Store org / EU trader evidence pack

Walk sheet for #114 OA-114-apple-org / play-org / eu-trader. How-to: store-org-and-eu-trader.md. Not a second operator-actions log.

Do not create a second app record. Do not start Play Production or App Review. Do not paste listing copy. Do not invent a second Account Holder.

Never put street address, phone, email, tax IDs, recovery-key text, 2FA QR, backup codes, or passwords in git, chat, or this file.

Where to put the shot	Allowed
This chat	Role names, Active/Accepted agreements (crop tax), app identity / CZ-only, Play users, Play tracks with no Production
NAS evidence/keryx/	Same safe shots, plus a secret-free 2026-09-13-store-org-eu-trader.txt
Console / Apple Passwords only	Address, phone, email, tax IDs, recovery key, backup codes

Suggested NAS filenames use today’s date. Crop or blur contact fields before any shot that might show them.

A — Apple org (OA-114-apple-org)

Verify (do not type the values into chat):

• [ ] Apple Developer legal entity is SOURCE CONTROL SINGLE MEMBER P.C. on team 8P59575P2K
• [ ] Account Holder is Thomas Minitsios (only user is OK; write that)
• [ ] ASC Agreements, Tax, and Banking: Free Apps Active / Accepted
• [ ] Users and Access lists every user and role (Account Holder, Admin, Developer, Marketing, Support, …)
• [ ] Apple ID 2FA is on
• [ ] Recovery key / trusted-phone procedure lives in Apple Passwords (location only)
• [ ] Review/support contact class is the SafeCall channel (no standalone Keryx mailbox)

Upload here (crop emails if the table shows them):

ID	Shot
A1	Apple Developer membership / team 8P59575P2K / legal-entity name (no address)
A2	ASC Agreements: Free Apps Active / Accepted (no tax IDs)
A3	Users and Access: user count + role names
A4	Any 2FA-required / security setting that does not show the recovery key

Where to click (A4). There is no 2FA page in App Store Connect. Use the Apple Account that signs in as Account Holder:

1. On GLaDOS: System Settings → click your name → Sign-In & Security.
2. Screenshot the row Two-Factor Authentication showing On. Do not open Recovery Key. Crop any phone numbers.
3. Or on the web: account.apple.com → Sign-In & Security → same row.

Do not upload: recovery key, trusted-phone numbers, tax/banking.

B — Play org (OA-114-play-org)

Verify:

• [ ] Play developer account is the approved publisher for Keryx for SafeCall / com.sourcectl.keryx
• [ ] Users and permissions: account owner / admin / release-manager roles listed (only user is OK; write that)
• [ ] Google account 2FA is on
• [ ] Recovery (backup codes / recovery mailbox) lives in Apple Passwords or Google account recovery — location only
• [ ] No Production release is rolled out
• [ ] App availability is still Czech Republic only

Upload here:

ID	Shot
B1	Play Console app dashboard: Keryx for SafeCall, package com.sourcectl.keryx
B2	Users and permissions: role names (crop emails)
B3	Release / testing tracks showing Internal (or Closed) and no Production rollout
B4	Countries / availability: Czech Republic only (no listing copy)

Where to click (Play). Start at play.google.com/console as the account owner.

• B2: Left sidebar, account Settings (gear) → Users and permissions. This is on the developer account, not inside the app. Crop emails.
• B3: Open Keryx for SafeCall → left Test and release → Testing → Internal testing. Then Test and release → Production and confirm it is empty / not rolled out. Do not press Review or Start rollout.
• B4: Still in the app → Test and release → Production → Countries/regions. Expect Czech Republic only. If Production has no countries yet: Test and release → Testing → Internal testing → Countries/regions.
• Play 2FA (text confirm, or a cropped shot): not in Play Console. Open myaccount.google.com/security → 2-Step Verification showing On. Crop phone numbers and backup codes.

Do not upload: organization address, public developer phone/email, backup codes.

C — EU trader (OA-114-eu-trader)

Verify (values stay in ASC / Play / Apple Passwords):

• [ ] ASC trader declared as sourcectl / SOURCE CONTROL SINGLE MEMBER P.C.
• [ ] Public address, phone, and email are filled in ASC
• [ ] Same public contact class is in Apple Passwords
• [ ] Play public developer phone/email and organization address are present in the console
• [ ] Nothing from those fields was pasted into git or chat

Upload here only if you can crop away address, phone, and email:

ID	Shot
C1	ASC EU Digital Services Act / trader page showing status = declared (crop the contact block)
C2	Optional: Play developer-account page showing contacts exist, with the contact block cropped

If you cannot crop the contact block, skip C1/C2 in chat. Write on the NAS note: “EU trader declared in ASC; Play public contacts present; values not in git.”

NAS note (required)

Upload via File Browser to evidence/keryx/2026-09-13-store-org-eu-trader.txt (nas-unlock.md if the share is empty). Example — do not add real values:

Date: 13 September 2026
A: Apple entity / agreements / Account Holder / Users and Access / 2FA verified.
   Users: 1 (Account Holder). Recovery: Apple Passwords.
B: Play org / roles / 2FA verified. Users: 1 (owner). No Production.
C: EU trader declared in ASC. Play public developer contacts present.
   Values: ASC / Play / Apple Passwords. Not in git.
Concentration: Thomas is Account Holder, Play owner, and P0-05 backup.
   MiniVan-3 is the second Mac.

Optional: copy release-record.md to the same folder and fill checksums you already have. Leave soak / listing / rating blank.

After the safe shots land in chat

OA-114-apple-org / play-org / eu-trader and #114 closed 13 September 2026. Apple Account Recovery is later #158. Leave #117, #124, and #125 open.