Keryx dependency ownership and vendored ntfy

Approved: 25 August 2026

This document is the P1-09 ownership and compliance packet for Keryx for SafeCall dependencies and the in-repo vendored ntfy plugin. It inventories direct Dart packages, records license notes from locked versions, assigns update and vulnerability ownership, and aligns privacy-manifest expectations with Apple privacy compliance.

It does not claim that a machine SBOM or LICENSE/NOTICE archive was produced, that every transitive Gradle/CocoaPods license was enumerated, that privacy manifests are fixed or verified on a signed binary, or that CI dependency gates exist.

Purpose and non-goals

Purpose

• Establish ownership for dependency and vendored-plugin maintenance.
• Inventory direct dependencies and known privacy-impacting surfaces for store and release evidence.
• Approve update/advisory cadence and vulnerability response for launch.
• Document vendored ntfy provenance, versioning, and maintainer duties.

Non-goals

• Generating machine SBOM artifacts or packaging NOTICE into AAB/IPA.
• Wiring CI license/supply-chain gates (#112).
• Verifying every plugin privacy signature on a signed candidate (#109 / #110 / #125).
• Publishing the vendored plugin to pub.dev.
• Adding an analytics or crash SDK (prohibited at launch by P0-05).

Approved decisions

• Owner and approver: Thomas Minitsios, 25 August 2026 (P0-05 RACI).
• Vendored ntfy: in-repo, first-party-maintained path dependency keryx/vendor/ntfy at 1.0.2-keryx.1; not a pub.dev release.
• Advisory cadence: review at least quarterly (aligned with #133) and before each store submission.
• Launch gate: no known critical or high unmitigated advisory on direct dependencies or vendored ntfy at go/no-go.
• Telemetry: no analytics or crash SDK at launch (P0-05).

Direct dependency inventory

Versions below are from keryx/pubspec.lock as of this approval (25 August 2026). Re-check the lockfile before submission. Update owner for all rows: Thomas Minitsios.

Package	Locked version	Purpose	Privacy impact	License (package LICENSE)
Flutter SDK	(environment)	App framework	Platform APIs via plugins	Flutter / Dart project licenses
cupertino_icons	1.0.9	Icon font	None material	MIT
mobile_scanner	7.2.0	SafeCall QR camera scan	Camera	BSD-3-Clause
shared_preferences	2.5.5	Local config / history prefs	Device storage / UserDefaults	BSD-3-Clause (Flutter Authors)
http	1.6.0	HTTPS calls as needed	Network	BSD-3-Clause (Dart authors)
flutter_local_notifications	22.0.1	Local notification presentation	Notifications; UserDefaults (plugin manifest)	BSD-3-Clause
app_badge_plus	1.3.2	App icon badge	Badge API	MIT
ntfy (path)	1.0.2-keryx.1	Background subscribe / wake hooks	Network; prefs/UserDefaults; Android FGS/boot today; FCM/APNs when implemented	MIT (keryx/vendor/ntfy/LICENSE, Copyright 2026 Karsmiths Solutions)

Dev-only: flutter_test, flutter_lints — not shipped in release binary; owner still reviews if they affect CI trust.

Native and transitive posture

Android and iOS transitive native libraries arrive through Flutter plugins (Gradle / CocoaPods). This packet does not enumerate every transitive artifact.

Known privacy-impacting native surfaces for launch forms:

• Camera stack via mobile_scanner
• Preferences / UserDefaults via shared_preferences (+ foundation implementation) and vendored ntfy
• Notifications / badges via flutter_local_notifications and app_badge_plus
• Vendored ntfy Android service/boot receivers (to be removed or minimized per Android delivery)
• Future FCM / APNs registration via client ntfy (P1-03 / P1-04)

Full transitive license aggregation and automated SBOM generation are owned by #112 and release evidence under #125.

Store Data Safety and App Privacy answers remain play-data-safety.md and apple-privacy-compliance.md.

Privacy-manifest and SDK checklist

Align with Apple privacy compliance. Inventory status for this packet (source / pub-cache observation — not signed-archive verification):

Component	PrivacyInfo observation	Packet requirement
App-level Runner	No app-level PrivacyInfo.xcprivacy under keryx/ios/	Add before submission
Vendored ntfy	Source lists empty NSPrivacyAccessedAPITypes while using UserDefaults	Declare CA92.1 (P1-07); implement in source
shared_preferences / foundation	Hosted package ships PrivacyInfo.xcprivacy	Confirm survives packaging on signed IPA (#110)
flutter_local_notifications	iOS manifest includes UserDefaults CA92.1	Confirm on signed IPA
mobile_scanner	Darwin privacy plist present (empty accessed-API array in observed version)	Confirm camera purpose strings + packaging (#110)
app_badge_plus	iOS/macOS privacy plist present	Confirm on signed IPA
http / cupertino_icons	No native privacy manifest expected	N/A

Closing this item inventories expectations. It does not claim manifests are fixed in source or verified on a signed candidate.

Vendored ntfy ownership

Topic	Record
Path	keryx/vendor/ntfy (path dependency from keryx/pubspec.yaml)
Version	1.0.2-keryx.1 (publish_to: none)
Provenance	In-repo Keryx-maintained fork for SafeCall companion delivery. Compare to public ntfy clients as reference only; do not invent an external upstream URL in this packet.
Maintainer	Thomas Minitsios / sourcectl
License	MIT — keryx/vendor/ntfy/LICENSE (Copyright 2026 Karsmiths Solutions)
Modifications in scope	Android FCM wake + authenticated poll (perpetual dataSync FGS removed); iOS Firebase topic subscribe + poll_request / APNs hooks; SharedPreferences / UserDefaults subscription state; Dart plugin API used by Keryx
Tests	Keryx Dart tests under keryx/test/; native NtfyPolicyGate / NtfyFirebaseWake / NtfyRemoteWake tests in vendor/ntfy. Deeper CI gates → #112
Versioning	Keep *-keryx.N until a publishable package decision is made
Vulnerability response	Owner triages advisories affecting the plugin or its transitive native surface; patch the vendored tree or upgrade dependents; unmitigated critical/high blocks launch go/no-go

Update and advisory cadence

When	Action
Quarterly	Review direct deps, vendored ntfy, and known plugin advisories; record outcome with #133
Before each store submission	Re-check pubspec.lock, vendor tree, and open critical/high advisories
On advisory	Owner triages within support/escalation norms (P0-05); patch or accept risk explicitly in roadmap with review date

This packet records the process. It does not automate scanning.

Release notice and archive plan

At each release candidate, archive under store/release evidence (#125 / publishing runbook):

• keryx/pubspec.lock
• Source commit SHA
• Any machine-generated SBOM or NOTICE outputs once #112 produces them
• Signed-binary privacy reports (#110) and Play/ASC form snapshots (#125)

Public NOTICE packaging inside the binary, if required by a specific license obligation discovered in the full transitive pass, is a release artifact task — not claimed complete by closing #102.

Evidence handoffs

Evidence	Owner
Machine SBOM + CI license/supply-chain gates	#112
Implement CA92.1 + app-level privacy manifests	Later implementation (P1-07)
Production signing; AAB/IPA privacy verification	#109 / #110
Archive notices with store evidence	#125
Quarterly reviews	#133 + this owner
Apple / Play form alignment	apple-privacy-compliance.md, play-data-safety.md

Explicit non-claims

Closing #102 approves this packet. It does not:

• claim a machine SBOM or LICENSE/NOTICE zip was produced;
• claim every transitive Gradle/Pod license was enumerated;
• claim privacy manifests are fixed or signed-report-verified;
• claim CI dependency gates exist;
• claim the vendored fork is published to pub.dev.

Review record

• Status: approved as the P1-09 dependency and vendored-ntfy ownership packet.
• Date: 25 August 2026.
• Approver: Thomas Minitsios under the P0-05 RACI.
• Depends on: P0-05 ownership, apple-privacy-compliance.md, play-data-safety.md, android-delivery-architecture.md.
• Evidence sources: keryx/pubspec.yaml, keryx/pubspec.lock, keryx/vendor/ntfy/ (LICENSE, manifests, native sources), hosted package LICENSE / PrivacyInfo observations in pub-cache for locked versions.