Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·36 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Real scans are never recorded: nothing calls POST /api/events/openBlocked · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageDone Suppress analytics event writes for free-tier accountsDone Unify the four conflicting hash validation patternsDone Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Triage the "couldn't connect to the server" preview clusterDone Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tagsDone Public scan landing page polishTo do Replace the duplicate web hash-shape copies with one shared import once #658 or #681 landsTo do Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blankDone iOS Program NFC Tag read path rejects 7 and 8 character hashes; spec says accept 7-9Done ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode tableTo do CI gives no per-suite proof for the NDEF suites: iOS prints totals only, Android's newest main run was a Gradle cache hitTo do Fix tap_count hardcoded to 0 in NFC metadata endpointDone Add hash exhaustion alertingDone Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingDone Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsDone Close the check-then-insert race on hash claimingDone Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsDone Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failureTo do API: validate the hash shape in the four /content handlers (documents, notes, videos, audio) like destinationsPublic.ts doesTo do Android NfcWriter has no post-write read-back verify (spec 4a step 5)Done NDEF parity corpus: iOS asserts 1 of 5 vectors and no https://www. vector exists; generator and Kotlin disagree on wwwTo do ndef-format.md section 5 contradicts itself on empty + read-only; NFCTagClassifier.classify and diagnose order them oppositelyTo do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

18/36 done18 open2 open blockers

Selected taskclear

Unify the four conflicting hash validation patterns

DoneOwner · Vivt_6ae4ebe4

Unlocks 2Approve: NFC/QR Core Pipeline Add hash-format validation on /t/[hash] scan landing

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Unify the four conflicting hash validation patterns** · done

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## Unlocks 2

- Approve: NFC/QR Core Pipeline
- Add hash-format validation on /t/[hash] scan landing

## The brief on file

[2026-10-08 · Viv] HUB-STATE NOTE: marked done, but the fix lives only on draft PR #658 (r27/scan-pipeline-sweep, head e8b6b71d), which is NOT merged — the commit is not an ancestor of origin/main 4f2c1d6b. #658 is red on static-firewall (plus the inherited secrets-rotation red). Main does not have this until #658 is fixed and merged. Status left as done (the run definition counts a verified branch commit), flagged so nobody assumes it shipped.

Viv — collapse four divergent hash-validation regexes into one shared constant. Done when: every route validates hashes against a single exported pattern and the inconsistency is gone. FOUND BY CODE READ — four different patterns are live today: nfc.ts:11 uses /^[0-9A-Z]{7,9}$/ (uppercase only), destinationsPublic.ts:14 and events.ts:40 use /^[0-9A-Za-z]{7,9}$/ (mixed case), and qr.ts:20 CLIENT_HASH_PATTERN uses /^[0-9][0-9A-Z]{8}$/ (exactly 9 chars, must start with a digit). Consequence: a lowercase hash passes the public resolver and the event ingest but is rejected by NFC registration, and a 7- or 8-char hash passes NFC but fails QR client validation. Decide the canonical shape (the generator produces 9 chars starting with a digit, so that is the likely truth) and enforce it everywhere. Coordinate with the existing task 'Add hash-format validation on /t/[hash] scan landing' — that one adds validation, this one makes it consistent. Files: apps/api/tactile-api/src/routes/{nfc,destinationsPublic,events,qr}.ts

[overnight 29→30 Sep] DONE in draft PR #658 (commit 15375dfb), with ONE deliberate departure from the task's wording: TWO shapes, not one.
WHY NOT ONE: READ→MINT would stop every 7-char and mixed-case tag resolving (a tag can't be re-programmed from the server) and MINT→READ re-opens the AAAAAAA squat; both irreversible. Main was already the deliberate split from the 2026-07-29 entropy audit (nfc.ts had MINT + READ; the uppercase-only {7,9} in this task's text was fixed then) but the shapes were retyped in 14 places. packages/utils/src/hashPatterns.ts now exports HASH_PATTERN_MINT (/^[0-9][0-9A-Z]{8}$/, what every generator emits; enforced at POST /api/nfc, /api/nfc/hash/check, qr client_hash) and HASH_PATTERN_READ (/^[0-9A-Za-z]{7,9}$/, everything that must keep resolving). 11 routes import them (nfc, qr, destinationsPublic, abuse, groups, analytics/{destinations,triggers,goals,families,export}); 3 keep a byte-identical local READ copy ONLY to avoid conflicts with open PRs: events.ts (#653), destinations.ts (#611), triggers.ts (#642), pinned by a shrink-only allowlist.
tests/unit/hash-patterns.test.ts (56): a two-sided accept/reject corpus, an ADD-ONLY list of live shapes READ must always match, READ ⊇ MINT and generator shape over 2,000 draws, and a scan that fails on any drifted hash-shaped regex or any NEW local copy. Mutation-checked (narrowing READ fails 5, a drifted copy in groups.ts fails the scan, an identical new copy fails the allowlist).
FOLLOW-UP when #653/#611/#642 merge: convert those 3 files and delete their lines from LOCAL_COPIES_ALLOWED in the test (the test goes red until you do).
ALSO FOUND: apps/web/features/handoff/lib/contract.ts:87 accepts only 7-or-9 UPPERCASE characters (a fifth shape, a different consumer) — left alone. The sibling task 'Add hash-format validation on /t/[hash] scan landing' should import HASH_PATTERN_READ rather than retype it.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Unify the four conflicting hash validation patterns