R01: Establish production identity, EAS build authority, and signing recovery

[TheDarkSkyXD]

Parent

Build StreamFusion Mobile for Android

What to deliver

Registered com.thedarkskyxd.streamfusion identity, separate development identity, StreamFusion Expo ownership, committed versions, controlled EAS build start, and recovered production signer proof.

Capability IDs

• app-updates

Code ownership

• publisher
• release
• mobile

Acceptance criteria

• The behavior above works through the real Android application or the named verification/release path; code presence alone is insufficient.
• Each affected capability has an updated Android Parity Record bound to the current Desktop Baseline and Android candidate.
• The implementation respects the approved responsibility layers and adapter boundaries owned by this ticket.
• Required evidence is indexed: production-app-id, environment-isolation, signer-fingerprint, two-backups, recovery-drill, committed-version.
• External, lifecycle, persistence, native, or release boundaries define and verify safe failure containment, retry, fallback, disablement, rollback, or forward-fix behavior as applicable.
• The normal Change Gate passes with no untracked architecture exception, quarantined required test, or Development Exception.

Blocked by

• F03: Create the Android Expo development-client build path
• F04: Create the evidence catalog and verifier foundation

Sources

• Approved implementation specification
• Approved implementation roadmap
• Machine-readable ticket graph

[TheDarkSkyXD]

Human publisher action required

R01 needs account, identity, and private-key custody actions that cannot be performed by an agent. This is a private production build setup, not a public release.

Stage 1: create the authorities

1. Create or verify the project owner's individual full-distribution Android Developer Console identity.
2. Use a dedicated browser profile. Enable MFA, enroll two hardware security keys, and store offline account-recovery codes securely.
3. Create or confirm the StreamFusion Expo organization.
4. Create the production Expo project in that organization, separate from the existing development identity com.thedarkskyxd.streamfusion.dev.
5. Post only these safe identifiers here:
   • Expo organization slug
   • production Expo project slug
   • production EAS project ID
   • confirmation that Android Developer Console identity verification is complete
   • confirmation that the two hardware keys, offline recovery codes, MFA, and dedicated browser profile are configured

Once those safe identifiers are present, the agent can commit the production application ID, EAS ownership/project linkage, production APK profile, locally committed versionName and monotonic versionCode, and development/production isolation checks.

Stage 2: create and recover the production signer

After the production configuration is committed:

1. Explicitly start the production Android EAS cloud APK build from that exact commit. Allow EAS to generate one new signing key dedicated only to com.thedarkskyxd.streamfusion. Do not reuse a Desktop or other Android key.
2. Download the production Android credentials using eas credentials. Never commit the downloaded keystore or credentials.json.
3. Store two independently encrypted offline keystore backups in separate storage locations. Store the keystore passwords, key alias, creation details, and recovery procedure only in the approved secret manager.
4. Register com.thedarkskyxd.streamfusion and the public signing-certificate SHA-256 fingerprint in Android Developer Console. Complete its signed-APK ownership challenge if requested, and wait until the package/key status is Registered.
5. Restore one backup in an isolated environment, sign a non-production test artifact, then run apksigner verify --print-certs. The restored signer fingerprint must match the registered production fingerprint.
6. Post the final safe evidence using the handoff template below.

Final handoff template

Start the comment with:

R01 PUBLISHER HANDOFF COMPLETE

Include:

• production package registration status
• confirmation that development and production identities are isolated
• Expo organization slug, project slug, and EAS project ID
• public signing certificate and SHA-256 fingerprint
• confirmation that two encrypted backups exist in separate locations, without naming private locations
• recovery-drill date, pass result, test-artifact SHA-256, and matching signer fingerprint
• production EAS build ID and a query-free HTTPS build URL
• exact 40-character source commit, versionName, and versionCode
• confirmation of two hardware keys, offline recovery codes, MFA, and dedicated browser profile
• No credentials, private keys, passwords, recovery codes, or private account data are included.

Never post

• keystore files or encrypted backups
• keystore/key passwords, aliases, recovery procedures, or storage locations
• hardware-key serials or recovery codes
• Expo, GitHub, Google, or FCM tokens and credentials
• raw eas credentials output
• identity documents, payment details, private email addresses, or account-recovery data
• screenshots containing private account details, local paths, device serials, environment names, or tokenized URLs

The certificate and SHA-256 certificate fingerprint are public. The private signing key is not.

Official references:

• Android Developer Console registration: https://developer.android.com/developer-verification/guides/android-developer-console
• Expo organization ownership: https://docs.expo.dev/accounts/account-types/
• Expo Android credential download: https://docs.expo.dev/app-signing/app-credentials/