Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·26 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditTo do Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerTo do Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryTo do Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

18/26 done8 open2 open blockers

Selected taskclear

Agent-harness escape strings were shipping in page source — stripped, PR #167

DoneOwner · ait_d0ef2087

167 occurrences of --no-tier-delegate across 33 tracked files, including the shipped HTML of three public marketing pages. All removed, with a CI guard.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Agent-harness escape strings were shipping in page source — stripped, PR #167** · done

167 occurrences of --no-tier-delegate across 33 tracked files, including the shipped HTML of three public marketing pages. All removed, with a CI guard.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## The brief on file

DONE 2026-07-30 (Viv) — PR #167, branch chore/strip-harness-strings, commits ae95d42b +
b0866eb2.

WHAT IT WAS. "--no-tier-delegate" is an agent-harness escape string. It exists so an agent
can bypass a local tier-delegation hook on a TOOL CALL. It has no meaning to a human, none
to the compiler, and no business in this repo. Agents had been pasting it into source
comments for months.

TRUE SCOPE: 167 occurrences across 33 tracked files — not the 21 I first found, because my
grep used a partial path filter. packages/ui/src (10 files, the shared design system), the
marketing site, three applied migrations, and ten legal documents.

IT REACHED THE PUBLIC. Many .astro occurrences sat inside HTML comments, which ship to the
browser. Proven, not assumed: a baseline `astro build` had the marker in the shipped HTML of
/, /product and /qr-generator. After the strip, zero. qr-generator.astro alone had it on 90
lines.

PROOF THE STRIP CHANGED NOTHING ELSE — this mattered more than the strip:
  - Astro: full build both sides, 107 files each. Only the 3 leaking HTML pages differ, and
    every CSS and JS bundle is byte-identical. Splitting the HTML on whitespace runs: zero
    non-whitespace segments differ; the only deltas are 6 inter-element whitespace runs, and
    with no <pre>/<textarea> on any page those collapse identically. Rendered output
    unchanged.
  - TS/TSX/MJS: both versions through tsc with removeComments, emitted output compared —
    all 12 byte-identical.
  - Applied migrations: comments stripped from before and after, remainder compared with
    cmp. Byte-identical executable SQL. Editing an applied migration's executable text is
    how a repo stops being able to reproduce its own database, so this one was checked
    hardest.

A VACUOUS TEST CAUGHT AND THROWN OUT, worth remembering: the first comment-only proof used
esbuild, which segfaulted and reported "0 bytes identical" — a passing result that proved
nothing. The agent noticed and redid it with tsc rather than report the green.

THE GUARD: scripts/verify/no-harness-artifacts.mjs, wired into package.json AND into
.github/workflows/verify.yml. That second step is not optional — verify.yml enumerates each
step rather than calling `pnpm verify`, so adding a check to the chain alone does NOT put it
in CI. It walks `git ls-files`, so it sees hidden trees like .claude/ and .github/ that
ripgrep skips by default, and excludes node_modules and build output for free. Red/green
proven by introducing a temporary violation.

KNOWN_DEBT IS EMPTY. The strip branch was scoped away from docs/legal, so ten published
legal documents were initially carved out. I cleaned them separately — the marker was an
HTML comment on line 1, not legal wording, so no sign-off was required. Verified: exactly
one line removed per file, all ten removed lines are the marker, zero other lines touched.
Guard now green across 3,630 files with no carve-outs at all.

WORTH NOTING: the /legal pages published in PR #158 were NEVER exposed, because that
loader strips all HTML comments before rendering. That defence was written for the internal
DECISION markers and happened to cover a leak nobody knew about.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Agent-harness escape strings were shipping in page source — stripped, PR #167