Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·36 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Real scans are never recorded: nothing calls POST /api/events/openBlocked · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageDone Suppress analytics event writes for free-tier accountsDone Unify the four conflicting hash validation patternsDone Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Triage the "couldn't connect to the server" preview clusterDone Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tagsDone Public scan landing page polishTo do Replace the duplicate web hash-shape copies with one shared import once #658 or #681 landsTo do Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blankDone iOS Program NFC Tag read path rejects 7 and 8 character hashes; spec says accept 7-9Done ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode tableTo do CI gives no per-suite proof for the NDEF suites: iOS prints totals only, Android's newest main run was a Gradle cache hitTo do Fix tap_count hardcoded to 0 in NFC metadata endpointDone Add hash exhaustion alertingDone Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingDone Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsDone Close the check-then-insert race on hash claimingDone Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsDone Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failureTo do API: validate the hash shape in the four /content handlers (documents, notes, videos, audio) like destinationsPublic.ts doesTo do Android NfcWriter has no post-write read-back verify (spec 4a step 5)Done NDEF parity corpus: iOS asserts 1 of 5 vectors and no https://www. vector exists; generator and Kotlin disagree on wwwTo do ndef-format.md section 5 contradicts itself on empty + read-only; NFCTagClassifier.classify and diagnose order them oppositelyTo do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

18/36 done18 open2 open blockers

Selected taskclear

Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blank

DoneOwner · Vivt_4e229bdf

build(url, "") emits a 3-byte empty Text record on Android; iOS drops record 2 for a blank hash and has a test for it.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blank** · done

build(url, "") emits a 3-byte empty Text record on Android; iOS drops record 2 for a blank hash and has a test for it.

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## The brief on file

[2026-10-16 · Viv] DONE on draft PR #765 (https://github.com/TacTile-dev/TacTile/pull/765, branch r32/native-agent-ndef, commit a0f3ecd9, off origin/main 4f2c1d6b). Not merged, not deployed, nothing written to production. Android NdefMessageBuilder.build drops the Text record when backupText.trim() is empty; a lone URI record carries MB|ME (header 0xD1); a non-blank hash is unchanged (two records, 0x91), and the text is now written trimmed like iOS makeWriteMessage.

EVIDENCE: shared blank-hash vector https://tactile.to/t/123ABCD7Q with blank text builds ONE record, hex D10117550474616374696C652E746F2F742F313233414243443751 (27 bytes). Android NdefParityTest 9/9 (blankBackupText_dropsTheTextRecord_andTheUriRecordCarriesMbAndMe, theSameUrlWithTextKeepsTwoRecordsAndTheMbOnlyHeader, paddedBackupText_isWrittenTrimmed, blankBackupText_type2TlvFramesTheSingleRecord, plus the four byte-for-byte fixtures); two blank vectors (empty, whitespace-only) regenerated with gen-ndef-parity-vectors.mjs, re-run by the reader byte-identical, first four vectors unchanged. Swift NFCGoldenNDEFTests 11/11 (5 new test_goldenBlank_* cases) and NFCEncoderWriterSimulatedTests 20/20 incl. the real writer's test_write_whitespaceHashText_omitsTextRecord, xcodebuild iPhone 17 Pro iOS 26.5: NFCNDEFMessage.length == 27 and one record. TS tests/unit/ndef-golden-fixtures.test.ts 7 pass (pins the Android corpus to the shared fixture ndef-golden.json blankHash); pnpm verify:unit 234 files / 4694 tests. Mutations: build() always appends the Text record gave 5 red; uriRecord ignoring `last` (keeps 0x91) gave 5 red; both restored.

WHAT THE SIMULATOR DOES AND DOES NOT PROVE (the Done-when said check CoreNFC): CoreNFC exposes only NFCNDEFMessage.length (27 for 0x91 and 0xD1 alike), no raw bytes, so the simulator confirms the record count and length, not the header flag bits. 0xD1 rests on NDEF 1.0 (MB/ME) and a lone short record has no valid alternative; the Android and TS tests pin the byte value. Both readers accepted this as the strongest evidence available; it is stated in the PR body.

GATE (bash scripts/verify/gate.sh on the branch tip 689d45e1, two full runs): run 1 red only on verify:ts-source-coverage, the known tsc --showConfig SIGSEGV flake (the log named apps/internal-hub/tsconfig.json failing twice); pnpm verify:ts-source-coverage alone then passed (rc 0, 1214/1293 sources). Run 2: exit 0, 55 of 56 passed, ending "gate: passing with known-red: verify:secrets-rotation" (the sanctioned red, Matthew's t_3e28c5b5). Gate logs: scratchpad gate-ndef-run1.log, gate-ndef-run2.log, ts-src-cov-alone.log.
CI on #765 at head 689d45e1 (settled 01:55 Fri 16 Oct): build & test (Android) pass, build & test (iOS) pass, playwright pass, swift-parity pass, semgrep pass, dep-scan pass, static-firewall pass, signed release bundle skipped; verify red at exactly one step, "Secrets rotation audit" (the sanctioned red, t_3e28c5b5). PR is MERGEABLE against origin/main 4f2c1d6b.
READERS: acceptance CONFIRMED (generator re-run byte-identical, 27 bytes decoded by hand, hand-run Kotlin 9/9, iOS 11/11 and 20/20, both mutations), safety CONFIRMED (files within the planned list, none in an open PR; #658 calls build() with a non-blank hash so its bytes are unchanged). Neither repairable.

UI CHECK: none (writer output is covered by the byte-level tests).

[2026-10-15 · Viv] Where the audit doc is: docs/audit/2026-10-ndef-signoff.md exists only on draft PR #759 (branch r31/tooling-docs-ship, https://github.com/TacTile-dev/TacTile/pull/759) until Matthew merges it. Any "r31/tooling-docs draft PR" pointer in this task means #759.

[2026-10-15 · Viv] Found by the NDEF sign-off (t_92603a30), audit doc docs/audit/2026-10-ndef-signoff.md section 3 row D3. Line cites are origin/main 4f2c1d6b.

PROBLEM: docs/nfc/ndef-format.md section 2 makes record 2 (Text) optional: omitted if the hash text is empty or whitespace after trim. iOS: NFCEncoderWriter.makeWriteMessage (NFCEncoderWriter.swift:652-662), pinned by test_write_whitespaceHashText_omitsTextRecord. Android: NdefMessageBuilder.build (apps/android/app/src/main/java/com/tactile/app/core/nfc/NdefMessageBuilder.kt:62-63) is uriRecord(url) + textRecord(backupText) unconditionally, so build(url, "") appends a Text record with payload 02 65 6E (empty text) and header 0x51, and a whitespace-only string is written as text. No Kotlin test covers a blank value; the 4 parity vectors all carry a non-empty backupText. Today's callers pass the hash, so this is latent.

DONE WHEN: build() drops the Text record when backupText.trim() is empty, in agreement with iOS. With one record left, the URI record must carry both MB and ME (header 0xD1 = MB|ME|SR|TNF, not 0x91); the current uriRecord hard-codes 0x91, so it needs an ME parameter. Check what CoreNFC actually serialises for a single-record message before pinning the bytes. Add a parity vector with a blank hash (bytes from the iOS rule, confirmed in a simulator run) and a Kotlin test; the Swift golden test gets the same vector (see the parity-corpus task t_6cc300ed, filed from the same audit).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blank