Publishing keryx

This guide covers publishing keryx from the sourcectl.com business accounts to the Apple App Store and Google Play Store.

Release Identity

• App name: keryx
• Android application ID: com.sourcectl.keryx
• iOS bundle ID: com.sourcectl.keryx
• Project path: keryx/
• Version source: keryx/pubspec.yaml

Before every release, update version in keryx/pubspec.yaml:

version: 1.0.1+2

The part before + is the public version. The number after + is the build number and must increase for each uploaded build.

Store Listing Checklist

Prepare these values before opening either store console:

• App name: keryx
• Short description: SafeCall safety notifications for your building.
• Long description: explain that keryx scans a SafeCall dashboard QR code, stores the notification setup locally, and displays SafeCall safety notifications.
• Category: Business, Productivity, or Medical depending on the deployment context and local compliance review.
• Support URL: sourcectl.com support or product support page.
• Privacy policy URL: sourcectl.com privacy policy page that covers camera use, local storage, notifications, and ntfy network connections.
• Contact email: sourcectl.com support mailbox.
• Screenshots: onboarding empty state, QR scan screen, notification list, and advanced settings screen.
• Release notes: summarize the QR provisioning and SafeCall notification behavior.

Privacy Notes

keryx uses:

• Camera access to scan SafeCall dashboard QR codes.
• Notification permission to display SafeCall alerts.
• Network access to receive SafeCall alerts from the configured notification server.
• Local storage for the configured notification server URL, selected notification channels, labels, pause state, and recent notification history.

keryx does not need SafeCall admin JWTs, server-side MQTT credentials, or a user account in the mobile app. Do not include those secrets in QR payloads or store listing screenshots.

Apple App Store

Use the existing Apple Developer business account for sourcectl.com.

1. Confirm bundle identity:

   • Bundle ID: com.sourcectl.keryx
   • Display name: keryx
   • Signing team: sourcectl.com Apple Developer team

2. Create or verify the App Store Connect app record:

   • Platform: iOS
   • Bundle ID: com.sourcectl.keryx
   • SKU: an internal sourcectl.com SKU such as keryx-ios
   • Primary language: choose the production listing language.

3. Configure signing:

   • Open keryx/ios/Runner.xcworkspace in Xcode if automatic signing needs adjustment.
   • Select the Runner target.
   • Set the sourcectl.com team.
   • Ensure the bundle identifier remains com.sourcectl.keryx.

4. Build an IPA:

cd keryx
flutter clean
flutter pub get
flutter analyze
flutter test
flutter build ipa --release

5. Upload:

   • Use Xcode Organizer, Transporter, or App Store Connect upload tooling for the generated IPA/archive.
   • Wait for processing in App Store Connect.
   • Add the build to TestFlight first for internal testing.

6. Complete App Store privacy and review metadata:

   • Camera: QR code scanning for provisioning.
   • Notifications: SafeCall alert display.
   • Data collection: mark no personal data collection unless sourcectl.com adds analytics or account login later.
   • Network use: notification server connections configured by the organization.
   • Provide review notes explaining that testers need a SafeCall dashboard-generated QR code to configure the app.
   • Ensure Push Notifications capability is enabled for com.sourcectl.keryx.
   • Ensure Background Modes includes Remote notifications.
   • Confirm the configured ntfy server has Firebase/APNs upstream push credentials and message caching if real-time killed-state iOS delivery is required.
   • Confirm APNs poll_request wakes cause keryx to poll cached messages from the configured ntfy topics.

7. Submit:

   • Run internal TestFlight smoke tests.
   • Attach final screenshots and release notes.
   • Submit for App Review.

Google Play Store

Use the existing Google Play Console business account for sourcectl.com.

1. Confirm Android identity:

   • Application ID: com.sourcectl.keryx
   • App label: keryx

2. Configure Play App Signing:

   • Use Google Play App Signing for production.
   • Create and store the upload keystore outside the repo.
   • Do not commit keystore files, passwords, or signing properties.

3. Configure release signing locally:

   • Create a local key.properties or equivalent secure signing setup outside version control.
   • Wire release signing only through ignored/local files.
   • Keep debug signing for local development only.

4. Build an Android App Bundle:

cd keryx
flutter clean
flutter pub get
flutter analyze
flutter test
flutter build appbundle --release

5. Upload:

   • Create the app in Play Console with package name com.sourcectl.keryx.
   • Upload build/app/outputs/bundle/release/app-release.aab.
   • Start with Internal testing, then Closed testing or Production.

6. Complete Google Play Data Safety:

   • Camera: used only for QR code scanning.
   • Device or other IDs: no collection unless added later.
   • Personal info: no collection unless added later.
   • App activity: no analytics unless added later.
   • Data sharing: no sharing unless added later.
   • Security practices: data is encrypted in transit when using HTTPS ntfy servers; configured topics are stored locally on device.
   • Foreground service: disclose that Android uses a foreground service to keep SafeCall alerts active in the background and attempts to restart it after reboot.
   • Battery optimization: note that some OEMs may require unrestricted battery use for reliable closed-state delivery.

7. Complete app content:

   • Privacy policy URL.
   • Target audience and content rating.
   • Data safety form.
   • App access instructions explaining QR provisioning.
   • Store listing screenshots and descriptions.

8. Roll out:

   • Test internal release on physical Android devices.
   • Confirm camera permission, notification permission, QR scan, saved topics, and alert delivery.
   • Promote gradually to production.

Pre-Submission Smoke Test

Run this checklist on a real iOS and Android device before store submission:

1. Generate a keryx QR code from the SafeCall admin dashboard.
2. Install the release build.
3. Scan the QR code.
4. Confirm the notification list is displayed without server URLs or topic names.
5. Confirm the app starts receiving automatically and shows an empty notification list.
6. Publish a test ntfy message to one selected topic.
7. Confirm the app displays a local notification and recent alert entry.
8. Mark notifications read and confirm they move from Active to Archive while the app remains configured.
9. Pause and resume notifications from advanced settings.
10. Minimize the Android app and confirm the foreground service notification remains visible.
11. Publish another test message and confirm Android receives it while minimized.
12. Reboot the Android device without opening keryx and confirm the foreground service restarts after unlock.
13. Publish another test message and confirm Android receives it after reboot. If it does not, allow unrestricted battery use for keryx and repeat.
14. Pause notifications, reboot Android, and confirm the foreground service does not restart while paused.
15. On iOS, confirm background delivery according to the configured ntfy server push support; without APNs/Firebase upstream support, confirm missed messages appear after reopening the app.
16. Scan a new QR code from advanced settings, then use Reset App and confirm the onboarding screen returns.