Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·56 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

44/56 done12 open2 open blockers

Selected taskclear

SPEC → backend: checkout returns every buyer to ONE origin, so app.tactile-connect.com buyers land on tactile.to

To doOwner · ait_4fefd007

Unlocks 1ROUND 7 · SESSION — Backend: un-quarantine the hidden tests, then the honest MCP surface

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**SPEC → backend: checkout returns every buyer to ONE origin, so app.tactile-connect.com buyers land on tactile.to** · to do

Where it sits: TacTile › Inbox — on deck

## Unlocks 1

- ROUND 7 · SESSION — Backend: un-quarantine the hidden tests, then the honest MCP surface

## The brief on file

[2 Oct 2026 overnight — Viv: draft PR #703 https://github.com/TacTile-dev/TacTile/pull/703 — api: checkout and the billing portal can return a buyer to the origin they started on (inert until the client sends the field) (API half; stays open until the client half ships); not merged, not deployed]

web-mobile can now sell (PR this round). One thing it cannot fix from the client: where Stripe sends the buyer afterwards.

THE PROBLEM. apps/api/tactile-api/src/routes/billing.ts:70-76 —

  const origin = env.PUBLIC_WEB_ORIGIN?.replace(/\/+$/, "") ?? "https://tactile.to";
  success_url: `${origin}/settings/subscription?checkout=success&session_id={CHECKOUT_SESSION_ID}`
  cancel_url:  `${origin}/settings/subscription?checkout=cancelled`

One env var, so EVERY checkout returns to the same origin no matter which app
started it. A customer who bought on app.tactile-connect.com — the domain every
marketing CTA points at (site/src/config.ts APP_URL/SIGNUP_URL) — completes
payment and is dropped on tactile.to, a different app on a different domain
where they may not have a session. They have paid and been handed to something
that looks like it does not know them.

The portal has the same shape at :111 —
  const returnUrl = env.STRIPE_PORTAL_RETURN_URL ?? "https://tactile-connect.com/account/billing";
— and note that default is a THIRD host: tactile-connect.com with no `app.`
prefix. Worth checking it resolves at all.

WHAT I SUGGEST, and why it is not "just read the Origin header": the Origin
header on a fetch from either app is attacker-influencable in the general case,
and success_url is a redirect target. So take an explicit, validated hint:

  POST /api/billing/checkout { tier, interval, return_origin? }

  · return_origin is matched against a server-side ALLOWLIST of known app
    origins (tactile.to, staging.tactile.to, app.tactile-connect.com, and
    whatever the staging equivalent is). Anything not on the list falls back to
    PUBLIC_WEB_ORIGIN rather than erroring — a buyer should never be blocked
    from paying by a config mismatch.
  · Same treatment for the portal's return_url.
  · The allowlist wants to live next to the CORS origin list, which has already
    been wrong once this week (staging.tactile.to was missing from it) — one
    list of "our surfaces", not two that drift.

The path (`/settings/subscription`) happens to be the same on both apps today,
so only the ORIGIN needs to vary. If that stops being true, send return_path
alongside and validate it as a path, never as a full URL.

WHEN IT LANDS: tell the web session. apps/web-mobile/app/settings/subscription/
page.tsx already reads ?checkout=success|cancelled and renders both outcomes —
it is simply unreachable on that domain until this is fixed, and starts working
with no client change.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

SPEC → backend: checkout returns every buyer to ONE origin, so app.tactile-connect.com buyers land on tactile.to