Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·23 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageTo do Suppress analytics event writes for free-tier accountsTo do Unify the four conflicting hash validation patternsTo do Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Public scan landing page polishTo do Fix tap_count hardcoded to 0 in NFC metadata endpointTo do Add hash exhaustion alertingTo do Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingTo do Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsTo do Close the check-then-insert race on hash claimingTo do Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsTo do Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

4/23 done19 open1 open blocker

Selected taskclear

Reconcile the three divergent hash generators

To doOwner · Vivt_45c6cd53

Unlocks 1Approve: NFC/QR Core Pipeline

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Reconcile the three divergent hash generators** · to do

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## Unlocks 1

- Approve: NFC/QR Core Pipeline

## The brief on file

Viv — establish one canonical hash generator, or document why three are correct. Done when: either all three share a seed layout, or the divergence is deliberately documented with a parity test covering all three. FOUND BY CODE READ: TacTileHashGenerator.kt's own header flags this — iOS and Android use the seed layout device(2) + medium(2) + zeroPad14(global) + zeroPad14(specific) + epoch, while the Cloudflare Worker generator (packages/utils/src/generateDestinationId.ts, called via reserveHashId in qr.ts) uses a DIFFERENT layout: zeroPad14(global) + actionCode(3) + zeroPad14(specific) + envCode(3) + epoch. The existing parity gate (HashParityTest.kt + hash-parity-vectors.json) only covers iOS-to-Android, so worker-minted hashes are untested against either. Runtime resolution is a DB lookup so this is not breaking today, but three generators with no shared test is a latent divergence in the product's core identifier. Files: apps/android/.../TacTileHashGenerator.kt, apps/ios/.../TacTileHashGenerator.swift, packages/utils/src/generateDestinationId.ts, apps/android/app/src/test/.../HashParityTest.kt

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Reconcile the three divergent hash generators