Keryx reviewer environment (in-repo first slice)

First slice: 17 September 2026

This packet is the in-repo slice of #123 (P5-01). OA-123-review-host landed 20 September 2026; #123 is closed. This packet remains the in-repo topology. Live HTTPS, QR, and ACL are operator evidence, not this file.

Host evidence is OA-123-review-host in operator-actions.md. Public path reservation: public-web-pages.md. Reviewer notes: store-listing-copy.md. Preferred screenshot capture: store-screenshot-kit.md. Cadence: test-traceability.md row C-07 (G4).

Decision

Choice	Value
Isolation	Dedicated ntfy user + topics + tokens on the existing sourcectl notify host (https://notify.wantok.cz on hetest2 per ntfy-deployer.md). Isolation is ACL + sample data, not a second VM
Reviewer UX	One static HTTPS page. Reviewers do not log into SafeCall admin and do not type ntfy server, topic, or auth
Page path	{public_base}/keryx/review. Do not invent a hostname in git. {public_base} stays a controlled record
QR	Pre-baked safecall.keryx.ntfy.v2, HTTPS-only, subscribe_auth present, debug_access: false
Send test	Server-side publish token on the page backend. Never in git or in page HTML
Sample alerts	Screenshot-kit rows A1–A5 (Demo Site North / fictional)
Owner / SLA	Thomas Minitsios (P0-05). Keep QR + Send-test working for the current ASC build expiry (90 days) and until Play review closes

Not claimed: live DNS/TLS from this file, minted tk_… in git, committed QR PNG, TST000 as the reviewer env. Store console paste was OA-125 (done; close #125). Submit is #126.

Topology

Surface	This slice	Residual (OA-123-review-host)
Notify host	Named: sourcectl shared ntfy on hetest2	Create review user, A1–A5 topics, subscribe + publish tokens
Topics	Placeholder IDs REVIEW-* (not ACL)	Real topic ACL on those IDs; not TST000
Public page	Secret-free copy in templates/reviewer-page.md	HTTPS at {public_base}/keryx/review with durable QR image
Send test	Spec only (POST with server-side publish token)	Implement without exposing the token to the browser
Credentials	Git has example payload only (https://notify.example.test/, tk_example_subscribe_only)	NAS secrets/keryx/ + Apple Passwords

Forbidden:

• Reusing TST000 topics or client publish/subscribe tokens (dual-run is a client probe, not Apple/Google review).
• upstream-base-url: https://ntfy.sh (wakes the official ntfy iOS app, not com.sourcectl.keryxapp).
• debug_access: true on the reviewer QR (threat-model.md A8).
• Client production QR, real building names, MACs, or floor plans.
• Putting tk_…, QR photographs, or filled {public_base} into git.

Topic and label map

Friendly names match store-screenshot-kit.md sample alerts A1–A5. Placeholder topic IDs are for the packet and example payload only.

ID	Topic placeholder	Label (EN)	Title / body (EN)	Label (CS)
A1	REVIEW-panic	Panic button alerts	Panic button alerts / Demo panic button pressed at Demo Site North	Poplachové tlačítko
A2	REVIEW-battery	Low battery alerts	Low battery alerts / Demo sensor battery below threshold	Slabá baterie
A3	REVIEW-sensor	Sensor threshold alerts	Sensor threshold alerts / Demo temperature reading outside range	Prah senzoru
A4	REVIEW-unseen	Device not seen alerts	Device not seen alerts / Demo device has not reported recently	Zařízení neviděno
A5	REVIEW-health	Installation health alerts	Installation health alerts / Demo notification pipeline test succeeded	Stav instalace

Send-test default: A1 (REVIEW-panic). Keryx treats A5 (REVIEW-health) as an Overview condition, so it never appears on Active. The QR still includes all five topics for labels. Overview all-clear needs REVIEW-status ACL plus a keryx-status snapshot (Send-test PUTs an empty snapshot after the ntfy post).

Example QR payload (git only)

Shape matches lib/src/keryx_qr.fixtures.json. Not a live credential.

{
  "type": "safecall.keryx.ntfy.v2",
  "ntfy_server_url": "https://notify.example.test/",
  "topics": [
    "REVIEW-panic",
    "REVIEW-battery",
    "REVIEW-sensor",
    "REVIEW-unseen",
    "REVIEW-health"
  ],
  "labels": {
    "REVIEW-panic": "Panic button alerts",
    "REVIEW-battery": "Low battery alerts",
    "REVIEW-sensor": "Sensor threshold alerts",
    "REVIEW-unseen": "Device not seen alerts",
    "REVIEW-health": "Installation health alerts"
  },
  "created_at": "2026-09-17T00:00:00.000Z",
  "debug_access": false,
  "subscribe_auth": "Bearer tk_example_subscribe_only",
  "token_id": "review-token-example"
}

The live QR uses the real notify HTTPS origin and a real subscribe token. Ordinary Keryx UI still hides server URL, topic IDs, and subscribe_auth.

Page wire

Reviewers use TestFlight or Play Internal (not a sideload). They never configure ntfy.

1. Install Keryx for SafeCall from the store track named in the review notes.
2. Open {public_base}/keryx/review (English; Czech block on the same page).
3. Grant camera and notification permission. If denied, use in-app Open Settings (accessibility.md).
4. Scan the QR on the page (all A1–A5 categories).
5. Tap Send test notification on the page (A1 panic sample).
6. Confirm Active shows the sample alert; Archive works; pause does not drop config.
7. If stuck: Reset App in Keryx, then rescan the same static QR.

Expected results for Apple/Google notes (also in store-listing-copy.md):

• Scan succeeds without typing a server, topic, or token.
• Send-test produces a system notification and an Active row.
• Scanning is not a purchase, subscription, or paid unlock.
• Keryx is a free SafeCall administrator companion; downloading it does not provide SafeCall.

Paste-ready page copy: templates/reviewer-page.md.

Credential custody

Item	Where	Git
Review ntfy username	NAS secrets/keryx/ntfy/ note	Placeholder only
Subscribe token (tk_…)	Apple Passwords + NAS	Example tk_example_subscribe_only only
Publish token for Send-test	Apple Passwords + page backend env	Never
Durable QR PNG	NAS evidence/keryx/ after OA	Do not commit
{public_base}	#114 controlled record	Placeholder {public_base}

Rotate subscribe and publish tokens if a QR is photographed into a ticket or the page is scraped. After rotation, regenerate the QR image; the public path stays {public_base}/keryx/review.

Reset, rotation, monitoring, SLA

Topic	Policy
Reset	Keryx Reset App, then rescan the same static QR. Does not revoke the review token (host-side revoke is the operator path)
Rotation	Owner rotates tokens on leak or at the end of a review window; update the QR image on the page
Monitoring	ntfy 2.16 up on hetest2; periodic Send-test (owner, no client PII in logs)
Review window	Keep QR + Send-test working for the current ASC binary expiry (90 days) and until Play review closes
Owner	Thomas Minitsios (P0-05). Backup is the same person (named concentration risk)

Do not apply auth-default-access: deny-all for this environment while the official ntfy app dual-run is still in force (OA-119-ntfy-cutover).

What this slice proves

• Isolation, page shape, QR contract, sample catalog, and SLA are written.
• Apple/Google steps do not ask reviewers to configure ntfy.
• TST000 is explicitly not the reviewer environment.
• {review_environment_url} in listing copy is this path once live: {public_base}/keryx/review.

What this slice does not do

• Close #123.
• Deploy DNS/TLS or the public page (OA-107-https + OA-123-review-host).
• Mint live tokens or commit a QR PNG.
• Paste {review_environment_url} into App Store Connect or Play Console (#125).
• Capture store screenshot PNGs.
• Stand up a SafeCall admin UI for reviewers.

Operator enable

1. On hetest2: review user, REVIEW-* topics, subscribe + publish tokens (store in NAS / Apple Passwords; not git).
2. Publish {public_base}/keryx/review from templates/reviewer-page.md with a durable QR image of the live v2 payload.
3. Off-LAN: Send-test, then scan on one iPhone and one Android.
4. Archive pass/fail on NAS evidence/keryx/ (no QR photo in GitLab).
5. Tick OA-123-review-host (done 20 September 2026). #123 closed. Console paste was OA-125. Do not apply deny-all here.

Handoff

Remaining work	Owner
Live isolated ACL + HTTPS page + off-LAN proof	OA-123-review-host done 20 September 2026; #123 closed
{review_environment_url} in both consoles	OA-125-listings done 21 September 2026; close #125. Submit is #126
{public_base} DNS/TLS for /keryx/*	OA-107-https done 20 September 2026
Preferred screenshot capture from this env	store-screenshot-kit.md