Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›DevOps›DevOps Foundation·35 in this wave

Approve: DevOps FoundationTo do · blocker NEEDS MATTHEW: staging STRIPE_WEBHOOK_SIGNING_SECRETBlocked · blocker main is RED — 8 unit tests failing on origin/main, so pnpm verify cannot gate any PRDone · blocker The production account's data is 42 days stale — Analytics renders empty at any default windowBlocked · blocker MATTHEW: add db_url to the 1Password Supabase item — two RLS audits have never been runnableDone · blocker Wire apps/api test suite into CIDone Wire Playwright specs into CIDone Wire verify:swift-parity into CIDone Enable branch protection on mainBlocked Verify the staging environment is actually liveDone Web deploy workflow (manual trigger only)To do API deploy workflow (manual trigger only)To do Add post-deploy smoke test to the deploy workflowsTo do Write the rollback procedureTo do Add Sentry to iOSTo do Add Sentry to AndroidTo do Configure uptime monitoringTo do Set the three missing staging secrets on tactile-api-stagingDone Playwright is failing on main and producing no report — every run that gets a runner failsTo do Playwright job must free port 3000 BEFORE its first suite — a watchdog-killed job leaks its server and fails every later runDone Add CHANGELOG.mdTo do Automate release tagging on mainTo do Fix stale Vercel references in the observability runbookDone Add apps/api typecheck to CIDone Clean the SAST baselineTo do Flip SAST to blockingTo do Edge function deploy workflow (manual trigger only)To do Supabase migration check in CITo do Write the release procedureTo do Configure Supabase log drainTo do Centralize Cloudflare Workers logsTo do Replace console.* with structured logging in apps/apiTo do Two runners share one ~/.gradle — scope it per runner without losing the warm cacheTo do MATTHEW: CI capacity — one Mac, two runners, and a full Xcode build now runs on every pushTo do Auto-cancel queued CI runs whose head branch was deletedTo do

Wave

DevOps Foundation

Unblocked now — nothing waits on the surfaces. Wiring existing tests into CI, deploy automation, base observability.

TacTile › Launch TacTile › DevOps › DevOps Foundation

10/35 done25 open3 open blockers

Selected taskclear

Playwright is failing on main and producing no report — every run that gets a runner fails

To doOwner · ait_83279213

Every playwright job assigned a runner in the current window fails, including on main (push run 31970438847). No playwright-report artifact is produced, so the tests are not merely failing — they appear never to run.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Playwright is failing on main and producing no report — every run that gets a runner fails** · to do

Every playwright job assigned a runner in the current window fails, including on main (push run 31970438847). No playwright-report artifact is produced, so the tests are not merely failing — they appear never to run.

Where it sits: TacTile › Launch TacTile › DevOps › DevOps Foundation

## The brief on file

TWO OF THREE FIXED. Progress is real and measured on main (run 31979128424):
  Run Playwright             PASS
  Run Playwright (authed)    PASS
  Run Playwright (agent)     PASS   <- fixed in #504
  Run Playwright (web-mobile) FAIL  <- all that remains
Compare where this started: the Docker precondition failed and FIFTEEN steps were skipped.

WHAT #504 FIXED, and it was a LIVE PRODUCTION BUG, not a test artefact. My earlier note on
this task guessed it was pre-existing test rot and warned against copying a fix between the
two playwright configs. BOTH halves of that were wrong, and the correction matters:

  apps/web/features/agent/lib/api.ts reads the conversation id from a RESPONSE HEADER.
  apps/api/tactile-api/src/routes/agent.ts set Access-Control-Allow-Origin and
  X-Conversation-Id but NO Access-Control-Expose-Headers. A custom header on a
  cross-origin response is invisible to JS unless it is named there. Production IS
  cross-origin — tactile.to -> api.tactile.to — so res.headers.get() returned null on
  every real turn. Conversations were neither deep-linkable nor reload-survivable in
  production, for every browser user. iOS and Android were unaffected: CORS is a browser
  rule.

  #482 is what EXPOSED it: it moved the agent config from APP_ORIGIN to a closed port,
  making the harness cross-origin — i.e. making it match production. The spec had been
  passing for a reason production does not have. My "do not copy a fix between the configs"
  warning was backwards: the copy was correct, and reverting it would have re-hidden a live
  bug.

  Isolated cleanly: adding ONLY the expose header to the mock — no app or config change —
  took the suite from 1 failed/19 passed to 20 passed.

DEPLOYED. Staging first per repo policy, then production: api.tactile.to and
whitelabel.tactile.to both report release bb3d18452be5402106d81cea8ff23d5783aae6f6, which
is exactly the commit carrying the fix, and agent.ts:1320 in that tree sets the header.
NOTE the preflight legitimately does NOT show expose-headers — it belongs on the real
response, not the OPTIONS reply, so probing the preflight neither confirms nor refutes it.
The header sits on the authenticated 200 SSE response, and the 401s at agent.ts:1366/1395
return before it, so an unauthenticated probe cannot observe it. Not claimed as end-to-end
confirmed.

WHAT REMAINS: Run Playwright (web-mobile), failing on main. It was previously SKIPPED
because the agent step failed ahead of it, so it is newly visible rather than newly broken —
the same unmasking that revealed the agent bug. Diagnose it on its own evidence.
An open question worth answering first: does apps/web-mobile read the SAME
X-Conversation-Id header? If it does, it had the identical CORS defect and the identical
fix applies. That was explicitly NOT measured.

TWO FOLLOW-UPS from the same work, neither done:
  · The new CORS check has a blind spot: it only scans files that set
    Access-Control-Allow-Origin THEMSELVES, and most routes get CORS centrally via
    applyCorsHeaders. It therefore misses middleware/rate-limit.ts, which sets
    X-RateLimit-Remaining-* on centrally-CORS'd responses — likely the same defect, browsers
    cannot read those either.
  · StickerGroup's comment claimed its hand-copied list was pinned by
    tests/unit/qr-studio-sticker.test.ts. That file did not exist; the guard was a promise.
    Fixed in #504 by exporting STICKER_OPTIONS and deriving STICKER_RESOURCE from it.

STANDING LESSON, now twice-earned: read the STEP LIST before any log text. A job whose first
step fails looks identical to a suite that broke, and `gh pr checks` prints `fail` for a
job that was cancelled and never ran.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

DevOps Foundation

Playwright is failing on main and producing no report — every run that gets a runner fails