Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Android›Android — Pre-submission blockers·11 in this wave

Approve: Android pre-submission blockersTo do · blocker Provision apps/android/local.properties so the Android app can reach a backendTo do · blocker GitHub Actions is off for the whole repo — billing wall fails every job in 2sDone · blocker Add launcher icon setDone Bump compileSdk and targetSdk to Play's current floorDone Produce and validate a real signed release AABDone Confirm Supabase session tokens are encrypted at restDone verify:one-contact-address is red on main — design/card-creation-flow.html publishes kaitlynn@tactile.to 14 timesDone Automate versionCode and versionNameDone Un-pin security-crypto from alphaDone Replace deprecated security-crypto with Android Keystore + migrate enrolled devicesBlocked

Wave

Android — Pre-submission blockers

Short, hard list that blocks any Play Store submission. Do these first — they are cheap and absolute.

TacTile › Launch TacTile › Android › Android — Pre-submission blockers

8/11 done3 open2 open blockers

Selected taskclear

Provision apps/android/local.properties so the Android app can reach a backend

To doOwner · met_f85c04f8Blocker

Unlocks 2Produce and validate a real signed release AAB Confirm Supabase session tokens are encrypted at rest

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Provision apps/android/local.properties so the Android app can reach a backend** · to do · blocker

Where it sits: TacTile › Launch TacTile › Android › Android — Pre-submission blockers

## Unlocks 2

- Produce and validate a real signed release AAB
- Confirm Supabase session tokens are encrypted at rest

## The brief on file

MATTHEW — this is now ONE COMMAND instead of a hand-copy, and it no longer needs you specifically. It needs 1Password to be reachable.

    bash scripts/android/provision-local-properties.sh          # add --check first for a dry run

Script built and committed 2026-09-21 (Viv): scripts/android/provision-local-properties.sh, branch chore/android-local-properties, commit 4c6e8efe. Not merged, not pushed.

WHY A SCRIPT RATHER THAN FILLING THE FILE: this row's own closing note asked for it, and it is the right call. Hand-filling fixes one laptop; the file existing on exactly one machine is the single point of failure behind every runtime QA step in this wave, and wave w_8b2fb838 (Android release automation) structurally cannot work without a reproducible path. I also deliberately did NOT write into ~/Command/tactile — that is a shared canonical checkout, so you run it there yourself.

THE DERIVATIONS, because three of the four are not a straight copy from the vault:
  · SUPABASE_REST_URL = op://TacTile/Supabase/url + "/rest/v1". The vault field is the BARE project URL — cross-checked against apps/web-mobile/.env.local.example, which maps NEXT_PUBLIC_SUPABASE_URL to that same reference. NetworkConfig.deriveProjectUrl() strips /v1 then /rest back OFF to recover the project URL, so it must be built the other direction. Trailing slashes are stripped so it cannot emit a double slash.
  · SUPABASE_ANON_KEY = op://TacTile/Supabase/anon_key. Never service_role_key — enforced by construction, since the template references only that one field.
  · TACTILE_API_BASE_URL is NOT a vault secret at all, just an environment choice. Defaults to staging per local.properties.example; override by env var for prod.
  · GOOGLE_WEB_CLIENT_ID = op://TacTile/Google-OAuth/client_id, looked up separately and non-fatal if absent.

FOUR PROPERTIES WORTH KNOWING BEFORE YOU RUN IT:
  1. It PRESERVES your existing sdk.dir. Gradle requires it and clobbering it breaks Android Studio. Only synthesised from ANDROID_HOME / ANDROID_SDK_ROOT / the default path when genuinely absent.
  2. It REFUSES TO WRITE A PARTIAL FILE. An `op read` piped straight into a writer sets an EMPTY value on auth failure, and a half-written local.properties looks configured and fails at runtime — the exact bug being fixed. Values resolve into temp files and are asserted non-empty and URL-shaped before the destination is touched; both the op-fails and op-returns-empty paths were exercised.
  3. It never prints a value, only presence and length.
  4. Idempotent — a rerun upserts the four managed keys in place, so comments and DEV_AUTOLOGIN_* survive byte for byte.

VERIFIED THROUGH THE MECHANISM, AND HONESTLY SHORT OF THE LAST MILE. 1Password went cold partway through this session — `op read` worked at the start (returned a live JWT, rc=0) and later failed with a sustained `authorization timeout`, which is a genuine failure distinct from the known `op whoami` false negative and matches you being away from Touch ID. So the script has NOT been run against real values.
What WAS proven end to end, with obviously-labelled placeholders: `./gradlew :app:assembleDebug` BUILD SUCCESSFUL (JAVA_HOME pointed at Android Studio's JBR — there is no system JDK on this machine), the generated BuildConfig carries all four fields non-empty, and the app installed and reached the SIGN-IN SCREEN on emulator Medium_Phone_API_36.1 rather than dying on the NetworkConfig guard. That is this row's acceptance mechanism, demonstrated — just not with real credentials. The placeholder file was deleted afterwards so no fake-looking config sits in the tree. Baseline confirmed the other way too: with no local.properties at all, Gradle fails immediately on "SDK location not found".
Parses under bash 3.2.57 (what macOS actually ships); verify:shell-parse passes with the script tracked — an untracked script is invisible to that scan.

TWO THINGS STILL GENUINELY OPEN:
  1. Run it with 1Password reachable, then rebuild and reinstall for the real sign-in proof. That closes this row and unblocks the on-device halves of t_62cd5815 and t_b0dcb211.
  2. GOOGLE_WEB_CLIENT_ID's field IS populated in the vault per docs/secrets/INDEX.md (set 2026-05-10, not a placeholder), but nothing in the vault says whether it is the WEB-application-type client or the Android-type one. The runbook requires the Web one, because it has to match what Supabase's Google provider validates against. That distinction only exists in Google Cloud Console, so it is a one-time eyeball. The script reports presence and flags the uncertainty rather than assuming.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Android — Pre-submission blockers

Provision apps/android/local.properties so the Android app can reach a backend