Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Backend API·33 in this wave

Approve: Backend APITo do · blocker Implement /api/profile or remove routeDone Implement /api/uploadDone Implement destination analyticsDone Add upload size limits and file validationDone Define the API versioning strategyDone Verify all 14 destination content read endpointsDone Verify the five existing destination update endpoints workIn progress Fix the stale SENTRY_RELEASE on tactile-apiDone iOS decodes payment_destinations as an array — a latent whole-list decode failureTo do Add staging.tactile.to to the API CORS allowlistDone Emit CardSchema (not bare ActionPreview) from the 12 non-QR tool preview generatorsDone pnpm verify is red on main, and CI hides 9 more failures by excluding three test filesDone EMIT LEG: send method:\"link\" from the clients, or the Link bucket stays at zeroTo do POST /api/events/open is documented public+unauth but 401s anonymouslyDone Staging has no RATE_LIMIT_DO binding — both rate limiters fail open thereDone Mask the Wi-Fi password before it reaches agent proposal cards (blocks WifiCard)Done link_hub.ts has the identical partial-drop hole contact.ts just hadDone Add /health endpointDone Replace link-click placeholder zeroDone Verify documents/gallery/audio routes completeDone Add structured logging via pino-compatible APIIn progress Add request-id middlewareDone Add Sentry to WorkersDone Verify the four completed Backend API items in productionIn progress Build update endpoint for menu destinationsDone Build update endpoint for link_hub destinationsDone Build update endpoint for payment destinationsDone Build update endpoint for wifi destinationsDone Build update endpoint for bluetooth destinationsDone Build update endpoint for action destinationsDone Build the webhook MCP module (tools/webhook.ts) — Matthew chose SHIP over cutDone Derive per-type opIds for destination.create/edit so Website + Gallery cards can renderDone

Wave

Backend API

The long pole — Auth, Billing, Email, Custom Domains and Edge Functions all wait on this gate.

TacTile › Launch TacTile › Backend & Infrastructure › Backend API

27/33 done6 open1 open blocker

Selected taskclear

Verify all 14 destination content read endpoints

DoneOwner · Vivt_2f021e7b

Unlocks 1Approve: Backend API

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Verify all 14 destination content read endpoints** · done

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Backend API

## Unlocks 1

- Approve: Backend API

## The brief on file

Viv — exercise every destination content read endpoint and confirm each returns usable data for a real saved destination.

ROUTE-LEVEL VERIFICATION DONE 2026-08-03 against production (whitelabel.tactile.to). DATA-LEVEL VERIFICATION STILL OPEN — see the blockers at the foot.

THE PREMISE WAS WRONG, AND THAT IS THE HEADLINE. This task says "a code audit found all 14 GET .../content endpoints exist, and the public web viewer fix depends entirely on that being true." It was not true. **13 of 14 existed. Form did not.** Form served its public read only at the bare `/api/form/:hash`, so anything looping over destination types — exactly what the Web — Public destination viewer wave must do — got a generic 404 for form alone.

FIXED: PR #200, branch fix/form-content-endpoint-parity, commit 096c46aa. Adds `GET /api/form/:hash/content` pointing at the same `fetchFormContent` handler, already documented as the public form read and already IP-metered by public-resolver-guard like every other hash-addressed read. The bare `/:hash` stays — iOS and web-mobile already call it. Ready for review, not merged, not deployed.

HOW THE 14 WERE TESTED WITHOUT AUTH. Content reads are public by design: public-resolver-guard.ts treats `/api/<family>/<hash>` as a metered public read unless the family is explicitly exempt, so no session is needed. The discriminator is the error body on a nonexistent hash:
  - a mounted route that performed a real lookup returns a NAMED miss —
    "Destination not found." (11 types), "Menu not found.", "Link hub not found.";
  - an unrouted path falls through to the route-level `{"error":"Not found"}`.
Control: `/api/notarealtype/ZZZZZZZZZ/content` returns plain-text `Not found` (no such family), and `/api/audio/ZZZZZZZZZ/notarealsubpath` returns `{"error":"Not found"}` — confirming the discriminator distinguishes "route exists" from "family exists".

RESULTS — /api/<type>/ZZZZZZZZZ/content, all 404 as expected for a bogus hash:
  website, notes, documents, videos, contact, audio, gallery, payment, wifi,
  bluetooth, actions   → {"error":"Destination not found."}   ROUTE OK
  menu                 → {"error":"Menu not found."}          ROUTE OK
  link-hub             → {"error":"Link hub not found."}      ROUTE OK
  form                 → {"error":"Not found"}                ROUTE ABSENT → fixed in #200
  (form bare hash      → {"error":"Form not found."}          confirms the handler exists)

WHAT THIS PROVES AND WHAT IT DOES NOT. It proves all 14 routes are mounted, reachable and reach a real database lookup in production. It does NOT prove they return usable data for a real saved destination, which is what this task ultimately asks and what the viewer actually depends on.

BLOCKED ON, to finish the data half — neither is a code problem:
  1. 1Password is returning "authorization timeout" on every read, so no QA session
     token can be fetched (the TacTile QA — Quinn/Ben Ari/Terra items).
  2. A direct read-only SELECT against the prod DB for one real hash per type was
     denied by the tool permission layer, so I could not obtain real hashes that way
     either.
Either one unblocks it: with real hashes these are plain unauthenticated GETs and the
whole 14 can be confirmed in a couple of minutes.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Backend API

Verify all 14 destination content read endpoints