# 2026-07-09 — `/keys` + Wire + Merchant GOA

## Done

1. **Exchange `/keys`:** was suspended (no wire accounts → then no online signing keys).
   - `enable-account` + `wire-fee` + `global-fee` → offline **upload** (local `BASE_URL=http://127.0.0.1:9011/`)
   - `download` → `sign` → `upload` for denoms + signkeys
   - Result: `GET /keys` **200**, ~1 MB, currency GOA, master `TW6K5FXF…`
2. **Merchant health:** `check_merchant-health.sh` includes exchange `/keys` + MASTER_KEY match → **ALL CRITICAL PASSED** (GOA via `host.containers.internal:9011` fallback).
3. **Wire helpers:** secret `exchange-accountcredentials-1.secret.conf` needs group `taler-exchange-db` mode 640; then aggregator/closer/wirewatch/transfer OK.
4. **Smoke:** local+public `/keys` 200; bank wire-gateway config as `exchange` → 200 on `:9012`; bank SPA public earlier (LE cert). Full phone Withdraw is manual (wallet app).
5. **Admin-log:** docs diagram keys/wire; scripts `wire-enable-and-upload.sh`, `offline-sign-upload-keys.sh`, `start_wire_helpers.sh`; merchant overrides GOA; ports 9012 noted.

## Manual withdraw (phone)

1. https://bank.hacktivism.ch/ → login `explorer` (pw host `/root/bank-explorer-password.txt`)
2. Withdraw GOA → open in Taler Wallet (exchange.hacktivism.ch `/keys` must stay 200)