POROROCA OTA · DOCUMENTATION
Production operations
Roll out gradually, read delivery health, recover, and rotate credentials.
DEFAULT POLICY
Make the blast radius boring.
Publish a unique update at 10%, verify real healthy renders, then move through 25%, 50%, and 100%.
status → publish 10% → observe → 25% → observe → 50% → observe → 100%DELIVERY SIGNALS
Interpret events as a funnel.
| Signal | Meaning | Inspect |
|---|---|---|
| eligible | Cohort selected this install. | Rollout/compatibility. |
| downloaded | SDK verified and staged. | Network/auth if low. |
| applied | Host reached healthy render. | Primary success. |
| render_error | Host caught presentation failure. | Screen/metadata. |
| reverted | Host recovered away from update. | Update/launch logs. |
Compare rates, not raw totals. Adoption requires eligible users to open the app and check.
INCIDENT RESPONSE
Stop widening, then restore known-good.
- Capture status, update ID, percentage, and symptoms.
- Stop automation that widens rollout.
- Roll back the exact app/channel in Dashboard or MCP.
- Confirm status points to the previous update.
- Verify a real device resolves and renders known-good.
- Use a new update ID for the fix.
Rollback takes effect on the device's next check; it is not a remote process kill.
CREDENTIAL RESPONSE
Revoke first, investigate second.
- Leaked delivery token: revoke, replace in CI/MCP, inspect release history.
- Leaked runtime token: revoke and replace in the next mobile build.
- Lost private key: generate a pair and ship its public key in a normal app release.
- Compromised private key: stop publishing and distrust later bundles from that key.
EARLY ACCESS LIMITS
Know when OTA is the wrong tool.
- No executable behavior, permissions, entitlements, or native dependencies in documents.
- Billing, auth, navigation, and sensitive data remain compiled.
- Android storage is host-managed and its renderer surface is smaller than SwiftUI.
- SDK and MCP are source-distributed; pin repository revisions.
- Use store releases for native code changes or broken embedded behavior.