amadan
Provision Ocho with Team Tito app identifiers
4 files changed,
+14
−9
apple/README.md+4 −4apple/project.yml+4 −4docs/infinity/status.md+5 −0internal/infinityhome/apple.go+1 −1
Intent
diff --git a/apple/README.md b/apple/README.md| index f89421f..2ac713f 100644 |
| --- a/apple/README.md |
| +++ b/apple/README.md |
| @@ -15,7 +15,7 @@ tools/infinity/check-native-ui |
| The last command uses two disposable local personal processes and a dedicated iPhone simulator (override `OCHO_SIMULATOR_ID`). It verifies native receipt/composition/send, peer decryption and zero WebViews. The package tests cover Web Crypto interoperability, group integrity, restored history and read-only legacy migration. |
| -Build the generated `Infinity` or `InfinityMac` Xcode scheme. Device signing needs a team/profile for `chat.ocho.infinity` or `chat.ocho.infinity.mac`, with `webcredentials:ocho.chat` and the matching server association. Both apps display **Ocho**. Physical passkey ceremonies need user presence and a PRF-capable provider; unsupported providers retain explicit recovery-file fallback. |
| +Build the generated `Infinity` or `InfinityMac` Xcode scheme. Device signing needs a team/profile for `chat.ocho.app` or `chat.ocho.app.mac`, with `webcredentials:ocho.chat` and the matching server association. Both apps display **Ocho**. Physical passkey ceremonies need user presence and a PRF-capable provider; unsupported providers retain explicit recovery-file fallback. |
| ## Existing accounts |
| @@ -27,8 +27,8 @@ The icon uses the outlined Myriad Pro infinity glyph. No font file is distribute |
| ## Team Tito signing — 2026-09-07 |
| -The project defaults to **Team Tito Limited**, team `9U4A84C4WK`, at Paul's request. Provisioning is not yet complete: Xcode rejected the saved `accounts@tito.io` login. Reauthenticate that account in Xcode Settings → Accounts, then build with automatic signing and `-allowProvisioningUpdates`. |
| +The project defaults to **Team Tito Limited**, team `9U4A84C4WK`. Xcode's `accounts@tito.io` login was refreshed successfully. Apple rejected registration of the old personal-team identifier, so the team apps use `chat.ocho.app` (iOS), `chat.ocho.app.mac` (Mac), and `chat.ocho.app.uitests` (UI tests). The display name remains Ocho. Build 4 is the first team build. |
| -The existing bundle identifiers are retained provisionally. After login, verify whether Apple permits Team Tito to register them. An unpublished app cannot use Apple's normal App Store app-transfer flow; if the identifiers remain bound to the old team, use new Team Tito identifiers and update the association accordingly. Do not delete existing registrations or installed apps to work around this. |
| +Open the generated project and build with automatic signing, or use `xcodebuild ... -allowProvisioningUpdates`. Team members need repository access and access to Team Tito's Certificates, Identifiers & Profiles in their Apple account. Do not commit certificates, private keys or provisioning profiles. |
| -The prepared webcredentials association includes both the existing personal-team apps and Team Tito apps. It is not deployed yet; first verify the actual signed application identifiers. A team change alters Keychain access, so preserve the existing installed app until the account is recoverable through a passkey or encrypted recovery file. Do not assume a team-signed replacement can read the old identity. No App Store Connect record transfer, TestFlight upload or team-member invitation has been performed by this change. |
| +The webcredentials association includes both personal-team installations and the new Team Tito applications. The new bundle IDs and team create separate application/Keychain containers. Preserve the existing installation and recover the account in the team build using a passkey or encrypted recovery file; do not assume it can read the old app's identity. No existing registrations or app data were deleted. App Store Connect records, TestFlight upload and invitations remain separate distribution steps. |
diff --git a/apple/project.yml b/apple/project.yml| index 9a58dc5..b58deef 100644 |
| --- a/apple/project.yml |
| +++ b/apple/project.yml |
| @@ -8,7 +8,7 @@ settings: |
| base: |
| SWIFT_VERSION: '5.0' |
| MARKETING_VERSION: '0.2.0' |
| - CURRENT_PROJECT_VERSION: '3' |
| + CURRENT_PROJECT_VERSION: '4' |
| GENERATE_INFOPLIST_FILE: YES |
| ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon |
| CODE_SIGN_STYLE: Automatic |
| @@ -27,7 +27,7 @@ targets: |
| - path: Infinity |
| settings: |
| base: |
| - PRODUCT_BUNDLE_IDENTIFIER: chat.ocho.infinity |
| + PRODUCT_BUNDLE_IDENTIFIER: chat.ocho.app |
| CODE_SIGN_ENTITLEMENTS: Infinity/Infinity.entitlements |
| TARGETED_DEVICE_FAMILY: '1,2' |
| INFOPLIST_KEY_UILaunchScreen_Generation: YES |
| @@ -53,7 +53,7 @@ targets: |
| - path: InfinityMac |
| settings: |
| base: |
| - PRODUCT_BUNDLE_IDENTIFIER: chat.ocho.infinity.mac |
| + PRODUCT_BUNDLE_IDENTIFIER: chat.ocho.app.mac |
| ENABLE_APP_SANDBOX: YES |
| ENABLE_HARDENED_RUNTIME: YES |
| CODE_SIGN_ENTITLEMENTS: InfinityMac/InfinityMac.entitlements |
| @@ -76,7 +76,7 @@ targets: |
| - package: OchoCore |
| settings: |
| base: |
| - PRODUCT_BUNDLE_IDENTIFIER: chat.ocho.infinity.uitests |
| + PRODUCT_BUNDLE_IDENTIFIER: chat.ocho.app.uitests |
| GENERATE_INFOPLIST_FILE: YES |
| INFOPLIST_KEY_NSAppTransportSecurity: { NSAllowsLocalNetworking: true } |
| schemes: |
diff --git a/docs/infinity/status.md b/docs/infinity/status.md| index 45b27d0..63cf8a2 100644 |
| --- a/docs/infinity/status.md |
| +++ b/docs/infinity/status.md |
| @@ -40,3 +40,8 @@ Machine tooling and cross-session delivery limits are recorded in `android-hando |
| ## Team Tito preparation — 2026-09-07 |
| Paul requested development ownership under Team Tito Limited (`9U4A84C4WK`). The Xcode project now defaults to that team, and the source associated-domain response retains personal-team entries while adding provisional Team Tito entries. These association changes have not been deployed. The signed build attempt failed because Apple rejected Xcode's saved `accounts@tito.io` login; no Team Tito provisioning profiles were available for Ocho. Reauthentication is required before checking identifier availability, producing signed builds and completing account migration. Existing installed apps and account data remain intact. See the Apple README for the exact next steps and unpublished-app transfer constraints. |
| + |
| + |
| +### Team Tito login resolved |
| + |
| +Apple accepted the refreshed Xcode login. Registration of `chat.ocho.infinity` under Team Tito was rejected as unavailable, so team builds now use `chat.ocho.app` and `chat.ocho.app.mac` (display name Ocho, build 4). The iOS development provisioning profile identifies Team Tito Limited and `9U4A84C4WK.chat.ocho.app`; the signed app includes `webcredentials:ocho.chat`. Existing apps remain installed and their account data is untouched. Restoring the same account in a team build requires passkey/recovery because the app and Keychain containers differ. The source association now lists the actual new team identifiers alongside the old personal ones. |
diff --git a/internal/infinityhome/apple.go b/internal/infinityhome/apple.go| index ff61546..d15417d 100644 |
| --- a/internal/infinityhome/apple.go |
| +++ b/internal/infinityhome/apple.go |
| @@ -7,6 +7,6 @@ func appleAssociation(w http.ResponseWriter, r *http.Request) { |
| // Keep existing installations associated while Team Tito builds are provisioned. |
| write(w, 200, map[string]any{"webcredentials": map[string]any{"apps": []string{ |
| "J5NDF5PCD8.chat.ocho.infinity", "J5NDF5PCD8.chat.ocho.infinity.mac", |
| - "9U4A84C4WK.chat.ocho.infinity", "9U4A84C4WK.chat.ocho.infinity.mac", |
| + "9U4A84C4WK.chat.ocho.app", "9U4A84C4WK.chat.ocho.app.mac", |
| }}}) |
| } |