[dependabot]

Upgrade the example app to MMKV 4.3.1 with its native dependencies aligned: MMKVCore 2.4.0 in CocoaPods and Nitro runtime 0.35.0 in the example and library development environment. The original Dependabot change updated only the JavaScript lockfile; the locked iOS install failed because it still required MMKVCore 2.2.4. MMKV 4.2+ also requires Nitro 0.35.0 or newer.

The four-file change updates dependency pins and lockfiles only. The library’s public Nitro peer range, generated C++ specs and crypto implementation are unchanged. Merging updates the example/development environment; it does not publish a library release.

AgentSCM alpha.8 adoption example

This PR demonstrates the workflow after #1086 switched GitHub to the prebuilt alpha.8 verifier. Its first hosted run passed binary acquisition/provenance, version verification and status reconciliation:

1. Review the dependency change and fix its native lockfile/runtime requirements.
2. Commit through the repository hooks, leaving a clean tree.
3. Use the published, provenance-verified AgentSCM binary to execute the trusted recipe locally: iOS first, then Android. Keep the signing key and retained evidence outside the checkout.
4. Verify the signed record against the exact final commit, tree, base and trusted configuration.
5. Push that exact commit, then use local-validation post to attach its signed evidence. GitHub’s trusted default-branch verifier checks the signature and bindings and publishes agentscm/local-validation.

The first local reproduction failed during CocoaPods setup, and alpha.8 signed that failure; its standalone verifier returned failure and rejected the same evidence against a different head. After the dependency fixes, both platforms passed. Old June hosted-test comments below refer to the original PR head and are superseded by evidence for the new head.

Validation

Exact head: 7a32f415423e35bca53f727dd72d660cf2424aab, rebased onto the alpha.8 verifier migration at 60f75fc102ecbbd05a15aa13b7c3e5b01ec6fee3.

• iOS 26.2 / iPhone 17 Pro simulator: 41 suites, 2,208 tests, zero failures.
• Android API 36 / arm64 Pixel 10 Pro emulator: 41 suites, 2,208 tests, zero failures; Android lint clean.
• Fresh alpha.8 local-validation run after rebase: pass; standalone verify: success, “attestation satisfies the exact head”.
• Envelope: c546ff5aba54fdd3f08358a8ae77c3992b153e01a8ab1acd8c2239bec49c4ed8.
• Commit hooks (TypeScript, C++ formatting, package prepare), bun lint, and bun format passed before the CI-only rebase; git range-diff confirms both dependency commits are unchanged.
• Independent dependency/lockfile review: no blockers.
• Hosted alpha.8 verification passed for this exact head; agentscm/local-validation is green.

Reproduce

Follow docs/local-e2e.md for key enrollment, trust checks and installation. With the exact published binary installed:

AGENTSCM_BIN="$HOME/.agentscm/bin/agentscm-0.1.0-alpha.8"
git fetch origin main
git status --short # must be empty
git diff --exit-code origin/main -- .github/local-validation/recipe.json .github/local-validation/policy.json .github/local-validation/registry.json

"$AGENTSCM_BIN" local-validation run \
  --repo . \
  --recipe .github/local-validation/recipe.json \
  --policy .github/local-validation/policy.json \
  --registry .github/local-validation/registry.json \
  --key-file /absolute/private/path/boorad.ed25519 \
  --issuer-id boorad \
  --state-dir /absolute/private/path/rnqc-attestations \
  --base-ref main --base-rev origin/main

# Save envelope_sha256 from the result as ATTESTATION.
# Push the signed HEAD and confirm the remote PR head matches before posting.
"$AGENTSCM_BIN" local-validation post \
  --state-dir /absolute/private/path/rnqc-attestations \
  --attestation "$ATTESTATION" \
  --github-repo margelo/react-native-quick-crypto --pr 1057 \
  --token-file /absolute/private/path/github-token

What the check means

The mobile suites execute on the enrolled maintainer’s Mac, not on GitHub. The attestation is worker_asserted: the signature binds the reported result to the exact source and policy; it does not independently prove execution or host integrity. GitHub runs the verifier using the pinned prebuilt release.

Alpha.8’s comment renderer warns about absent PostgreSQL/S3 even when policy marks them not required. RNQC requires neither service; both policy flags are false, and that generic warning does not make this attestation fail. The iOS/Android suites are crypto-app qualification, not an exhaustive MMKV persistence test suite. Known verifier setup-failure limits remain documented in the linked guide.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
react-native-quick-crypto	Ready	Preview	Oct 28, 2026 3:00pm UTC

[boorad]

Local validation: reported pass

Source: github.com/margelo/react-native-quick-crypto at 7a32f415423e

Worker-reported; the verifier checks the signature and source bindings, not whether commands ran.

Coverage: 2/2 checks reported; 7 omissions.

⚠️ Missing services: PostgreSQL, S3. Coverage is incomplete.

Coverage omissions (7)

• ignored tests
• windows
• container smoke
• hub end-to-end
• live execution
• postgres tests
• s3 tests

Source and environment

• Repository: github.com/margelo/react-native-quick-crypto
• Commit: 7a32f415423e35bca53f727dd72d660cf2424aab
• Tree: a43ffb2fc1512261f84bed310c52069ad54a32d3
• Base ref: main
• Base tip: 60f75fc102ecbbd05a15aa13b7c3e5b01ec6fee3
• Merge base: 60f75fc102ecbbd05a15aa13b7c3e5b01ec6fee3
• Services: PostgreSQL=false, S3=false
• Platform: macos-aarch64
• Toolchain: 1.4.2, v24.21.0, git version 2.50.1 (Apple Git-155)

Command results

• ios-e2e: Exited, exit 0, 117547 ms
• android-e2e: Exited, exit 0, 84535 ms

Signed machine-readable evidence

The exact signed bytes are preserved below for verification and audit tooling.

eyJ2ZXJzaW9uIjoxLCJhbGdvcml0aG0iOiJlZDI1NTE5IiwicGF5bG9hZCI6eyJ2ZXJzaW9uIjox
LCJyZXF1aXJlbWVudF9pZCI6ImxvY2FsLXZhbGlkYXRpb24iLCJjaGVja19raW5kIjoiY29tbWFu
ZC92MSIsInN1YmplY3QiOnsicmVwb3NpdG9yeSI6ImdpdGh1Yi5jb20vbWFyZ2Vsby9yZWFjdC1u
YXRpdmUtcXVpY2stY3J5cHRvIiwiY2hhbmdlIjp7InJlcG9zaXRvcnkiOiJnaXRodWIuY29tL21h
cmdlbG8vcmVhY3QtbmF0aXZlLXF1aWNrLWNyeXB0byIsImlkIjoiZ2l0LWNvbW1pdDo3YTMyZjQx
NTQyM2UzNWJjYTUzZjcyN2RkNzJkNjYwY2YyNDI0YWFiIn0sImNoYW5nZV92ZXJzaW9uIjoxLCJj
b250ZXh0X2RpZ2VzdCI6ImYwY2FkODc5Y2JkMWEwZmQ0YmU3MTY2NjhjMDcxNDMzYTUxNDQzZGY3
MGY0MjBlZmFhNzVlNGQwZDJiYjBkNjEiLCJyZXZpc2lvbiI6Ijk4NzY5NDYxYmJjM2RhOGQ1MTUy
NWRiMGQ0OGY1NTI1MWIzN2Q1MzNhYmZlNDMwMjJhYzBmNDQwMWFkNzBjNTIiLCJyZWNpcGVfc2hh
MjU2IjoiMjZmMDQ5YmJhZTkwYTNlZDdhOGUxMzM2N2QyMGQzZTY1YzUxMzVjMDZjNzA3Zjg1YTVj
MTAzZDNkODAzNTJkZCIsInRvb2xjaGFpbl9zaGEyNTYiOiI3MGVmZmY0NDU2NDI3MTc3NDc0OWI1
NWM0MTdhOWJkMGVkM2JmMDlmODRlYzc0YTczYzNjMDAyMGE2NTZlNjdkIiwiZW52aXJvbm1lbnRf
c2hhMjU2IjoiNTBlZDhkOWY1ODBhMzZiZGE2MDhkYWZlMDViZjU4NjgwNGRiNmYzN2Q2MGMyYzkz
ZjZkYTU2ZDMwNThkYjkxMCJ9LCJpbnN0YWxsZWRfcG9saWN5X3NoYTI1NiI6ImQyNjM2YWYwMThh
NWQ3NTYxZTI3YTNiODAxMDZlYjQwMGJkZjljZmZjNzY5YzVkNjliOWEwMmE4NzJlNzJiN2UiLCJp
bnN0YWxsZWRfcG9saWN5X2Vwb2NoIjoxLCJpc3N1ZXJfcmVnaXN0cnlfc2hhMjU2IjoiYjJhMWFj
NjMxYzRkYjRhYjk2ZmI1ODg5NTAxZDljZGUyNzljNTk2MzcxZjgzMDRlMmVlMjZjY2FmZGJhYmY2
ZCIsImF0dGVtcHRfaWQiOiJiY2IyMTQzMTkyMDJkMjdlNDAyNjlkYzI3MDA0OGY4YSIsInJ1bl9n
ZW5lcmF0aW9uIjoxLCJyZXF1ZXN0X3NoYTI1NiI6IjI2ZjA0OWJiYWU5MGEzZWQ3YThlMTMzNjdk
MjBkM2U2NWM1MTM1YzA2YzcwN2Y4NWE1YzEwM2QzZDgwMzUyZGQiLCJsaW1pdHNfc2hhMjU2Ijoi
MjZmMDQ5YmJhZTkwYTNlZDdhOGUxMzM2N2QyMGQzZTY1YzUxMzVjMDZjNzA3Zjg1YTVjMTAzZDNk
ODAzNTJkZCIsInRlcm1pbmFsX3JlY29yZF9zaGEyNTYiOiI3MTA0MjE0ZmVmMDE0NTg4ZTg3MWFk
NjUwMDkyZDFlMzdjMTY2ZDRlOTdiZWQ5M2FjNzg2ZGNhMjlmMGJmNTA2IiwiaXNzdWVyX2lkIjoi
Ym9vcmFkIiwia2V5X2lkIjoiNmMxYzgxNjk4MjA4ZTZjMjg0OGQ3YTEwYWMyZWM4NTA0NjhhNjVj
MzZkMWFhYjUzNTQwZDhmOGM4NmNhMjViOCIsImlzc3VlZF9hdF9tcyI6MTc5MzE5OTQ3OTQ4OCwi
ZXhwaXJlc19hdF9tcyI6MTc5NTc5MTQ3OTQ4OCwidGVybWluYWxfc3RhdGUiOiJzdWNjZXNzIiwi
cmVjb3Zlcnlfc3RhdGUiOiJub3RfcmVxdWlyZWQiLCJvdXRjb21lIjoicGFzcyIsImV4ZWN1dGlv
bl9iYXNpcyI6Indvcmtlcl9hc3NlcnRlZCIsImNvdmVyYWdlIjp7InNjb3BlIjpbImlvcy1lMmUi
LCJhbmRyb2lkLWUyZSJdLCJleHBlY3RlZF9jb3VudCI6Miwib2JzZXJ2ZWRfY291bnQiOjIsImlu
dmVudG9yeV9jb21wbGV0ZSI6ZmFsc2UsIm9taXNzaW9ucyI6WyJpZ25vcmVkIHRlc3RzIiwid2lu
ZG93cyIsImNvbnRhaW5lciBzbW9rZSIsImh1YiBlbmQtdG8tZW5kIiwibGl2ZSBleGVjdXRpb24i
LCJwb3N0Z3JlcyB0ZXN0cyIsInMzIHRlc3RzIl19LCJkZXBlbmRlbmNpZXMiOlt7ImlkZW50aXR5
IjoiYnVuLmxvY2siLCJzdGF0ZSI6eyJzdGF0ZSI6InJlc29sdmVkIiwicmV2aXNpb24iOiJmMzdk
YWY4ZDU0YTNjNWExMWE2MmFmYTQ5MzRiNTIzZmY2MWRmZTk2OWU3M2U4YjBiYTEwMTdlMzVkZjRi
MTcxIn19LHsiaWRlbnRpdHkiOiJwYWNrYWdlLmpzb24iLCJzdGF0ZSI6eyJzdGF0ZSI6InJlc29s
dmVkIiwicmV2aXNpb24iOiI4OThlZDZjZWZkMTQwN2UzYjJiZTAyZTNlZmY5YWVlNDJiM2RhNTll
Y2FjZDg1NGMxMGNkZTVmMmM0ODRhNmJjIn19XSwiYXJ0aWZhY3RzIjpbeyJhcnRpZmFjdF9pZCI6
InJlY29yZCIsIm1lZGlhX3R5cGUiOiJhcHBsaWNhdGlvbi9qc29uIiwic2hhMjU2IjoiNzEwNDIx
NGZlZjAxNDU4OGU4NzFhZDY1MDA5MmQxZTM3YzE2NmQ0ZTk3YmVkOTNhYzc4NmRjYTI5ZjBiZjUw
NiIsImJ5dGVzIjoxMTQ5LCJjbGFpbWVkX2F2YWlsYWJpbGl0eSI6ImZ1bGwifV0sIm91dHB1dCI6
eyJzdGRvdXRfc2hhMjU2IjoiZTNiMGM0NDI5OGZjMWMxNDlhZmJmNGM4OTk2ZmI5MjQyN2FlNDFl
NDY0OWI5MzRjYTQ5NTk5MWI3ODUyYjg1NSIsInN0ZG91dF9ieXRlcyI6MCwic3RkZXJyX3NoYTI1
NiI6ImUzYjBjNDQyOThmYzFjMTQ5YWZiZjRjODk5NmZiOTI0MjdhZTQxZTQ2NDliOTM0Y2E0OTU5
OTFiNzg1MmI4NTUiLCJzdGRlcnJfYnl0ZXMiOjAsInRydW5jYXRlZCI6ZmFsc2V9fSwic2lnbmF0
dXJlX2hleCI6ImFmMDIwYjY1ZDUyODhjOTM4N2ZhNjhiYWFhNDI4NWRiYTliOTBlOTNkMzM3ZTE5
Nzc4MDBkN2JlZDJhMDQ5NmMzYTIyZWQ4MzcwMmM4YjJiMTdmOWE0MjY2YmYyMDIzNGQ5M2Q1MjI0
NWZlZTE0MGFkYTA4Y2Q3ZWU1YWE2NDBiIn0=

eyJzdWJqZWN0Ijp7InJlcG9zaXRvcnkiOiJnaXRodWIuY29tL21hcmdlbG8vcmVhY3QtbmF0aXZl
LXF1aWNrLWNyeXB0byIsImNvbW1pdCI6IjdhMzJmNDE1NDIzZTM1YmNhNTNmNzI3ZGQ3MmQ2NjBj
ZjI0MjRhYWIiLCJ0cmVlIjoiYTQzZmZiMmZjMTUxMjI2MWY4NGJlZDMxMGM1MjA2OWFkNTRhMzJk
MyJ9LCJjb250ZXh0Ijp7ImJhc2VfcmVmIjoibWFpbiIsIm1lcmdlX2Jhc2UiOiI2MGY3NWZjMTAy
ZWNiYmQwNWExNWFhMTNiN2MzZTViMDFlYzZmZWUzIn0sImJhc2VfdGlwIjoiNjBmNzVmYzEwMmVj
YmJkMDVhMTVhYTEzYjdjM2U1YjAxZWM2ZmVlMyIsInJlY2lwZV9zaGEyNTYiOiIyNmYwNDliYmFl
OTBhM2VkN2E4ZTEzMzY3ZDIwZDNlNjVjNTEzNWMwNmM3MDdmODVhNWMxMDNkM2Q4MDM1MmRkIiwi
cmVzdWx0cyI6W3siaWQiOiJpb3MtZTJlIiwiYXJndiI6WyJidW4iLCJydW4iLCJlMmU6aW9zIl0s
ImV4aXRfY29kZSI6MCwic3RvcCI6ImV4aXRlZCIsImR1cmF0aW9uX21zIjoxMTc1NDcsInN0ZG91
dF9zaGEyNTYiOiJhYmE2ZDU1NzExYWQ0ZDIzYmYwZDNkZDYwYzRmMzhiMGI0ZmVkMmIzNjE5MTc1
Y2RiM2QwYTljMjE5NWFiZjg2Iiwic3RkZXJyX3NoYTI1NiI6IjFiYWI1MmRiNWE3NDY1NTdjM2Zm
N2E2NGU3ZmRlYjc5ZTdmN2Y3ZDMwMTYzMjI5NTVhOTUxOTc5YmUyMjFiN2UiLCJ0cnVuY2F0ZWQi
OmZhbHNlfSx7ImlkIjoiYW5kcm9pZC1lMmUiLCJhcmd2IjpbImJ1biIsInJ1biIsImUyZTphbmRy
b2lkIl0sImV4aXRfY29kZSI6MCwic3RvcCI6ImV4aXRlZCIsImR1cmF0aW9uX21zIjo4NDUzNSwi
c3Rkb3V0X3NoYTI1NiI6IjY1ZTVlNmU4ZmNmZmNiN2ZiYjQzY2Y4ZDBiMzM5NzMxZjVhMjc4Yzgy
MjY3NWIyODE2YmM4OWJhZWMyNzVlZTIiLCJzdGRlcnJfc2hhMjU2IjoiYmU2MDMxYjA2NTNlNTYw
MjU0NWY2OTk5NjNhMzI5OGQ5MzYxNjllZDY4Y2YzOThlMWYxZTFhZDYyOTRmNTg2NSIsInRydW5j
YXRlZCI6ZmFsc2V9XSwic2VydmljZXMiOnsicG9zdGdyZXMiOmZhbHNlLCJzMyI6ZmFsc2V9LCJw
bGF0Zm9ybSI6Im1hY29zLWFhcmNoNjQiLCJ0b29sY2hhaW4iOlsiMS40LjIiLCJ2MjQuMjEuMCIs
ImdpdCB2ZXJzaW9uIDIuNTAuMSAoQXBwbGUgR2l0LTE1NSkiXSwidHJlZV91bmNoYW5nZWRfYWZ0
ZXIiOnRydWV9

[boorad]

Local device E2E evidence

• Head: 7a32f415423e35bca53f727dd72d660cf2424aab
• AgentSCM attestation: c546ff5aba54fdd3f08358a8ae77c3992b153e01a8ab1acd8c2239bec49c4ed8
• iOS result SHA-256: c8e050f01e7ae905f4970c183dc62030654c6f32055ca50f8851de589519f43b
• iOS screenshot SHA-256: a07533dbeeb0d3de2e605ca7dab9735573b2404a475c31febbc678212197333a
• Android result SHA-256: 0ff02d761bb411ed991ad4f1b07fe2a3201d24ab9d9dfbbc7387fb015ba44d71
• Android screenshot SHA-256: eae3ee39ebf3fdbeae390db7cd7709646841944e31f882b9b97aa7b336f2948d

Platform	Final screenshot
iOS
Android

The hashes above are present in command stdout committed by the signed attestation. Images expire after 30 days; the hashes remain the durable binding.