Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·23 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageTo do Suppress analytics event writes for free-tier accountsTo do Unify the four conflicting hash validation patternsTo do Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Public scan landing page polishTo do Fix tap_count hardcoded to 0 in NFC metadata endpointTo do Add hash exhaustion alertingTo do Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingTo do Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsTo do Close the check-then-insert race on hash claimingTo do Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsTo do Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

4/23 done19 open1 open blocker

Selected taskclear

Rate-limit and cache the public scan resolver

To doOwner · Vivt_8081b908

Unlocks 1Approve: NFC/QR Core Pipeline

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Rate-limit and cache the public scan resolver** · to do

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## Unlocks 1

- Approve: NFC/QR Core Pipeline

## The brief on file

Viv — protect and speed up the public scan path. Done when: /t/[hash] and the public type resolver are rate-limited per IP, hash resolution is cached so a repeat scan does not hit Supabase every time, and both are verified under load. WHY: this endpoint must stay unauthenticated by design — anyone who taps a tag hits it — which makes it the product's most exposed surface, and combined with low hash entropy it is the enumeration vector. It is also the hottest path in the product, so caching is both a cost and a latency win. Coordinate with the existing 1M-event load test task rather than duplicating it. Files: apps/web/app/t/[hash]/route.ts, apps/api/tactile-api/src/routes/destinationsPublic.ts

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Rate-limit and cache the public scan resolver