SafeCall Docs

Appearance

Administrator app onboarding, troubleshooting, and offboarding ​

Last updated: 13 September 2026 · English only

How a SafeCall administrator uses Keryx on their phone: install from the store, grant permissions, scan the QR, live with Active/Archive, and leave the official ntfy app when the owner accepts Keryx.

This is the #121 phone-side guide. GitLab still says “end-user”; the product model does not. The person holding the phone is a SafeCall administrator. Do not invent a separate generic end user.

It is not the Mobile Access QR-generation handbook (admin-provisioning-handbook.md, #120 closed) and not the public landing DRAFT (legal/install.md; live HTTPS is #107).

OA-121-app-walk is done (19 September 2026, iPhone TestFlight 1.3.7 (18)). Czech, live web, and store screenshots remain open. Do not close #121, #107, #108, #117, #124, or #125 from this page.

Do not put QR photos, tk_… tokens, passwords, or real client names / MAC addresses in git, chat, or tickets.

1. Who may install, and the official listing ​

  • Adult SafeCall administrators or operators for a contracted SafeCall deployment.
  • Publisher: sourcectl. Public name: Keryx for SafeCall. Launcher label: Keryx.
  • Search that name in the Czech App Store or Google Play. During soak, Internal testing / TestFlight is also this guide. Do not sideload APKs or use unofficial mirrors.
  • Downloading Keryx does not buy or provide SafeCall.

Store URLs stay in controlled records (#125). They are not pasted here.

2. Install and update ​

  1. Install Keryx for SafeCall from the store or Internal track.
  2. Open the app. You should see No notifications have been enabled yet and Scan QR code.
  3. Updates come from the same store / Internal track. Keep the current build. Internal 1.0.0+3 cannot receive the closed-app wake. First-device proof used 1.2.1 (8).

3. Permissions ​

Keryx needs Camera (to scan) and Notifications (to show alerts).

If you denied either:

  • iOS: Settings → Keryx → Camera / Notifications.
  • Android: Settings → Apps → Keryx → Permissions / Notifications.

Return to the app and try again. There is no dead-end: the scan button stays available after you restore Camera.

4. Scan the QR ​

Generate the QR on SafeCall Mobile Access (see admin-provisioning-handbook.md). Then on this phone:

  1. Tap Scan QR code.
  2. Point the camera at the Keryx QR from your Mobile Access page, not an Ariadne code and not a photo in chat.
  3. Treat the QR as a secret. Anyone who scans it can receive those categories until support revokes the credential.
  4. Do not photograph the QR into email, Slack, or tickets.

If the code is outdated, HTTP, or missing credentials, generate a new HTTPS Keryx QR on Mobile Access and scan that.

5. First alerts ​

  • After a good scan, Active is the current list. Category cards follow the cadence SafeCall already uses.
  • A lock-screen banner means the phone received a supplemental alert. Delivery is not guaranteed.
  • Marking read or Archive is local. It is not a receipt to SafeCall.
  • To prove the path from SafeCall, keep Notification pipeline tests on the QR and use Mobile Access Send test notification. That test stays quiet (priority=min). Watch/Panic Test Send is louder (urgent) and is a different control.

Swipe-away lock-screen proof on one device already landed. The full OEM/Focus matrix is #117.

6. Day-to-day ​

ControlWhat it does
ActiveUnread / current alerts
ArchiveOlder alerts you archived. Filter by category, search text, or date.
LanguageEnglish, Čeština, or System default (this phone). The gear is available before the first scan. Does not change OS permission text. Survives Reset App.
Pause notifications / Resume notificationsStops or restarts banners on this phone
Scan new QR codeReplaces this phone’s setup with a new QR
Reset AppWipes local config and history on this phone only. Does not reset language.

You do not enter a server URL or topic name. You do not tune ntfy from Keryx.

Keryx notifications are supplemental. Keep site SOPs, phone/radio, and the SafeCall web UI. Keryx is not a guaranteed emergency channel and does not use Apple Critical Alerts.

7. Android battery and iOS Focus ​

  • Launch Keryx does not keep a perpetual foreground service. If Settings still says it does, that line is stale — ignore it.
  • Force-stop / force-quit can block wake until you reopen the app.
  • OEM battery / autostart exceptions only if sourcectl asked. Do not invent a perpetual service.
  • iOS Focus / Do Not Disturb and denied notification permission can hide banners. This build uses ordinary notifications, not Critical Alerts.

8. When something fails ​

Try these before escalating. Do not paste a QR or configure a generic ntfy client.

SymptomWhat to try
Camera deniedRestore Camera (section 3), then Scan QR code again.
No bannersNotifications on; Focus/DND off for a test; confirm the app is not paused.
Scan succeeded, nothing arrivesConfirm the QR included the category you are testing. Ask whoever generated it to send the Mobile Access test with pipeline tests selected.
Android: works only while openDo not enable a perpetual foreground service. Force-stop can block wake until reopen.
iOS: silent on lock screenFocus/DND; notification permission; ordinary notifications only.
Old alerts, no new onesNetwork; Scan new QR code; cache can expire after a long offline stretch.
Version mismatchUse the current store/Internal build, not 1.0.0+3.

Host / TLS / auth / “alerts leave SafeCall but no one receives them” belongs to the SafeCall support channel and, if needed, the restricted ntfy-deployer.md packet. Do not teach ordinary administrators server URLs or tokens.

9. Privacy on this phone ​

  • The lock screen can show the full title and body. Treat the phone like any work device that displays operational text.
  • Tickets and chat may include: OS version, Keryx version (Settings), “scan worked / no banner”, time (CET/CEST).
  • Never include: QR image, tk_…, subscribe headers, raw debug JSON, client names, MACs, or room identifiers.

10. Support ​

Existing SafeCall support channel. No standalone Keryx mailbox, public status page, 24/7 desk, or emergency-dispatch SLA.

HoursTarget
Czech business hours, Monday–Friday, CET/CESTNext-business-day first response for ordinary contacts
Supported-tier core-path incidentsSame-business-day acknowledgment by the go/no-go owner when reported through SafeCall

These are support-process targets, not alert-delivery SLAs. Draft source: legal/support.md.

11. Replacement, Reset App, uninstall, offboarding ​

There is no revoke button in the app or in the SafeCall admin UI.

  1. Generate a new QR for the replacement phone and scan it there (admin-provisioning-handbook.md).
  2. Ask the SafeCall support channel to revoke the old credential. Give date, who held the phone, and categories — not the QR and not a token.
  3. If the old phone is still in hand: Reset App or uninstall after support confirms revoke.

Reset App and uninstall only wipe this phone. The old credential still receives until revoke. Offboarding is always: revoke, then reset or uninstall.

12. Leave the official ntfy app ​

Keryx replaces the official / generic ntfy app for this administrator. Until the site owner accepts Keryx, a short overlap is OK (you may see duplicates).

  1. Install Keryx, scan your QR, and confirm Active (and a lock-screen banner if you can).
  2. Keep the official ntfy app subscribed until the owner says the Keryx path is good enough — including the limitations in section 7.
  3. Then remove the official ntfy subscription / uninstall that app on this phone.
  4. Do not set host deny-all. That is OA-119-ntfy-cutover after official ntfy clients are gone site-wide.

You do not recreate topic names. Categories and the QR are the migration.

13. Managed devices (MDM) ​

Organizations may assign the same public Keryx app through Apple Business Manager, standard MDM, or managed Google Play. That is an installation channel only. You still grant Camera and Notifications and scan a SafeCall QR. Managed app configuration, injected credentials, zero-touch, and silent setup are not supported.