MANUAL RUN: Priority: Bob steps (everything left, in order) #3448

Priority. All of Bob in one place, top to bottom: housekeeping, the rest of the builder setup, then the iOS day. About 6 to 8 hours of your hands, Bob (the builder Mac) plus your browser, top to bottom.

Replaces #3443, #3397 (Bob setup) and #3306 (the iOS block); their bodies stay as the long version. MAC_SETUP.md (Parts 4 to 6) is the start-from-zero guide. New Bob or iOS owner-hands work goes here as a checkbox, not a new issue.

Already done on Bob (2026-11-03)

macOS current with automatic security updates, FileVault, Firewall, Remote Login; Docker updated and sized; Xcode with iOS 27.2; Homebrew with git gh node xcodegen, Blender, Tailscale (bob, launches at login, key expiry off); Rust with the wasm target; builder-setup.sh (3 slots, ssh-copy-id, BUILDER_HOST on the office Mac; the office's tests run there, codeSplitter's 1041 pass); Homebrew auto-update daily.

0. Housekeeping first (2 min)

• Merge MAC_SETUP: making a Tailscale account the first time, and trusting the autoupdate tap #3425 (guide fixes from setting Bob up): open, all checks green, nothing blocking; Squash and merge.
• Close MANUAL RUN: set Bob up with everything installed, and keeping itself updated #3397, MANUAL RUN: the iOS block (Bob and Apple, all iOS owner-hands work in one day) #3306 and MANUAL RUN: Bob, all of it (finish the builder setup, then the iOS day) #3443: this issue replaces all three (each has a comment pointing on).

A. Finish the setup (about 20 min)

• Xcode installed; Settings > Components shows iOS 27.2 and macOS 27.2.
• Xcode > Settings > Accounts: + > Apple ID > Continue, sign in (two-factor code on your phone).
• Team ID: developer.apple.com/account > Membership details (10 characters). Comment it here: the universal-link file (/.well-known/apple-app-site-association) needs it, and an agent adds it in a PR within minutes.
• Terminal on Bob: sudo xcode-select -s /Applications/Xcode.app (asks for Bob's password, prints nothing).
• App Store > Settings > Automatic Updates on, so Xcode updates itself.
• Your own clone on Bob: once it finishes, git pull and bun install --frozen-lockfile in it. Merge anything an agent has open for iOS first.
• Optional: office Mac on Tailscale with the same account, then BUILDER_HOST=q@bob in ~/.zshenv so the office reaches Bob away from home.

A2. Paste-back check (2 min), after Xcode

Run on Bob and comment the output on this issue:

for c in "sw_vers -productVersion" "xcodebuild -version" "xcode-select -p" "xcrun simctl list runtimes" "swift --version" "xcodegen --version" "git --version" "gh --version" "node --version" "bun --version" "cargo --version" "rustup target list --installed" "docker info --format {{.ServerVersion}}" "/Applications/Blender.app/Contents/MacOS/Blender --version" "brew autoupdate status" "pmset -g"; do echo "== $c"; sh -c "$c" 2>&1 | head -4; done; df -h / | tail -1

A3. Time Machine, once A and A2 check out (10 min, then it runs on its own)

• System Settings > General > Time Machine > Add Backup Disk, encrypted. Leave out ~/builder, ~/Library/Developer/Xcode/DerivedData, ~/Library/Developer/CoreSimulator, ~/Library/Containers/com.docker.docker. Let the first backup finish before B.

B1. Bob: build and run (about 1 h)

• The shell (was MANUAL RUN: iOS test client (#2210) needs an Xcode simulator run #2333): bun run ios https://<any deployed app> --build builds, installs and opens it in a simulator. The app fills the screen; a link to another site opens Safari; the top-right arrow changes apps. Then cd native/ios && swift test.
• Park Hide & Seek build and tests (was MANUAL RUN: Bob: Park Hide & Seek iOS drop map on the builder Mac #2923, Park Hide & Seek iOS: compile the offline spike and run its tests on the builder #2918): cd apps/park-hide-seek/ios && DEVELOPMENT_TEAM=<id> xcodegen, swift test (includes testDropRuleKeepsOutTheCabinTheRimAndCliffs, testYouSeeYourAcceptedDrop, testACamperPicksTheirDropInTheEmbeddedRoom), build the App target in Xcode (never compiled before: expect small SwiftUI/RealityKit fixes).
• Offline in the simulator (was MANUAL RUN: Park Hide & Seek offline in the iOS simulator (spike for #2897) #2908): airplane mode, type a name, Play offline against AI. A round runs drop, hide, hunt, results; thumbstick, Run and Crouch work; terrain and people draw. Write down frame rate, one tick's cost (Instruments), app size, anything that felt bad.
• Drop map (was MANUAL RUN: Bob: Park Hide & Seek iOS drop map on the builder Mac #2923): in the 15 s drop phase tap a spot, see the flag, hide starts there. Tap red ground: nothing is sent. Repeat online.
• Run once on your own iPhone (cable, Developer Mode): Play offline, then Quick play against the live edge (bun run deploy in the app first if it is stale).

B2. Apple side, in the browser (1 to 1.5 h)

• Records and upload key (was MANUAL RUN: App Store Connect records and an upload key for the iOS apps #2886): developer.apple.com Identifiers: bundle IDs for Park Hide & Seek (com.quinnscode.parkhideseek), Hippo Tycoon and qCRM. App Store Connect: app record for Park Hide & Seek. Users and Access > Integrations > Team Keys > +, name rustybuns-upload, access App Manager; download the .p8 once. Save the .p8, Key ID and Issuer ID in 1Password (one Password item each) and add ASC_KEY_P8, ASC_KEY_ID, ASC_ISSUER_ID as secrets in the drops environment. An Apple Distribution certificate and provisioning profile are needed too (the iOS lane PR iOS lane: SwiftUI shell, Rust xcframework, TestFlight in CI #2876 says whether the API key can make them or they need Xcode on Bob).
• Sign in with Apple (was MANUAL RUN: eqosys Sign in with Apple keys and App Review accounts #2898, with MANUAL RUN: eqosys signing key in 1Password, then deploy #2785): Services ID with Sign in with Apple, return URL https://eqosys.qntbr.com/api/auth/callback/apple, a key (.p8). bun apps/eqosys/scripts/apple-secret.ts <teamId> <keyId> <servicesId> < AuthKey.p8 prints the client secret (good six months). Put them in 1Password (eqosys vault, item apple, built-in password field per value), add the three APPLE_* bindings to apps/eqosys/rustybuns.config.ts with .env.schema, deploy eqosys. For each iOS app: bun apps/eqosys/scripts/review-account.ts <appId> <email> <password>, and put the account in App Store Connect's review notes.
• Server notifications (was eqosys: handle Sign in with Apple server notifications (consent revoked, Apple account deleted) #3153, code merged in eqosys: Sign in with Apple's server notifications at POST /api/apple/events #3380): on the same Services ID, Configure next to Sign in with Apple, server-to-server notification endpoint https://eqosys.qntbr.com/api/apple/events. About 2 min. It answers 503 until the APPLE_* values are deployed.
• Privacy (was MANUAL RUN: App Store Connect privacy URL and privacy questions for each Q iOS app #3152), after eqosys is deployed with the privacy page: read https://eqosys.qntbr.com/privacy once. For each app in App Store Connect > App Privacy: Privacy Policy URL https://eqosys.qntbr.com/privacy; nutrition label from that page (Email Address, Name, Gameplay content, User ID, Diagnostics if the game sends reports; each linked to the user, not used for tracking). Link the same URL in the app's settings next to Delete account. About 15 min per app.

B3. TestFlight (45 min plus Apple processing)

• On Bob: archive and upload (steps in apps/park-hide-seek/TESTFLIGHT.md); raise CURRENT_PROJECT_VERSION each time.
• Was MANUAL RUN: Park Hide & Seek iOS: build in Xcode, join a quick-play room from TestFlight #2905: install through TestFlight, join a quick-play room with a second phone or a friend, play against bots, open a ?room= link. The universal-link file and the eqosys iOS sign-in return (eqosys: in-app account deletion and Sign in with Apple, for the App Store #2879) must be in by now.

B4. App Store (1 to 1.5 h, then Apple review 1 to 3 days)

• Listing text, screenshots (6.9" iPhone, 13" iPad), age rating, review notes (offline play needs no account).
• Was MANUAL RUN: Park Hide & Seek: put the real App Store link in STORE_URL #2912: send the real App Store link (https://apps.apple.com/app/id<number>) once Apple gives it; an agent replaces STORE_URL (apps/park-hide-seek/src/api.ts) and Edge.store (apps/park-hide-seek/ios/Sources/ParkKit/Rooms.swift).
• Add for Review, Submit.

Not in this block

Agent work, no hands needed yet: #2916 (real character models), #2883 Hippo Tycoon and #2884 qCRM on iOS, #3149 Splat spy to the App Store. When one of them needs your hands, it becomes a checkbox here. Left alone on purpose: #2441 is the Mac app's Developer ID signing, not iOS.