When a new Jetpack library named “Security state provider” lands, it’s natural for platform-minded Android engineers to take notice. The security-state-provider is not a checker of a device's real-time integrity but a publisher of component security states. A tale of two roles: publisher vs. consumerThis architecture creates a clean separation between the entities that report security information and those that consume it. It allows for fine-grained compliance checks that go beyond the global device SPL. It doesn't tame the chaos of real-time device integrity, but instead conquers a more subtle entropy: the fragmentation of component security reporting.