Make the iPhone app ready for TestFlight and the App Store

[frahlg]

Problem

#8 gives the iPhone app pairing, Now and widgets, but not what TestFlight and the App Store need from the app itself. The app store permission in #10 asks that the license and an offer of the exact version's source be reachable in the app. App Review needs a way in without a box. And the app lacks a privacy manifest, an export answer, a launch screen and an iOS 26 icon.

This branch makes the app ready for TestFlight and the App Store in every country. A parallel session builds the release pipeline (Actions, RELEASING.md, store text and the privacy policy).

Change

1. Source & licenses (FTW/About/, FTWKit/Identity/BuildSource.swift, LicenseText.swift)

• A Copy Files phase copies LICENSE, NOTICE and LICENSING.md from the repository root into FTW.app/Licenses/. These are the root files themselves, not copies kept in the app folder.
• A script phase writes the commit to Licenses/REVISION:
  • FTW_SOURCE_REVISION if set. CI passes GITHUB_SHA. Anything but 40 lower-case hex digits fails the build.
  • Else git rev-parse HEAD.
  • A tree with changes, or no git at all, is a local build. The screen says "Local build" and links to the repository.
• The screen shows version, build and commit. It links to tree/<commit> and blob/<commit>/LICENSE, and it shows the three texts, joined for a phone's width. A test checks that joining keeps every word of every file in order. Relative links in LICENSING.md open at the same commit.
• It shows the copyright line and the no-warranty notice, as AGPL §0 asks of an interactive program.
• Third-party code: none, and the screen says so. A test fails if Package.swift or the project gains a package.
• Origin.licenseURL, which pointed at main, is gone. BuildSource builds both links.
• The words are in English and Swedish. A test reads the views and fails on any sentence with no Swedish.

2. Remove this phone (FTW/About/RemovePhoneView.swift, FTWKit/Identity/PhoneRemoval.swift)

• protocol/registry.yaml has no op for a phone to remove itself, so none is named. Core does have DELETE /api/app-link/devices/{id} over the passthrough, but it refuses to remove the last owner over a session, which is the usual household. The box's own page always works.
• The screen does what the phone can:
  • It deletes the key, the pairing, the sealed readings and the widgets' records, then reloads the widgets. This is AppModel.leave(), which AppModelTests already covers.
  • It names the phone as the box does (Phone plus 8 characters of its key, Vault.deviceIDOnBox) and gives the three steps on the box.
• The passkey stays in the Passwords app, and the screen says so. Signalling it as unknown (ASCredentialUpdater) could delete a passkey that the web app on another device still uses.
• 5.1.1(v): it does not apply. Pairing creates no account with Sourceful: no user name and no record on any server of ours. Apple's guidance defines deletion as removing the account from the developer's records (5.1.1 account deletion, guidelines, updated June 8, 2026). The app offers removal anyway, and the review notes should say so.

3. Demo in Release. No code change was needed. FTWDemo links in every configuration, and the pairing screen offers "Try the live demo" under "Interactive demo" on a fresh install. Inside, the band reads "Live demo · simulated home" with Exit demo. Checked with a Release simulator build (release-pair-*.png).

4. Launch screen. UILaunchScreen fills with LaunchBackground, the app's surface colour (#F4F4F2 light, #0D0D0D dark). The launch screen and the first frame match.

5. Privacy manifests (FTW/PrivacyInfo.xcprivacy, FTWWidgets/PrivacyInfo.xcprivacy)

• No tracking, no tracking domains, nothing collected.
• Each executable needs its own manifest (required reasons). Reasons were checked against the Release binaries with nm -u:

API	App	Widget	Why
File timestamp, C617.1	yes	yes	CacheReader.latestSiteID sorts App Group files by contentModificationDate. C617.1 covers the app group container.
UserDefaults, CA92.1	yes	no	Only Debug builds read it today, for -FTWDemo, -FTWTab and -FTWAbout. It is declared so that adding @AppStorage cannot trip ITMS-91053.

• No disk space, boot time or keyboard APIs.
• App Privacy answer: "No, we do not collect data from this app". Apple counts data as collected when it is kept off the device in readable form beyond serving the request (App Privacy Details). Readings and commands are end to end encrypted to the household's box, and the relay keeps no record of who connected (ftw-webapp relay/README.md). Its access log deletes client addresses.
• One gap: Caddy's own error log (relay/deploy/Caddyfile, ERROR level, 3 × 10 MB) can hold a client address beside the request URI when a proxy error happens. That is diagnostics nobody uses, but it is readable and kept. Either strip addresses from that log too, which makes the answer exact, or declare "Other Diagnostic Data", not linked to the user and not used for tracking.

6. Export compliance: ITSAppUsesNonExemptEncryption = NO

• Apple: NO means only exempt encryption, which Apple frames as exempt from documentation upload (key, article). App Store Connect asks for the algorithm type (overview, outcomes). The answer is "None of the algorithms mentioned above". X25519, ChaChaPoly, SHA-256, HKDF and AES-GCM all run in CryptoKit, which ships in iOS. Noise IK is a published protocol made from those primitives, and the app implements no algorithm. Apple's outcome for encryption limited to the OS: no documents. No Apple page names CryptoKit as OS encryption in so many words; that is our reading.
• US EAR:
  • The source is public, so the encryption source code is not subject to the EAR (15 CFR 742.15(b)). Neither is object code built from it (note to 734.3(b)(2)–(3), 734.7).
  • Since the 2021 rule (86 FR 16482), only "non-standard cryptography" needs an email to BIS and NSA, and FTW uses none.
  • The fallback route is mass market under 740.17(b)(1). Its annual report (740.17(e)(3)) now covers only components and executable software, not an end-user app.
  • So there is no filing, as long as every store build comes from a public commit. That is what the source revision phase records.
• France: answering "None" brings no upload request from Apple. French law still asks for a free declaration to ANSSI a month before supplying a cryptology tool for confidentiality in France (Décret 2007-663, art. 3–5; ANSSI procedures; online since 31 March 2026). Decision for Fredrik: file it before France goes live, or leave France out of the first release.
• No lawyer has reviewed this.

7. Icon. FTW/AppIcon.icon is an Icon Composer document made from ftw-webapp/public/icons/icon.svg: the amber bolt (#FFAC41, the mark's oklch(0.82 0.16 65)) as a glass layer on #0D0D0D, with no gradient, as the mark asks. iOS draws the light, dark, tinted and clear looks from it. The archive holds 1024 px renditions for any, dark and tinted. The 1024 PNG and the ten macOS sizes are gone. The SVG says it is a placeholder mark until the real FTW icon exists.

8. Accessibility

• The new screens use system fonts and lists. The mark in the header grows with the text, and the header and the footer links stack at accessibility sizes. Headings in the license texts carry the header trait.
• The flow diagram and the price chart live in FTW/UI/, which the car session owns and is rewriting. At the largest size on this base, the diagram's nodes overlap and the demo band takes four lines (demo-now-largest-text.png). The car branch already caps the diagram and the freshness band. The rest goes to that session as concrete changes, not edits here: cap DemoBand, give the price bars VoiceOver labels and values in place of a fixed English sentence, and add accessibility actions to the tappable flow nodes.

Privacy policy and support (5.1.1(i)). The foot of Now and of pairing links the privacy policy beside Source & licenses. Source & licenses has a Privacy and support section with the privacy policy and the support page. Both pages come from srcfl/ftw-web#18: https://ftw.energy/privacy and /support, or /sv/privacy and /sv/support when the app speaks Swedish. ftw.energy does not serve that site yet; #18 says how to add the domain.

Entry point. One line each, AboutLink(app: app): at the end of NowView.body and after content in PairView. The footer stays on one line while it fits and stacks when it does not.

Evidence

• swift test: 108 passed, 1 live test skipped (DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer). The new AboutTests has 13 tests.
• Simulator builds, Debug and Release: 0 warnings. FTW_SOURCE_REVISION=dev fails the build with the error; a full SHA is written as given.
• xcodebuild archive -configuration Release -destination generic/platform=iOS CODE_SIGNING_ALLOWED=NO succeeded with 0 warnings. The archive holds Licenses/{LICENSE,NOTICE,LICENSING.md,REVISION} (the commit, e76660d), both manifests, ITSAppUsesNonExemptEncryption = false and UILaunchScreen.
• Removal, end to end in the simulator: I paired from a QR picture with a random box key. Afterwards the Keychain held 5 items for the app. Remove this phone → Remove: 0 items, an empty App Group, and the app back on Connect FTW.
• Screenshots: light, dark, largest text and Swedish, of Source & licenses (with the privacy section), the license texts, Remove this phone and its question, the Release pairing screen with the demo, and Now's footer. They are in the session scratchpad under m1/store/, on the shared laptop.

Not in this PR

• The car session should add the two AboutLink lines on its branch, and the accessibility changes above.
• README Status is not updated here.
• The commits carry no DCO sign-off. Fredrik signs off his own work.

🤖 Generated with Claude Code

[frahlg]

Included in #14, which lands the whole iPhone M1 app as one PR. The branch stays.