Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·36 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Real scans are never recorded: nothing calls POST /api/events/openBlocked · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageDone Suppress analytics event writes for free-tier accountsDone Unify the four conflicting hash validation patternsDone Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Triage the "couldn't connect to the server" preview clusterDone Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tagsDone Public scan landing page polishTo do Replace the duplicate web hash-shape copies with one shared import once #658 or #681 landsTo do Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blankDone iOS Program NFC Tag read path rejects 7 and 8 character hashes; spec says accept 7-9Done ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode tableTo do CI gives no per-suite proof for the NDEF suites: iOS prints totals only, Android's newest main run was a Gradle cache hitTo do Fix tap_count hardcoded to 0 in NFC metadata endpointDone Add hash exhaustion alertingDone Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingDone Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsDone Close the check-then-insert race on hash claimingDone Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsDone Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failureTo do API: validate the hash shape in the four /content handlers (documents, notes, videos, audio) like destinationsPublic.ts doesTo do Android NfcWriter has no post-write read-back verify (spec 4a step 5)Done NDEF parity corpus: iOS asserts 1 of 5 vectors and no https://www. vector exists; generator and Kotlin disagree on wwwTo do ndef-format.md section 5 contradicts itself on empty + read-only; NFCTagClassifier.classify and diagnose order them oppositelyTo do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

18/36 done18 open2 open blockers

Selected taskclear

Enforce chip compatibility in code, not just docs

To doOwner · Vivt_f39945a0

Unlocks 1Approve: NFC/QR Core Pipeline

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Enforce chip compatibility in code, not just docs** · to do

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## Unlocks 1

- Approve: NFC/QR Core Pipeline

## The brief on file

[2 Oct 2026 overnight — Viv: draft PR #687 https://github.com/TacTile-dev/TacTile/pull/687 — iOS: the Program NFC Tag flow enforces the chip tier and capacity gate before it writes (iOS half); not merged, not deployed]

Viv — make the chip compatibility matrix something the code enforces. Done when: attempting to program an unsupported or insufficient-capacity chip fails with a clear, specific message before any write is attempted, and the supported-chip list lives in one place shared by iOS and Android rather than being documentation only. CONTEXT: docs/nfc/ndef-format.md is a real canonical spec covering tap-URL grammar, NDEF payload layout, chip compatibility and the programming sequence, backed by 111 unit tests — the spec work is genuinely done. The open question is whether the app checks capacity and type at runtime or just tries and fails. A tag that half-writes because the payload exceeded chip capacity is the worst outcome, since it leaves a physical object in a broken state. Files: docs/nfc/ndef-format.md, apps/ios/TacTileConnect/Features/NFCStampTest/, apps/android/.../data/nfc/

[overnight 29→30 Sep] PARTLY DONE in draft PR #658 (commit e8b6b71d); left TODO for the iOS shipped-path gate. Est. 1.5-2 h for what remains.
FOUND: the spec is real and iOS's canonical writer (NFCEncoderWriter.swift:414-452 blocked-chip gate, :611-616 capacity gate) enforces it before writeNDEF, with tests. But (1) Android had NO gate: NfcWriter.writeTag checked only Ndef.isWritable; (2) the list existed in five places nothing compared (NTAG219's removal reached the server LAST, #532); (3) the iOS flow behind the SHIPPED 'Program NFC Tag' button, NFCStampTestService (capability-gaps register gap 26), computes the chip variant and throws it away (`_ = chipVariant // retained for future use`, :183-184) and discards queryNDEFStatus's capacity (`let (ndefStatus, _, statusError)`, :187), so it enforces neither the tier nor the capacity gate.
DONE IN THE PR: docs/nfc/chip-catalog.json (the section-3 matrix, 15 chips) + tests/unit/nfc-chip-catalog.test.ts (27) holding it equal to the spec table, the server's resolveChipFamily, iOS NFCChipCatalog + NFCChipFamily.supportedFamilies, and Android NfcChipFamily/NfcWriteGate; Android NfcWriteGate (pure Kotlin) wired into NfcWriter.writeTag: MIFARE Classic and any over-capacity message are refused with a specific message before connect(). NfcWriteGateTest 11/11 under Gradle (neighbouring NFC/hash suites 41/0). Mutation-checked on both sides. COPY TO REVIEW: Android's blocked-chip message 'This tag type isn't supported. TacTile tags use NTAG213, NTAG215, or NTAG216.' is new (iOS's says 'doesn't work with iPhone', wrong on Android).
REMAINING (Swift, not touched without a simulator run): gate NFCStampTestService.processTag/writeBranch with NFCChipCatalog.Variant.tier + the capacity from queryNDEFStatus (mirror NFCEncoderWriter.swift:414-452 and :611-616); add a simulated-tag test (NFCEncoderWriterSimulatedTests has fixtures incl. capacity 40/48 and unformatted-blank); then delete the 'ios-stamptest-ignores-chip-and-capacity' entry from chip-catalog.json knownGaps (the parity test goes red until you do, on purpose).
SECOND KNOWN GAP (platform-wide, not Android's alone): a conditional chip (NTAG210/212, Ultralight EV1) registers as NTAG213 on EVERY platform because the server persists only the supported set (resolveChipFamily degrades anything else); Android additionally cannot even name one (NfcChipFamily is NTAG213/215/216 + UNKNOWN). The pre-write gate does not depend on either. Fixing it means teaching the server to store the conditional families, a product/data-model call.
NOTE the apps do not READ the JSON at runtime; it is parity-tested. Generating the Swift/Kotlin tables from it is the next step if wanted.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Enforce chip compatibility in code, not just docs