Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›iOS›iOS — Build & release·18 in this wave

Submit iOS build for reviewTo do · blocker Approve: iOS releaseTo do · blocker Rotate the leaked Supabase service_role key + provision the release iOS plistTo do · blocker Remove the simulator auto-login before releaseDone Verify App Store privacy labels match realityTo do Produce iPhone + iPad screenshotsTo do Verify in-app purchase products match Stripe/App Store ConnectTo do Full device test pass on physical iPhoneTo do Full device test pass on physical iPadTo do App Store review pre-flightTo do TacTileConnectTests bundle fails as a whole, and the live Canvas Arrange algorithm has zero coverageDone arrangeLegacy exists only to keep its own test meaningful — decide: delete both, or make it realTo do Write iOS store listing copyTo do CustomDomainViewModelTests has never run — orphaned from the test target by a now-false commentDone project.pbxproj + entitlements hygiene: 4 tests that never run, 8 phantom file refs, an unreferenced Release entitlements fileIn progress Reconcile the destination count: app shows 143, brief says 282Done Agent UI test target needs a mock server nobody starts locallyTo do tile_nfc_profiles RLS exists in production but in no migration — the migrations do not describe prodTo do

Wave

iOS — Build & release

Ship to the App Store. Fastlane already works — a successful TestFlight upload ran 2026-07-25. Store listing, review prep, and the release build are what's left.

TacTile › Launch TacTile › iOS › iOS — Build & release

4/18 done14 open3 open blockers

Selected taskclear

Reconcile the destination count: app shows 143, brief says 282

DoneOwner · ait_ccdb29bb

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Reconcile the destination count: app shows 143, brief says 282** · done

Where it sits: TacTile › Launch TacTile › iOS › iOS — Build & release

## The brief on file

FIXED AND ON MAIN 2026-08-08 (round 11).

ROOT CAUSE. `SupabaseClient.request()` set both headers from one value:
    let apiKey = config.serviceRoleKey ?? config.anonKey
    request.setValue(apiKey, forHTTPHeaderField: "apikey")
    request.setValue("Bearer \(apiKey)", forHTTPHeaderField: "Authorization")
PostgREST derives the acting role from the bearer, so the client acted as the KEY, never as the signed-in user. Debug had a service-role key -> RLS bypassed -> looked perfect. Release's hardening forces serviceRoleKey nil -> bearer was the anon key -> every owner-scoped read returned nothing, rendered as an empty account. The "143 of 282" in this task's old title was that, not a counting discrepancy.

THE FIX. `apikey` keeps the project key; `Authorization` now carries the user's access token from an injectable `accessTokenProvider`, defaulted to `SupabaseAuthClient.shared.auth.session.accessToken` and guarded by `#if canImport(Supabase)`. No silent fallback: a missing session throws `SupabaseClientError.missingUserSession` rather than degrading to anon and returning a plausible-looking empty result.

RLS CONFIRMED FIRST, against the live catalog (read-only). `tile_nfc_profiles` has RLS ON with five owner-scoped policies, ALL `TO authenticated`, `using (owner_account_id = auth.uid())`. So `anon` read exactly zero rows there and an authenticated owner reads their own — the fix is a strict improvement, not a gamble. NOTE the repo/prod drift this exposed: those policies exist in production but in NO migration and the table is absent from schema.sql. Filed as t_e9812756 — a rebuild from migrations would come up with that tenant table unprotected.

GUARDS, both landed, both watched failing:
 - tests/unit/ios-supabase-bearer.test.ts (inside verify:unit -> inside gate.sh, so it actually blocks a merge). Reverted the Swift and watched it go red: "Authorization is set from `"Bearer \(apiKey)"` — it must be built from the access token".
 - SupabaseClientBearerTests.swift (3 XCTests, stubbed URLProtocol, asserts on the outgoing headers). Reverted ONLY the bearer expression so it still compiled, and watched all 3 fail on assertions, e.g. ("Bearer service-role-key-for-test") is not equal to ("Bearer user-jwt-for-test").

SEQUENCING: this had to land BEFORE the service-role rotation (t_ab735ea6). It has. Debug now exercises RLS honestly instead of bypassing it, which is the point rather than a side effect.

The observability half (a total outage no longer rendering as an empty account) landed separately and better via #290, using do/catch instead of `try?` — `try?` on the Optional-returning fetches produced a double Optional where `.some(nil)` (row absent) and `nil` (fetch threw) collapsed together, which is the same conflation this task is about.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

iOS — Build & release

Reconcile the destination count: app shows 143, brief says 282