Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›iOS›iOS — Build & release·18 in this wave

Submit iOS build for reviewTo do · blocker Approve: iOS releaseTo do · blocker Rotate the leaked Supabase service_role key + provision the release iOS plistTo do · blocker Remove the simulator auto-login before releaseDone Verify App Store privacy labels match realityTo do Produce iPhone + iPad screenshotsTo do Verify in-app purchase products match Stripe/App Store ConnectTo do Full device test pass on physical iPhoneTo do Full device test pass on physical iPadTo do App Store review pre-flightTo do TacTileConnectTests bundle fails as a whole, and the live Canvas Arrange algorithm has zero coverageDone arrangeLegacy exists only to keep its own test meaningful — decide: delete both, or make it realTo do Write iOS store listing copyTo do CustomDomainViewModelTests has never run — orphaned from the test target by a now-false commentDone project.pbxproj + entitlements hygiene: 4 tests that never run, 8 phantom file refs, an unreferenced Release entitlements fileIn progress Reconcile the destination count: app shows 143, brief says 282Done Agent UI test target needs a mock server nobody starts locallyTo do tile_nfc_profiles RLS exists in production but in no migration — the migrations do not describe prodTo do

Wave

iOS — Build & release

Ship to the App Store. Fastlane already works — a successful TestFlight upload ran 2026-07-25. Store listing, review prep, and the release build are what's left.

TacTile › Launch TacTile › iOS › iOS — Build & release

4/18 done14 open3 open blockers

Selected taskclear

tile_nfc_profiles RLS exists in production but in no migration — the migrations do not describe prod

To doOwner · met_e9812756

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**tile_nfc_profiles RLS exists in production but in no migration — the migrations do not describe prod** · to do

Where it sits: TacTile › Launch TacTile › iOS › iOS — Build & release

## The brief on file

Found 2026-08-08 (round 11) while sanity-checking RLS before landing the iOS bearer-token fix. NOT a bug in the app; a drift between tracked migrations and the live database. No DDL was written — deliberately, per the round's rules (no backups, no staging DB).

THE REPO SAYS: `tile_nfc_profiles` has no policy anywhere in `supabase/migrations/`, and the table is absent from `supabase/schema.sql` entirely. (Both re-confirmed by grep this round.)

PRODUCTION SAYS OTHERWISE. Read-only catalog query against xtzqmvfhtremtmbzykeq returned RLS ENABLED plus five owner-scoped policies, every one `TO authenticated`:
  p_tile_nfc_profiles_owner_select  (r)  using (owner_account_id = auth.uid())
  p_tile_nfc_profiles_owner_insert  (a)
  p_tile_nfc_profiles_owner_update  (w)  using (owner_account_id = auth.uid())
  p_tile_nfc_profiles_owner_delete  (d)  using (owner_account_id = auth.uid())
  p_tile_nfc_profiles_owner_upsert  (*)  using (owner_account_id = auth.uid())

Query used (safe to repeat — pure SELECT against pg_class/pg_policy):
  select c.relname, c.relrowsecurity, p.polname, p.polcmd,
         pg_get_expr(p.polqual, p.polrelid),
         (select string_agg(r.rolname,',') from pg_roles r where r.oid = any(p.polroles))
  from pg_class c join pg_namespace n on n.oid=c.relnamespace
  left join pg_policy p on p.polrelid=c.oid
  where n.nspname='public' and c.relname='tile_nfc_profiles';

WHY IT MATTERS, in order:
1. Someone applied DDL to production outside the migrations directory. Whatever else that person did is also untracked. This table is the one that happened to get looked at.
2. A rebuild from migrations — a restore, a staging database, a new environment — would come up with `tile_nfc_profiles` WITHOUT RLS. That is a tenant table; every owner would read every other owner's NFC profiles. The safe-looking direction of the drift is the dangerous one.
3. It changes nothing about the round-11 iOS fix, which is why that shipped. Before it, Release sent the anon key as bearer and `anon` satisfies none of these five policies, so iOS read exactly zero NFC profiles. After it, an authenticated owner satisfies all five. Strict improvement either way.

WHAT TO DO: reconcile, do not "fix". Write a migration that captures the CURRENT production state (idempotent — `create policy if not exists`, or drop-and-recreate guarded), so the tree and prod agree and a rebuild is safe. Then ask the wider question: how many other tables are in this state? `pg_policy` vs the migrations directory is a mechanical diff and worth running once across all of public.

DO NOT change the live policies as part of this. They are correct as they stand.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

iOS — Build & release

tile_nfc_profiles RLS exists in production but in no migration — the migrations do not describe prod