Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Backend API·33 in this wave

Approve: Backend APITo do · blocker Implement /api/profile or remove routeDone Implement /api/uploadDone Implement destination analyticsDone Add upload size limits and file validationDone Define the API versioning strategyDone Verify all 14 destination content read endpointsDone Verify the five existing destination update endpoints workIn progress Fix the stale SENTRY_RELEASE on tactile-apiDone iOS decodes payment_destinations as an array — a latent whole-list decode failureTo do Add staging.tactile.to to the API CORS allowlistDone Emit CardSchema (not bare ActionPreview) from the 12 non-QR tool preview generatorsDone pnpm verify is red on main, and CI hides 9 more failures by excluding three test filesDone EMIT LEG: send method:\"link\" from the clients, or the Link bucket stays at zeroTo do POST /api/events/open is documented public+unauth but 401s anonymouslyDone Staging has no RATE_LIMIT_DO binding — both rate limiters fail open thereDone Mask the Wi-Fi password before it reaches agent proposal cards (blocks WifiCard)Done link_hub.ts has the identical partial-drop hole contact.ts just hadDone Add /health endpointDone Replace link-click placeholder zeroDone Verify documents/gallery/audio routes completeDone Add structured logging via pino-compatible APIIn progress Add request-id middlewareDone Add Sentry to WorkersDone Verify the four completed Backend API items in productionIn progress Build update endpoint for menu destinationsDone Build update endpoint for link_hub destinationsDone Build update endpoint for payment destinationsDone Build update endpoint for wifi destinationsDone Build update endpoint for bluetooth destinationsDone Build update endpoint for action destinationsDone Build the webhook MCP module (tools/webhook.ts) — Matthew chose SHIP over cutDone Derive per-type opIds for destination.create/edit so Website + Gallery cards can renderDone

Wave

Backend API

The long pole — Auth, Billing, Email, Custom Domains and Edge Functions all wait on this gate.

TacTile › Launch TacTile › Backend & Infrastructure › Backend API

27/33 done6 open1 open blocker

Selected taskclear

Staging has no RATE_LIMIT_DO binding — both rate limiters fail open there

DoneOwner · Vivt_6f693334

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Staging has no RATE_LIMIT_DO binding — both rate limiters fail open there** · done

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Backend API

## The brief on file

Found 2026-08-06 while trying to verify a new rate limiter on staging and getting 135 consecutive 204s where 429s were expected. Pre-existing, not introduced by the Backend API wave.

THE DEFECT
apps/api/tactile-api/wrangler.toml declares the Durable Object bindings ONCE, at
the top level (`[durable_objects]`, with RATE_LIMIT_DO = RateLimitV1). There is
no `[env.staging.durable_objects]` block — and this file inherits NOTHING into
[env.staging]: vars, KV namespaces, R2 buckets, services, routes, observability
and triggers are every one of them repeated per-env.

So the staging worker has no RATE_LIMIT_DO binding at all.

CONSEQUENCE, and it is bigger than the thing that surfaced it. Both limiters
early-return when the namespace is absent:

    const namespace = env.RATE_LIMIT_DO;
    if (!namespace) return null; // not bound in dev/CI — no-op

That is `callLimiter` in middleware/public-resolver-guard.ts. It means on staging:
  - the NEW funnel-beacon limiter (applyBeaconLimit) does nothing, and
  - the EXISTING public-resolver enumeration guard does nothing.

The second one matters more. That guard exists because the unauthenticated
hash-addressed reads return Wi-Fi passwords, Bluetooth pairing PINs, payment
handles and contact-card PII, and destination hashes are only ~44.7 bits. On
staging those endpoints have been completely unmetered — and staging shares
production's KV namespaces and its database, so it resolves REAL destinations
with REAL customer data. staging-api.tactile.to is a public hostname.

VERIFIED, not inferred:
  - `grep -n "durable_objects" wrangler.toml` → only line 119, top level.
  - `npx wrangler deploy --dry-run` (default/production env) lists
    `env.RATE_LIMIT_DO (RateLimitV1)` — production IS correctly bound.
  - 135 POSTs to staging's beacon in one burst: 135 x 204, zero 429, against a
    120/min per-ip ceiling.

FIX: add a `[[env.staging.durable_objects.bindings]]` entry for RATE_LIMIT_DO
(and check VIDEO_TRANSCODER / VIDEO_TRANSCODER_CONTAINER the same way — the same
inheritance rule applies to them and nobody has checked). Note DO class bindings
across environments need the migration tag to line up; either give staging its
own instance of RateLimitV1 or point it at the production script with
`script_name`. Decide deliberately: a shared instance means staging traffic
consumes production rate-limit budget.

THEN: re-run the burst against staging and confirm it 429s, so the next person
who tries to verify a limiter on staging gets a truthful answer.

WIDER LESSON WORTH WRITING DOWN SOMEWHERE: this wrangler.toml's non-inheritance
has now caused two separate silent staging/production divergences (SENTRY_RELEASE
was set on prod and not staging; RATE_LIMIT_DO likewise). A check that diffs the
binding sets between the two environments and fails on an unexplained difference
would have caught both.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Backend API

Staging has no RATE_LIMIT_DO binding — both rate limiters fail open there