Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Workers & Durable Objects·6 in this wave

Approve: Workers & Durable ObjectsTo do · blocker Add per-account rate limit Durable ObjectDone Document VideoTranscoderContainerV3 deploymentDone Add retry logic to VideoTranscoder.notifyCompletionDone Worker tail log aggregationTo do Mirror whitelabel.tactile.to custom domain in wrangler.toml routesDone

Wave

Workers & Durable Objects

Edge compute — rate limiting, video transcoding, log aggregation. Depends on Database.

TacTile › Launch TacTile › Backend & Infrastructure › Workers & Durable Objects

4/6 done2 open1 open blocker

Selected taskclear

Add per-account rate limit Durable Object

DoneOwner · Vivt_cce66f34

Unlocks 1Approve: Workers & Durable Objects

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Add per-account rate limit Durable Object** · done

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Workers &amp; Durable Objects

## Unlocks 1

- Approve: Workers &amp; Durable Objects

## The brief on file

Viv — build the per-account rate limiting Durable Object. Done when: write endpoints are throttled per account rather than per IP, limits are tier-aware, exceeding a limit returns 429 with a Retry-After header, and the limits are documented. WHY A DURABLE OBJECT AND NOT MIDDLEWARE: rate limiting needs consistent state across Cloudflare's edge, and a DO gives you one authoritative counter per account instead of per-colo counters that can each let the limit through. This is the mechanism behind the Security wave's "Per-account rate limiting on write endpoints" task — that one is the requirement, this is the implementation, so do this first. Also relevant: the public scan resolver needs rate limiting too (tracked in NFC/QR Core Pipeline) and it may be able to reuse this. File: apps/api/tactile-api/src/index.ts (Durable Object registration), apps/api/tactile-api/wrangler.toml (DO binding + migration)

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Workers &amp; Durable Objects

Add per-account rate limit Durable Object

Workers & Durable Objects