call "$Q" PATCH /api/videos/ZZZZZZZZZ -H "$J" -d '{"name":"x"}'; want "unknown video hash" 404

echo "== AUDIO + DOCUMENT (public, so the GETs are unauthenticated) =="
call "$Q" POST /api/audio -F "file=@$FX/a.mp3;type=audio/mpeg" -F name='QA r27 audio' -F visibility=public; want "audio create" 200; A=$(jq -r '.hash_id // empty' <<<"$BODY"); mk Q "$A"
call - GET "/api/audio/$A/content"; want "audio content (no auth)" 200; is "audio name not null (#202)" "$(jq -r .name <<<"$BODY")" "QA r27 audio"
call "$Q" PATCH "/api/audio/$A" -H "$J" -d '{"name":"QA r27 audio renamed"}'; want "audio PATCH (400 before #202)" 200
call - GET "/api/audio/$A/content"; is "audio rename persisted" "$(jq -r .name <<<"$BODY")" "QA r27 audio renamed"
call "$Q" POST /api/documents -F "file=@$FX/a.txt;type=text/plain" -F name='QA r27 doc' -F visibility=public; want "document create" 200; D=$(jq -r '.hash_id // empty' <<<"$BODY"); mk Q "$D"
call - GET "/api/documents/$D/content"; want "document content (no auth)" 200

echo "== $FAILS failure(s); cleanup runs now =="
exit $FAILS
```

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.
To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it
Lanes

Backend API

Verify the five existing destination update endpoints work
