Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Android›Android — Pre-submission blockers·11 in this wave

Approve: Android pre-submission blockersTo do · blocker Provision apps/android/local.properties so the Android app can reach a backendTo do · blocker GitHub Actions is off for the whole repo — billing wall fails every job in 2sTo do · blocker Add launcher icon setDone Bump compileSdk and targetSdk to Play's current floorDone Produce and validate a real signed release AABDone Confirm Supabase session tokens are encrypted at restDone verify:one-contact-address is red on main — design/card-creation-flow.html publishes kaitlynn@tactile.to 14 timesDone Automate versionCode and versionNameDone Un-pin security-crypto from alphaDone Replace deprecated security-crypto with Android Keystore + migrate enrolled devicesTo do

Wave

Android — Pre-submission blockers

Short, hard list that blocks any Play Store submission. Do these first — they are cheap and absolute.

TacTile › Launch TacTile › Android › Android — Pre-submission blockers

7/11 done4 open3 open blockers

Selected taskclear

verify:one-contact-address is red on main — design/card-creation-flow.html publishes kaitlynn@tactile.to 14 times

DoneOwner · met_b0510563

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**verify:one-contact-address is red on main — design/card-creation-flow.html publishes kaitlynn@tactile.to 14 times** · done

Where it sits: TacTile › Launch TacTile › Android › Android — Pre-submission blockers

## The brief on file

DONE in PR #234 — and it turned out to be the smaller of two problems found in the same sweep.

FIXED: design/card-creation-flow.html published kaitlynn@tactile.to 14 times. It is sample data inside a card-preview mockup — a demo of what a USER's contact card looks like, not a TacTile contact point — and the file ALREADY uses "Jane Doe" and "Alex Doe" as its sample personas elsewhere. Switched to match, which also removes a real teammate's address from a design artifact. 9 name occurrences changed alongside for consistency.

NOT exempted in the checker. scripts/verify/one-contact-address.mjs's own comment calls ALLOWED/EXEMPT_PATHS "the seam where the rule erodes", and `jane@` is already covered by its PERSONAL regex, so no widening was needed.

THE BIGGER FIND, fixed in the same PR: the same run surfaced 8 failing unit tests that turned out to be reporting a SHIPPED defect, not test rot. Commit 9e911fa6 ("good-night: 29 safe auto-fix(es)", 2026-08-02) replaced hardcoded #FFFFFF with hsl(var(--color-primary-foreground)) across 10 files — correct in CSS, wrong wherever the value is DATA parsed as a colour.

Worst instance: packages/mcp-server/src/tools/scannability.ts, where DESIGN_TOKEN_COLORS exists solely to translate that token into hex. The auto-fix rewrote the map's VALUE to the token itself, making it an identity mapping — so qr.rate_scannability has been grading every default design C instead of A+ since 2026-08-02. Also hit apps/qr-generator/web/src/builder.ts, site/src/lib/tqr1.ts (a field named `bgHex`), and packages/agent-core/src/toolPreviews.ts. All reverted to hex; the three genuinely-CSS sites were left alone.

Plus one stale fixture: tests/unit/contact-fields-absent-vs-empty.test.ts used three arbitrary bytes as a fake JPEG, which the upload guard added in 5e20e19f now correctly rejects on its leading-byte signature check. Fixture given real JPEG magic; the route's new strictness was not touched.

RESULT: pnpm verify is 17 of 18 green. Unit suite 2674 passing, 0 failing (was 8).

STILL RED, and it is not a code change: verify:secrets-rotation — 6 critical overdue rotations (Anthropic tier_2_console_key 45d, GitHub PAT 49d, Resend 52d, Sentry 29d, Stripe live_publishable_key and live_restricted_key 32d) plus an OpenAI placeholder referenced by deployed code. Needs rotation at each provider and a 1Password write. Tracked as t_c9a11962.

WORTH A SEPARATE LOOK: the good-night auto-fixer made a substitution no human reviewer would have, in a position where the data format is load-bearing, and shipped it under the label "safe". Whatever rule generated it should not treat a hex literal as interchangeable with a CSS token without knowing whether the string is painted or parsed.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Android — Pre-submission blockers

verify:one-contact-address is red on main — design/card-creation-flow.html publishes kaitlynn@tactile.to 14 times