Lanes
One lane at a time — the goal, the critical path, and the current wave of blockers.
Approve: Settings, Analytics & agent buildTo do · blockerViv — Build the analytics Compare page or gate it behind a beta flag.To doViv — Source the AI agent's model label from the actual serving model instead of a hardcoded string.DoneViv — Write real Privacy Policy content and clear it for launch.To doViv — Write real Terms of Service content and clear it for launch.To doViv — Add a branded not-found.tsx to apps/web.DoneViv — Restrict CORS on the RAG query API route.Doneme — Decide whether CSP enforcement (CSP_ENFORCE=1) is set in the production deployment environment, and confirm it before next release.To doViv — Add disabled state to 'Lock tag' and 'Password protect' toggles on trigger management, or ship the feature.To doViv — Fix or disable 'Edit Design' button on QR trigger detail.DoneViv — Finish or remove the 4 unavailable analytics widgets (geo-map, live-counter, goal-progress, ai-qa).DoneViv — Pull pricing feature bullets from shared billing config instead of hand-maintained duplicate strings.To doViv — Add route-level loading.tsx skeletons for key authenticated routes.To doViv — Restyle app/error.tsx and app/global-error.tsx to match the design system.To doViv — Consolidate the three duplicated account-deletion implementations into one.To doViv — Rename or restructure features/destinations/pages/SettingsPage.tsx to reflect that it manages workspace/account settings, not destinations.To doViv — Implement inline_lock badge rendering in the analytics Gate component.DoneViv — Replace the marketing homepage's 'Dashboard screenshot coming soon' placeholder with a real product screenshot or demo visual.To doViv — Un-skip and implement the 10 skipped Supabase auth Playwright tests.To doCaitlin — Verify desktop auth flows end-to-end: sign in (OAuth + email/password + OTP), sign up, forgot/reset password, device-trust verify-device (if flag enabled), sign out.To doCaitlin — Verify Assets feature (Triggers, Groups, Families tabs) end-to-end, including trigger detail linking/renaming/deleting and family/group management.To doCaitlin — Verify Analytics Overview, Dive, and Campaigns pages render real data correctly (Compare page tracked separately as unfinished).To doCaitlin — Verify all seven apps/web Settings pages (workspace identity, agent, custom domain, subscription, security, notifications, data) function correctly end-to-end.To doCaitlin — Verify the AI agent chat UI end-to-end (send message, receive streamed response, conversation history).To doCaitlin — Verify public destination viewers /t/[hash], /d/[hash], /n/[hash] across all destination types they support.To doA paying customer silently loses their paid blocks when the plan lookup errors — usePlan's error is never surfacedTo do
Wave
Web — Settings, Analytics & agent build
TacTile › Launch TacTile › Web › Web — Settings, Analytics & agent build
6/26 done20 open1 open blocker
Selected taskclear
Viv — Restrict CORS on the RAG query API route.
DoneOwner · Vivt_965f8517
Done when: app/api/rag/query/route.ts sends a specific allowed-origin header (or validates origin server-side) instead of access-control-allow-origin: '*' on a production endpoint. File: apps/web/app/api/rag/query/route.ts:20 (inline comment 'tighten later if needed', unchanged since 2026-04-20).
Show the prompt
To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it