From 22871d037c854edbca108c95c8c8e88a87bd8c90 Mon Sep 17 00:00:00 2001
From: jjbrunton <jamie@jbrunton.co.uk>
Date: Sun, 30 Aug 2026 00:13:40 +0100
Subject: [PATCH] chore(release): configure store submissions

Route Android uploads to an internal draft and bind iOS submissions to the verified App Store Connect app. Document explicit-path local artifact submission and preserve separate release authorization.
---
 apps/mobile/eas.json | 12 +++++++++++-
 docs/releasing.md    | 24 ++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/apps/mobile/eas.json b/apps/mobile/eas.json
index b6c5c79..34d2eb5 100644
--- a/apps/mobile/eas.json
+++ b/apps/mobile/eas.json
@@ -32,6 +32,16 @@
     }
   },
   "submit": {
-    "production": {}
+    "production": {
+      "android": {
+        "track": "internal",
+        "releaseStatus": "draft",
+        "changesNotSentForReview": true
+      },
+      "ios": {
+        "ascAppId": "6757159885",
+        "appleTeamId": "BXVPBATDZY"
+      }
+    }
   }
 }
diff --git a/docs/releasing.md b/docs/releasing.md
index 6a51f90..92634c1 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -33,6 +33,30 @@ Output files are placed in the current directory by default.
 These scripts create signed artifacts only. They do not upload or submit them.
 Store mutation always requires a separate, explicitly authorized command.
 
+## Submit a local artifact with EAS
+
+The production submission credentials are managed by EAS. Never add App Store
+Connect `.p8` files, Google service-account JSON files, or local credential paths
+to the repository or `eas.json`.
+
+Submit only an independently verified artifact by its exact absolute path:
+
+```bash
+cd apps/mobile
+
+# Uploads an Android internal-track draft; it does not roll out the release.
+eas submit --platform android --profile production --path /absolute/path/to/sauci.aab --wait
+
+# Uploads to App Store Connect/TestFlight; it does not submit for App Review.
+eas submit --platform ios --profile production --path /absolute/path/to/sauci.ipa --wait
+```
+
+Do not use `--latest` for a local release. Before upload, verify the artifact's
+package or bundle identifier, public version, build number, signature, and
+SHA-256 digest. After upload, read back the same identity and version from Google
+Play Console or App Store Connect. Public rollout, App Review submission, and
+TestFlight group distribution remain separate, explicitly authorized actions.
+
 ### Source integrity
 
 Sauci commits its native `ios/` and `android/` projects. Start a release from a