Before creating a request#
Use a compatible Android engineering build and an owner-operated deployment. Device storage must be healthy. Do not silently replace an invalidated key or confuse a browser demonstration with real enrollment.
Which part runs where?#
| Where | Action and effect |
|---|---|
| Android device | Create a device-owned public enrollment request. Private material stays in protected encrypted local storage. |
| Trusted transfer channel | Give the exact public request to the intended deployment owner. A recipient request is single-use by default in the guide. |
| Owner’s VPS / administration system | Issue the recipient-sealed profile with kurdctl. The Android app never receives root administration authority. |
| Intended Android device | Import the returned profile. Preview, compare deployment identity, then confirm storage. |
When the key is missing or invalidated#
Preserve the existing state. A sealed profile for another device cannot be made appropriate by renaming it. Ask the owner for the correct recipient-bound profile or follow an explicit recovery path.
Read recovery guidanceSource and scope
Reviewed . The linked source describes the implementation; released-build evidence is a separate check.