Keryx CI (unsigned first slice)

First slice: 17 September 2026

This packet is the runner/trust model for the unsigned GitLab CI slice of #112. It does not close that issue.

How-to for enabling shared runners: OA-112-ci-enable in operator-actions.md. Commands live in .gitlab-ci.yml and scripts/test/keryx-native.ts. Cadence: test-traceability.md.

Decision

Choice	Value
Host	GitLab.com shared Linux runners on sourcecontrollers/safecall
Secrets	None. No CI variables, keystores, .p12, .p8, or KERYX_KEY_*
Trigger	Default branch and merge requests. No path filters on this slice
Jobs	keryx:dart, keryx:server, keryx:native-android
Images	ghcr.io/cirruslabs/flutter:3.44.0 (Dart 3.12 / Flutter ≥ 3.44 from keryx/pubspec.lock); oven/bun:1.4 (server)

What runs

Job	Command
keryx:dart	cd keryx && flutter pub get && flutter analyze && flutter test
keryx:server	bun install in lib/, web/, server/, and keryx-status/; cd web && bun build.ts --release; bun scripts/build/generators/embeds.ts; then cd server && bun test and cd keryx-status && bun test. Playwright browsers are not downloaded.
keryx:native-android	flutter pub get, write local.properties, then bun test:keryx-native --android (:ntfy:testDebugUnitTest). Uses the committed Gradle wrapper (keryx/android/gradlew, gradlew.bat, gradle/wrapper/gradle-wrapper.jar).

Local full native harness (Android + Swift) remains:

bun test:keryx-native

--ios is for a future macOS runner. Linux shared runners do not have Swift.

What this slice does not do

• Close #112.
• Signed AAB/IPA compile, Play/App Store secrets, or KERYX_KEY_*.
• 16 KB page-size gate, privacy-manifest report, license/advisory/SBOM.
• Swift SPM job, GitLab macOS runners, or a GLaDOS self-hosted runner.
• Playwright E2E or Ariadne bun test:contracts.

Trust model (this slice)

• Jobs are unsigned quality gates. A green pipeline is not a store artifact.
• Shared Linux runners are untrusted for secrets. Do not inject NAS material.
• keryx:server rebuilds web/build and regenerates server/src/static_embeds.ts plus server/built_migrations/ in the job workspace. Those generated trees are not store artifacts.
• The Android Gradle wrapper under keryx/android/ is source, not a signing secret. Keep it tracked so the native job does not depend on a preinstalled Gradle.
• Do not register GLaDOS as a GitLab runner in this slice.
• Report retention is GitLab job logs. Checksums for signed builds stay on NAS evidence/keryx/ from bun run release:keryx, not CI.

Signed compile, SBOM, and a documented Mac/secret model remain #112 residual.

Operator enable

1. GitLab → Settings → CI/CD → Runners: shared runners on for this project.
2. Push to master (or open an MR) and confirm three jobs start.
3. Tick OA-112-ci-enable when a default-branch pipeline is green (done 17 September 2026: pipeline 2858894786).
4. Do not paste listing copy, do not upload store binaries from CI, do not close #112.