Appearance
Ariadne / Theseus operator actions
Last updated: 23 October 2026 (OA-AT-rtls-relay done; OA-AT-maps on #148 / #164)
Single checklist of human / portal / secret-store steps for Ariadne and Theseus. The inventory and roadmap remain the source for what the work items are. This log is what a person still owes. Click-level sittings:
Keryx public launch is a separate sitting: Keryx operator close-out. Lab host packet: lab-server.md.
Do not put passwords, .p12, .p8, keystores, mobile keys, Theseus field tokens, or ntfy tokens in this file or in git. Record only where they live (secret store / keychain / portal / lab machine).
Statuses: blocking (a named GitLab close is waiting), pending (owed, not currently blocking repo work), later (named so it is not forgotten), done (verified).
How-to for the shared Wantok secret store: Keryx secret store, NAS unlock. Do not invent a second store.
Blocking now
None on Theseus stores. Next Ariadne operator work is camera-fit Internal 1.0.2 then the OA-AT-maps phone walk. #164 (camera-fit + 1.0.2). #148 stays open until that walk (reopened 17 September 2026). #162 and #163 closed 19 September 2026 (first Internal tracks).
Pending
| Id | Status | Linked item | What is owed | Where it lives (not the secret) |
|---|---|---|---|---|
| OA-AT-maps | pending | A5 / #148, #164 | Blocked 19 Sep 2026: Internal 1.0.1 shows 4. NP chrome but a white canvas (7015×4960 map, camera not fitted). Ship Internal 1.0.2 (4) from releases/ (#164), then the phone walk. Do not close #148. | Lab host + phones. Maps and mar.json not in git. |
Later
| Id | Status | What |
|---|---|---|
| OA-AT-hansel-mac-qr | later | Hansel printed-MAC / holder deploy wizard — not the walk-around confirm flow. Product does not exist. |
Done
| Id | Status | What |
|---|---|---|
| OA-AT-rtls-relay | done | 23 October 2026. rtls-relay.service on mnew.ssh (enabled, thomas, 127.0.0.1:8793), /home/thomas/rtls-relay/ with rtls-relay.env (mode 600; RTLS_RELAY_SHARED_SECRET copied on the host from bug-collector.env, never in git or chat), sudoers drop-in /etc/sudoers.d/rtls-relay, nginx location /rtls/ on the updates vhost (backup of the old file: /home/thomas/rtls-relay/setup/updates.wantok.cz.bak). https://updates.wantok.cz/rtls/health → ok; a wrong secret → 401; a 3 MB upload passes nginx; scripts/build/rtls-relay.sh --upload-only restarts it without a password, so every bun commit now deploys it. Guide. |
| OA-AT-theseus-play | done | 19 September 2026. Play Internal 2 (0.1.1) installed. Ops inbox live. Production Inactive. Temporary unreviewed package name expected. No Production. |
| OA-AT-theseus-apple | done | 19 September 2026. App ID com.sourcectl.theseus. ASC Theseus for SafeCall CZ-only, not submitted. TestFlight Internal group Friends and Family; 0.1.1 (2) installed. Ops inbox live (safecall-ops). NAS secrets/theseus/iOS/ team .p12 copies. No App Review. |
| OA-AT-ariadne-play | done | 19 September 2026. Play Internal 3 (1.0.1) installed. Phone listing com.sourcectl.ariadne (unreviewed) with Uninstall/Open (test build). Production Inactive. Temporary unreviewed title is expected — do not start Production. Never cz.wantok.ariadne. |
| OA-AT-ariadne-apple | done | 19 September 2026. App ID com.sourcectl.ariadne. ASC Ariadne Indoor Navigation CZ-only, not submitted. TestFlight Internal group Friends and Family; 1.0.1 (3) installed. 1.0.1 (2) ignored (missing Bluetooth purpose string). NAS secrets/ariadne/iOS/ team .p12 copies. No App Review. |
| OA-AT-unlock | done | Production Argon2id PHC on NAS secrets/theseus/unlock.hash (97 B, 17 September 2026 File Browser). Passphrase only in Apple Passwords (item Wantok staff passphrase @ Theseus; username wantok). PHC and passphrase not in git. Path: layer-1 unlock. Secret-free GitLab note posted 17 September 2026. #151 stays closed. |
| OA-AT-ops | done | hetest2 user safecall-ops-subscriber, read-only on topic safecall-ops only (not *). Token label safecall-ops (17 September 2026 15:52 UTC). Token value in Apple Passwords (item NTFY; username safecall-ops-subscriber; host notify.wantok.cz; Notes field, not the password field). Notes: NAS secrets/theseus/ops/token_label_notes.txt. Not on a Keryx QR. Path: ops inbox. Secret-free GitLab note posted 17 September 2026. #153 stays closed. |
| OA-AT-lab-host | done | 18 September 2026. https://safecall-lab.sourcectl.com HTTPS / 200; interactive SPA login as admin@sourcectl.com. systemd safecall-lab.service on con.ssh port 8788. JWT issuer/audience https://auth.wantok.cz. Apple Passwords items SafeCall lab admin @ safecall-lab.sourcectl.com and SafeCall lab mobile API key @ safecall-lab.sourcectl.com. Remote config/main.config.json not in git. Path: lab-server.md. #161 may close on the next origin push with Closes #161. |
| OA-AT-lab-maps-import | done | 18 September 2026. CEDR Hansel import on lab (location_id=1, 7 floors, 827 beacons). Remote server/maps/ has CEDR_4NP_deployment-map.png and Map_CEDR_4NP.png. Floor 4. NP map_id=1, end_user_path set. Rasters not in git. Skipped duplicate MAC 1C.WC zeny S1095C. Not the phone walk. #148 stays open until OA-AT-maps. |
| OA-AT-store-ids | done (source) | Source IDs are com.sourcectl.ariadne and com.sourcectl.theseus. Portal registration is OA-AT-ariadne-apple / play and OA-AT-theseus-apple / play. Never cz.wantok.ariadne. |
| OA-AT-internal-dist | superseded | Replaced by OA-AT-theseus-apple and OA-AT-theseus-play (Internal only). |