Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·49 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

39/49 done10 open3 open blockers

Selected taskclear

REVENUE OUTAGE — nobody can buy: apps/web calls /api/billing/* relatively and no such route exists

DoneOwner · ait_457ed798Blocker

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**REVENUE OUTAGE — nobody can buy: apps/web calls /api/billing/* relatively and no such route exists** · done · blocker

Where it sits: TacTile › Inbox — on deck

## The brief on file

FIXED AND LIVE IN PRODUCTION 2026-08-07 — PR #255 (57738af3), deployed and verified.

apps/web/app/api/[...path]/route.ts is an allowlisted same-origin proxy forwarding billing, account, custom-domains, me, settings and webhooks to the API worker with the caller's Bearer token. Middleware now exempts /api/ from the redirect gate for the reason /api/rag already was — these carry their own auth, and an API path must answer 401 rather than 302 into an HTML login page.

VERIFIED LIVE ON PRODUCTION, not on a test: all seven paths return 401 {"error":"Missing Bearer token."} from the API worker where every one previously returned 307 to /signin. Controls hold — an un-allowlisted family 404s instead of forwarding, /api/health is still served locally, page routes are still gated, and the invalid-token body matches api.tactile.to exactly (staging matches staging-api), proving each environment proxies to its own API.

A drift guard ships with it (tests/unit/web-api-proxy.test.ts, modelled on internal-routes-reachable): every family apps/web fetches must be one this worker can serve, so the next call site in an unproxied family fails the build instead of 404ing in a customer's browser. Mutation-checked four ways — dropping "billing" fails 2 tests, forwarding the session cookie fails 1, removing the middleware exemption fails 1, unconditional forwarding fails 1.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

REVENUE OUTAGE — nobody can buy: apps/web calls /api/billing/* relatively and no such route exists