Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Android›Android — Destinations build·43 in this wave

Wave

Android — Destinations build

Destination creation, viewers, and post-create editing. Creation is comprehensively built (~20 real builders across all 8 categories) despite stale in-code comments claiming otherwise. Editing is the real gap: only website and notes are editable post-create — 11 of 13 types show "Editing coming soon," mirroring iOS's destination-editing gap almost exactly.

TacTile › Launch TacTile › Android › Android — Destinations build

35/43 done8 open1 open blocker

Selected taskclear

Residue from the round-20 adversarial re-read: clientKey collapses IPv4-mapped IPs, and 2 of 3 clients bypass the resend meter

To doOwner · backendt_4533c0a4

Filed 2026-08-13. Findings from adversarially re-reading PRs #391/#393 after merge. The HIGH one (ReDoS) was fixed in #400; these are what remains, each with its reachability verdict.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Residue from the round-20 adversarial re-read: clientKey collapses IPv4-mapped IPs, and 2 of 3 clients bypass the resend meter** · to do

Filed 2026-08-13. Findings from adversarially re-reading PRs #391/#393 after merge. The HIGH one (ReDoS) was fixed in #400; these are what remains, each with its reachability verdict.

Where it sits: TacTile › Launch TacTile › Android › Android — Destinations build

## The brief on file

BACKEND SESSION. Filed 2026-08-13 from the round-20 adversarial re-read of #391 (resend limiter) and #393 (visibility gate). The HIGH finding from that pass — a quadratic regex made anonymously reachable — was fixed in #400. These are the rest, ordered by value. Each carries its reachability verdict so nobody re-litigates it.

=== 1. THE ADDRESS BUCKET ONLY PROTECTS ONE OF THREE CLIENTS ===

#391 added a per-address bucket to routes/auth.ts specifically to stop one victim's inbox being flooded from many IPs. It only covers callers that go through the Worker.

apps/ios/.../AuthService.swift and apps/web-mobile both call Supabase's resend directly with the ANON key, not this endpoint. So the mail-bombing protection covers the web client only; the other two paths are bounded solely by whatever Supabase's own per-address cooldown is.

DECIDE: either route all clients through /api/auth/resend-verification so one meter governs, or accept that this bucket is defence for one surface and say so in the code comment (which currently implies it is universal). Do NOT leave the comment as-is — it overstates the protection.

Related: the address bucket's 3/min is looser than Supabase's own cooldown, so today the effective ceiling is upstream, not here. If Supabase ever relaxes that, this number becomes the real one and should be re-reviewed rather than assumed conservative.

=== 2. clientKey COLLAPSES EVERY IPv4-MAPPED ADDRESS INTO ONE BUCKET ===

apps/api/tactile-api/src/middleware/public-resolver-guard.ts:122-132.

The comment on :122 says "IPv4 (and IPv4-mapped forms) have no host-bit escape hatch - key as-is". The guard on :123 is `if (!raw.includes(":")) return raw;` — and `::ffff:1.2.3.4` DOES contain colons, so it falls through into the /64 collapse and `slice(0,4)` truncates to the all-zero prefix.

Reproduced against the real exported function:
  ::ffff:203.0.113.9            -> 0:0:0:0::/64
  ::ffff:198.51.100.7           -> 0:0:0:0::/64
  0:0:0:0:0:ffff:203.0.113.9    -> 0:0:0:0::/64
  ::1                           -> 0:0:0:0::/64
  ::                            -> 0:0:0:0::/64

Two unrelated networks therefore share one bucket across EVERY limiter that keys on clientKey — resend 10/min, total 300/min, miss 20/min, beacon 120/min. The first caller to spend it locks out the rest.

The mirror-image bug in the same function: no hextet normalisation, so one /64 written three legal ways yields three buckets —
  2001:db8:85a3::1                          -> 2001:db8:85a3:0::/64
  2001:0db8:85a3:0000:0000:0000:0000:0001   -> 2001:0db8:85a3:0000::/64
  2001:DB8:85A3::1                          -> 2001:DB8:85A3:0::/64

REACHABILITY: REFUTED for the public edge, and this is why it is medium and not high. :119 reads ONLY CF-Connecting-IP, with no X-Forwarded-For fallback (unlike utils/rate-limit-health.ts:45, utils/audit.ts:184, routes/customDomains.ts:901, utils/analytics/ingest.ts:83, routes/abuse.ts:125 — none of which call clientKey). Cloudflare controls that header's format. It IS reachable on the SELF service-binding path (wrangler.toml:64-66).

One correction to carry forward: `filter(Boolean)` is NOT the culprit — the ::-expansion at :126-130 is correct. The defect is that no IPv4-mapped special case exists at all, so the slice truncates.

FIX: strip a %zone suffix; detect ::ffff:a.b.c.d and 0:0:0:0:0:ffff:a.b.c.d and return the embedded dotted-quad (which is what the comment already promises); lowercase and strip leading zeros per hextet. There is currently NO test for clientKey at all — pin it with a table test over the exact strings above.

=== 3. THE GATE'S 404 NEVER CHARGES THE ENUMERATION MISS BUDGET ===

index.ts:412-415 returns as soon as enforceVisibility answers, which is BEFORE the `ctx.waitUntil(recordPublicResolverOutcome(...))` at :425. So a 404 produced by the gate is free, while a 404 produced by a route is charged. An enumerator who happens to hit private hashes is metered more weakly than one who hits absent ones — the opposite of what you want.

=== 4. TWO HASH MATCHERS DISAGREE, AND THE ROUTE'S IS LOOSER ===

hashFromPath (visibility-gate.ts:65-70) and HASH_ADDRESSED (public-resolver-guard.ts:76-77) both operate on the RAW pathname, and WHATWG URL does not percent-decode path segments. So /api/link-hub/%30RCIFJVUP/content does not match the gate's hash pattern while routes/link_hub.ts:514 still resolves it. Verify whether PostgREST decodes it on the route side; if it does, that is a gate bypass and this becomes HIGH.

=== 5. SMALLER, ALL VERIFIED ===

- tests/unit/visibility-gate.test.ts: replacing ownerIdsMatch with `(a,b) => a === b` keeps all tests green, because both fixtures use byte-identical UUIDs. The owner tests do not actually pin the canonicalisation (pair_ prefixes, casing) that ownerIdsMatch exists for.
- visibility-gate.ts notFound() sets no Cache-Control: no-store, unlike its sibling tooManyRequests in the same directory which sets it with a written reason. A 404 emitted during a 30-second Supabase blip can be cached at the edge and outlive the blip.
- docs/adr/0008-api-versioning.md:91-95 describes the rate-limit skip list as exempting four paths "via path.startsWith(...)". It is now eight predicates with three shapes, and #397 changed the matching semantics to normalise trailing slashes. Stale.
- public-resolver-guard.ts:94 EXEMPT_FAMILIES carries `"auth", // authenticated / token exchange`. That comment is now factually false — /api/auth/resend-verification is unauthenticated by explicit design. No functional consequence today.
- routes/auth.ts: the IP meter fails OPEN when CF-Connecting-IP is absent (`if (ip)` skips the call), while the seam it calls fails CLOSED. Opposite asymmetry from the sibling limiters. Decide deliberately and write it down.
- Bucket names: `authresend` is a strict prefix of `authresendaddr`. Safe today only because the `pub:<bucket>:` delimiter forces a colon. DO names are durable, so a future bucket whose name is a prefix of another AND whose keys can begin with the remaining characters would silently merge two counters.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Android — Destinations build

Residue from the round-20 adversarial re-read: clientKey collapses IPv4-mapped IPs, and 2 of 3 clients bypass the resend meter