Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›DevOps›DevOps Foundation·35 in this wave

Approve: DevOps FoundationTo do · blocker NEEDS MATTHEW: staging STRIPE_WEBHOOK_SIGNING_SECRETBlocked · blocker main is RED — 8 unit tests failing on origin/main, so pnpm verify cannot gate any PRDone · blocker The production account's data is 42 days stale — Analytics renders empty at any default windowBlocked · blocker MATTHEW: add db_url to the 1Password Supabase item — two RLS audits have never been runnableDone · blocker Wire apps/api test suite into CIDone Wire Playwright specs into CIDone Wire verify:swift-parity into CIDone Enable branch protection on mainBlocked Verify the staging environment is actually liveDone Web deploy workflow (manual trigger only)To do API deploy workflow (manual trigger only)To do Add post-deploy smoke test to the deploy workflowsTo do Write the rollback procedureTo do Add Sentry to iOSTo do Add Sentry to AndroidTo do Configure uptime monitoringTo do Set the three missing staging secrets on tactile-api-stagingDone Playwright is failing on main and producing no report — every run that gets a runner failsTo do Playwright job must free port 3000 BEFORE its first suite — a watchdog-killed job leaks its server and fails every later runDone Add CHANGELOG.mdTo do Automate release tagging on mainTo do Fix stale Vercel references in the observability runbookDone Add apps/api typecheck to CIDone Clean the SAST baselineTo do Flip SAST to blockingTo do Edge function deploy workflow (manual trigger only)To do Supabase migration check in CITo do Write the release procedureTo do Configure Supabase log drainTo do Centralize Cloudflare Workers logsTo do Replace console.* with structured logging in apps/apiTo do Two runners share one ~/.gradle — scope it per runner without losing the warm cacheTo do MATTHEW: CI capacity — one Mac, two runners, and a full Xcode build now runs on every pushTo do Auto-cancel queued CI runs whose head branch was deletedTo do

Wave

DevOps Foundation

Unblocked now — nothing waits on the surfaces. Wiring existing tests into CI, deploy automation, base observability.

TacTile › Launch TacTile › DevOps › DevOps Foundation

10/35 done25 open3 open blockers

Selected taskclear

Verify the staging environment is actually live

DoneOwner · Vivt_538764e0

Unlocks 5Web deploy workflow (manual trigger only)API deploy workflow (manual trigger only)Edge function deploy workflow (manual trigger only)Configure uptime monitoring Approve: DevOps Foundation

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Verify the staging environment is actually live** · done

Where it sits: TacTile › Launch TacTile › DevOps › DevOps Foundation

## Unlocks 5

- Web deploy workflow (manual trigger only)
- API deploy workflow (manual trigger only)
- Edge function deploy workflow (manual trigger only)
- Configure uptime monitoring
- Approve: DevOps Foundation

## The brief on file

Viv — confirm staging is actually live: staging.tactile.to responds, staging Supabase is reachable, and staging secrets are present. Done when: findings are written into docs/runbooks/setup-staging.md covering each of the three checks and their current state.

--- DONE 2026-07-27 (Viv) · commit 44657ef4 ---
All three checks run against the DEPLOYED environment, findings appended to docs/runbooks/setup-staging.md under "Verification 2026-07-27".

VERDICT: staging serves traffic but is NOT a trustworthy pre-prod gate. A release validated on staging today exercises no Sentry, no outbound email, and no working Stripe webhooks.

1. RESPONDS — ✅ YES. staging.tactile.to 200, /signin 200, staging-api/api/health 200. The yellow staging banner renders, which confirms NEXT_PUBLIC_ENV=staging actually reached the deployed worker rather than just sitting in config.

2. SUPABASE — ⚠️ NOT PROVEN, and not provable with what's available. All four Supabase secrets are present and the app boots, but nothing I could run executes a query. /api/health is deliberately shallow; /api/health/deep is the real probe and is token-gated (401 on staging AND prod — correct behaviour), and HEALTH_TOKEN is documented at wrangler.toml:182 as "local random; not in 1P" so it can't be retrieved. Management API confirms only 2 projects exist (TacTile DB ACTIVE_HEALTHY, pretender-cloud), consistent with staging using a branch; enumerating branches failed on permissions. TO CLOSE: put HEALTH_TOKEN in 1Password, then curl /api/health/deep with it. The post-deploy smoke test (t_407e75d7) needs exactly this, so do it once and reuse.

3. SECRETS — ❌ NO. 10 on staging vs 25 on prod. Three real breakages:

🔴 STRIPE WEBHOOKS ARE DEAD ON STAGING. Staging has STRIPE_WEBHOOK_SECRET; the code reads STRIPE_WEBHOOK_SIGNING_SECRET (src/routes/billing.ts:129) and returns 500 without it. THE CAUSE WAS THE RUNBOOK ITSELF — Step 2 instructed the wrong name and staging was configured from it. I corrected Step 2 and recorded the two commands to fix the live worker. (Note the runbook's troubleshooting section predicts a 401 from key mismatch — different failure; this is a 500 from a naming bug.)

🔴 NO SENTRY ON STAGING. SENTRY_DSN unset even though Step 2 says to set it — the step was skipped. Staging errors go nowhere, which defeats the point of staging.

🔴 EMAIL SILENTLY NO-OPS. RESEND_API_KEY unset. Per the known hazard the email service falls back to a no-op stub logging only a console warning — and with no Sentry, that warning goes nowhere either. Any staging test of signup verification, password reset or billing receipts appears to pass while sending nothing.

🟠 ENABLE_VIDEO_TRANSCODE=true on staging without CONTAINER_SHARED_SECRET, which its own wrangler.toml comment says it requires.
🟠 Staging health reports version "unknown" vs prod's git SHA — SENTRY_RELEASE isn't set, so staging deploys aren't traceable to a commit.
🟠 Missing: ANALYTICS_HMAC_SECRET, CF_API_TOKEN, CF_ZONE_ID (custom domains won't provision on staging).

✅ ANTHROPIC_API_KEY on staging is CORRECT, not a violation — policy stores the literal `disabled-in-staging` sentinel there and createAnthropicClient short-circuits it to a stub. Values can't be read back, so eyeball it once: a real sk-ant-… key in that slot is the one case that's an ADR-0001 breach rather than an outage.

Housekeeping: prod carries both SUPABASE_SERVICE_ROLE and SUPABASE_SERVICE_ROLE_KEY; code reads the latter, the bare one looks vestigial.

NO SECRET VALUES WERE READ — only names, via `wrangler secret list`.

THE THREE 🔴 ITEMS ARE ONE `wrangler secret put` EACH and should be closed before staging gates any prod deploy. The three deploy-workflow tasks (t_5a7ef1c3, t_c7bc95eb, t_356a7be0) that depend on this are now unblocked to BUILD, but shouldn't be relied on to gate prod until these are fixed.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

DevOps Foundation

Verify the staging environment is actually live