Skip to content

fix(ios): unblock iOS E2E on Xcode 27 / iOS 27 and any checkout path - #1096

Merged
boorad merged 6 commits into
mainfrom
fix/podspec-path-independent-checksum
Nov 10, 2026
Merged

boorad merged 6 commits into
mainfrom
fix/podspec-path-independent-checksum

Conversation

@boorad

@boorad boorad commented Nov 10, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Unblocks iOS E2E (and therefore agentscm/local-validation attestations) from any checkout path and on Xcode 27 / iOS 27.

  1. Path-dependent podspec checksum. QuickCrypto.podspec baked absolute __dir__ paths (OpenSSL force-include prefix header, OpenSSL include, libsodium include) into pod_target_xcconfig. CocoaPods hashes the evaluated spec, so example/ios/Podfile.lock's QuickCrypto checksum matched only the directory that generated it (chore(deps): upgrade MMKV with aligned native dependencies #1057 was qualified from a T3 worktree). The runner's pod install --deployment then failed everywhere else. The real paths are now expressed relative to $(PODS_ROOT), keeping the symlink-safe real-path behaviour for monorepo stores.

  2. Xcode 27 + fmt. React Native 0.81 bundles fmt 11.0.2, whose consteval format checks fail under Xcode 27.2's clang when the example forces C++20 on every pod. The example Podfile compiles only the fmt target as C++17 (example-only; remove once the example reaches RN 0.84+/fmt 12).

  3. iOS 27 UIScene requirement. iOS 27 terminates apps without a scene manifest (UIApplicationEvaluateRuntimeIssueForNoSceneLifecycleAdoption); the example app crashed at launch on the runner's newest (27.2) simulator. The example now starts React Native from a SceneDelegate.

  4. iOS 27 accessibility overlay. On iOS 27 the accessibility tree reports a non-interactive full-screen Toolbar above the tab content, so agent-device refuses the semantic press on Run All (interactionBlocked: covered). A real tap works, so the runner taps the button's frame center when it is reported covered.

Changes

  • QuickCrypto.podspec: pods_relative helper (realpath of the sandbox, or of its parent on a first install; falls back to the absolute path outside CocoaPods); comment updates.
  • example/ios/Podfile: fmt → C++17 in post_install.
  • example/ios/Podfile.lock: QuickCrypto spec checksum and PODFILE CHECKSUM only.
  • example/ios/QuickCryptoExample/AppDelegate.swift, Info.plist: SceneDelegate + UIApplicationSceneManifest (keeps AppDelegate.window set; LogBox and DeviceInfo read it).
  • example/test/e2e/runner.mjs: frame-center tap fallback for a covered Run All button.

Testing

  • 35efd7b5 — bundle exec pod install --project-directory=ios --deployment succeeds from ~/dev/rnqc/example and from a temporary worktree at a different path; generated xcconfig paths resolve ($(PODS_ROOT)/../../../packages/react-native-quick-crypto/ios/openssl/...) — macOS.
  • 2b90bee5 — xcodebuild with the E2E runner's arguments (Debug, iphonesimulator, -derivedDataPath ios/build) — BUILD SUCCEEDED — Xcode 27.2.
  • 2056238a — --deployment install passes after the review fix.
  • Independent review: one Low (symlinked Pods dir) and one comment nit, both fixed in 2056238a; three Info items skipped (bare ENOENT on a partial OpenSSL extract, fmt override lifetime, pod lib lint sandbox caching — RNQC doesn't lint/trunk this podspec).
  • 20a00cf3 — iOS 27.2 simulator launch: no scene trap, React Native renders. Independent review of the UIScene commit: no fixes; deep-link forwarding / silent guard / window retention skipped.
  • f30e0f09 (rebased onto main after fix(ci): point local-validation verifier at renamed agentscm/agentscm #1097) — signed AgentSCM attestation 7185a25b…: iOS (27.2 sim, Xcode 27.2) 41 suites / 2208 tests / 0 failures; Android 41 suites / 2208 tests / 0 failures. Attestation and both screenshots posted on this head; agentscm/local-validation success. This is worker-asserted evidence (see docs/local-e2e.md), not GitHub-run mobile testing.

Delivery

The podspec change reaches consumers in the next npm release: their pod install emits $(PODS_ROOT)-relative include paths instead of absolute ones (no behavior change for the build). The fmt, UIScene, and runner changes are example/test-only.

Unblocks #1095.

🤖 Generated with Claude Code

@boorad boorad self-assigned this Nov 10, 2026
@vercel

vercel Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
react-native-quick-crypto Ready Ready Preview Nov 10, 2026 2:07am UTC

Request Review

@boorad

boorad commented Nov 10, 2026

Copy link
Copy Markdown
Collaborator Author

AgentSCM icon Local validation: reported pass

Source: github.com/margelo/react-native-quick-crypto at bf0c0ddac424

Worker-reported; the verifier checks the signature and source bindings, not whether commands ran.

Coverage: 2/2 checks reported; 7 omissions.

⚠️ Missing services: PostgreSQL, S3. Coverage is incomplete.

Coverage omissions (7)
  • ignored tests
  • windows
  • container smoke
  • hub end-to-end
  • live execution
  • postgres tests
  • s3 tests
Source and environment
  • Repository: github.com/margelo/react-native-quick-crypto
  • Commit: bf0c0ddac424a9650bc006f66e282fd34589cdb8
  • Tree: 6ab76ce2035e9f6a989eb20a7a84ac1b15fa145d
  • Base ref: main
  • Base tip: 27ca9a067e4e7c5721fb0b213418b8e247d14967
  • Merge base: 27ca9a067e4e7c5721fb0b213418b8e247d14967
  • Services: PostgreSQL=false, S3=false
  • Platform: macos-aarch64
  • Toolchain: 1.4.2, v24.21.0, git version 2.54.0 (Apple Git-157)
Command results
  • ios-e2e: Exited, exit 0, 142435 ms
  • android-e2e: Exited, exit 0, 163293 ms
Signed machine-readable evidence

The exact signed bytes are preserved below for verification and audit tooling.

eyJ2ZXJzaW9uIjoxLCJhbGdvcml0aG0iOiJlZDI1NTE5IiwicGF5bG9hZCI6eyJ2ZXJzaW9uIjox
LCJyZXF1aXJlbWVudF9pZCI6ImxvY2FsLXZhbGlkYXRpb24iLCJjaGVja19raW5kIjoiY29tbWFu
ZC92MSIsInN1YmplY3QiOnsicmVwb3NpdG9yeSI6ImdpdGh1Yi5jb20vbWFyZ2Vsby9yZWFjdC1u
YXRpdmUtcXVpY2stY3J5cHRvIiwiY2hhbmdlIjp7InJlcG9zaXRvcnkiOiJnaXRodWIuY29tL21h
cmdlbG8vcmVhY3QtbmF0aXZlLXF1aWNrLWNyeXB0byIsImlkIjoiZ2l0LWNvbW1pdDpiZjBjMGRk
YWM0MjRhOTY1MGJjMDA2ZjY2ZTI4MmZkMzQ1ODljZGI4In0sImNoYW5nZV92ZXJzaW9uIjoxLCJj
b250ZXh0X2RpZ2VzdCI6ImE1YzQxNTgyMWFjMGUxZjE1OTlhN2ZkYjRmMzVhNTQ3MzFhZTQwODNi
MjM1MWI5NmE5NTkyYTFiNDVkM2JkM2UiLCJyZXZpc2lvbiI6IjIyZmMzMzg5ZTQ3MzNmN2FmZWNl
NzRlMWU1YzU3NDZkODcyZGIxMzg3OGY4OTA3NDBkNDI4YzdmM2M1YTdjMmYiLCJyZWNpcGVfc2hh
MjU2IjoiMjZmMDQ5YmJhZTkwYTNlZDdhOGUxMzM2N2QyMGQzZTY1YzUxMzVjMDZjNzA3Zjg1YTVj
MTAzZDNkODAzNTJkZCIsInRvb2xjaGFpbl9zaGEyNTYiOiI5YzhiZDQ5YTM5OTNhMDhmMDI0ZGFh
ZDMzNGU1OGRhOGFlNjAyZmEzOWY5ZWZiYzBiNDdjYTNjZDRmNTU1MzczIiwiZW52aXJvbm1lbnRf
c2hhMjU2IjoiNTBlZDhkOWY1ODBhMzZiZGE2MDhkYWZlMDViZjU4NjgwNGRiNmYzN2Q2MGMyYzkz
ZjZkYTU2ZDMwNThkYjkxMCJ9LCJpbnN0YWxsZWRfcG9saWN5X3NoYTI1NiI6ImQyNjM2YWYwMThh
NWQ3NTYxZTI3YTNiODAxMDZlYjQwMGJkZjljZmZjNzY5YzVkNjliOWEwMmE4NzJlNzJiN2UiLCJp
bnN0YWxsZWRfcG9saWN5X2Vwb2NoIjoxLCJpc3N1ZXJfcmVnaXN0cnlfc2hhMjU2IjoiYjJhMWFj
NjMxYzRkYjRhYjk2ZmI1ODg5NTAxZDljZGUyNzljNTk2MzcxZjgzMDRlMmVlMjZjY2FmZGJhYmY2
ZCIsImF0dGVtcHRfaWQiOiI3NzMwYjg3NTZlZWQ0MDg3MGZjNmE4YWYxYmE1YThjZSIsInJ1bl9n
ZW5lcmF0aW9uIjoxLCJyZXF1ZXN0X3NoYTI1NiI6IjI2ZjA0OWJiYWU5MGEzZWQ3YThlMTMzNjdk
MjBkM2U2NWM1MTM1YzA2YzcwN2Y4NWE1YzEwM2QzZDgwMzUyZGQiLCJsaW1pdHNfc2hhMjU2Ijoi
MjZmMDQ5YmJhZTkwYTNlZDdhOGUxMzM2N2QyMGQzZTY1YzUxMzVjMDZjNzA3Zjg1YTVjMTAzZDNk
ODAzNTJkZCIsInRlcm1pbmFsX3JlY29yZF9zaGEyNTYiOiJiZmNhZDU5OWJjMjViMzQ2ZjQ0MTk1
MDYwOTAzYjJlOWI1MGU4NjY5ZGUxODBlNDY2MWM1ZjM4ZTE3MDY3MGY5IiwiaXNzdWVyX2lkIjoi
Ym9vcmFkIiwia2V5X2lkIjoiNmMxYzgxNjk4MjA4ZTZjMjg0OGQ3YTEwYWMyZWM4NTA0NjhhNjVj
MzZkMWFhYjUzNTQwZDhmOGM4NmNhMjViOCIsImlzc3VlZF9hdF9tcyI6MTc5NDI3NTUwOTk1MCwi
ZXhwaXJlc19hdF9tcyI6MTc5Njg2NzUwOTk1MCwidGVybWluYWxfc3RhdGUiOiJzdWNjZXNzIiwi
cmVjb3Zlcnlfc3RhdGUiOiJub3RfcmVxdWlyZWQiLCJvdXRjb21lIjoicGFzcyIsImV4ZWN1dGlv
bl9iYXNpcyI6Indvcmtlcl9hc3NlcnRlZCIsImNvdmVyYWdlIjp7InNjb3BlIjpbImlvcy1lMmUi
LCJhbmRyb2lkLWUyZSJdLCJleHBlY3RlZF9jb3VudCI6Miwib2JzZXJ2ZWRfY291bnQiOjIsImlu
dmVudG9yeV9jb21wbGV0ZSI6ZmFsc2UsIm9taXNzaW9ucyI6WyJpZ25vcmVkIHRlc3RzIiwid2lu
ZG93cyIsImNvbnRhaW5lciBzbW9rZSIsImh1YiBlbmQtdG8tZW5kIiwibGl2ZSBleGVjdXRpb24i
LCJwb3N0Z3JlcyB0ZXN0cyIsInMzIHRlc3RzIl19LCJkZXBlbmRlbmNpZXMiOlt7ImlkZW50aXR5
IjoiYnVuLmxvY2siLCJzdGF0ZSI6eyJzdGF0ZSI6InJlc29sdmVkIiwicmV2aXNpb24iOiJmMzdk
YWY4ZDU0YTNjNWExMWE2MmFmYTQ5MzRiNTIzZmY2MWRmZTk2OWU3M2U4YjBiYTEwMTdlMzVkZjRi
MTcxIn19LHsiaWRlbnRpdHkiOiJwYWNrYWdlLmpzb24iLCJzdGF0ZSI6eyJzdGF0ZSI6InJlc29s
dmVkIiwicmV2aXNpb24iOiI4OThlZDZjZWZkMTQwN2UzYjJiZTAyZTNlZmY5YWVlNDJiM2RhNTll
Y2FjZDg1NGMxMGNkZTVmMmM0ODRhNmJjIn19XSwiYXJ0aWZhY3RzIjpbeyJhcnRpZmFjdF9pZCI6
InJlY29yZCIsIm1lZGlhX3R5cGUiOiJhcHBsaWNhdGlvbi9qc29uIiwic2hhMjU2IjoiYmZjYWQ1
OTliYzI1YjM0NmY0NDE5NTA2MDkwM2IyZTliNTBlODY2OWRlMTgwZTQ2NjFjNWYzOGUxNzA2NzBm
OSIsImJ5dGVzIjoxMTUwLCJjbGFpbWVkX2F2YWlsYWJpbGl0eSI6ImZ1bGwifV0sIm91dHB1dCI6
eyJzdGRvdXRfc2hhMjU2IjoiZTNiMGM0NDI5OGZjMWMxNDlhZmJmNGM4OTk2ZmI5MjQyN2FlNDFl
NDY0OWI5MzRjYTQ5NTk5MWI3ODUyYjg1NSIsInN0ZG91dF9ieXRlcyI6MCwic3RkZXJyX3NoYTI1
NiI6ImUzYjBjNDQyOThmYzFjMTQ5YWZiZjRjODk5NmZiOTI0MjdhZTQxZTQ2NDliOTM0Y2E0OTU5
OTFiNzg1MmI4NTUiLCJzdGRlcnJfYnl0ZXMiOjAsInRydW5jYXRlZCI6ZmFsc2V9fSwic2lnbmF0
dXJlX2hleCI6IjhkZGZjZjkxYjdjNmFmZmQ3NjA3NmNlNGU2YThhYmNmZTJlYzJkNmU2OTNjMDgw
NjYxNWQ5ZjVjZmY3Y2JkZTY3YjkxM2IwNWJiYjMyM2I5OTI1OTczYmRlZGNlM2MyNjM3ZjcxZmY2
NGIxZTQwYWJlMzU0NmQ5MjQ0NzZkYjBlIn0=
eyJzdWJqZWN0Ijp7InJlcG9zaXRvcnkiOiJnaXRodWIuY29tL21hcmdlbG8vcmVhY3QtbmF0aXZl
LXF1aWNrLWNyeXB0byIsImNvbW1pdCI6ImJmMGMwZGRhYzQyNGE5NjUwYmMwMDZmNjZlMjgyZmQz
NDU4OWNkYjgiLCJ0cmVlIjoiNmFiNzZjZTIwMzVlOWY2YTk4OWViMjBhN2E4NGFjMWIxNWZhMTQ1
ZCJ9LCJjb250ZXh0Ijp7ImJhc2VfcmVmIjoibWFpbiIsIm1lcmdlX2Jhc2UiOiIyN2NhOWEwNjdl
NGU3YzU3MjFmYjBiMjEzNDE4YjhlMjQ3ZDE0OTY3In0sImJhc2VfdGlwIjoiMjdjYTlhMDY3ZTRl
N2M1NzIxZmIwYjIxMzQxOGI4ZTI0N2QxNDk2NyIsInJlY2lwZV9zaGEyNTYiOiIyNmYwNDliYmFl
OTBhM2VkN2E4ZTEzMzY3ZDIwZDNlNjVjNTEzNWMwNmM3MDdmODVhNWMxMDNkM2Q4MDM1MmRkIiwi
cmVzdWx0cyI6W3siaWQiOiJpb3MtZTJlIiwiYXJndiI6WyJidW4iLCJydW4iLCJlMmU6aW9zIl0s
ImV4aXRfY29kZSI6MCwic3RvcCI6ImV4aXRlZCIsImR1cmF0aW9uX21zIjoxNDI0MzUsInN0ZG91
dF9zaGEyNTYiOiI3NjM2NmM4OWE5ZjdmZjljOTUzNDFiNDgyN2IzODFjM2UxNDVhODk5NTljY2Nk
NGZmYWYyOTc3NDEzN2ZkMjU0Iiwic3RkZXJyX3NoYTI1NiI6IjFiYWI1MmRiNWE3NDY1NTdjM2Zm
N2E2NGU3ZmRlYjc5ZTdmN2Y3ZDMwMTYzMjI5NTVhOTUxOTc5YmUyMjFiN2UiLCJ0cnVuY2F0ZWQi
OmZhbHNlfSx7ImlkIjoiYW5kcm9pZC1lMmUiLCJhcmd2IjpbImJ1biIsInJ1biIsImUyZTphbmRy
b2lkIl0sImV4aXRfY29kZSI6MCwic3RvcCI6ImV4aXRlZCIsImR1cmF0aW9uX21zIjoxNjMyOTMs
InN0ZG91dF9zaGEyNTYiOiIxMDNjZTJjNzZjMTE5ZjVjZDliYWY3NmQxNzQzYzJkOGIzM2ZhNDc5
OWU1M2FmNzU1NDY3NWVjM2UyOGMyNDcyIiwic3RkZXJyX3NoYTI1NiI6ImJlNjAzMWIwNjUzZTU2
MDI1NDVmNjk5OTYzYTMyOThkOTM2MTY5ZWQ2OGNmMzk4ZTFmMWUxYWQ2Mjk0ZjU4NjUiLCJ0cnVu
Y2F0ZWQiOmZhbHNlfV0sInNlcnZpY2VzIjp7InBvc3RncmVzIjpmYWxzZSwiczMiOmZhbHNlfSwi
cGxhdGZvcm0iOiJtYWNvcy1hYXJjaDY0IiwidG9vbGNoYWluIjpbIjEuNC4yIiwidjI0LjIxLjAi
LCJnaXQgdmVyc2lvbiAyLjU0LjAgKEFwcGxlIEdpdC0xNTcpIl0sInRyZWVfdW5jaGFuZ2VkX2Fm
dGVyIjp0cnVlfQ==

@boorad

boorad commented Nov 10, 2026

Copy link
Copy Markdown
Collaborator Author

Local device E2E evidence

  • Head: bf0c0ddac424a9650bc006f66e282fd34589cdb8
  • AgentSCM attestation: 014dc98dae52fcfceb07c5bbf34935534f5c0784b87d0bdbfabd789ee82a7a84
  • iOS result SHA-256: d332241ddca8e2c49f4961c01cf1b93c89d19d5d3efaf50d7c81685fba876ca0
  • iOS screenshot SHA-256: fb5e9e6463120ea38f562af1bf1b4097e7f7545b3f6d14d0705194d82e2fc4c1
  • Android result SHA-256: 135c0ccc823f9e29a797b81db9b9322836f9e30ce0d01d01630fa2a8b37b728f
  • Android screenshot SHA-256: 0c96c24bd9c780bb1e73303c6b827155a3bd3f9e810add469b989b71936599b3
Platform Final screenshot
iOS iOS local E2E result
Android Android local E2E result

The hashes above are present in command stdout committed by the signed attestation. Images expire after 30 days; the hashes remain the durable binding.

@boorad boorad changed the title fix(ios): make podspec checksum path-independent and build fmt as C++17 on Xcode 27 fix(ios): unblock iOS E2E on Xcode 27 / iOS 27 and any checkout path Nov 10, 2026
React Native 0.81 bundles fmt 11.0.2, whose consteval format checks fail under Xcode 27.2's clang when the pod is forced to C++20.
iOS 27 terminates apps without a scene manifest (UIApplicationEvaluateRuntimeIssueForNoSceneLifecycleAdoption). The React Native root now starts from a SceneDelegate.
On iOS 27 the accessibility tree exposes a non-interactive full-screen toolbar above the tab content, so agent-device refuses the semantic press. A real tap at the button frame works.
@boorad

boorad commented Nov 10, 2026

Copy link
Copy Markdown
Collaborator Author

AgentSCM icon Local validation: reported pass

Source: github.com/margelo/react-native-quick-crypto at f30e0f09c8bb

Worker-reported; the verifier checks the signature and source bindings, not whether commands ran.

Coverage: 2/2 checks reported; 7 omissions.

⚠️ Missing services: PostgreSQL, S3. Coverage is incomplete.

Coverage omissions (7)
  • ignored tests
  • windows
  • container smoke
  • hub end-to-end
  • live execution
  • postgres tests
  • s3 tests
Source and environment
  • Repository: github.com/margelo/react-native-quick-crypto
  • Commit: f30e0f09c8bbc61a1d56b3b92cfce079446b6c5e
  • Tree: 1bbacab53dbd6f14f5fe2cb29380db4fd463066e
  • Base ref: main
  • Base tip: 5741621795d371f8ad9df4fe0e22c645b11617f3
  • Merge base: 5741621795d371f8ad9df4fe0e22c645b11617f3
  • Services: PostgreSQL=false, S3=false
  • Platform: macos-aarch64
  • Toolchain: 1.4.2, v24.21.0, git version 2.54.0 (Apple Git-157)
Command results
  • ios-e2e: Exited, exit 0, 140981 ms
  • android-e2e: Exited, exit 0, 93130 ms
Signed machine-readable evidence

The exact signed bytes are preserved below for verification and audit tooling.

eyJ2ZXJzaW9uIjoxLCJhbGdvcml0aG0iOiJlZDI1NTE5IiwicGF5bG9hZCI6eyJ2ZXJzaW9uIjox
LCJyZXF1aXJlbWVudF9pZCI6ImxvY2FsLXZhbGlkYXRpb24iLCJjaGVja19raW5kIjoiY29tbWFu
ZC92MSIsInN1YmplY3QiOnsicmVwb3NpdG9yeSI6ImdpdGh1Yi5jb20vbWFyZ2Vsby9yZWFjdC1u
YXRpdmUtcXVpY2stY3J5cHRvIiwiY2hhbmdlIjp7InJlcG9zaXRvcnkiOiJnaXRodWIuY29tL21h
cmdlbG8vcmVhY3QtbmF0aXZlLXF1aWNrLWNyeXB0byIsImlkIjoiZ2l0LWNvbW1pdDpmMzBlMGYw
OWM4YmJjNjFhMWQ1NmIzYjkyY2ZjZTA3OTQ0NmI2YzVlIn0sImNoYW5nZV92ZXJzaW9uIjoxLCJj
b250ZXh0X2RpZ2VzdCI6IjU3MGM2MGI1ZjViMGQ0YzkwMjMwOTJmOWViNDUzYmQzYzczYjNhYWM2
YTgyZjJiMjMwM2FhNTBmODc0MTVkZWEiLCJyZXZpc2lvbiI6IjA3ZTI5Y2JjM2M3M2E5Y2Y2NDg3
ZDU1YjRhYjE0NzE4NjI0Y2YxOTdhNDE5NzA4MzdhYTE4YzZmNTRhMGRkYTEiLCJyZWNpcGVfc2hh
MjU2IjoiMjZmMDQ5YmJhZTkwYTNlZDdhOGUxMzM2N2QyMGQzZTY1YzUxMzVjMDZjNzA3Zjg1YTVj
MTAzZDNkODAzNTJkZCIsInRvb2xjaGFpbl9zaGEyNTYiOiI5YzhiZDQ5YTM5OTNhMDhmMDI0ZGFh
ZDMzNGU1OGRhOGFlNjAyZmEzOWY5ZWZiYzBiNDdjYTNjZDRmNTU1MzczIiwiZW52aXJvbm1lbnRf
c2hhMjU2IjoiNTBlZDhkOWY1ODBhMzZiZGE2MDhkYWZlMDViZjU4NjgwNGRiNmYzN2Q2MGMyYzkz
ZjZkYTU2ZDMwNThkYjkxMCJ9LCJpbnN0YWxsZWRfcG9saWN5X3NoYTI1NiI6ImQyNjM2YWYwMThh
NWQ3NTYxZTI3YTNiODAxMDZlYjQwMGJkZjljZmZjNzY5YzVkNjliOWEwMmE4NzJlNzJiN2UiLCJp
bnN0YWxsZWRfcG9saWN5X2Vwb2NoIjoxLCJpc3N1ZXJfcmVnaXN0cnlfc2hhMjU2IjoiYjJhMWFj
NjMxYzRkYjRhYjk2ZmI1ODg5NTAxZDljZGUyNzljNTk2MzcxZjgzMDRlMmVlMjZjY2FmZGJhYmY2
ZCIsImF0dGVtcHRfaWQiOiJmY2JjNDEyNzlkNDdhMjkzNDk0MmRhMDBhYmFmZTJiNCIsInJ1bl9n
ZW5lcmF0aW9uIjoxLCJyZXF1ZXN0X3NoYTI1NiI6IjI2ZjA0OWJiYWU5MGEzZWQ3YThlMTMzNjdk
MjBkM2U2NWM1MTM1YzA2YzcwN2Y4NWE1YzEwM2QzZDgwMzUyZGQiLCJsaW1pdHNfc2hhMjU2Ijoi
MjZmMDQ5YmJhZTkwYTNlZDdhOGUxMzM2N2QyMGQzZTY1YzUxMzVjMDZjNzA3Zjg1YTVjMTAzZDNk
ODAzNTJkZCIsInRlcm1pbmFsX3JlY29yZF9zaGEyNTYiOiJlY2I1NDExYThhMDUwNWU2N2UyYmU4
NmQ4YTNlZmRiYThmYjhiZmNmNGZjNDc4ODNkMzExMGE1NmEyZWFmNjk4IiwiaXNzdWVyX2lkIjoi
Ym9vcmFkIiwia2V5X2lkIjoiNmMxYzgxNjk4MjA4ZTZjMjg0OGQ3YTEwYWMyZWM4NTA0NjhhNjVj
MzZkMWFhYjUzNTQwZDhmOGM4NmNhMjViOCIsImlzc3VlZF9hdF9tcyI6MTc5NDI3NjYzNTI5MSwi
ZXhwaXJlc19hdF9tcyI6MTc5Njg2ODYzNTI5MSwidGVybWluYWxfc3RhdGUiOiJzdWNjZXNzIiwi
cmVjb3Zlcnlfc3RhdGUiOiJub3RfcmVxdWlyZWQiLCJvdXRjb21lIjoicGFzcyIsImV4ZWN1dGlv
bl9iYXNpcyI6Indvcmtlcl9hc3NlcnRlZCIsImNvdmVyYWdlIjp7InNjb3BlIjpbImlvcy1lMmUi
LCJhbmRyb2lkLWUyZSJdLCJleHBlY3RlZF9jb3VudCI6Miwib2JzZXJ2ZWRfY291bnQiOjIsImlu
dmVudG9yeV9jb21wbGV0ZSI6ZmFsc2UsIm9taXNzaW9ucyI6WyJpZ25vcmVkIHRlc3RzIiwid2lu
ZG93cyIsImNvbnRhaW5lciBzbW9rZSIsImh1YiBlbmQtdG8tZW5kIiwibGl2ZSBleGVjdXRpb24i
LCJwb3N0Z3JlcyB0ZXN0cyIsInMzIHRlc3RzIl19LCJkZXBlbmRlbmNpZXMiOlt7ImlkZW50aXR5
IjoiYnVuLmxvY2siLCJzdGF0ZSI6eyJzdGF0ZSI6InJlc29sdmVkIiwicmV2aXNpb24iOiJmMzdk
YWY4ZDU0YTNjNWExMWE2MmFmYTQ5MzRiNTIzZmY2MWRmZTk2OWU3M2U4YjBiYTEwMTdlMzVkZjRi
MTcxIn19LHsiaWRlbnRpdHkiOiJwYWNrYWdlLmpzb24iLCJzdGF0ZSI6eyJzdGF0ZSI6InJlc29s
dmVkIiwicmV2aXNpb24iOiI4OThlZDZjZWZkMTQwN2UzYjJiZTAyZTNlZmY5YWVlNDJiM2RhNTll
Y2FjZDg1NGMxMGNkZTVmMmM0ODRhNmJjIn19XSwiYXJ0aWZhY3RzIjpbeyJhcnRpZmFjdF9pZCI6
InJlY29yZCIsIm1lZGlhX3R5cGUiOiJhcHBsaWNhdGlvbi9qc29uIiwic2hhMjU2IjoiZWNiNTQx
MWE4YTA1MDVlNjdlMmJlODZkOGEzZWZkYmE4ZmI4YmZjZjRmYzQ3ODgzZDMxMTBhNTZhMmVhZjY5
OCIsImJ5dGVzIjoxMTQ5LCJjbGFpbWVkX2F2YWlsYWJpbGl0eSI6ImZ1bGwifV0sIm91dHB1dCI6
eyJzdGRvdXRfc2hhMjU2IjoiZTNiMGM0NDI5OGZjMWMxNDlhZmJmNGM4OTk2ZmI5MjQyN2FlNDFl
NDY0OWI5MzRjYTQ5NTk5MWI3ODUyYjg1NSIsInN0ZG91dF9ieXRlcyI6MCwic3RkZXJyX3NoYTI1
NiI6ImUzYjBjNDQyOThmYzFjMTQ5YWZiZjRjODk5NmZiOTI0MjdhZTQxZTQ2NDliOTM0Y2E0OTU5
OTFiNzg1MmI4NTUiLCJzdGRlcnJfYnl0ZXMiOjAsInRydW5jYXRlZCI6ZmFsc2V9fSwic2lnbmF0
dXJlX2hleCI6IjkwNWE2OTMzN2IzZWNiNWJhMWQ3NmVhYzA3ODY5NjBjODA1NDEyNjI3MzhkMGJm
Mzc4M2NiYTllYjM3MTU1MDZkZDI0NGQwYWNjYWU1N2NiOWMxMjFlMDBmZWQ5NGZmYjgzMDc1NTM5
ZmZhZGZiM2ExMjIwNmVmZWY5MzgyMTBjIn0=
eyJzdWJqZWN0Ijp7InJlcG9zaXRvcnkiOiJnaXRodWIuY29tL21hcmdlbG8vcmVhY3QtbmF0aXZl
LXF1aWNrLWNyeXB0byIsImNvbW1pdCI6ImYzMGUwZjA5YzhiYmM2MWExZDU2YjNiOTJjZmNlMDc5
NDQ2YjZjNWUiLCJ0cmVlIjoiMWJiYWNhYjUzZGJkNmYxNGY1ZmUyY2IyOTM4MGRiNGZkNDYzMDY2
ZSJ9LCJjb250ZXh0Ijp7ImJhc2VfcmVmIjoibWFpbiIsIm1lcmdlX2Jhc2UiOiI1NzQxNjIxNzk1
ZDM3MWY4YWQ5ZGY0ZmUwZTIyYzY0NWIxMTYxN2YzIn0sImJhc2VfdGlwIjoiNTc0MTYyMTc5NWQz
NzFmOGFkOWRmNGZlMGUyMmM2NDViMTE2MTdmMyIsInJlY2lwZV9zaGEyNTYiOiIyNmYwNDliYmFl
OTBhM2VkN2E4ZTEzMzY3ZDIwZDNlNjVjNTEzNWMwNmM3MDdmODVhNWMxMDNkM2Q4MDM1MmRkIiwi
cmVzdWx0cyI6W3siaWQiOiJpb3MtZTJlIiwiYXJndiI6WyJidW4iLCJydW4iLCJlMmU6aW9zIl0s
ImV4aXRfY29kZSI6MCwic3RvcCI6ImV4aXRlZCIsImR1cmF0aW9uX21zIjoxNDA5ODEsInN0ZG91
dF9zaGEyNTYiOiJmYWMwOTY3YWM5MjEzMDAwYjk5ZmI1MTkyY2YzMDQ0Y2IwYWZhYWU0MmRiOTVh
ZDY0ZDE3MDNhYWVkZjA3MjkxIiwic3RkZXJyX3NoYTI1NiI6IjFiYWI1MmRiNWE3NDY1NTdjM2Zm
N2E2NGU3ZmRlYjc5ZTdmN2Y3ZDMwMTYzMjI5NTVhOTUxOTc5YmUyMjFiN2UiLCJ0cnVuY2F0ZWQi
OmZhbHNlfSx7ImlkIjoiYW5kcm9pZC1lMmUiLCJhcmd2IjpbImJ1biIsInJ1biIsImUyZTphbmRy
b2lkIl0sImV4aXRfY29kZSI6MCwic3RvcCI6ImV4aXRlZCIsImR1cmF0aW9uX21zIjo5MzEzMCwi
c3Rkb3V0X3NoYTI1NiI6IjNkOWQ4NWRkYjQzMjgzNjJjMjUxNGExYzg4MjE2ZDhmNDc0OTIwZTFl
NGEyYTE0ZGJjZWJkYTZhYmZhYmZkMWUiLCJzdGRlcnJfc2hhMjU2IjoiYmU2MDMxYjA2NTNlNTYw
MjU0NWY2OTk5NjNhMzI5OGQ5MzYxNjllZDY4Y2YzOThlMWYxZTFhZDYyOTRmNTg2NSIsInRydW5j
YXRlZCI6ZmFsc2V9XSwic2VydmljZXMiOnsicG9zdGdyZXMiOmZhbHNlLCJzMyI6ZmFsc2V9LCJw
bGF0Zm9ybSI6Im1hY29zLWFhcmNoNjQiLCJ0b29sY2hhaW4iOlsiMS40LjIiLCJ2MjQuMjEuMCIs
ImdpdCB2ZXJzaW9uIDIuNTQuMCAoQXBwbGUgR2l0LTE1NykiXSwidHJlZV91bmNoYW5nZWRfYWZ0
ZXIiOnRydWV9

@boorad

boorad commented Nov 10, 2026

Copy link
Copy Markdown
Collaborator Author

Local device E2E evidence

  • Head: f30e0f09c8bbc61a1d56b3b92cfce079446b6c5e
  • AgentSCM attestation: 7185a25bad74df5dff10017e402b605e0458378f870626fed6cdbc8c2d248b3c
  • iOS result SHA-256: 456b128e43e9eada7f4f721cde24540de9f04c74b1b736ae5c9c0ad5cdf5d829
  • iOS screenshot SHA-256: 7f366ff6399f02c90abdad8cdbebef5ac56cb831bea60a303010c3c4fd1e61e8
  • Android result SHA-256: 75b9ce134472b4db8bd99248dec995aaa3acf9f8751d80dfcf73a2ab3e5fe9d0
  • Android screenshot SHA-256: cf87d47b7142cd97f198af5ece5f9dfd8100c78d625639123749026574ce0dbe
Platform Final screenshot
iOS iOS local E2E result
Android Android local E2E result

The hashes above are present in command stdout committed by the signed attestation. Images expire after 30 days; the hashes remain the durable binding.

@boorad
boorad merged commit 901bdcb into main Nov 10, 2026
5 checks passed
@boorad
boorad deleted the fix/podspec-path-independent-checksum branch November 10, 2026 12:34

This branch was successfully deployed

1 active deployment
Preview — f30e0f09 Deployed Nov 10, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant