Operator edition · Version 1.0
A complete path from clean checkout to a private-team instance—covering infrastructure, mobile signing, encrypted voice proof, security, recovery, and a machine-executable AI-agent contract.
Decision 01
Both paths preserve the mobile protocol and end-to-end encrypted media contract. Select one origin, one membership authority, and one recovery model for each private-team instance.
For teams that control their network, cluster, storage, and recovery process.
For teams that prefer managed edge services and encrypted TLS media.
Prepare once
Missing delivery, storage, signing, or recovery inputs create deployments that look healthy but cannot serve a real team.
Public HTTPS origin, K3s gRPC name, valid certificate SANs, TCP 443, and UDP 47000 where applicable.
Verified sender, least-privilege FCM identity, and independent APNs production and sandbox keys.
Live storage, an actually encrypted backup destination, retention policy, and named recovery owner.
Apple entitlements and profile, Android upload key, Firebase client configuration, and matching app-link associations.
Two Android and two iOS physical devices plus an external microphone for audible acoustic proof.
Named operator, exact account or cluster, controlled change window, rollback plan, and incident ownership.
Build and install
Validate source, produce immutable artifacts, prove them in staging, and promote the exact same bits to production.
Record the full Git SHA, expected remote, clean status, product version, protocol version, and toolchain.
Promptfoo orchestrates the protocol, Rust, Kotlin, Swift, TypeScript, browser, integration, recovery, and security gates while native tools produce deterministic evidence.
Create multi-architecture control, relay, and admin images plus signed Android and iOS release artifacts.
Review DNS, TLS, public exposure, storage classes, image digests, migrations, secrets handling, and rollback.
Use an atomic Helm release on K3s or independent Cloudflare staging resources. Wait for readiness and delivery providers.
After the full release gate passes, deploy those exact digests and hashes to production without rebuilding.
The Markdown guide includes commands, protected-variable contracts, expected evidence, stop conditions, and a JSON handoff manifest.
Open the machine-readable guideCampaign definitions, privacy controls, route accounting, and physical proof requirements are maintained in the Promptfoo testing contract.
Verification
A green build is necessary. It is not proof that encrypted audio reached another device's speaker.
Android to Android, iOS to iOS, and Android to iOS in both directions.
Foreground, background, locked screen, push wake, reboot, restoration, and rapid repress.
Wi-Fi, mobile data, transitions, UDP available, and UDP blocked with encrypted TLS fallback.
Speaker, receiver, wired, supported Bluetooth, interruptions, and route changes.
Operate
The team must be able to restore, rotate, upgrade, and fail closed before a production handoff is complete.
Capture the database and ciphertext objects at one recovery point. Encrypt, retain, inventory, and verify.
Stop writers, snapshot current state, restore both parts, then prove administration, history, push, and voice.
Promote tested digests, inspect the manifest diff, apply atomically, and rerun health and communication gates.
Disable affected transmission, revoke and rotate, preserve redacted evidence, and never downgrade encryption.
Final gate
Ready to plan your instance?
Download the operator guide, brief the team, and give your automation agent the exact same source of truth.