Reticle Expo

Confidential Compute attestation from mobile — @premai/reticle WASM running inside a QuickJS worklet via bare-wasm3, not JavaScriptCore.

Verifies that a Prem Confidential API gateway is backed by real confidential hardware directly from an iOS or Android device — interpreter-based, zero external dependencies, no server-side proxy.

What it does

Tap Attest. The app returns:

{
  "cpuType": "SEV",
  "hasGpu": true
}

cpuType — whether the remote enclave is running on AMD SEV-SNP or Intel TDX.
hasGpu — whether a trusted GPU is attached to that enclave.

Why this is technically interesting

Mobile WebAssembly is a dead end. JavaScriptCore (the JS engine embedded in React Native on iOS/Android) does not expose a WebAssembly API to user code, and even platforms that do can't execute wasm-bindgen FFI modules without JIT. This app routes around the problem entirely:

1. A BareKit worklet spawns a QuickJS isolate in a background thread inside the RN process — a second JS engine the app fully controls.
2. @premai/bare-wasm3 monkey-patches globalThis.WebAssembly inside that worklet, a pure-interpreter WASM runtime that needs no JIT and runs on any CPU.
3. The @premai/reticle WASM module (compiled with wasm-bindgen) loads and executes inside bare-wasm3 exactly as it would in a browser.

The result: a complete TEE attestation flow from a phone, with the only JS engine that matters being the one you own.

Architecture

  React Native (Hermes)                      BareKit Worklet (QuickJS)
┌──────────────────────┐               ┌────────────────────────────────┐
│  app/index.tsx       │      IPC      │  worklets/attestation-worklet  │
│  useAttestation()    │  ◄──────────► │  .js                           │
│  ReticleWorkletBridge│  JSON lines   │                                │
│                      │               │  require('bare-wasm3/global')  │
│  Worklet.start()     │               │  → wasm3 patches WebAssembly   │
│  worklet.IPC.write() │               │                                │
│                      │               │  import('@premai/api-sdk')     │
│                      │               │  → ClientBuilder               │
│                      │               │  → request_modules()           │
└──────────────────────┘               └────────────────────────────────┘

Two JS engines, one process. Hermes owns the UI; QuickJS owns WASM execution. Communication is newline-delimited JSON over a Duplex IPC pipe.

Getting started

Prerequisites

• macOS with Xcode installed
• Bun
• PREM Confidential API: docs.prem.io

Install and run

# Install — runs patch-package, links iOS prebuilds, bundles the worklet
bun install

# iOS simulator or device
bun run ios