Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Auth & User Management·14 in this wave

Approve: Auth & User ManagementTo do · blocker Remove Ben Ari hardcoded credentialsDone Confirm NEXT_PUBLIC_ALLOW_BEN_ARI_LOGIN unset in productionTo do Build /forgot-password routeDone Build /reset-password routeDone Wire email verification on signupDone Build account deletion UIDone Test JWT exp + refresh lifecycleDone Wire iOS native Google sign-inTo do Sign off: the seven completed Auth flowsTo do Add MFA optionTo do Build onboarding flowDone Wire orphan auth screens into navTo do Add biometric unlock to iOS and AndroidTo do

Wave

Auth & User Management

Depends on Backend API. Two hardcoded-credential items are security-critical and should run first.

TacTile › Launch TacTile › Backend & Infrastructure › Auth & User Management

7/14 done7 open1 open blocker

Selected taskclear

Add MFA option

To doOwner · Vivt_beb6f0a8

Post-launch acceptable — deliberately NOT gating the approval gate.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Add MFA option** · to do

Post-launch acceptable — deliberately NOT gating the approval gate.

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Auth & User Management

## The brief on file

Viv — add multi-factor authentication as an optional account setting. Done when: a user can enrol a TOTP authenticator, is challenged for it on sign-in, and can recover access if they lose the device. Confirmed absent by code read — no multiFactor, mfa.enroll or TOTP code anywhere in apps/, so there is nothing partial to build on; Supabase Auth supports MFA natively, so this is enrolment plus challenge UI rather than a from-scratch implementation. DELIBERATELY NON-BLOCKING: this task is intentionally not wired to the Auth approval gate, so it will never hold up launch. Treat it as post-launch-acceptable unless Matthew says otherwise. Files: apps/ios/TacTileConnect/System/Auth/, apps/android/.../data/auth/, apps/web/features/auth/

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Auth & User Management

Add MFA option