Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·26 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditTo do Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerTo do Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryTo do Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

18/26 done8 open2 open blockers

Selected taskclear

NEEDS MATTHEW: GitHub Actions billing wall — all CI is blocked

DoneOwner · met_412e17f7

Every GitHub Actions job now refuses to start. Separate from, and discovered by, fixing the tactile-hub deploy.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**NEEDS MATTHEW: GitHub Actions billing wall — all CI is blocked** · done

Every GitHub Actions job now refuses to start. Separate from, and discovered by, fixing the tactile-hub deploy.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## The brief on file

RESOLVED 2026-08-15/16. This is no longer true and must not keep reading as a blocker.

WHAT IT SAID: the GitHub Actions billing wall meant every workflow run failed in
2-5 seconds WITHOUT EXECUTING, so no CI gated anything and a red check proved
nothing.

WHAT CHANGED: the fleet moved to SELF-HOSTED runners on Matthew's Mac. Self-hosted
consumes zero Actions minutes on any plan, so the wall is structurally unable to
recur — it is not "paid down", it is bypassed. Two runners are registered
(tactile-m1max, tactile-m1max-2) as launchd LaunchAgents with RunAtLoad+KeepAlive,
so they survive reboot and logout.

MEASURED 2026-08-16, jobs genuinely executing with real durations:
  build & test (iOS Debug+Release xcodebuild)  17.4 min
  verify (49 checks)                           10.3 min
  playwright (e2e + local Supabase stack)       8.2 min
Compare the wall era, where every one of those was 2-5s and never ran.

WHAT REPLACED IT AS THE CONSTRAINT — and this is the live item, not this one:
CAPACITY, tracked as t_361002e9. Two runners on one Mac, and queue WAIT now
exceeds compute: verify waits 28.6 min, playwright 33.7 min, and static-firewall
waits 19.6 minutes to do 12 SECONDS of work. That is a different problem with a
different fix (a second machine, or hosted minutes for the cheap Linux jobs).

ALSO SHIPPED against the same constraint:
  · #495/#496 — a local launchd job cancels queued runs whose branch was deleted.
    GitHub never does this, and 10 of 16 queued runs were dead after one merge
    wave, delaying a live job by 74 minutes.
  · #494 — a nightly schedule for the playwright job, which was starved out and
    executed on only 6 of 40 runs.

STILL TRUE AND UNRELATED: branch protection needs a paid plan (t_ba67f30b), so
scripts/verify/gate.sh + .githooks/pre-push remain the only real merge gate.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

NEEDS MATTHEW: GitHub Actions billing wall — all CI is blocked