Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›DevOps›DevOps Foundation·35 in this wave

Approve: DevOps FoundationTo do · blocker NEEDS MATTHEW: staging STRIPE_WEBHOOK_SIGNING_SECRETBlocked · blocker main is RED — 8 unit tests failing on origin/main, so pnpm verify cannot gate any PRDone · blocker The production account's data is 42 days stale — Analytics renders empty at any default windowBlocked · blocker MATTHEW: add db_url to the 1Password Supabase item — two RLS audits have never been runnableDone · blocker Wire apps/api test suite into CIDone Wire Playwright specs into CIDone Wire verify:swift-parity into CIDone Enable branch protection on mainBlocked Verify the staging environment is actually liveDone Web deploy workflow (manual trigger only)To do API deploy workflow (manual trigger only)To do Add post-deploy smoke test to the deploy workflowsTo do Write the rollback procedureTo do Add Sentry to iOSTo do Add Sentry to AndroidTo do Configure uptime monitoringTo do Set the three missing staging secrets on tactile-api-stagingDone Playwright is failing on main and producing no report — every run that gets a runner failsTo do Playwright job must free port 3000 BEFORE its first suite — a watchdog-killed job leaks its server and fails every later runDone Add CHANGELOG.mdTo do Automate release tagging on mainTo do Fix stale Vercel references in the observability runbookDone Add apps/api typecheck to CIDone Clean the SAST baselineTo do Flip SAST to blockingTo do Edge function deploy workflow (manual trigger only)To do Supabase migration check in CITo do Write the release procedureTo do Configure Supabase log drainTo do Centralize Cloudflare Workers logsTo do Replace console.* with structured logging in apps/apiTo do Two runners share one ~/.gradle — scope it per runner without losing the warm cacheTo do MATTHEW: CI capacity — one Mac, two runners, and a full Xcode build now runs on every pushTo do Auto-cancel queued CI runs whose head branch was deletedTo do

Wave

DevOps Foundation

Unblocked now — nothing waits on the surfaces. Wiring existing tests into CI, deploy automation, base observability.

TacTile › Launch TacTile › DevOps › DevOps Foundation

10/35 done25 open3 open blockers

Selected taskclear

NEEDS MATTHEW: staging STRIPE_WEBHOOK_SIGNING_SECRET

BlockedOwner · met_90e27a65Blocker

Staging Stripe webhooks still 500. The signing secret exists nowhere I can reach it — 1Password's Stripe.test_webhook_secret is empty and Cloudflare secrets are write-only.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**NEEDS MATTHEW: staging STRIPE_WEBHOOK_SIGNING_SECRET** · blocked · blocker

Staging Stripe webhooks still 500. The signing secret exists nowhere I can reach it — 1Password's Stripe.test_webhook_secret is empty and Cloudflare secrets are write-only.

Where it sits: TacTile › Launch TacTile › DevOps › DevOps Foundation

## The brief on file

NEEDS MATTHEW — still. Re-verified 2026-08-02 by Viv; nothing has changed since 2026-07-30 and no path around it opened up.

WHAT I RE-CHECKED TODAY (all four dead ends re-tested, none stale)
  1. op://TacTile/Stripe/test_webhook_secret — STILL EMPTY. Listed the whole Stripe
     item: live_publishable_key, live_restricted_key and live_webhook_secret are all
     populated; test_publishable_key, test_restricted_key and test_webhook_secret are
     all empty. Only the *_rotated_at stamps exist for the test fields.
  2. `wrangler secret list --env staging` on tactile-api — STILL has the misnamed
     STRIPE_WEBHOOK_SECRET and STILL has no STRIPE_WEBHOOK_SIGNING_SECRET. Confirmed
     the code side too: src/routes/billing.ts:130 reads STRIPE_WEBHOOK_SIGNING_SECRET
     and 500s at :148 without it. Cloudflare secrets are write-only so the misnamed
     value cannot be read back and copied across.
  3. Stripe API — still needs a test-mode key to list or create a test endpoint, and
     the vault has none. The only Stripe key present is the LIVE restricted key.
  4. NEW check, also a dead end: the Stripe CLI is not installed on this machine and
     there is no ~/.config/stripe/config.toml, so there is no authenticated local
     session to list or create test-mode endpoints through either.

WHAT I FIXED WHILE I WAS IN THERE (branch docs/staging-stripe-webhook-runbook,
commit e63fa8f1 — committed locally, NOT pushed)
  Step 7 of docs/runbooks/setup-staging.md — the step you would follow to create the
  endpoint that unblocks this — was still wrong in TWO ways, and would have
  reproduced this exact bug plus a new one:
    - It said to store the signing secret as STRIPE_WEBHOOK_SECRET. That is the
      original wrong name that caused this whole defect. Step 2 was corrected on
      2026-07-27 but Step 7 was missed, so the fix only half landed.
    - It gave the endpoint URL as https://staging-api.tactile.to/webhooks/stripe.
      That path does not exist. The route is /api/billing/webhook (mounted at
      /api/billing/ in src/index.ts:174, matched in src/routes/billing.ts:36). An
      endpoint created from the runbook would have posted into a 404.
  Step 7 now also names the seven event types the handler actually switches on
  (src/routes/billing.ts:224): checkout.session.completed,
  customer.subscription.{created,updated,deleted}, invoice.payment_failed,
  invoice.payment_succeeded, payment_method.attached.

SEPARATE FINDING, WORTH A LOOK — possible live key on staging
  STRIPE_SECRET_KEY *is* set on tactile-api-staging, but all three test-mode fields
  in the vault are empty, so whatever staging holds did not come from them. The only
  Stripe key in the vault is live_restricted_key. This cannot be settled from here
  (write-only secrets), but "staging should NEVER hit live Stripe" is the runbook's
  own rule at the top of Step 7. Check Developers → API keys → recently used in the
  Stripe dashboard. If staging is holding an rk_live_/sk_live_, replace it. Noted in
  the runbook at Step 7 point 3.

THE ASK — unchanged, two minutes of your time, one of two paths
  A) If a test-mode webhook endpoint already exists: Stripe Dashboard → Test mode →
     Developers → Webhooks → the staging endpoint → Reveal signing secret. Paste it
     into 1Password as Stripe.test_webhook_secret.
  B) If it does not exist: create it at
     https://staging-api.tactile.to/api/billing/webhook with the seven events above.
     Stripe shows the whsec_ once, at creation. Paste it into the same field.

  Either way I then finish in five minutes: push it as STRIPE_WEBHOOK_SIGNING_SECRET
  --env staging, delete the misnamed STRIPE_WEBHOOK_SECRET, redeploy, and verify a
  real webhook delivery returns 200 instead of 500.

STILL DELIBERATELY NOT DOING: making billing.ts accept either name. That masks a
misconfiguration in billing code, and the runbook is explicit that the name is the
thing to fix.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

DevOps Foundation

NEEDS MATTHEW: staging STRIPE_WEBHOOK_SIGNING_SECRET