fix(wallet-import): trust WaaS v1.1.1 enclave measurements

[tolgahan-arikan]

Summary

Trust the WaaS v1.1.1 enclave measurements for wallet import, and prepare release 0.3.2.

Environment	Before	After
Staging	e271fe4b…	3d21c705… (v1.1.1 next)
Production	1935cbc7… (v1.1.0)	1935cbc7… + 66d0d200… (v1.1.1)

Measurements are from the WaaS v1.1.1 release:

• Staging already runs v1.1.1, so wallet import fails there until this ships.
• Production keeps v1.1.0 trusted until its rollout finishes. Remove 1935cbc7… in a follow-up.

Verification: live staging attestations pass the SDK verifier with the new PCR0. Rebuilding v1.1.1 from source reproduces the release's production PCR0s.

Testing

• ./gradlew --build-cache verify
• tools/check-expo-compatibility.sh

Related

• fix(wallet-import): trust WaaS v1.1.1 enclave measurements 0xPolygon/oms-wallet-typescript-sdk#103
• fix(wallet-import): trust WaaS v1.1.1 enclave measurements swift-sdk#48

[github-actions]

Claude finished @tolgahan-arikan's task in 13s —— View job

---

Review: trust WaaS v1.1.1 enclave measurements

No blockers found.

What I checked

• ParsedPublishableKey.kt: Staging now trusts only the v1.1.1 next PCR0 (3d21c705…). Production trusts v1.1.0 (1935cbc7…) and v1.1.1 (66d0d200…). That matches the rotation comment, which says to trust both measurements before the deploy and drop the retired one afterwards. Dropping the retired Staging value is correct, since it no longer attests.
• Both PCR0s are 96 hex characters, lowercase, and the old Production value is unchanged. Nothing is truncated.
• Tests now assert the full trusted set per environment, so a dropped or extra measurement fails. Dev keeps the all-zero debug PCR0, as before.
• Release bump to 0.3.2 is consistent across gradle.properties, both module -SNAPSHOT fallbacks, and the README snippet. There is no public API change, so docs/api.md and MIGRATION.md need no update.

Nits (non-blocking)

• The new test lines with the long hex strings may be near the ktlint max line length. You report verify passing, so this is fine if CI is green.
• Production keeps two trusted measurements until the follow-up removes 1935cbc7…. Please track that follow-up so the old measurement doesn't stay trusted indefinitely.

I didn't re-run the build or tests. The measurement values themselves (live attestation and reproducible build) rest on your PR description. I couldn't independently verify them against the upstream release.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T11:31:10.560110Z	9839e0f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.