Skip to content

Tier 4 Onset T5-0 Report — iOS archive readiness (1.2.22 / R940)

Status: STOP — audit only; no pointer flip, no archive, no submit
Date: 2026-08-30
Repo audited: onset-ios main @ 9825d3f
Last App Store shipped: 1.2.21 build 6 (ab24c7c)
T5-1 gate: Waits for T-4 close (Gate T4-R) + explicit Ryan authorization

Executive summary

Area Current state T-5 requirement
Release backend pointer Hosted (emxrmjys…) Flip to R940 public Supabase hostname + R940 anon key
Apple Sign-In pairing App → hosted GoTrue → RV26UG9967 (expected) App → R940 GoTrue → TU6S85XABQ (R940 ready since Gate E)
Version in repo 1.2.22 build 7 Likely build 8 at archive (build 7 used for Gate E TestFlight)
Archive scheme Onset / Release / display Onset Same — do not use Onset Staging
Public R940 Supabase edge Not built Blocker before T-5-1 (cannot use Tailscale or LAN IP)

No repo changes were made during this audit.

1. Backend pointer (Release / Production.xcconfig)

Current Release state — HOSTED (pre-T5, as expected)

Key Value
SUPABASE_HOST emxrmjysvxeboavhatry.supabase.co
SUPABASE_URL https://emxrmjysvxeboavhatry.supabase.co
SUPABASE_ANON_KEY sb_publishable_U7-odJqFhmJiHmSCvYmh6g_FW4FwueX

Source: Production.xcconfig on main (9825d3f).

Staging pointer — reverted to hosted (Gate E closeout)

Key Value
SUPABASE_HOST lzpyfohgfdohrtlamzek.supabase.co
SUPABASE_ANON_KEY `sb_publishable_1O60Z8IwiF1zxvN9PFhMIw_foIm3OnA

Commit 9825d3f reverted temporary Gate E R940 staging pointer. Staging and Release are both on hosted Supabase again.

Change since last App Store (1.2.21)

Production anon key migrated from legacy JWT to sb_publishable_* format (e186dbc). Host ref unchanged.

T-5-1 required flip (Production.xcconfig only)

  1. SUPABASE_HOST → public R940 hostname (recommended: onset-db.last1.enterprises via onset-edge tunnel → Kong :8000 on VM 119). Not provisioned yet — clinic tunnel exists (clinic.theonset.app); Supabase public ingress does not.
  2. SUPABASE_ANON_KEY → ONSET_DB_PROD_SUPABASE_ANON_KEY from BWS (JWT issued at R940 stack init; not sb_publishable_* unless R940 keys are migrated separately).
  3. Do not touch Staging.xcconfig for T-5 (rollback net stays on hosted staging).

Smoke before archive: curl https://<public-host>/auth/v1/settings returns apple: true from the public internet (not Tailscale-only).

2. Apple Sign-In key

iOS app

The iOS binary does not embed a .p8 or key ID. Sign in with Apple uses:

  • Entitlement: com.apple.developer.applesignin = Default (Supporting/Onset.entitlements)
  • Server-side validation on whichever Supabase GoTrue the app’s SUPABASE_URL hits

Backend pairing (must match at T-5)

Backend GoTrue Apple key Status
Hosted prod (emxrmjys…) RV26UG9967 (legacy) Still configured on hosted; not updated during Gate E
R940 (onset-db VM 119) TU6S85XABQ Configured Gate E; device-proven on TestFlight over Tailscale

Current pre-T5 pairing (consistent)

Release app → hosted Supabase → hosted GoTrue → RV26UG9967

This matches what App Store users run today. No iOS-side key change in 1.2.22.

T-5 pairing (must flip together)

Release app → R940 public Supabase → R940 GoTrue → TU6S85XABQ

R940 GoTrue is ready. Hosted prod Apple config was intentionally left on RV26UG9967 as rollback net until T-5.

Ryan action (pre/post T-5): Confirm RV26UG9967 revoked in Apple Developer → Keys if not already done when TU6S85XABQ was issued.

3. Version + build

Field Repo (main) Last App Store Notes
CFBundleShortVersionString / MARKETING_VERSION 1.2.22 1.2.21 Bump commit 55370e0
CFBundleVersion / CURRENT_PROJECT_VERSION 7 6 Bump with 1.2.22 prep

All native targets share the same version literals (scripts/production_checks.py enforces alignment).

T-5-1 build number recommendation

Gate E uploaded Onset Staging TestFlight 1.2.22 (7) against R940 (same bundle ID com.last1enterprises.Onset). App Store Connect may reject a second upload at build 7.

Recommend: ./scripts/ios-version.py set-build 8 (or Xcode bump) immediately before T-5-1 archive.

Marketing version 1.2.22 is already correct; no marketing bump required unless product wants 1.2.23 for the sovereign cutover narrative.

4. Archive config

Scheme and build configuration

Setting App Store archive Wrong path
Scheme Onset Onset Staging
ArchiveAction buildConfiguration Release Release-Staging
xcconfig Production.xcconfig Staging.xcconfig
Display name Onset Onset Staging
ONSET_STAGING compile flag Absent Present on Release-Staging
Fitness / protocolEngineV2 internal UI Off in Release On in Debug / Release-Staging

Evidence: Onset.xcodeproj/xcshareddata/xcschemes/Onset.xcscheme → ArchiveAction buildConfiguration = Release.

“Internal Only” / TestFlight distribution lesson

Not encoded in the repo. It is an Organizer → Distribute App choice at upload time.

For App Store submission (T-5-1):

  1. Product → Archive with Onset scheme (not Onset Staging).
  2. Organizer → Distribute App → App Store Connect → Upload.
  3. Do not restrict the build to Internal Testing only if the goal is App Store review / public release. Internal-only distribution limits TestFlight visibility and does not substitute for selecting the build on the App Store version record.
  4. After processing, attach build to the App Store version and Submit for Review.

Reference: Onset/APP_STORE_SUBMISSION.md § “App Store Connect — archive, upload, metadata, submit”; docs/ENVIRONMENTS.md iOS build configuration map.

Signing (Mac verification required)

From project.pbxproj (not verified on device — audit ran off-repo clone):

Setting Value
CODE_SIGN_STYLE Automatic
DEVELOPMENT_TEAM A5TF9D2CT7
Main bundle ID com.last1enterprises.Onset
Entitlements file Supporting/Onset.entitlements

Ryan on Mac before T-5-1: Xcode → Settings → Accounts → Manage Certificates — confirm Apple Distribution cert valid; Automatic signing resolves App Store provisioning profile for com.last1enterprises.Onset (+ watch/widget extensions).

5. Review-sensitive changes (App Review notes)

Likely needs review notes at T-5-1

  1. Backend infrastructure migration: Production Supabase moves from hosted (emxrmjys…) to self-hosted R940. No user-facing feature change; existing accounts and data preserved via Gate B restore. Suggest note: “Backend URL change only; auth and data continuity tested on TestFlight.”
  2. Sign in with Apple server key rotation: GoTrue Apple auth key rotates from RV26UG9967 to TU6S85XABQ on the production backend. No iOS binary change for the key; Apple may still ask because SIWA behavior depends on server config. Suggest note: “Sign in with Apple continues to work; server-side auth key rotated during infrastructure migration. Test account available on request.”

No change vs 1.2.21 (entitlements / permissions)

Supporting/Onset.entitlements unchanged in diff ab24c7c..9825d3f:

  • Sign in with Apple
  • HealthKit (read/update usage strings unchanged in Release block)
  • Associated domains (theonset.app, affiliate link)
  • App group group.com.last1enterprises.onset

No new capabilities, background modes, or permission strings in the iOS delta.

GitGuardian (resolve at T-5, not blocking archive prep)

Incident Context
GG 29340466 Legacy JWT in prod xcconfig (pre-sb_publishable migration)
GG 34103515 Staging xcconfig

Apple .p8 keys are not in onset-ios (Gate E confirmed).

6. What is in 1.2.22 vs last App Store (1.2.21 build 6)

Diff base: ab24c7c (last shipped) → 9825d3f (main).

User-visible iOS changes

Change Commits Review risk
Last1 ID button: Last1 mark + “Continue with Last1 ID” copy 1499bd4, 53f045d Low — cosmetic OAuth entry
SettingsView refactor (CI type-check) 8388e78, 197b161 None — no behavior change
Swift 6 / MainActor CI fixes 8229436, 2777ecc None
Supabase anon key format → sb_publishable_* in xcconfigs e186dbc Low — same hosted backend
Version 1.2.21 → 1.2.22, build 6 → 7 55370e0, ab24c7c.. Routine

Repo changes not in App Store binary (backend / ops)

  • Supabase SQL migrations, RPC/RLS hardening (5562289, b700055)
  • Marketing email platform migrations (0d14dc2, b64c869)
  • Gate E staging R940 pointer (a414fb6) — reverted (9825d3f)
  • CI / Release Gate fixes (1737c95, b079dda, etc.)

Not in 1.2.22 iOS delta

  • No .p8 file in iOS repo
  • No R940 backend pointer in Release (still hosted until T-5-1)
  • No new entitlements

Extended review triggers

Trigger Applies to T-5-1?
SIWA server key + backend migration Yes — primary review note
HealthKit No change
Subscriptions (RevenueCat / StoreKit) No change
Last1 ID OAuth UI polish Minor; already in 1.2.22 binary even if T-5 ships same marketing version

T-5-1 checklist (do not execute until authorized)

Prerequisites:

  • [ ] Gate T4-R pass (T-4 pass from Ryan browser E2E on https://clinic.theonset.app)
  • [ ] Public R940 Supabase hostname live + TLS smoke from internet
  • [ ] Ryan T-5 go authorization

Execution (Mac):

  1. [ ] Flip Production.xcconfig → R940 public host + ONSET_DB_PROD_SUPABASE_ANON_KEY
  2. [ ] Bump build to 8 (if build 7 already in ASC)
  3. [ ] Commit + push (or local-only archive if Ryan prefers — document either way)
  4. [ ] Pull main on Mac; Onset scheme → Release → Archive
  5. [ ] Distribute → App Store Connect → Upload (not internal-only restriction)
  6. [ ] App Review notes (backend migration + SIWA server key)
  7. [ ] Submit for review after build processes
  8. [ ] Post-ship: hosted Supabase teardown per migration plan (separate gate)

Rollback net until T-5 ships: hosted Supabase prod + Railway clinic DNS revert path remain live per T4 cutover report.

References

  • Gate E report — Apple TU6S85XABQ, E-3 device proof, staging revert
  • T4 cutover report — iOS Release still hosted
  • T-1 report — public Supabase hostname recommendation
  • onset-ios/docs/ENVIRONMENTS.md — scheme / xcconfig map
  • onset-ios/Onset/APP_STORE_SUBMISSION.md — archive + ASC workflow