SafeCall Docs

Appearance

Store organization roles and EU trader ​

Last updated: 13 September 2026

Operator how-to for #114 (closed 13 September 2026): OA-114-apple-org, OA-114-play-org, OA-114-eu-trader are done. Apple Account Recovery is later #158 (OA-114-apple-recovery). Store records and the NAS evidence archive were already done (OA-114-archive). Policy for what to verify lives in Publishing Keryx (Apple one-time setup steps 1 and 4; Play one-time setup step 1) and the P0-02 EU trader decision in roadmap.md.

Owed rows live in operator-actions.md. Do not close #117, #124, or #125 from this page. Do not paste listing copy, screenshots, or privacy / Data Safety forms. Do not start Play Production or App Review submit. Do not set auth-default-access: deny-all.

Do not put street address, phone, email, tax IDs, recovery-key material, or passwords in this file, in git, in chat, or in operator-actions.md. Record only where they live (App Store Connect, Play Console, Apple Passwords, NAS).

Purpose and non-goals ​

Purpose

  1. Verify Apple Developer / App Store Connect legal entity, agreements, Account Holder, Users and Access roles, 2FA, and recovery.
  2. Verify the Play Console organization account, 2FA, recovery, and admin / release-manager roles.
  3. Declare sourcectl as the EU trader on the existing ASC app record. Public address, phone, and email stay in ASC + Apple Passwords.
  4. Adopt the secret-free release-record template. Filled copies go to NAS evidence/keryx/, not git.

Non-goals

  • Creating a second Apple or Play app record. Keryx for SafeCall already exists (com.sourcectl.keryxapp, com.sourcectl.keryx, Czech Republic only).
  • Inventing a second human Account Holder or go/no-go. P0-05 already names Thomas Minitsios as both authority and backup. MiniVan-3 is a second Mac, not a second person. Invite extra Apple/Play users only if a named person already exists.
  • Closing #114 from this page alone (it is already closed). Residual recovery is #158.

Concentration (read first) ​

RoleWho
Apple Account HolderThomas Minitsios on team 8P59575P2K (SOURCE CONTROL SINGLE MEMBER P.C.)
Play account ownersame person on the existing Play developer account
Go/no-go and backupsame person (P0-05 named concentration)
Second signing MacMiniVan-3 (recovery drill already proven)

This page records that concentration. It does not invent a second human.

NAS notes ​

After each part, upload a secret-free note via File Browser (secret-store.md, nas-unlock.md if the share is empty):

PathContents
evidence/keryx/2026-09-13-store-org-eu-trader.txtDate, which parts were verified or declared, role names (Account Holder, Admin, …), “values live in ASC / Play / Apple Passwords”. No address, phone, email, or recovery-key text
evidence/keryx/ filled release-record stub (optional)Copy of templates/release-record.md with checksums you already have; leave soak / listing / rating fields blank

Printable shot list: templates/store-org-evidence-pack.md. Safe role-list screenshots may go in chat or NAS. Anything that shows address, phone, email, tax IDs, or recovery material is NAS only (or stay in the console). Mac scratch ~/sourcectl/keryx-release-evidence/ may remain.

Part A — Apple org (OA-114-apple-org) ​

App record Keryx for SafeCall / com.sourcectl.keryxapp already exists (CZ-only). Verify. Do not recreate.

  1. Open Apple Developer and App Store Connect as the Account Holder on team 8P59575P2K.
  2. Confirm the legal entity matches SOURCE CONTROL SINGLE MEMBER P.C. Do not copy the address into git.
  3. Agreements, Tax, and Banking (or Business): Free Apps (and Paid Apps if listed) are Active / Accepted. Accept any review banner. Do not record tax IDs.
  4. Users and Access: list every user and role (Account Holder, Admin, App Manager, Developer, Marketing, Customer Support, Finance, …). Confirm 2FA is required. If you are the only user, write that on the NAS note. Do not invent invitees.
  5. Confirm Apple ID 2FA is on, and that the recovery key / trusted-phone procedure lives in Apple Passwords (location only on the NAS note).
  6. Confirm a monitored review/support contact class exists in controlled records (SafeCall channel; no standalone Keryx mailbox). Do not paste the mailbox into git.

Part B — Play org (OA-114-play-org) ​

App Keryx for SafeCall / com.sourcectl.keryx already exists (CZ-only, Internal testing). Verify. Do not recreate. Do not start Production.

  1. Open Play Console as the account owner.
  2. Confirm the organization / developer account is the approved publisher. Legal identity and public developer contacts stay in the console.
  3. Users and permissions: list admins vs release managers (or the Play-equivalent account-owner / admin / release roles). If you are the only user, write that on the NAS note.
  4. Confirm 2FA on the Google account and that recovery (backup codes / recovery mailbox) lives in Apple Passwords or the Google account recovery flow — location only on the NAS note.
  5. Confirm no Production release is rolled out. Internal testing may stay as it is. Do not paste listing copy.

Part C — EU trader (OA-114-eu-trader) ​

P0-02 already decided: sourcectl acts as an EU trader for Czech distribution. This part declares that in ASC. #125 still owns the final listing / disclosure paste.

  1. In App Store Connect open Keryx for SafeCall → App Information (or the account Business / compliance banner if Apple shows the trader form there).
  2. Declare the trader as sourcectl / SOURCE CONTROL SINGLE MEMBER P.C. Enter the public business address, phone, and email in ASC only.
  3. Put the same public contact class in Apple Passwords (not git).
  4. In Play Console, confirm public developer phone/email and organization address are present for the existing developer account. Do not treat that as a listing paste.
  5. NAS note: “EU trader declared in ASC; Play public developer contacts present; values not in git.”

Release-record template ​

The runbook field list is now a fillable file: templates/release-record.md.

  1. Copy it to NAS evidence/keryx/ when you cut a store candidate (bun keryx or bun run release:keryx).
  2. Fill placeholders. Leave unknown soak / listing / rating fields blank.
  3. Never paste private keys, passwords, tk_…, or real client QR payloads into the filled copy or into GitLab.

Adopting the template in git satisfies the #114 “adopt release-record template from runbook” AC. A filled NAS stub is optional proof, not a second checklist.

Evidence pack (verify + shots) ​

Walk sheet: templates/store-org-evidence-pack.md. That is the shot list, not a second operator-actions log.

Paste in chat (safe): role-name pages, agreement Active/Accepted (crop tax IDs), Play users/permissions, Play track list showing no Production rollout, ASC/Play app-identity pages that show Keryx for SafeCall + CZ-only without contact fields.

Do not paste in chat (NAS or console only): EU trader form with address / phone / email visible, tax/banking, recovery key, 2FA QR, backup codes, passwords, listing copy.

OA-114-apple-org / play-org / eu-trader and #114 are done (13 September 2026). Residual Apple Account Recovery is #158.