Keryx monitoring and support intake (in-repo first slice)

First slice: 17 September 2026

This packet is the in-repo slice of #132 (P6-05). It does not close that issue and does not claim an analytics or crash SDK or a public status page. The intake drill is OA-132-intake-drill (done 17 September 2026; NAS evidence/keryx/2026-09-17-oa-132-intake-drill.txt, 1.05 KiB).

Drill evidence is OA-132-intake-drill in operator-actions.md. Support class: P0-05 in roadmap.md. Ticket data: data-classification.md. Delivery limits: safety-claims.md. Hotfix steps: hotfix-runbook.md and Publishing Keryx. Cadence: test-traceability.md.

Decision

Choice	Value
Telemetry	No analytics or crash SDK at launch. No Firebase Analytics, Crashlytics, Sentry, or similar. No administrator identifiers in this repository (P0-05)
Minimum signals	Host/ops signals already available, plus client-reported diagnosis. No new processor
Channel	Existing SafeCall support path only. No standalone Keryx mailbox, public status page, 24/7 desk, or emergency-dispatch SLA
Owner	Thomas Minitsios is RACI for incidents (P0-05). Backup is the same person (named concentration risk)
Hours	Czech business hours Mon–Fri CET/CEST; next-business-day first response; same-business-day ack for supported-tier core-path incidents
Delivery	Do not invent delivery SLOs; stay on safety-claims.md

Not claimed: live reviewer Send-test (#123), store console paste (#125). OA-132-intake-drill and OA-129-hotfix-tabletop are done (NAS evidence 17 September 2026). Do not close #132 or #129.

Signals allowed at launch

Purpose is reliability and store/release health. Processors stay the existing ntfy host operator, store Account Holder mailbox, GitLab, and SafeCall support channel. Retention follows those systems. Do not copy client PII into git.

Signal	Purpose	Processor	Retention	Notes
Client ntfy journalctl -u ntfy	Host up, publish/FCM errors	Deployer on hetest2 (or client dedicated ntfy)	Host journal policy	ntfy-deployer.md. No extra product
SafeCall Recheck	Publish path from the dashboard	SafeCall server + notify host	Existing SafeCall logs	Stop on 429 (burns the visitor bucket)
Reviewer Send-test	G4 page still publishes A5	Review page backend + ntfy	Host logs	Optional after OA-123-review-host. Do not wait
ASC / Play email	Review, policy, signing warnings	Account Holder mailbox (controlled record, not git)	Mailbox policy	No client alert bodies
GitLab work items	Defects and incidents	sourcecontrollers/safecall	GitLab retention	Secret-free notes only
Client-reported diagnosis	Field cases P0-05 deferred to this packet	SafeCall support channel	SafeCall support process	Redact per intake table below

Signals forbidden at launch

• Analytics or crash SDKs, or any new telemetry processor.
• Harvesting FCM/APNs device tokens, tk_… / subscribe_auth, QR payloads, or alert title/body into a central store.
• Public status pages or unauthenticated health URLs that expose topic names.
• Inventing a hostname, mailbox, or on-call product in git.

Apple nutrition label and Play Data Safety stay no analytics / no crash SDK until a later approved change with P0-05 authority and disclosure updates (legal/privacy.md, apple-privacy-compliance.md, play-data-safety.md).

Intake and redaction

Aligns the support-ticket row in data-classification.md. Public wording: legal/support.md §5.

Allowed in a ticket	Forbidden
Platform (iOS / Android) and OS version class	subscribe_auth, publish tokens, APNs/FCM tokens
Keryx version+build from the About / store listing	QR photographs or decoded QR JSON
Time window (local date/time, timezone)	Raw ntfy JSON, topic IDs, server URLs
Friendly category label (not topic id)	Real client or building names, MACs, floor plans
Paused yes/no; camera/notification granted yes/no	Unredacted lock-screen screenshots of production alerts

If a secret arrives anyway: do not paste it into GitLab or chat; rotate if the credential may have leaked; record only “rotated” on NAS evidence/keryx/.

Severity and communications

Severity	Examples	Ack	Internal comms
Sev1	Core alert path down on a supported tier; credential leak; store stop / unpublish	Same business day by Thomas (P0-05 core-path class)	GitLab issue + SafeCall account path. No public status page
Sev2	Single-platform delivery regression; reviewer page Send-test dead; store policy warning that does not stop the listing	Next business day first response	GitLab + SafeCall path
Sev3	Docs, UX, Czech copy, non-blocking listing nits	Next business day	GitLab

Escalation: Thomas Minitsios. Consulted: counsel if health/medical/claims scope changes (P0-02); client IT for OEM battery exceptions. Informed: affected SafeCall account owners via the SafeCall path.

Do not promise 24/7 coverage or guaranteed delivery while acknowledging a ticket.

Postmortem

After Sev1 or Sev2:

1. Secret-free GitLab note on the incident item (symptoms, version/build, what changed, follow-up iid).
2. NAS evidence/keryx/ pass/fail and checksums only. No QR photos, no tk_….
3. Feed durable tests or runbook edits into the next change. Hotfix packet is hotfix-runbook.md; OA-129-hotfix-tabletop is done. Launch client communications stay #127.

What this slice proves

• Launch monitoring is existing host/ops signals plus client reports, not a new SDK.
• Intake redaction and severity/ack match P0-05 and P1-05.
• Apple/Play “no analytics” answers remain aligned until a later change.
• Hotfix authority consumes this severity model in hotfix-runbook.md; OA-129-hotfix-tabletop is done.

What this slice does not do

• Close #132.
• Add telemetry, a mailbox, or a status page.
• Stand up reviewer Send-test (OA-123-review-host).

Operator enable

OA-132-intake-drill is done (17 September 2026). NAS evidence/keryx/2026-09-17-oa-132-intake-drill.txt (1.05 KiB). Do not close #132. Do not add an SDK. Do not stand up a status page.

Handoff

Remaining work	Owner
Remaining #132 ACs beyond the intake drill	#132
Hotfix / stop-rollout packet	hotfix-runbook.md; OA-129-hotfix-tabletop done
Phased rollout client communications	#127
Quarterly signal review	#133