feat(14-08): sync rewrapped xcframeworks v0.10.2+rewrap.1 + verify hardening

Consumer-side smoke landing for 14-08 / D-26:
- Synced LiteRTLM-Swift-fork@v0.10.2+rewrap.1 via scripts/sync-litertlm-swift.sh;
  both xcframework zips fetched from the fork's GitHub Release, SHA-256
  verified against rewrap-manifest.json, installed under ios/Frameworks/.
- Bumped package.json version to 0.2.0-litertlm.0.10.2.r1 (D-35).
- CHANGELOG.md sync entry added.
- ios/Frameworks/rewrap-manifest.json updated to the live Release's manifest
  (LiteRTLM sha 10565a59…, GemmaModelConstraintProvider sha 4d4cd8c8…).

Verify-script hardening:
- Layer B grep allowlist anchors fixed (`^\./` to match `grep -rn` output)
  + entries added for legit references in podspec/verify/README comments.
- Layer A consumer pod install now propagates ASDF_COCOAPODS_VERSION into
  the tmpdir so the asdf shim resolves outside the repo tree.
- .tool-versions added (nodejs 24.14.0, cocoapods 1.16.2) per D-18.

The xcframework binaries themselves are gitignored via ios/Frameworks/
.gitignore (intentional, per D-26: fetched at sync time, never committed);
those entries show as modified-but-not-staged in git status by design and
are not part of this commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: helenkwok

.tool-versions

@@ -0,0 +1,2 @@
+nodejs 24.14.0
+cocoapods 1.16.2

CHANGELOG.md

@@ -25,3 +25,4 @@
 ## 0.1.0
 
 - feat: initial expo-litert-lm — Expo Modules bindings for LiteRT-LM.
+2026-05-16 — synced rewrapped LiteRTLM-Swift v0.10.2+rewrap.1 (2 xcframeworks, first sha256: 10565a593a70...)

ios/Frameworks/rewrap-manifest.json

@@ -1,32 +1,27 @@
 {
   "schema_version": 1,
-  "upstream_version": "v0.7.3",
+  "upstream_version": "v0.10.2",
   "rewrap_iteration": 1,
-  "tag": "v0.7.3+rewrap.1",
-  "fork_sha": "pending",
-  "rewrap_script_sha": "pending",
-  "built_at": "2026-05-16T00:00:00Z",
+  "tag": "v0.10.2+rewrap.1",
+  "fork_sha": "864db6e5417a439635f2f45d45e33ba2a42ff712",
+  "rewrap_script_sha": "a2710c9db6e949338ad107ea035724c796355b65e0cfdcae7b32f90edbe06102",
+  "built_at": "2026-05-16T01:31:43Z",
   "xcframeworks": [
     {
       "name": "LiteRTLM-rewrapped.xcframework",
       "swift_target_name": "LiteRTLMBinary",
-      "zip_filename": "LiteRTLM-rewrapped-v0.7.3+rewrap.1.xcframework.zip",
-      "zip_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
-      "release_asset_url": "https://github.com/helenkwok/LiteRTLM-Swift/releases/download/v0.7.3+rewrap.1/LiteRTLM-rewrapped-v0.7.3+rewrap.1.xcframework.zip",
-      "install_names": [
-        "@rpath/CLiteRTLM.framework/CLiteRTLM",
-        "@rpath/LiteRTLM.framework/LiteRTLM"
-      ]
+      "zip_filename": "LiteRTLM-rewrapped-v0.10.2+rewrap.1.xcframework.zip",
+      "zip_sha256": "10565a593a70cd5f4e4cae7b56be59998ab358655831c2ff1b687578640cdf60",
+      "release_asset_url": "https://github.com/helenkwok/LiteRTLM-Swift/releases/download/v0.10.2+rewrap.1/LiteRTLM-rewrapped-v0.10.2+rewrap.1.xcframework.zip",
+      "install_names": []
     },
     {
       "name": "GemmaModelConstraintProvider.xcframework",
       "swift_target_name": "GemmaModelConstraintProviderBinary",
-      "zip_filename": "GemmaModelConstraintProvider-v0.7.3+rewrap.1.xcframework.zip",
-      "zip_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
-      "release_asset_url": "https://github.com/helenkwok/LiteRTLM-Swift/releases/download/v0.7.3+rewrap.1/GemmaModelConstraintProvider-v0.7.3+rewrap.1.xcframework.zip",
-      "install_names": [
-        "@rpath/GemmaModelConstraintProvider.framework/GemmaModelConstraintProvider"
-      ]
+      "zip_filename": "GemmaModelConstraintProvider-v0.10.2+rewrap.1.xcframework.zip",
+      "zip_sha256": "4d4cd8c8cfa8ca0603d818f2c1478155d7d62193f07d0045f3182cee61a879d8",
+      "release_asset_url": "https://github.com/helenkwok/LiteRTLM-Swift/releases/download/v0.10.2+rewrap.1/GemmaModelConstraintProvider-v0.10.2+rewrap.1.xcframework.zip",
+      "install_names": []
     }
   ]
 }

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-litert-lm",
-  "version": "0.2.0-dev.1",
+  "version": "0.2.0-litertlm.0.10.2.r1",
   "description": "Expo Modules bindings for on-device LLM inference. Android: Google's litert-lm-android (LiteRT-LM Engine + MediaPipe Tasks GenAI). iOS: vendored LiteRTLM-Swift wrapping the LiteRT-LM C API; MediaPipe Tasks GenAI available as opt-in MediaPipeFallback subspec. Supports .litertlm and .task model formats.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package.json

@@ -3,14 +3,23 @@
 # These patterns exempt known-legitimate references to raw LiteRTLM.xcframework
 # from the grep gate that would otherwise reject them.
 #
-# Format: each pattern is matched against grep -nE output (path:linenum:content).
-# A hit that matches ANY pattern here is considered allowed and excluded from failures.
+# Format: each pattern is matched against grep -rnE output, which prepends
+# `./` to every path. Anchor with `^\./` to match the path component.
 
-# sync script reads the manifest which references the canonical xcframework name
-^scripts/sync-litertlm-swift\.sh:
+# Sync script narrates the canonical xcframework name in comments
+^\./scripts/sync-litertlm-swift\.sh:
+
+# The verify script itself prints messages mentioning the raw filename
+^\./scripts/verify-consumption\.sh:
 
 # The allowlist file itself documents what we're guarding against
-^scripts/grep-allowlist\.txt:
+^\./scripts/grep-allowlist\.txt:
 
 # CHANGELOG references historical filenames as context
-^CHANGELOG\.md:
+^\./CHANGELOG\.md:
+
+# Podspec comments narrate the rewrap policy (does not vendor raw path)
+^\./ExpoLitertLm\.podspec:
+
+# README narrates the consumer model
+^\./README\.md:

scripts/grep-allowlist.txt

@@ -266,9 +266,20 @@ PODFILE_EOF
 }
 PBXPROJ_EOF
 
+  # Propagate the project's pinned CocoaPods version into the tmpdir so asdf's
+  # shim resolves correctly. The tmpdir lives outside the repo, so asdf can't
+  # find a parent `.tool-versions` and would otherwise error with
+  # "No version is set for command pod". ASDF_COCOAPODS_VERSION wins over
+  # `.tool-versions` lookup so we don't have to materialize a file.
+  COCOAPODS_VER="$(awk '/^cocoapods /{print $2; exit}' "$REPO_ROOT/.tool-versions" 2>/dev/null || true)"
+
   cd "$CONSUMER_DIR/ios"
   set +e
-  pod install 2>&1
+  if [ -n "$COCOAPODS_VER" ]; then
+    ASDF_COCOAPODS_VERSION="$COCOAPODS_VER" pod install 2>&1
+  else
+    pod install 2>&1
+  fi
   POD_EXIT=$?
   set -e
   cd "$REPO_ROOT"