SafeCall Docs

Appearance

Internal TestFlight (first upload) ​

This page is the operator how-to for the first internal TestFlight of Keryx for SafeCall. Policy and the rest of the release loop stay in Publishing Keryx. This page is how to stand up Internal Testing for the recorded pipeline IPA.

OA-124-testflight is done (10 September 2026): operator installed Keryx from Internal TestFlight. Keep this page as the how-to for the next IPA. Do not close #124 — full soak, Play Closed testing, and tester approval remain on that issue.

Do not put passwords, .p12, .p8, app-specific passwords, or App Store Connect API keys in this file or in git.

Purpose and non-goals ​

Purpose

  • Upload the next Internal IPA. Last installed build is 1.0.0+3. The closed-app FCM candidate is GLaDOS 1.2.0+7.
  • Answer first-upload export-compliance questions using the approved HTTPS-only exemption if this binary still asks.
  • Attach the processed build to Internal Testing and install it from the TestFlight app on a supported device. 1.0.0+2 was the first Internal install (megaphone mark); do not treat it as the working-loop candidate.

Non-goals

  • Pasting listing copy, screenshots, privacy nutrition labels, age rating, or Data Safety forms (#125).
  • Creating External TestFlight, inviting public email testers, or submitting Beta App Review.
  • Submitting the app for App Review or changing Czech Republic–only availability.
  • Play production promotion. First Play Internal install is recorded on OA-124-play-internal (ntfy-auth-and-play-internal.md).
  • Storing the APNs .p8, configuring Firebase, or client ntfy upstream (#119).
  • Closing the P4 device / soak matrix (#117 / #124).
  • Rebuilding with bun run release:keryx unless the recorded 1.0.0+3 IPA is gone. Do not upload superseded 1.0.0+1 (shield mark) or treat 1.0.0+2 as the working-loop candidate.

Killed-state delivery cannot pass yet: the iOS callback still discards the APNs token. An Internal install still satisfies OA-124-testflight.

Already true ​

Confirm these before opening Transporter. Do not create a second app record.

ItemValue
App Store Connect appKeryx for SafeCall (iOS 1.0, Prepare for Submission)
AvailabilityCzech Republic only (Available on App Release)
Team8P59575P2K (SOURCE CONTROL SINGLE MEMBER P.C.)
Bundle IDcom.sourcectl.keryxapp
Version / build1.0.0+3 — App Store Connect shows 1.0.0 (3) after upload
Pipeline commitEvidence HEAD 9dbd1d49; IPA includes uncommitted working-loop sources
IPA SHA-2567592a1b537f424c31b186d3d1b6372da395a8484d6e129f88f08c3bfd6e0d517
NAS evidenceevidence/keryx/ copy of local keryx/build/release-evidence/1.0.0+3.txt
Default IPA pathkeryx/build/ios/ipa/keryx.ipa (first *.ipa in that directory)

Pricing base Greece (EUR) is the price list, not store availability. EU trader is OA-114-eu-trader, not this page.

If File Browser shows an empty evidence/ tree after a NAS reboot, unlock first: nas-unlock.md.

1. Agreements ​

Uploads fail closed if the Free Apps agreement is unsigned.

  1. Open App Store Connect with an Apple ID that is on team 8P59575P2K (Account Holder, Admin, or App Manager).
  2. Open Agreements, Tax, and Banking (or Business).
  3. Confirm Free Apps (and Paid Apps, if listed) show Active / Accepted.
  4. If a banner asks you to review terms, accept it before uploading. Do not record legal-entity addresses or tax IDs in git.

Least-privilege role review stays on OA-114-apple-org. You only need a role that can deliver a build.

2. IPA in hand ​

Prefer the GLaDOS 1.2.0+7 FCM-candidate IPA. Do not upload the installed-loop 1.0.0+3 IPA (7592a1b5…), the superseded 1 September 1.0.0+1 IPA (68ac735b…), the first Internal 1.0.0+2 IPA (c93492ec…), the 30 August GLaDOS IPA (353be9df…), or the MiniVan-3 recovery IPA (a924af76…).

  1. On GLaDOS, confirm the file exists:

    bash
    ls -l keryx/build/ios/ipa/*.ipa
shasum -a 256 keryx/build/ios/ipa/keryx.ipa

  2. The SHA-256 must be 3e5b93a9ef1d16d6372336a046fb49730491d8335c764f039d5b09db068a9faa (same as keryx/build/release-evidence/1.2.0+7.txt, 1.2.0 (7)). Do not rebuild unless that IPA is gone (a new binary gets a new SHA).

  3. If the local IPA is missing, copy it back from the Mac scratch ~/sourcectl/keryx-release-evidence/ or rebuild. A new binary gets a new SHA; record it in NAS evidence/keryx/ before upload.

  4. If you recopied the file from NAS or another Mac, re-verify:

    bash
    bun run verify:keryx-ipa -- --expect-team=8P59575P2K

    Expect team 8P59575P2K, bundle com.sourcectl.keryxapp, and aps-environment=production.

Signing identity and ExportOptions: ios-signing.md.

3. Upload (Transporter) ​

Preferred path on GLaDOS. Transporter delivers an already-exported IPA. Do not invent altool, notarytool, or an App Store Connect API key for this pass.

  1. Install Transporter from the Mac App Store if it is missing.
  2. Open Transporter. Sign in with the same Apple ID you used in step 1.
  3. Drag keryx/build/ios/ipa/keryx.ipa onto the window (or Add).
  4. Confirm the displayed bundle is com.sourcectl.keryxapp and version 1.2.0 (7).
  5. Click Deliver. Wait until Transporter shows Delivered.
  6. Delivery means Apple accepted the file. It does not mean TestFlight processing finished.

Alternative: Xcode Organizer ​

Use this if Transporter cannot sign in and an archive is still on the Mac.

  1. Open keryx/ios/Runner.xcworkspace (the workspace, not the .xcodeproj).
  2. Window → Organizer → Archives.
  3. Select the Keryx / com.sourcectl.keryxapp archive that matches 1.2.0 (7) if it is still listed.
  4. Distribute App → App Store Connect → Upload. Team 8P59575P2K.
  5. Do not create a new archive unless the recorded IPA and the Organizer archive are both gone.

4. Processing ​

  1. In App Store Connect open Apps → Keryx for SafeCall → TestFlight.
  2. Under iOS Builds, wait until 1.2.0 (7) leaves Processing. This often takes 5–30 minutes; the first build can take longer.
  3. Refresh until the build is selectable. Do not treat Processing as a candidate.
  4. Open the build and read every yellow warning. Resolve or record each one before Internal Testing.
  5. CocoaPods 1.16.2 was already seen on earlier IPAs. It is not #110 and does not block this upload. The default Flutter launch image was replaced in 1.0.0+2 (OA-launch-image done).
  6. A red Invalid Binary or signing error is a stop. Do not push a Play production rollout or paste listings to “work around” it.

5. Build export-compliance questions ​

The first upload usually shows Missing Compliance until you answer encryption questions. Use the approved P1-07 answer. Do not fill the App Privacy nutrition label here — that is #125.

From apple-privacy-compliance.md: Keryx only uses operating-system / HTTPS (TLS) encryption to reach the client ntfy host. No proprietary or non-exempt cryptography at launch.

In App Store Connect, on build 1.2.0 (7):

  1. Open the Manage Compliance / export-compliance prompt.
  2. If asked whether the app uses encryption: Yes (HTTPS/TLS).
  3. If asked whether it qualifies for the U.S. EAR Category 5 Part 2 exemption (or “standard encryption” / HTTPS-only): Yes.
  4. If asked whether you are using any encryption other than HTTPS/TLS or OS-provided crypto: No.
  5. Save. The build should leave Missing Compliance.

Info.plist does not set ITSAppUsesNonExemptEncryption. Do not add that key in this pass just to hide the questionnaire.

Reconfirm only if a later binary adds custom crypto.

6. Internal Testing group ​

Internal TestFlight is limited to people who already have App Store Connect access (Account Holder, Admin, App Manager, Developer, or Marketing). It is not a public email invite list. Apple’s cap is 100 internal testers.

  1. Stay on Apps → Keryx for SafeCall → TestFlight.
  2. Open Internal Testing. The default group is App Store Connect Users. Create a group only if none exists; do not create an External group.
  3. Testers → +. Add yourself and any other ASC users who should install this build. If a person is missing, add them first under Users and Access with a least-privilege role, then return here.
  4. Do not enable External Testing, public links, or Submit for Review (Beta App Review).

7. Enable the build ​

  1. In the Internal group, select build 1.2.0 (7).

  2. If Automatic Distribution is offered, turn it on so new Internal testers receive this build.

  3. What to Test may be a short internal note only, for example:

    Internal TestFlight of 1.2.0+7 (FCM/APNs closed-app candidate). Confirm scan from Mobile Access, then swipe-away lock-screen banner on a high-priority alert. Delivery soak remains GitLab #124.

    Do not paste store listing copy, keywords, or screenshots.

  4. Save. Testers should get a TestFlight notification or email.

8. Install ​

Supported floor: iOS / iPadOS 17+ (P0-04). Source may still compile against an older minimum; that is not a support promise.

  1. On a supported iPhone or iPad, install TestFlight from the App Store.
  2. Sign in with the same Apple ID you added as an Internal tester.
  3. Accept the Keryx invite (banner, email, or the TestFlight app list).
  4. Install Keryx. Confirm the TestFlight detail shows version 1.2.0 and build 7. Confirm the home-screen icon is the white megaphone on navy, not the earlier shield.
  5. Launch, scan the generated Keryx QR from SafeCall Mobile Access, and send a test notification while the app is open. Camera and notification permission prompts are expected. Do not treat a successful launch as soak evidence. Do not treat lock-screen delivery as a pass.

9. Evidence ​

Record only that the Internal build exists. No secrets.

  1. Screenshot App Store Connect → TestFlight showing 1.2.0 (7) on Internal Testing (status Ready / Testing, not Processing or Missing Compliance).
  2. Keep the screenshot in NAS evidence/keryx/ (or the Mac scratch ~/sourcectl/keryx-release-evidence/). Suggested name: 2026-09-07-testflight-internal-1.0.0+3.png (use the real date).
  3. OA-124-testflight is ticked (10 September 2026). After a later IPA, update that row rather than reopening a second checklist.
  4. Optional GitLab note on #124: the new Internal build number. Do not close #124.