{
  "_ai_door": {
    "see": "https://miscsubjects.com/start",
    "note": "Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."
  },
  "task": {
    "task_id": "WT-0241",
    "kind": "work",
    "objective": "Physical-iPhone install of the Console shell is blocked: this Mac holds no code-signing credential of any kind",
    "detail": "FAILURE CLASS: missing credential, not missing code.\nLAYER: the Mac's developer identity. Not the app, not scripts/ios-build.sh.\nMISSING INVARIANT: the iOS app has only ever been built with CODE_SIGNING_ALLOWED=NO, so it was never proven installable on anything, and no gate said so. A target that cannot be installed should fail a check, not pass one.\n\nOBSERVED 2026-09-12. An iPhone 16 Pro Max (C12D8C70-525F-5699-92EA-59DE8590E320) is paired and available to devicectl, so the phone is not the problem. scripts/ios-build.sh device fails with 'No Accounts: Add a new account in Accounts settings' and 'No profiles for com.llmasos.console were found'. security find-identity -v -p codesigning reports 0 valid identities. ~/Library/MobileDevice/Provisioning Profiles is empty. ~/.miscsubjects/keys holds only AuthKey_BL72QSYNV2.p8, which is the APNs key: it can send a push and it cannot sign an app or fetch a profile.\n\nREPAIR, either one:\n(a) Sign an Apple ID on team CY4U4JBXM7 into Xcode, Settings then Accounts. scripts/ios-build.sh device then works unchanged.\n(b) Preferred, because an agent can use it unattended: create an App Store Connect API key with the Developer role, save it at ~/.miscsubjects/keys/AuthKey_<ID>.p8, put its key id and issuer id in ~/.build-vault.env, and add -authenticationKeyPath / -authenticationKeyID / -authenticationKeyIssuerID to the device and archive targets of scripts/ios-build.sh. Creating the key needs an account-holder sign-in at appstoreconnect.apple.com; that is the only step no agent can do.\n\nCONSEQUENCE WHILE IT STANDS: the shell is proven on the simulator only. APNs delivery to a handset cannot be proven by anyone, because no handset can run this build: GET /api/phone/register returns count 0, and the send surface POST /api/phone/register?push=1 correctly answers ok:false, 'no active device subscribes to topic approval'.\n\nREGRESSION TEST once repaired: scripts/ios-build.sh device installs and launches on the paired iPhone, then POST /api/phone/register?push=1 {topic:approval, approval_id:<id>} returns sent:1 and the banner opens that approval's card.",
    "state": "open",
    "priority": 1,
    "revision": 1,
    "depends_on": [],
    "permitted_capabilities": [],
    "acceptance_tests": [],
    "required_evidence": [],
    "parent_task": "WT-0237",
    "supersedes": null,
    "failure": null,
    "failure_count": 0,
    "last_result": null,
    "completed_at": null,
    "created_at": "2026-09-12T16:27:24-07:00",
    "updated_at": "2026-09-12T16:27:24-07:00",
    "audit": "/api/work/task/WT-0241/audit",
    "submit_to": "/api/work/task/WT-0241/submit"
  }
}