Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Auth & User Management·14 in this wave

Approve: Auth & User ManagementTo do · blocker Remove Ben Ari hardcoded credentialsDone Confirm NEXT_PUBLIC_ALLOW_BEN_ARI_LOGIN unset in productionTo do Build /forgot-password routeDone Build /reset-password routeDone Wire email verification on signupDone Build account deletion UIDone Test JWT exp + refresh lifecycleDone Wire iOS native Google sign-inTo do Sign off: the seven completed Auth flowsTo do Add MFA optionTo do Build onboarding flowDone Wire orphan auth screens into navTo do Add biometric unlock to iOS and AndroidTo do

Wave

Auth & User Management

Depends on Backend API. Two hardcoded-credential items are security-critical and should run first.

TacTile › Launch TacTile › Backend & Infrastructure › Auth & User Management

7/14 done7 open1 open blocker

Selected taskclear

Sign off: the seven completed Auth flows

To doOwner · Caitlint_ed9fab52

Unlocks 1Approve: Auth & User Management

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Sign off: the seven completed Auth flows** · to do

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Auth & User Management

## Unlocks 1

- Approve: Auth & User Management

## The brief on file

Caitlin — verify the seven Auth items marked done actually work, on iPhone, Android and web. Done when each is confirmed end to end with a real account: forgot password (email arrives, link works), reset password (new password actually logs you in), email verification on signup (including the resend path), account deletion (reachable in-app on both mobile platforms — this is an App Store and Play requirement, and the data really goes), onboarding (completes and does not re-appear on next launch), JWT refresh (leave the app idle past token expiry and confirm the session survives without a re-login), and that no Ben Ari bypass is reachable in a release build. WHY THIS EXISTS: all seven were marked done from reading code, not from anyone running them. Two specific traps to watch — the simulator auto-logs in as ben@tactile.to so auth screens must be tested on a real device or after signing out, and elsewhere in this product a save button was found that dismissed cleanly while silently discarding the change, so always re-open and confirm rather than trusting a clean dismissal.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Auth & User Management

Sign off: the seven completed Auth flows