Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Web›Web — Settings, Analytics & agent build·26 in this wave

Approve: Settings, Analytics & agent buildTo do · blocker Viv — Build the analytics Compare page or gate it behind a beta flag.To do Viv — Source the AI agent's model label from the actual serving model instead of a hardcoded string.Done Viv — Write real Privacy Policy content and clear it for launch.To do Viv — Write real Terms of Service content and clear it for launch.To do Viv — Add a branded not-found.tsx to apps/web.Done Viv — Restrict CORS on the RAG query API route.Done me — Decide whether CSP enforcement (CSP_ENFORCE=1) is set in the production deployment environment, and confirm it before next release.To do Viv — Add disabled state to 'Lock tag' and 'Password protect' toggles on trigger management, or ship the feature.Done Viv — Fix or disable 'Edit Design' button on QR trigger detail.Done Viv — Finish or remove the 4 unavailable analytics widgets (geo-map, live-counter, goal-progress, ai-qa).Done Viv — Pull pricing feature bullets from shared billing config instead of hand-maintained duplicate strings.To do Viv — Add route-level loading.tsx skeletons for key authenticated routes.Done Viv — Restyle app/error.tsx and app/global-error.tsx to match the design system.To do Viv — Consolidate the three duplicated account-deletion implementations into one.To do Viv — Rename or restructure features/destinations/pages/SettingsPage.tsx to reflect that it manages workspace/account settings, not destinations.Done Viv — Implement inline_lock badge rendering in the analytics Gate component.Done Viv — Replace the marketing homepage's 'Dashboard screenshot coming soon' placeholder with a real product screenshot or demo visual.To do Viv — Un-skip and implement the 10 skipped Supabase auth Playwright tests.Blocked Kaitlynn — Verify desktop auth flows end-to-end: sign in (OAuth + email/password + OTP), sign up, forgot/reset password, device-trust verify-device (if flag enabled), sign out.To do Kaitlynn — Verify Assets feature (Triggers, Groups, Families tabs) end-to-end, including trigger detail linking/renaming/deleting and family/group management.Done Kaitlynn — Verify Analytics Overview, Dive, and Campaigns pages render real data correctly (Compare page tracked separately as unfinished).Done Kaitlynn — Verify all seven apps/web Settings pages (workspace identity, agent, custom domain, subscription, security, notifications, data) function correctly end-to-end.To do Kaitlynn — Verify the AI agent chat UI end-to-end (send message, receive streamed response, conversation history).To do Kaitlynn — Verify public destination viewers /t/[hash], /d/[hash], /n/[hash] across all destination types they support.Done A paying customer silently loses their paid blocks when the plan lookup errors — usePlan's error is never surfacedDone

Wave

Web — Settings, Analytics & agent build

TacTile › Launch TacTile › Web › Web — Settings, Analytics & agent build

13/26 done13 open1 open blocker

Selected taskclear

Viv — Un-skip and implement the 10 skipped Supabase auth Playwright tests.

BlockedOwner · Vivt_54e2de0c

Done when: OTP happy path, email+password sign-in, OAuth (Apple/Google), JWT refresh lifecycle, and rate-limit trigger all have real passing test coverage instead of test.skip(), so CI actually signals when auth breaks. File: apps/web/playwright/auth.spec.ts:93-196 (10 test.skip() cases, unchanged since 2026-05-15).

Unlocks 2Approve: Settings, Analytics & agent build Kaitlynn — Verify desktop auth flows end-to-end: sign in (OAuth + email/password + OTP), sign up, forgot/reset password, device-trust verify-device (if flag enabled), sign out.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Viv — Un-skip and implement the 10 skipped Supabase auth Playwright tests.** · blocked

Done when: OTP happy path, email+password sign-in, OAuth (Apple/Google), JWT refresh lifecycle, and rate-limit trigger all have real passing test coverage instead of test.skip(), so CI actually signals when auth breaks. File: apps/web/playwright/auth.spec.ts:93-196 (10 test.skip() cases, unchanged since 2026-05-15).

Where it sits: TacTile › Launch TacTile › Web › Web — Settings, Analytics & agent build

## Unlocks 2

- Approve: Settings, Analytics & agent build
- Kaitlynn — Verify desktop auth flows end-to-end: sign in (OAuth + email/password + OTP), sign up, forgot/reset password, device-trust verify-device (if flag enabled), sign out.

## The brief on file

[2026-10-15 · Viv] AMBIGUOUS, not started: Tried: origin/main has 6 skips, not 10 (apps/web/playwright/auth.spec.ts:149, 159, 168, 176, 183, 212); the OTP UI is gone; Apple/Google OAuth consent cannot run in CI and there is no non-production GoTrue. Need an amended Done-when: which of the 6 must run, whether a redirect-URL assertion counts for OAuth, and whether the 429 rate-limit case counts. Needs: me.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Web — Settings, Analytics & agent build

Viv — Un-skip and implement the 10 skipped Supabase auth Playwright tests.