[thomasluizon]

Closes thomasluizon/orbit-tickets#436.

What was wrong

Two defects, and the second is why nobody noticed the first.

1. Seven Expo packages are behind the SDK 57 set that expo install --check expects.
2. The Expo SDK Pin gate could not fail. Every step of the expo-pin job was gated on
   steps.mobile-pkg.outputs.changed == 'true', which is true only when the diff touches
   apps/mobile/package.json. No open pull request did, so the job reported pass having run
   nothing. The drift is time-dependent, because expo install --check resolves its expected set
   from Expo's remote compatibility data, and a diff-gated job cannot see a time-dependent condition
   by construction.

Proof that the gate now works

The two halves are deliberately separate commits, so the gate is proved rather than asserted.

• The first commit changes only the workflow. The seven packages are still unaligned, so
  Expo SDK Pin is expected to be RED on it.
• The second commit aligns the versions, and Expo SDK Pin is expected to be GREEN.

Both run ids go in a comment on this pull request. A gate that is green both times has not been
fixed.

Cost

npm ci became npm ci --ignore-scripts --workspace @orbit/mobile, because the check reads project
configuration and installed package manifests and does not need native postinstall output. That
keeps the job cheap now that it runs on every pull request, without narrowing what it checks.

Verified locally

npm ci --ignore-scripts then CI=1 npx expo install --check from apps/mobile, on the aligned
versions:

Dependencies are up to date

That also confirms the assumption behind --ignore-scripts: the check does not need native
postinstall output.

Assumptions

• The seven versions are the ones reproduced on 2026-09-06. The implementing worker's network policy
  blocked Expo's remote versions endpoint, so it could not re-derive them, and inventing a newer set
  was rejected. CI re-derives them from the live endpoint, so the second commit going green is the
  check on this assumption.

Manual steps

• The Android release build runs these native package versions for the first time on this pull
  request. Its result on the aligned commit is the real evidence here, not the type check.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FVEELVD8mRz6BQYZmqZkvU

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
orbit-ui-mobile-web	Ignored		Sep 6, 2026 8:01am UTC

[thomasluizon]

The gate proof, both halves

As promised in the description. The two commits are deliberately separate so this is evidence rather than an assertion.

RED, commit 189a956d, the workflow change alone, run 34015852099:

Expo SDK Pin  completed/failure
step: Expo-pinned versions still resolve to the SDK set
  expo@57.0.19 - expected version: ~57.0.20
  expo-build-properties@57.0.16 - expected version: ~57.0.17
  expo-image-picker@57.0.15 - expected version: ~57.0.16
  expo-modules-core@57.0.15 - expected version: ~57.0.16
  expo-notifications@57.0.16 - expected version: ~57.0.17
  expo-router@57.0.18 - expected version: ~57.0.19
  expo-sharing@57.0.17 - expected version: ~57.0.18
Found outdated dependencies
##[error]Process completed with exit code 1.

GREEN, commit cd44024e, after the alignment: Expo SDK Pin: SUCCESS, https://github.com/thomasluizon/orbit-ui-mobile/actions/runs/34015976888/job/101439687207

Before this pull request the same job reported pass on every open pull request while executing nothing, because every step was gated on apps/mobile/package.json appearing in the diff.

One thing the red run settles that the implementing worker could not: CI re-derived the expected set from Expo's live compatibility endpoint and named the same seven versions. The worker's container was refused by that endpoint and by registry.npmjs.org (HTTP 403), so it had to assume those versions were still current. They were.

[pullfrog]

Important

Restore the omitted lockfile integrity values before merging; otherwise these seven production tarballs are no longer cryptographically pinned in source control.

Reviewed changes Reviewed the complete two-commit change through cd44024e, including the workflow behavior and dependency resolution:

• Always-on Expo gate — Removes the package-diff condition so Expo SDK Pin checks time-dependent compatibility drift on every pull request.
• Scoped clean install — Installs the mobile workspace without lifecycle scripts before invoking Expo's compatibility check.
• SDK 57 alignment — Updates seven Expo packages and their resolved lockfile versions to the set independently reproduced by the red/green CI proof.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the lockfile repair added since the prior Pullfrog review:

• Restored archive verification — Added the registry-published SHA-512 integrity values for all seven upgraded Expo tarballs.
• Reconciled transitive Expo packages — Regenerated the lockfile to select the newer @expo/cli, @expo/ui, and expo-modules-jsi versions required by the aligned direct dependencies, retaining integrity pins for each.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[thomasluizon]

Merge readiness, orchestrator, 2026-09-06 (D83 disclosure)

Merging under D88/D90 standing authority. Evidence at the exact head:

• Head 623b3200e95e0a2b9dacdc2cb4e2aa3a7fce9163, base redesign/main, MERGEABLE/CLEAN.
• verify-delivery.mjs returns DELIVERED: clean tree, pushed, one linked pull request, head matches, behind_by 0, CI pass.
• Every check on that head passes, including Expo SDK Pin and the Android release build. None red, none pending.
• Pullfrog APPROVED at that exact commit.
• 1 thread, 0 unresolved, empty review body.

Disclosed artifact: the pullfrog-approval check run does not publish on any open pull request tonight; it last published on PR #836 at 00:58:32Z. The approval exists as a submitted review at the exact head. Filed as orbit-tickets #440.

Why this one matters beyond its own ticket

Expo SDK Pin is currently RED on PR #840, and #840 does not touch the gate. It fails because that pull request's commits touched apps/mobile/package.json, which is the exact condition the OLD diff-gated job waited for. So the drift that could not red-gate anything all night red-gated the first mobile pull request that happened to touch a manifest. This merge is what clears it.

The proof this pull request exists to provide

• RED on 189a956d, the workflow change alone: run 34015852099, failing at "Expo-pinned versions still resolve to the SDK set" and naming all seven packages.
• GREEN on cd44024e, after the alignment.

Also fixed here, found by review rather than by the ticket: the implementing Cloud container was refused by registry.npmjs.org with HTTP 403 and wrote all seven upgraded lockfile entries without their SHA-512 integrity values, pinning a version and a URL but not the archive bytes. Commit a1bbb539 re-resolves them against the registry; expo@57.0.20 now matches npm view expo@57.0.20 dist.integrity exactly.