Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·49 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

39/49 done10 open3 open blockers

Selected taskclear

ROUND 6 · SESSION — Backend: catalog-reconciled group/family, the webhook secret done right, and two honest handler gaps

DoneOwner · ait_e0480a29

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**ROUND 6 · SESSION — Backend: catalog-reconciled group/family, the webhook secret done right, and two honest handler gaps** · done

Where it sits: TacTile › Inbox — on deck

## The brief on file

DONE 2026-08-07 — PRs #249/#250 (ancestry-verified). The webhook secret was WORSE than the web session found: a live-catalog query showed `anon` held SELECT on signing_secret too (not just authenticated), and BOTH roles could WRITE it — so an owner could overwrite their secret with a chosen constant, defeating the server's CSPRNG. Root cause worth keeping: 20260423_integrations.sql granted NOTHING (enabled RLS and stopped), so the file gives a reader no reason to think the table is reachable — the grants came from Supabase's blanket default privileges, and both the table comment and route header said "never returned via the API", true of the Worker allowlist and false of PostgREST. INDEPENDENTLY RE-VERIFIED by Viv 2026-08-07: webhook_configs and webhook_deliveries ACLs now contain only postgres + service_role; has_column_privilege false for anon AND authenticated on signing_secret (read and write); service_role intact; RLS still on. Reveal endpoint built audit-first: the disclosure counter is written BEFORE the secret is returned and a failed counter write returns 500 instead of the secret. Two silent-failure details caught: the response returns bare hex (Postgres \x syntax would have made every customer decode 33 bytes and every signature mismatch), and the audit field is `fingerprint` not `secret_fingerprint` because emitAudit redacts any key containing "secret". Item 3 (destination.edit url) was smaller than filed — PATCH /api/website/:hash always accepted url, only the proxy was missing; the round-5 parity gate immediately caught the catalog omission. Item 4 was already done in round 5 (#246) and its remaining asks are cancelled — see t_68803c02's re-scope. NOT STARTED, rolls forward: group.*/family.* (reconciliation is substantial — three group ops fail on every call, family modelled against the wrong entity; note the `reorder` mismatch is a PHANTOM, groups.ts:90-94 documents the route's deliberate absence), and the SSE doc (which round 5 established would not make the 13-type pass runnable anyway — the runner has no client-injection seam).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

ROUND 6 · SESSION — Backend: catalog-reconciled group/family, the webhook secret done right, and two honest handler gaps