Appearance
Keryx operator actions
Last updated: 2 October 2026 (next: OA-126-apple-resubmit; deny-all after store install + NSE)
Single checklist of human / portal / secret-store steps for Keryx for SafeCall. Policy packets remain the source for how; this log is what is still owed. To execute remaining Keryx public-launch rows, use the Keryx operator close-out (next: OA-126-apple-resubmit). Ariadne / Theseus sittings: Ariadne close-out, Theseus close-out.
Do not put passwords, keystores, .p12, .p8, or tokens in this file or in git. Record only where they live.
Statuses: blocking (launch or a named GitLab close is waiting), pending (owed, not currently blocking repo work), later (named so it is not forgotten; not this phase), done (verified).
Bulk session: work blocking then pending together; tick Verify after we confirm together.
How-to: iOS signing, Android signing, Secret store, NAS unlock, Internal TestFlight, ntfy auth dual-run and Play Internal, Client ntfy deployer checklist, Administrator provisioning handbook, Administrator app onboarding guide, Keryx Firebase / FCM / APNs, Store org roles and EU trader, Publishing Keryx, iOS delivery, CI (unsigned first slice), Accessibility (in-repo first slice), Reviewer environment (in-repo first slice), Monitoring and support intake (in-repo first slice), Hotfix, stop-rollout, and rejection (in-repo first slice).
Blocking now
#126 approval — #126. OA-126-submit is done (21 September 2026). Apple rejected 1.0 (18) on 23 September 2026 (Guidelines 1.1 and 2.3.10). Next step is OA-126-apple-resubmit (same binary; revised EN+CS metadata). Play submission 1 was In review (18 (1.3.7), Czechia). Keep #126 open until both stores approve. Dual-run stays. Do not apply auth-default-access: deny-all. Do not upload a new IPA for this rejection.
Next product work is #165 NSE (deny-all blocker, not a submit blocker). Cutover is #166 after public Czech install + NSE.
#125 listings/forms are closed. #123 and #108 are already closed. #119 stays closed. English phone-side guide is app-onboarding-guide.md (#121; do not close). #114 is closed (13 September 2026, org roles + EU trader). Apple Account Recovery stays #158 (OA-114-apple-recovery, after go-to-market). No pending OA-114 org rows. Local 1.2.0+7 AAB+IPA verified on GLaDOS 13 September 2026 (bun run release:keryx -- --contracts, git HEAD 4a37cfca, dirty docs only). Upload cert 0D:AC:61:B1:5F:85:91:3F:2B:21:20:5E:46:14:81:90:20:13:85:8B:76:D2:00:91:36:FD:30:9D:18:D8:0D:AA. AAB SHA-256 f3a93e6e806a46096503b4160c0411693c26487c42dc69a0aece656ea8b90c88. IPA SHA-256 3e5b93a9ef1d16d6372336a046fb49730491d8335c764f039d5b09db068a9faa, 1.2.0 (7), aps-environment=production, team 8P59575P2K. ExportOptions.plist now sets manageAppVersionAndBuildNumber=false (first export had rewritten CFBundleVersion to 8). Local evidence: keryx/build/release-evidence/1.2.0+7.txt and Mac scratch ~/sourcectl/keryx-release-evidence/2026-09-13-release-keryx-1.2.0+7.txt. Copy that file to NAS evidence/keryx/. OA-110-apns-p8, OA-119-firebase, OA-119-ntfy-apns, OA-119-ntfy-auth, and OA-119-ntfy-fcm are done (13 September 2026). Part I1: GLaDOS curl 200 to /keryx-fcm-probe-1789299971; hetest2 DEBUG log message_firebase=true and Publishing to Firebase with no Unable to publish to Firebase. /v1/config base_url stays empty on ntfy 2.16. Play Internal 7 (1.2.0) is available to testers (13 September 2026, not reviewed). ASC 1.2.0 (7) upload is Complete / Ready to Submit (90-day expiry); Internal Testing Groups is still empty and Installs is -. Operator later installed 1.2.1 (8) and ticked OA-119-closed-push-proof. ntfy auth dual-run Parts B–D are done (13 September 2026) on hetest2 + safecall.wantok.cz TST000. The P4-05 deployer packet is ntfy-deployer.md (OA-119-deployer-docs). Do not set deny-all. Do not start Play production; listing copy is #125. #124 stays open. Installed Internal 1.0.0+3 cannot receive this wake.
GLaDOS pipeline IPA (7 September 2026, bun run release:keryx -- --contracts, working-loop 1.0.0+3): SHA-256 7592a1b537f424c31b186d3d1b6372da395a8484d6e129f88f08c3bfd6e0d517. Do not upload the first Internal 1.0.0+2 IPA (commit 16349de3, SHA-256 c93492ec367b5b4a2514f7b1b1642060cc509b7451d3cea908f76ee4650935e2) as the working-loop candidate, or the superseded 1 September 2026 1.0.0+1 IPA (commit 6665a480, SHA-256 68ac735b22688daa0049ba492f99b712bbcd82b26232a6ad038a14f2c0b1f565). Earlier GLaDOS IPA (30 August 2026) SHA-256 353be9df68f4313ef8d556eb5869d5661b5757d1d44be866267d5f1050b3942a. MiniVan-3 SHA-256 a924af769b8fe27d6d942f74772bfa27c77707c1ae83aae10619a979e7a49f96 (Path B Distribution cert). CocoaPods 1.16.2 and launch-image warnings are not #110. Durable checksum copy is NAS evidence/keryx/ (OA-114-archive, 1 September 2026); Mac scratch ~/sourcectl/keryx-release-evidence/ may remain. After a NAS reboot, unlock gocryptfs before using File Browser. ASC: Keryx for SafeCall, Prepare for Submission, Czech Republic only (Available on App Release). Pricing base Greece (EUR) is the price list, not store availability. EU trader declaration is OA-114-eu-trader (done 13 September 2026). GLaDOS signed AAB verified 30 August 2026: upload cert SHA-256 0D:AC:61:B1:5F:85:91:3F:2B:21:20:5E:46:14:81:90:20:13:85:8B:76:D2:00:91:36:FD:30:9D:18:D8:0D:AA, AAB file SHA-256 a9a4db25474a7c8ddfb1cb8811e1f087b57b9b9cb0eec10f065b47486c5bf756. jarsigner self-signed/PKIX warnings are expected for a Play upload key. MiniVan-3 recovery 30 August 2026: same commit 459d18f6, fingerprint match, AAB file SHA-256 964144428ad0ad96a1e729254b947ffeb8b0ef445d6713a826e017b0d7f95ba4. Play Console 30 August 2026: Keryx for SafeCall, Czech Republic only, internal-testing AAB saved as draft, upload key SHA-256 matches GLaDOS (screenshot of Upload key certificate; do not request an upload key reset). Google's app signing key fingerprint is different and expected.
Pending (bulk with blocking)
| ID | Status | Issue | Where | Action | Verify |
|---|---|---|---|---|---|
| OA-126-apple-resubmit | blocking | #126 | App Store Connect | Apple rejected 1.0 (18) on 23 September 2026 (Guidelines 1.1 and 2.3.10). Paste the Apple EN+CS descriptions and review notes from store-listing-copy.md. No low-battery PNGs exist; the panic frames already in ASC are under keryx/store-assets/screenshots/asc-iphone-6.9-1260x2736/ and keryx/store-assets/screenshots/ipad-*-2064x2752.png. Do not re-upload those. Screenshot swap is optional and needs a new capture. Reply in the Resolution Center. Resubmit the same binary 1.0 (18). Do not upload a new IPA. Do not paste the Google description into Apple. Do not request expedited review. Soften “emergency-dispatch” on https://sourcectl.com/keryx if you can edit that host; do not block the paste on a site deploy. Keep #126 open. Path: operator-closeout.md. | [ ] |
| OA-165-nse | pending | #165 | Keryx iOS | Ship Notification Service Extension before deny-all. Not a store-submit blocker. | [ ] |
| OA-119-ntfy-fcm | done | #119 | Client ntfy (hetest2) | server.yml + firebase.json root:ntfy 640. ntfy 2.16 listens on 127.0.0.1:2586. Part I1 13 September 2026: GLaDOS 200 POST /keryx-fcm-probe-1789299971; journal message_firebase=true and Publishing to Firebase (no send error). /v1/config base_url is always empty on 2.16. Path: ntfy-fcm-apns.md Part I. | [x] |
| OA-119-closed-push-proof | done | #119 / #117 | One Android + one iPhone | Operator confirmed 13 September 2026 on 1.2.1 (8): lock-screen banner after swipe-away (iOS tap re-shows a local banner — known, not a double publish). First-device proof only. Does not close #117. Path: ntfy-fcm-apns.md Parts J–K. | [x] |
Later (named so they are not missed)
| ID | Status | Issue | Where | Action | Verify |
|---|---|---|---|---|---|
| OA-119-ntfy-cutover | later | #166 | Client ntfy | After Keryx is installable from the Czech stores, official ntfy clients are retired, and #165 NSE is shipped, set auth-default-access: deny-all. Do not do this during dual-run or during #126 submit. Path: operator-closeout.md. | [ ] |
| OA-114-apple-recovery | later | #158 | Apple Account | After public launch, enable Account Recovery / recovery key on a new device signed into the company Apple Account. Store the key only in Apple Passwords. Path: store-org-and-eu-trader.md. | [ ] |
Done
| ID | Status | Issue | Where | Action | Verify |
|---|---|---|---|---|---|
| OA-126-submit | done | #126 | ASC + Play Console | 21 September 2026: Apple 1.0 Waiting for Review; Play submission 1 In review (Production 18 (1.3.7), Czechia). NAS evidence/keryx/2026-09-21-oa-126-submit.txt (159 B). Apple later rejected 1.0 (18) on 23 September 2026. Resubmit is OA-126-apple-resubmit. Keep #126 open. Do not deny-all. Path: operator-closeout.md. | [x] |
| OA-125-listings | done | #125 | ASC + Play Console | 21 September 2026: EN+CS listings and screenshots in ASC+Play; App content including Data safety/IARC/18+/Health; Sign-in review URL; Internal testing Active 18 (1.3.7). NAS evidence/keryx/2026-09-21-oa-125-listings.txt (568 B). Submit is OA-126-submit / #126. #108 and #123 already closed. Path: store-listing-copy.md. | [x] |
| OA-123-review-host | done | #123 | Notify host (hetest2) + {public_base} | 20 September 2026: REVIEW-* ACL including REVIEW-status (no deny-all); live /keryx/review Send-test A1; off-LAN iPhone + Android Active pass on 1.3.7 (18); Overview all-clear 2:23 PM; NAS evidence/keryx/2026-09-20-oa-123-review-host.txt (205 B, File Browser). #123 closed. Path: reviewer-environment.md. | [x] |
| OA-107-https | done | #107 | Public web | 20 September 2026: https://sourcectl.com/keryx, /privacy, /terms, /support, /review return 200 over HTTPS; HTTP 308 to HTTPS. Publisher Source Control (browser tab of /keryx/privacy). /keryx/review is a secret-free placeholder (no QR, no send-test). Czech public HTML deferred to #108. NAS evidence/keryx/2026-09-20-oa-107-https.txt (154 B, File Browser). #107 already closed from the packet. Store URL paste is OA-125. | [x] |
| OA-legal-cs | done | #108 | Counsel | Operator confirmed counsel reviewed the EN+CS legal package 20 September 2026. DRAFT banners removed from English public HTML the same day. Letter not in git. Do not close #108 (Czech app UI / handbook / Czech public HTML). Path: legal/. | [x] |
| OA-116-device-a11y | done | #116 | One iPhone + one Android | Skipped 20 September 2026: trained hospital security / SafeCall administrators; no VoiceOver/TalkBack walk; no WCAG 2.2 AA claim. In-repo permission-recovery UI stays. #116 closed. Path: accessibility.md. | [x] |
| OA-121-app-walk | done | #121 | One SafeCall administrator | 19 September 2026 iPhone TestFlight Keryx for SafeCall 1.3.7 (18): empty onboarding, Camera + Notifications, scan (Overview after mint), Mobile Access pipeline test (lock-screen banner + Dashboard ntfy recheck / CDR001-test), Pause then Resume, Čeština. NAS evidence/keryx/2026-09-19-oa-121-app-walk.txt (32 B, File Browser). No QR photographed. Do not close #121. Path: app-onboarding-guide.md. | [x] |
| OA-keryx-status-sidecar | done | Daily status plane | Notify host (hetest2 / SSH mnew.ssh) | One-time dir, keryx-status.env (no READ_SECRET), systemd enabled, sudoers drop-in, nginx /keryx-status/ → :8792. Binary deployed 19 September 2026: keryx-status.service active; local and public /keryx-status/health 200; unauth GET 401; ntfy /v1/health 200. NAS evidence/keryx/2026-09-19-oa-keryx-status-sidecar.txt (955 B, File Browser). scripts/build/keryx-status.sh uses mnew.ssh. Existing Keryx phones still need a new QR after SafeCall is upgraded. How-to: keryx-status. | [x] |
| OA-132-intake-drill | done | #132 | NAS evidence/keryx/ | Tabletop archived 17 September 2026 as 2026-09-17-oa-132-intake-drill.txt (1.05 KiB, File Browser). Drill AC ticked on the work item; secret-free GitLab note posted. No SDK. No status page. Do not close #132. Path: monitoring-intake.md. | [x] |
| OA-129-hotfix-tabletop | done | #129 | NAS evidence/keryx/ | Tabletop archived 17 September 2026 as 2026-09-17-oa-129-hotfix-tabletop.txt (644 B, File Browser). Tabletop AC ticked on the work item; secret-free GitLab note posted. Did not halt or unpublish the live listing. Do not start #128. Do not close #129. Path: hotfix-runbook.md. | [x] |
| OA-112-ci-enable | done | #112 | GitLab shared Linux | Unsigned slice green on master 17 September 2026: keryx:dart, keryx:server, keryx:native-android on pipeline 2858894786 (5c367031). Reopened 17 September 2026 after a premature Done; secret-free GitLab note posted. No signing CI variables. Do not close #112 (signed compile, SBOM, Swift/macOS remain). Path: ci.md. | [x] |
| OA-121-app-guide-docs | done | #121 | Repo docs | English packet app-onboarding-guide.md (13 September 2026). Store/Internal install, permissions, Scan QR code, Active/Archive, pause, no perpetual FGS, official-ntfy migration, Reset App does not revoke. OA-121-app-walk done 19 September 2026. Live English web is OA-107 done. Czech store content (#108) and screenshots (#125) are done; do not close #121 (onboarding residual). | [x] |
| OA-120-admin-walk | done | #120 | One SafeCall user | Operator confirmed 13 September 2026: the user installed Keryx and scanned the admin QR with no problem. No QR photographed into chat. Does not claim Send test notification or pause/rescan. Czech handbook accepted on #108. #120 closed 13 September 2026. Path: admin-provisioning-handbook.md. | [x] |
| OA-120-handbook-docs | done | #120 | Repo docs | English packet admin-provisioning-handbook.md. Walk is OA-120-admin-walk. Cross-link AC accepted against ntfy-deployer.md; public app guide stays #121. Czech handbook accepted on #108. #120 closed 13 September 2026. | [x] |
| OA-114-apple-org | done | #114 | Apple Developer / ASC | Entity SOURCE CONTROL SINGLE MEMBER P.C., team 8P59575P2K, Account Holder Thomas, Free+Paid Apps Active, Users and Access 1 live user (Account Holder + Admin), 2FA on (13 September 2026). Recovery key not set up; accepted → #158. Support is the SafeCall channel. Path: store-org-and-eu-trader.md Part A. | [x] |
| OA-114-play-org | done | #114 | Play Console | Org Source Control, 1 user (owner, Active), Google 2-Step Verification on, Internal testing Active 8 (1.2.1), Production Inactive, countries Czechia only (13 September 2026). No Production rollout. Path: store-org-and-eu-trader.md Part B. | [x] |
| OA-114-eu-trader | done | #114 | ASC | Digital Services Act Active (7 September 2026). Play public contacts present in console. Values not in git. NAS note evidence/keryx/2026-09-13-store-org-eu-trader.txt. Path: store-org-and-eu-trader.md Part C. | [x] |
| OA-110-apns-p8 | done | #119 | NAS secrets/keryx/iOS/ | Team APNs auth key stored as apns-keryx.p8 (13 September 2026 File Browser). Key ID lives in Apple Passwords / Firebase Cloud Messaging, not git. Path: ntfy-fcm-apns.md Part F. | [x] |
| OA-119-firebase | done | #119 | Firebase Console + NAS secrets/keryx/firebase/ | Project Keryx for SafeCall (keryx-for-safecall): Android com.sourcectl.keryx and iOS com.sourcectl.keryxapp (team 8P59575P2K). Admin SDK JSON on NAS as ntfy-firebase-adminsdk.json. Client files already in repo. Path: ntfy-fcm-apns.md Part G. | [x] |
| OA-119-ntfy-apns | done | #119 | Firebase Cloud Messaging | FCM HTTP v1 enabled. Production and Development APNs auth keys uploaded for com.sourcectl.keryxapp, team 8P59575P2K. upstream-base-url on the notify host is empty, not https://ntfy.sh. Path: ntfy-fcm-apns.md Part H. | [x] |
| OA-119-deployer-docs | done | #119 | Repo docs | P4-05 packet ntfy-deployer.md plus secret-free templates/ (13 September 2026). Acceptance-test table records TST000 publish/live proof and first-device swipe-away; reboot/cache soak stays #117/#118; deny-all stays OA-119-ntfy-cutover. #119 closed 13 September 2026. | [x] |
| OA-119-ntfy-users | done | #119 | Client ntfy + NAS secrets/keryx/ntfy/ | safecall-publisher (* read-write) and safecall-token-manager (* read-only, not admin) on hetest2. Publish token label safecall-publish. POST /v1/account/token as token-manager returned 200 + tk_… (13 September 2026); leftover probe token deleted. Passwords/tokens stay in Apple Passwords. Host/username notes are on NAS secrets/keryx/ntfy/ (File Browser, 13 September 2026). Mac scratch may remain. Path: ntfy-auth-and-play-internal.md Part B. | [x] |
| OA-119-ntfy-limits | done | #119 | Client ntfy (hetest2) | Both users on tier safecall (message-limit=100000, expiry 24h). visitor-request-limit-exempt-hosts set to safecall-test public egress 91.98.126.69 and 2a01:4f8:1c1a:8835::1 (13 September 2026 restart). Anonymous laptop publish still 200. Authenticated burst 12× 200, no 429. Did not raise visitor-subscription-limit. Did not change the existing anonymous burst knob. Path: ntfy-auth-and-play-internal.md Part C. | [x] |
| OA-119-safecall-config | done | #119 | SafeCall safecall.wantok.cz / /opt/safecall TST000 | All three ntfy keys set (publish is tk_…, not tk_local_…). Latest persisted Keryx tokens are real tk_…. Operator re-scanned 13 September 2026; official ntfy app still shows TST000-test (Recheck + dual-run probes + pipeline test). Path: ntfy-auth-and-play-internal.md Part D. | [x] |
| OA-119-ntfy-auth | done | #119 | Client ntfy (hetest2) | auth-file: /var/lib/ntfy/user.db, auth-default-access: read-write, behind-proxy: true (13 September 2026 server.yml). Do not set deny-all. Parts B–D done the same day. Path: ntfy-auth-and-play-internal.md Part A. | [x] |
| OA-124-play-internal | done | #124 | Play Console | Operator installed Keryx from Play Internal testing on 10 September 2026. Working-loop AAB 1.0.0+3 (SHA-256 dff47ac927687950c25c574ee9ecd1283cbc3355dbcc0d6c902f74a93e488601). Upload cert 0D:AC:61:B1:…:0D:AA. Path: ntfy-auth-and-play-internal.md Part E. Do not paste listings (#125). Do not start Production. Do not close #124. | [x] |
| OA-124-testflight | done | #124 | ASC TestFlight | Operator installed Keryx from Internal TestFlight on 10 September 2026. Working-loop IPA 1.0.0+3 (SHA-256 7592a1b537f424c31b186d3d1b6372da395a8484d6e129f88f08c3bfd6e0d517). First Internal install was 1.0.0+2. Path: internal-testflight.md. Do not paste listings (#125). Full soak stays #124. Do not close #124. | [x] |
| OA-launch-image | done | #104 / #106 | Flutter iOS / Android assets | Replaced the default Flutter launch image with the navy megaphone mark in 1.0.0+2 (7 September 2026). | [x] |
| OA-111-pipeline | done | #111 | GLaDOS + NAS evidence/keryx/ | bun run release:keryx -- --contracts passed 1 September 2026 (no bump/tag/upload). Version 1.0.0+1, commit 6665a480. AAB SHA-256 a9a4db25474a7c8ddfb1cb8811e1f087b57b9b9cb0eec10f065b47486c5bf756 (upload cert 0D:AC:61:B1:…:0D:AA). IPA SHA-256 68ac735b22688daa0049ba492f99b712bbcd82b26232a6ad038a14f2c0b1f565, aps-environment=production, team 8P59575P2K. NAS file evidence/keryx/2026-09-01-release-keryx-1.0.0+1.txt verified 1 September 2026 (File Browser). Mac scratch may remain. CI/SBOM remains #112. Superseded as the TestFlight candidate by 1.0.0+2. | [x] |
| OA-114-archive | done | #114 | NAS evidence/keryx/ | CT 500 File Browser from GLaDOS and MiniVan-3 (1 September 2026). Checksums in evidence/keryx/. Unlock after reboot: nas-unlock.md. #114 closed 13 September 2026. Residual recovery is #158. | [x] |
| OA-110-cert-backup | done | #110 | NAS secrets/keryx/iOS/ | Both Macs’ Apple Distribution .p12 (keryx-apple-distribution-glados-8P59575P2K.p12, keryx-apple-distribution-minivan-8P59575P2K.p12). Export passwords in Apple Passwords, not git. | [x] |
| OA-110-push | done | #110 | Apple Developer → Identifiers | App ID com.sourcectl.keryxapp has Push: store IPA proves aps-environment=production (GLaDOS and MiniVan-3, 30 August 2026). Do not enable Broadcast. | [x] |
| OA-110-recovery | done | #110 | MiniVan-3 | Second-Mac IPA: verify:keryx-ipa -- --expect-team=8P59575P2K passed. SHA-256 a924af769b8fe27d6d942f74772bfa27c77707c1ae83aae10619a979e7a49f96, aps-environment=production, team 8P59575P2K, Path B Distribution cert. | [x] |
| OA-110-evidence | done | #110 | NAS evidence/keryx/ | IPA checksum notes on the NAS share (2026-08-30-ios-ipa.txt). Mac scratch ~/sourcectl/keryx-release-evidence/ may remain. | [x] |
| OA-110-asc | done | #110 | App Store Connect | App Keryx for SafeCall exists (iOS 1.0 Prepare for Submission). Availability: Czech Republic only (Available on App Release). Pricing base Greece (EUR) is not store availability. No listing copy pasted. | [x] |
| OA-109-play-record | done | #109 | Play Console | App Keryx for SafeCall exists. Category Business. Countries Czech Republic only. Internal testing release saved as draft. Package from first AAB com.sourcectl.keryx. No listing copy pasted. | [x] |
| OA-109-play-signing | done | #109 | Play Console | Play App Signing enrolled. Upload key SHA-256 0D:AC:61:B1:5F:85:91:3F:2B:21:20:5E:46:14:81:90:20:13:85:8B:76:D2:00:91:36:FD:30:9D:18:D8:0D:AA matches GLaDOS (30 August 2026 screenshot). App signing key is Google-managed (different fingerprint, expected). No production rollout. | [x] |
| OA-109-keystore | done | #109 / #111 | NAS secrets/keryx/android/ | upload-keystore.jks + key.properties on the share (1 September 2026). Upload cert SHA-256 0D:AC:61:B1:5F:85:91:3F:2B:21:20:5E:46:14:81:90:20:13:85:8B:76:D2:00:91:36:FD:30:9D:18:D8:0D:AA. Local gitignored copies remain for builds. | [x] |
| OA-109-recovery | done | #109 | MiniVan-3 | Same upload keystore copied from GLaDOS. verify:keryx-aab -- --expect-fingerprint=0D:AC:61:B1:5F:85:91:3F:2B:21:20:5E:46:14:81:90:20:13:85:8B:76:D2:00:91:36:FD:30:9D:18:D8:0D:AA passed. AAB file SHA-256 964144428ad0ad96a1e729254b947ffeb8b0ef445d6713a826e017b0d7f95ba4. | [x] |
Using bun keryx
Operator store-candidate cut. Same prompts as bun commit. It bumps keryx/pubspec.yaml, builds and verifies the signed AAB and IPA, copies them to releases/keryx.aab and releases/Keryx.ipa, commits, tags keryx-vX.Y.Z, and pushes to origin. It does not upload to Play or TestFlight, and it does not replace this log.
bash
bun keryx # prompt for bump type + message
bun keryx patch # prompt for message only
bun keryx patch "Fix notifications"After a successful run, upload releases/keryx.aab and releases/Keryx.ipa using ntfy-auth-and-play-internal.md Part E and internal-testflight.md. Copy keryx/build/release-evidence/ to NAS evidence/keryx/.
Using bun run release:keryx
Local rebuild for P3-03 / #111. It fails closed without Android key.properties and without iOS distribution signing. It does not upload, push tags, or replace this log. Prefer bun keryx when you intend to bump, commit, and push.
First recorded run: 1 September 2026 on GLaDOS (--contracts, no bump/tag). Second recorded run: 7 September 2026 (1.0.0+2, commit 16349de3, --contracts, no bump/tag). AAB SHA-256 a884dc07c8f5a78f7da42526fca1db27287b1172d56995adbd71e80471ef247c (upload cert still 0D:AC:61:B1:…:0D:AA). IPA SHA-256 c93492ec367b5b4a2514f7b1b1642060cc509b7451d3cea908f76ee4650935e2. Local evidence: keryx/build/release-evidence/1.0.0+2.txt. Third recorded run: 7 September 2026 (1.0.0+3, --contracts, no bump/tag). Evidence git HEAD 9dbd1d49 (binary includes uncommitted working-loop sources). AAB SHA-256 dff47ac927687950c25c574ee9ecd1283cbc3355dbcc0d6c902f74a93e488601. IPA SHA-256 7592a1b537f424c31b186d3d1b6372da395a8484d6e129f88f08c3bfd6e0d517. Local evidence: keryx/build/release-evidence/1.0.0+3.txt. Fourth recorded run: 13 September 2026 (1.2.0+7, --contracts, no bump/tag). Evidence git HEAD 4a37cfca. AAB SHA-256 f3a93e6e806a46096503b4160c0411693c26487c42dc69a0aece656ea8b90c88 (upload cert still 0D:AC:61:B1:…:0D:AA). IPA SHA-256 3e5b93a9ef1d16d6372336a046fb49730491d8335c764f039d5b09db068a9faa (1.2.0 (7) after pinning manageAppVersionAndBuildNumber=false). Local evidence: keryx/build/release-evidence/1.2.0+7.txt. After each successful run, copy the printed checksums into NAS evidence/keryx/ and optionally the local scratch ~/sourcectl/keryx-release-evidence/.