Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›iOS›iOS — Build & release·18 in this wave

Submit iOS build for reviewTo do · blocker Approve: iOS releaseTo do · blocker Rotate the leaked Supabase service_role key + provision the release iOS plistTo do · blocker Remove the simulator auto-login before releaseDone Verify App Store privacy labels match realityTo do Produce iPhone + iPad screenshotsTo do Verify in-app purchase products match Stripe/App Store ConnectTo do Full device test pass on physical iPhoneTo do Full device test pass on physical iPadTo do App Store review pre-flightTo do TacTileConnectTests bundle fails as a whole, and the live Canvas Arrange algorithm has zero coverageDone arrangeLegacy exists only to keep its own test meaningful — decide: delete both, or make it realTo do Write iOS store listing copyTo do CustomDomainViewModelTests has never run — orphaned from the test target by a now-false commentDone project.pbxproj + entitlements hygiene: 4 tests that never run, 8 phantom file refs, an unreferenced Release entitlements fileIn progress Reconcile the destination count: app shows 143, brief says 282Done Agent UI test target needs a mock server nobody starts locallyTo do tile_nfc_profiles RLS exists in production but in no migration — the migrations do not describe prodTo do

Wave

iOS — Build & release

Ship to the App Store. Fastlane already works — a successful TestFlight upload ran 2026-07-25. Store listing, review prep, and the release build are what's left.

TacTile › Launch TacTile › iOS › iOS — Build & release

4/18 done14 open3 open blockers

Selected taskclear

Rotate the leaked Supabase service_role key + provision the release iOS plist

To doOwner · met_ab735ea6Blocker

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Rotate the leaked Supabase service_role key + provision the release iOS plist** · to do · blocker

Where it sits: TacTile › Launch TacTile › iOS › iOS — Build & release

## The brief on file

MATTHEW-ONLY — needs the Supabase dashboard. STEP 2 IS NOW DONE; only the rotation is left.

WHAT HAPPENED. apps/ios/TacTileConnect/Resources/SupabaseConfig.plist is gitignored, so it reads like a dev-machine file. It is not: it sits in Copy Bundle Resources for EVERY configuration. The plist on the build machine was REST_URL + SERVICE_ROLE_KEY with NO ANON_KEY — the inverse of SupabaseConfig.example.plist — and SupabaseClient.swift silently promoted the service-role key into the anon slot. The distribution archive at ~/Library/Developer/Xcode/Archives/2026-07-17 contains that key for production project xtzqmvfhtremtmbzykeq. Verify:
  plutil -p ~/Library/Developer/Xcode/Archives/2026-07-17/*.xcarchive/Products/Applications/*.app/SupabaseConfig.plist

DONE in #265: the anon fallback is DEBUG-only and a release build refuses a SERVICE_ROLE_KEY outright.

DONE 2026-08-08 (round 8, with your approval): the local plist is now provisioned correctly — ANON_KEY set to the publishable anon key from the Supabase dashboard, SERVICE_ROLE_KEY empty. Verified end to end: a Release build launches, signs in, loads real data, and `plutil -p` on the built .app shows SERVICE_ROLE_KEY = "". The key is out of the artifact.
  - Your previous dev plist is backed up at Resources/SupabaseConfig.plist.bak (gitignored via *.bak). DELETE IT once the key is rotated — it still contains the live service-role value.
  - Side effect to know about: DevSessionBootstrap (DEBUG-only) needs the service-role key to mint a UIV harness session and can no longer do so. It degrades gracefully (prints "no service-role key in plist; skipping"). The app falls back to the persisted Supabase session, which is what the harness now runs on.

STILL YOURS, AND STILL THE POINT:
ROTATE the service_role key for xtzqmvfhtremtmbzykeq. It is 44 days overdue in docs/secrets/secrets.config.yaml and is the sole remaining reason `pnpm verify` is 17/18 on the iOS side (the chain also lists Stripe, Sentry, Resend and Supabase-Pretender-Cloud as overdue — same pass). Assume the old value is public: it shipped in a TestFlight build. Anything else consuming it (workers, edge functions, scripts) needs the new value at the same time.

THEN the TestFlight build can be cut. Not before.

WORTH DECIDING SEPARATELY: nothing stops the next machine putting a service-role key back in that plist. The release build now refuses to launch if one is present, which is a loud failure rather than a silent leak — but a pre-archive check, or moving the key out of the bundle entirely, is the durable fix.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

iOS — Build & release

Rotate the leaked Supabase service_role key + provision the release iOS plist