Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Backend API·33 in this wave

Approve: Backend APITo do · blocker Implement /api/profile or remove routeDone Implement /api/uploadDone Implement destination analyticsDone Add upload size limits and file validationDone Define the API versioning strategyDone Verify all 14 destination content read endpointsDone Verify the five existing destination update endpoints workIn progress Fix the stale SENTRY_RELEASE on tactile-apiDone iOS decodes payment_destinations as an array — a latent whole-list decode failureTo do Add staging.tactile.to to the API CORS allowlistDone Emit CardSchema (not bare ActionPreview) from the 12 non-QR tool preview generatorsDone pnpm verify is red on main, and CI hides 9 more failures by excluding three test filesDone EMIT LEG: send method:\"link\" from the clients, or the Link bucket stays at zeroTo do POST /api/events/open is documented public+unauth but 401s anonymouslyDone Staging has no RATE_LIMIT_DO binding — both rate limiters fail open thereDone Mask the Wi-Fi password before it reaches agent proposal cards (blocks WifiCard)Done link_hub.ts has the identical partial-drop hole contact.ts just hadDone Add /health endpointDone Replace link-click placeholder zeroDone Verify documents/gallery/audio routes completeDone Add structured logging via pino-compatible APIIn progress Add request-id middlewareDone Add Sentry to WorkersDone Verify the four completed Backend API items in productionIn progress Build update endpoint for menu destinationsDone Build update endpoint for link_hub destinationsDone Build update endpoint for payment destinationsDone Build update endpoint for wifi destinationsDone Build update endpoint for bluetooth destinationsDone Build update endpoint for action destinationsDone Build the webhook MCP module (tools/webhook.ts) — Matthew chose SHIP over cutDone Derive per-type opIds for destination.create/edit so Website + Gallery cards can renderDone

Wave

Backend API

The long pole — Auth, Billing, Email, Custom Domains and Edge Functions all wait on this gate.

TacTile › Launch TacTile › Backend & Infrastructure › Backend API

27/33 done6 open1 open blocker

Selected taskclear

Implement /api/profile or remove route

DoneOwner · Vivt_cafddade

Unlocks 1Approve: Backend API

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Implement /api/profile or remove route** · done

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Backend API

## Unlocks 1

- Approve: Backend API

## The brief on file

DONE — VERIFIED 2026-08-03 (Viv). No code change needed: /api/profile is already implemented, so neither branch of "implement or remove" applies. The premise was accurate when the item was written on 2026-05-03 and went stale three months ago.

WHEN IT STOPPED BEING A PLACEHOLDER
  4cb8c5c9  feat(api): qr-completion routes — … profile (+tests)   ← the implementation
  3691627b  fix(agent,api): one agent path, and bind every write to the session
  781d7341  fix(profile): stop wiping profile fields on every save

WHAT EXISTS NOW
  src/routes/profile.ts, 1107 lines, serving all nine documented endpoints:
    POST   /api/profile
    PATCH  /api/profile/:hash_id
    DELETE /api/profile/:hash_id
    GET    /api/profile?owner_account_id=<uuid>
    GET    /api/profile/:hash_id            (falls through to metadata)
    GET    /api/profile/:hash_id/meta
    GET    /api/profile/:hash_id/content
    GET    /api/profile/:hash_id/{background-image,profile-picture,company-logo}
  Spec: apps/api/docs/profile-actions.md. Storage: the profiles + profile_fields
  tables plus R2 for the three asset kinds. Mounted at src/index.ts:134.

HOW I VERIFIED (not inferred)
  - Live prod: GET https://whitelabel.tactile.to/api/profile returns 401
    {"error":"Missing Bearer token."} — real auth, not a placeholder body.
  - Tests: `npx tsx --test tests/routes/profile.test.ts` → 16 tests, 16 pass, 0 fail.
    Includes the cross-tenant regression (owner mismatch → 403) and unauthenticated
    → 401. Also covered by tests/routes/cross-tenant-owner.test.ts and
    tests/routes/destructive-replace-ordering.test.ts.

THE 301 OPTION IS WRONG, NOT JUST UNNECESSARY — worth recording so nobody retries it.
The item suggested "deprecate (301 redirect to /api/account/profile)". These are two
different resources that happen to share a word:
  - /api/account/profile (routes/account.ts:23) — the signed-in user's OWN account
    record: display_name, timezone. One per user.
  - /api/profile — reusable, hash-addressed vCard CONTACT profiles. Many per owner,
    each with its own R2 assets.
iOS depends on the second one: System/Networking/ActionContentService.swift:1133-1187
and System/App/AppSession.swift:19 (profiles are seeded on sign-in). Redirecting or
removing it breaks the Contact destination.

CHECKLIST CORRECTED — branch fix/api-profile-checklist-stale, commit d5a2854b
(committed locally, NOT pushed). data/checklists/launch-readiness-checklist.json:
item api-1 → verified with the evidence above, and the "Backend API" section
description fixed, which was wrong twice over: it claimed 21 route modules (now 37
top-level, 53 .ts including the analytics/ and static/ subtrees) and called
/api/profile and /api/upload "two stub endpoints".

SEPARATE FINDING — /api/upload is NOT a stub, it does not exist
Worth its own item if anyone is counting on it. There is no routes/upload.ts, no
mount in src/index.ts, and https://whitelabel.tactile.to/api/upload returns 404.
Presigned uploads appear to be under construction in apps/upload-presigner/, which
was untracked working-tree state on 2026-08-03 and belongs to another session — I
did not touch it. Whether /api/upload should ever exist on this worker is an open
design question, not a blank to fill in.

NOT DONE, DELIBERATELY: I did not push the checklist JSON to Supabase. Supabase is
the source of truth for checklists (apps/checklist/scripts/sync.sh push) and that is
an outward write nobody asked for. Run it when convenient.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Backend API

Implement /api/profile or remove route