SafeCall Docs

Appearance

Theseus operator close-out ​

Last updated: 19 September 2026 (Internal tracks done; no remaining store work)

Click-level playbook for Theseus for SafeCall only. Wantok-internal. Not the Keryx public launch. Keryx sitting: operator-closeout.md. Ariadne sitting: ariadne-operator-closeout.md. Status log: operator-actions.md.

GitLab: #163 closed 19 September 2026 (Internal tracks). Milestone Theseus Wantok access. Never Keryx public launch.

Do not put passwords, PHCs, tk_…, .p12, or keystores in this file or in git.

Scoreboard ​

  • [x] OA-AT-unlock (17 September 2026)
  • [x] OA-AT-ops (17 September 2026)
  • [x] OA-AT-theseus-apple — TestFlight Internal 0.1.1 (2) (19 September 2026)
  • [x] OA-AT-theseus-play — Play Internal 2 (0.1.1) (19 September 2026)
  • [ ] OA-AT-hansel-mac-qr — later; product does not exist

No remaining Theseus Internal-store operator work.

OA-AT-unlock — Theseus production PHC ​

Status: done 17 September 2026. Skip this chapter. Next is OA-AT-ops.

Log: Ariadne / Theseus operator actionsHow-to: layer-1 unlockIssue: #151 (code already landed; NAS file is now present) Machines: GLaDOS + NAS. Time box: 15 min.

Gate: none.

  1. In Apple Passwords, create (or open) a long random Wantok staff passphrase for Theseus. Not theseus-dev. Do not paste it into git or chat.
  2. From the safecall repo:
bash
 cd theseus
 dart run tool/hash_unlock.dart

Type the passphrase, then newline. Stdout is the PHC string only ($argon2id$v=19$m=…). 3. Copy stdout only to NAS /srv/sourcectl/secrets/theseus/unlock.hash (File Browser or SFTP). One line, no passphrase. 4. Confirm a debug Theseus still unlocks with public theseus-dev (unchanged). Do not put the production PHC in a debug run.

Verify

  • [x] NAS file exists (secrets/theseus/unlock.hash, 97 B, 17 September 2026)
  • [x] Passphrase is only in Apple Passwords (item Wantok staff passphrase @ Theseus; username wantok)
  • [x] Production PHC is not in git (file lives on the NAS only)

Evidence: NAS secrets/theseus/unlock.hash. Do not reopen #151. Tick log: OA-AT-unlock → done. GitLab: Secret-free note posted 17 September 2026. Stay closed.

Forbidden: Echoing the passphrase; committing unlock.hash; shipping kReleaseMode without --dart-define=THESEUS_UNLOCK_HASH=… later.

OA-AT-ops — Theseus safecall-ops subscribe token ​

Status: done 17 September 2026. Skip this chapter. Apple and Play Internal chapters below are also done. Remaining Theseus operator work is only OA-AT-hansel-mac-qr (later; product does not exist).

Log: Ariadne / Theseus operator actionsHow-to: ops inbox, ntfy auth dual-run Part B Issue: #153Machines: hetest2 + NAS + Apple Passwords. Time box: 20 min.

Gate: none. Dual-run read-write default may stay. Do not apply deny-all.

  1. SSH to the notify host (ihetest2). ntfy needs sudo here (/etc/ntfy/server.yml is not world-readable). Create a dedicated user. Do not reuse safecall-token-manager.

    bash
    sudo ntfy user add safecall-ops-subscriber
sudo ntfy access safecall-ops-subscriber "safecall-ops" read-only
sudo ntfy user list
sudo ntfy token add --label="safecall-ops" safecall-ops-subscriber
sudo ntfy token list safecall-ops-subscriber

    Quote the topic name. Confirm user list shows read-only on safecall-ops only (not *).

  2. Put the tk_… value in Apple Passwords. Put host, username, and token-label notes only on NAS secrets/theseus/ops/token_label_notes.txt.

  3. Confirm the token is subscribe-only on safecall-ops. Do not grant write. Do not put this topic on a Keryx QR. Publish stays server_ntfy_ops_* on the SafeCall box.

Verify

  • [x] User safecall-ops-subscriber; ACL safecall-ops read-only (not *)
  • [x] Token label safecall-ops; notes on NAS secrets/theseus/ops/token_label_notes.txt; token value only in Apple Passwords (item NTFY; username safecall-ops-subscriber; Notes field, not the password field)
  • [x] No tk_… in git or GitLab

Evidence: NAS notes file. Do not reopen #153. Tick log: OA-AT-ops → done. GitLab: Secret-free note posted 17 September 2026. Stay closed.

Forbidden: Putting safecall-ops on a Keryx QR; anonymous Theseus subscribe; using a Keryx subscribe_auth as ops auth.

OA-AT-theseus-apple — Theseus TestFlight Internal ​

Same clicks as Ariadne. Differences are named below.

Issue: #163Gate: OA-AT-unlock and OA-AT-ops are done.

Progress 19 September 2026: done. TestFlight 0.1.1 (2) installed. Ops inbox shows live safecall-ops messages (not “Ops not configured”). No Submit for Review.

1. App ID ​

Identifiers → + → App IDs → App.

  • Description: Theseus
  • Explicit bundle ID: com.sourcectl.theseus
  • Capabilities: nothing extra. No Push.

If Apple refuses the string: stop and paste the error. Do not invent com.sourcectl.theseusapp.

Paste: Identifiers list with com.sourcectl.theseus.

2. ASC app — done 19 September 2026 ​

Skip. App Theseus for SafeCall exists. Pricing and Availability: Czech Republic Available on App Release; others Not Available. Do not Submit for Review.

3. Distribution .p12 (same team file, new folder) ​

This is a copy of the Keryx file. Same bytes, same export password. Do not mint a new certificate. Do not re-run security find-identity unless Keychain lost Apple Distribution for 8P59575P2K (already confirmed during Ariadne).

  1. Open File Browser: http://192.168.178.213:8080.
  2. Open secrets/keryx/iOS/.
  3. Confirm keryx-apple-distribution-glados-8P59575P2K.p12 is there.
  4. If secrets/theseus/iOS/ is missing: open secrets/theseus (the folder already has unlock.hash) → New Folder → iOS.
  5. Copy keryx-apple-distribution-glados-8P59575P2K.p12 into secrets/theseus/iOS/.
  6. Rename the copy to theseus-apple-distribution-glados-8P59575P2K.p12.

Optional: copy keryx-apple-distribution-minivan-8P59575P2K.p12 the same way, rename to theseus-apple-distribution-minivan-8P59575P2K.p12.

  1. Open theseus/ios/Runner.xcworkspace (workspace, not .xcodeproj).
  2. Left sidebar: Runner target (not the project).
  3. Signing & Capabilities.
  4. Team: SOURCE CONTROL SINGLE MEMBER P.C. (8P59575P2K). Not the personal team 79UF8SKVMS.
  5. Automatically manage signing: on.
  6. Bundle Identifier: com.sourcectl.theseus.
  7. Do not click + Capability. No Push.

Paste: File Browser listing of secrets/theseus/iOS/ showing the filename (do not open the .p12), plus Signing & Capabilities with team 8P59575P2K and bundle com.sourcectl.theseus.

4. Theseus Play keystore + Play app — done 19 September 2026 ​

Skip. Keystore on NAS. Play Theseus for SafeCall exists. Production Inactive, countries Czechia Targeted (1). Do not click Create new release on Production.

5. Load secrets into the shell — binaries exist, do not re-run ​

releases/theseus.aab and releases/Theseus.ipa are 0.1.1 (2). Skip bun release:theseus. That command already bumped the version.

bash
ls -l releases/Theseus.ipa releases/theseus.aab

Paste: that ls -l (already produced 19 September 2026: IPA ~20.7 MB, AAB ~60.1 MB). Never env values.

6. Transporter ​

Drag /Users/tmin/Code/active/safecall/releases/Theseus.ipa. Bundle com.sourcectl.theseus. Deliver.

Paste: Transporter Delivered.

7. TestFlight Internal ​

  1. App Store Connect → Apps → Theseus for SafeCall → TestFlight.
  2. Wait until 0.1.1 (2) is no longer Processing.
  3. If Manage Compliance / Missing Compliance appears:
    • Uses encryption: Yes
    • Exempt (HTTPS/TLS only, EAR Category 5 Part 2): Yes
    • Other cryptography: No
    • Save
  4. Internal Testing. Group App Store Connect Users (create it if missing). Add yourself. Add build 0.1.1 (2).
  5. Do not create External Testing. Do not Submit for Review.

Paste: Internal Testing with 0.1.1 (2); not Processing.

8. Install and unlock ​

  1. TestFlight → install Theseus.
  2. Unlock with the Wantok staff passphrase @ Theseus item. Not theseus-dev.
  3. Open the ops inbox. It must not say Ops not configured.

Paste: Theseus unlocked, ops inbox with any list or empty-state that is not “Ops not configured”. No passphrase.

Verify

  • [x] Internal IPA installed (0.1.1 (2), 19 September 2026)
  • [x] Production PHC used at build (ops inbox live)
  • [x] No public listing / no Submit

Evidence: NAS evidence/ariadne-theseus/YYYY-MM-DD-oa-at-theseus-apple.txt. Tick log: OA-AT-theseus-apple → done (19 September 2026). GitLab: #163 closed 19 September 2026. Forbidden: Public App Store; theseus-dev in a store build.

OA-AT-theseus-play — Theseus Play Internal ​

Same clicks as Ariadne Play. New keystore. Do not copy Ariadne’s or Keryx’s .jks.

Issue: #163

Progress 19 September 2026: done. Internal 2 (0.1.1) rolled out. Android install unlocked; ops inbox live. Production Inactive. Temporary unreviewed package name is expected.

1. Create the keystore on GLaDOS ​

In Terminal, from /Users/tmin/Code/active/safecall:

bash
cd theseus/android
keytool -genkey -v \
  -keystore upload-keystore.jks \
  -storetype JKS \
  -keyalg RSA \
  -keysize 2048 \
  -validity 10000 \
  -alias upload \
  -dname "CN=Theseus for SafeCall, OU=Theseus, O=SOURCE CONTROL SINGLE MEMBER P.C., C=GR"
cd ../..

keytool asks for a keystore password, then the same password again, then a key password. Use the same password for store and key. Put that password in a new Apple Passwords item named Theseus Android upload keystore @ GLaDOS. Do not reuse the Keryx or Ariadne keystore password items.

Paste: Terminal line generated 2,048 bit RSA key pair / keystore saved as upload-keystore.jks. No password text.

2. Create key.properties ​

bash
cp theseus/android/key.properties.example theseus/android/key.properties

Open theseus/android/key.properties and fill only the two password lines. Leave alias and storeFile as in the example:

properties
storePassword=<the password you just typed>
keyPassword=<the same password>
keyAlias=upload
storeFile=../upload-keystore.jks
bash
git check-ignore -v theseus/android/key.properties theseus/android/upload-keystore.jks

Both must print an ignore rule. Never git add them.

Paste: git check-ignore output. Not the file contents.

3. Copy both files to the NAS ​

  1. File Browser: http://192.168.178.213:8080.
  2. If secrets/theseus/android/ is missing: open secrets/theseus → New Folder → android.
  3. Upload from GLaDOS:
    • /Users/tmin/Code/active/safecall/theseus/android/upload-keystore.jks
    • /Users/tmin/Code/active/safecall/theseus/android/key.properties

Paste: File Browser listing of secrets/theseus/android/ showing those two filenames.

4. Create the Play app ​

  1. Open Play Console.
  2. Create app.
  3. App name: Theseus for SafeCall.
  4. Default language: English.
  5. Type: App.
  6. Free or paid: Free.
  7. Check Developer Program Policies, US export laws, and Play App Signing Terms of Service.
  8. Create app.
  9. Left menu Grow users → Store presence → Store settings.
  10. App category: Business. Save.
  11. Test and release → Testing → Internal testing → countries: Czech Republic only.

Do not click Production Create new release.

Paste: Dashboard Theseus for SafeCall; countries CZ only.

5. Build if needed — skip ​

releases/theseus.aab exists (0.1.1 (2)). Do not run bun release:theseus.

6. Internal release ​

  1. Play Console → Theseus for SafeCall.
  2. Test and release → Testing → Internal testing.
  3. Create new release.
  4. Upload /Users/tmin/Code/active/safecall/releases/theseus.aab.
  5. Confirm package com.sourcectl.theseus.
  6. Release name can be First Internal AAB.
  7. Save → Review and roll out / Roll out to Internal testing.

Do not open Production → Start rollout. If Play blocks behind a privacy-policy URL: stop and paste that card.

Paste: Internal testing release rolled out. Package com.sourcectl.theseus.

7. Testers and install ​

Add the lab Android Google account. Open the opt-in URL on that phone. Install Theseus for SafeCall from Play. Unlock with Wantok staff passphrase @ Theseus. Ops inbox must not say Ops not configured.

Paste: Play install + unlocked Theseus (no passphrase). Production track Inactive.

Verify

  • [x] Package com.sourcectl.theseus (Internal AAB 2 / 0.1.1)
  • [x] Internal AAB installed (19 September 2026)
  • [x] Production Inactive (19 September 2026)

Evidence: NAS evidence/ariadne-theseus/YYYY-MM-DD-oa-at-theseus-play.txt. Tick log: OA-AT-theseus-play → done (19 September 2026). GitLab: #163 closed 19 September 2026. Forbidden: Public Play Production.

OA-AT-hansel-mac-qr — Printed-MAC / holder deploy wizard ​

Who: Operator, only after a product ships. Log: Ariadne / Theseus operator actionsHow-to: inventory (Hansel front/deploy.js); Theseus T7 BLE confirm is not this wizard Product: does not exist in safecall.

Gate: A printed-MAC / holder-QR product must ship first (Theseus or web). If it does not exist, stop. Walk-around beacon confirm (T7) does not tick this row.

Intended operator flow (when the wizard exists):

  1. Print or display Hansel-style MAC / holder QRs for lab beacons.
  2. Open the deploy wizard (not Ariadne navigation, not T7 map-tap confirm).
  3. Scan each printed code, attach to the SafeCall beacon row, verify the holder mapping on the lab box.
  4. NAS pass/fail. Do not commit QR photos.

Verify (only after the product exists)

  • [ ] Wizard is in a Wantok-internal build
  • [ ] At least one printed MAC / holder QR mapped on the lab install
  • [ ] Distinct from T7 walk-around confirm

Evidence: NAS evidence/ariadne-theseus/YYYY-MM-DD-oa-at-hansel-mac-qr.txt. Tick log: only then. Until the product exists, leave later. GitLab: none until the product exists.

Forbidden: Ticking this from T7 walk-around confirm.