feat(chat): restore separate Chat authority integration above PolkaVM

.github/workflows/deploy.yml

@@ -1,6 +1,7 @@
 name: Deploy
 
 on:
+  workflow_dispatch:
   pull_request:
     types: [labeled, synchronize]
   push:
@@ -34,6 +35,11 @@ jobs:
           # Environments a PR label is allowed to target (development only).
           ALLOWED='["paseoli.dev","paseo.fyi"]'
           case "$EVENT_NAME" in
+            workflow_dispatch)
+              echo 'environments=["westendli.dev"]' >> "$GITHUB_OUTPUT"
+              echo 'smoke_environments=["westendli.dev"]' >> "$GITHUB_OUTPUT"
+              echo "ref=$GITHUB_SHA" >> "$GITHUB_OUTPUT"
+              ;;
             release)
               echo 'environments=["paseo.li","testnet.li"]' >> "$GITHUB_OUTPUT"
               echo "ref=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
@@ -75,6 +81,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.plan.outputs.ref || github.sha }}
 
       - uses: ./.github/actions/setup-node
 
@@ -117,7 +125,7 @@ jobs:
         env:
           VITE_APP_URL: ${{ vars.APP_URL }}
           VITE_APP_DEBUG: ${{ vars.APP_DEBUG }}
-          VITE_COMMIT_SHA: ${{ github.sha }}
+          VITE_COMMIT_SHA: ${{ needs.plan.outputs.ref || github.sha }}
           VITE_SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           VITE_METRICS: ${{ secrets.VITE_METRICS }}
           VITE_NETWORKS: ${{ vars.NETWORKS }}

DEPLOYMENT.md

@@ -143,11 +143,79 @@ reloads the whole server configuration. `nginx -t` must pass before reload; a fa
 operator repair but does not reload the running service. This is not an atomic rollback or a full provisioning path.
 
 After frontend upload, the opted-in job performs a public read-only GET to
+
 `https://<site>/__dotli-identity/paseo/attester`, matching its environment. It requires successful HTTP status and a
 JSON object containing a 32-byte hex `attester`; frontend HTML with status 200 fails. No authentication challenge,
 token, or username is created by the smoke check. Unset `DEPLOY_NGINX` to return to dist-only CI; this does not remove
 an already installed proxy.
 
+## Qualify and deploy Chat on paseo.fyi
+
+Chat-specific browser integration belongs to `paritytech/dotli-community#255`, head `feat/chat-v2-host-runtime`, base
+`feat/pvm-wasm`. Keep that base and forward changes through Seity #287 into the deploy integration #291,
+`feat/jam-peer-transport-on-seity` (base `feat/chat-seity-profile`). Only #291 carries `deploy: paseo.fyi`; never put
+that label on #238, #185, #255, #287, or #290. Updating these branches does not merge their feature PRs into their
+bases.
+
+Each browser layer must vendor a matching client/host package set from its corresponding native layer:
+
+| Browser layer           | Native host source                                        |
+| ----------------------- | --------------------------------------------------------- |
+| #185 PolkaVM runtime    | `host-rust-core#540`, `feat/pvm-app-runtime`              |
+| #255 Chat               | `host-rust-core#709`, `feat/chat-v2-product-authority`    |
+| #287 Seity profiles     | `host-rust-core#1001`, `feat/chat-seity-profile`          |
+| #290 JAM PeerTransport  | `host-rust-core#1010`, `feat/pvm-peer-transport`          |
+| #291 Deploy integration | `host-rust-core#1011`, `feat/jam-peer-transport-on-seity` |
+
+Keep #291 and native #1011 integration-only: merge their refreshed Seity and PeerTransport parents with `--no-ff`, then
+refresh the matching vendored packages. Never copy Chat, Seity, or PeerTransport APIs into a lower layer.
+
+Before publishing the Chat layer:
+
+1. Build `@parity/truapi` and `@parity/truapi-host` from the same committed `host-rust-core#709` source, including
+   codegen and the browser WASM build. Version `0.17.0` alone is not proof of the method-12 native Chat actor API.
+   Replace the two vendored package archives together, retain `@parity/truapi=file:../truapi` in the vendored host
+   package, and update `vendor/truapi-host.lock.json` with the actual source and WASM revision, archive SHA-256 values,
+   the hash of `vendor/truapi/dist/generated/client.js`, and the uncompressed
+   `vendor/truapi-host/dist/wasm/web/truapi_server_bg.wasm` hash. If package dependency metadata changes, refresh
+   `package-lock.json` with Node 26/npm 12 and `npm install`; otherwise retain the existing lock. Never invent pins.
+2. Run the repository quality gate against the candidate head and verify the vendored generated client exposes
+   `account.deviceChat` (method 12), `MainPurseChatPayment` review, private storage slots through `NativeChatProducts`,
+   and per-product platform callbacks on the shared signing runtime. The independent PolkaVM renderer/runtime asset lock
+   is not a substitute for the Host WASM pin.
+3. Use a debug build with `VITE_NETWORKS=paseo-next-v2`. Confirm People genesis
+   `0x4a2b5b737de1da59e209b0000a876ec2fa20035dc34fd292a848da32d255ad48`, Coinage instance `0` (`pUSD`, six chain
+   decimals), and bare identity suffix `paseo`. Inspect the configured chain metadata rather than inferring an asset
+   from a UI name. The browser uses the inherited experimental wallet, not a product-owned wallet; it does not claim
+   hardware-backed spending approval.
+4. In the actual browser surface, qualify invitation/acceptance, text and attachments, then a rejected payment. Every
+   spend must show the exact requesting product, recipient identity, amount, maximum debit, chain, asset instance and
+   operation. A prior Chat grant must not skip this review. Only an explicitly authorized real-funds exercise may
+   approve a payment; check actual settlement in both directions, not merely a sent message.
+5. Close the product connection while keeping the page core's wallet lease open; receive in the background. Products and
+   host controls lease the same native core; changing the page product retires the old signing authority before
+   acquiring its replacement. Reload and verify authorized native Chat devices resume without prompting. Verify pending
+   payments reconcile rather than being displayed as cleared. Move the wallet to a competing tab: the former owner must
+   stop its worker and release custody before the new tab can sign. Concurrent custody attempts must fail unavailable,
+   not create a second signer or overwrite inventory. Test storage/crypto failures in an isolated profile, never by
+   clearing an existing wallet's storage. The wallet owner is exclusive across host subdomains/tabs. Private core
+   records are authenticated-encrypted in the root-origin store; immutable attachment source Blobs remain host-private
+   but are not encrypted at rest, matching the SDK source store's existing policy.
+
+After qualifying each source layer, forward both #287 and #290 into #291 and rebuild its matching native #1011 package
+set. Run the quality gate and browser qualification again on the final #291 candidate. Verify the repository, PR number,
+head, base, vendor provenance, and deployment label before publishing the approved candidate to **#291's existing head
+branch**. Its `pull_request/synchronize` event selects `paseo.fyi` from that label and deploys the PR head SHA after the
+quality gate. Confirm that no other deployment label is present before triggering a synchronization. Observe both
+published-product and TrUAPI smoke jobs, then repeat the Chat surface checks on paseo.fyi with the separately qualified,
+payment-capable `echat.paseo` product release. An older `egui-chat` build is not a substitute for the current product or
+evidence that payments work.
+
+Do not use `workflow_dispatch` for this operation: this workflow routes manual dispatch to **westendli.dev**, not
+paseo.fyi. Do not fall back to another environment if paseo.fyi qualification or deployment fails. The wallet's
+same-origin identity proxy must already be configured, or its separately authorized `DEPLOY_NGINX` opt-in must target
+`fyi-paseo` as documented above.
+
 ## Checking what is deployed
 
 Every origin serves its own build's `host_version.json` at the root:

README.md

@@ -248,10 +248,12 @@ be tested without publishing a manifest.
 
 Custom messages (`ChatMessageContent::Custom`) render live: when a custom message cell scrolls into view, the panel asks
 the product to draw it through the Renderer service (`renderer.render`, with a `ChatMessage` render context) and renders
-the streamed tree with the host's own design system (`src/chat/custom-renderer.ts`). The tree is a closed vocabulary of
-layouts and design tokens, so a product can never inject markup, styles, or URLs. Button taps and text-field edits
-inside a rendered tree flow back on `renderer.action_subscribe`; taps on `Actions`-content buttons flow back as
-`ActionTriggered` chat actions.
+the streamed tree with the host's Solid components (`packages/ui/src/components/chat/CustomMessage.tsx` and
+`CustomNode.tsx`). The tree is a closed vocabulary of layouts and design tokens, so a product can never inject markup,
+styles, or URLs. Button taps and text-field edits inside a rendered tree flow back on `renderer.action_subscribe`; taps
+on `Actions`-content buttons flow back as `ActionTriggered` chat actions. Replacing a streamed tree aborts its image
+loads and revokes its object URLs; scrolling a message out of view or closing the panel releases its render subscription
+and tree resources.
 
 ### App iframe model
 
@@ -444,6 +446,10 @@ scenarios exercise a fresh visit without opting in. On production `dot.li`, the
 **Save & Apply** first. An existing saved choice, including an opt-out on a testnet, remains authoritative. The site
 default applies only when no valid preference has been saved.
 
+The `echat` smoke stays signed out: it cancels the initial sign-in request, uses the guest's Retry button to open a
+fresh host prompt, cancels again, and checks redraw and resize. An idle, demand-driven UI need not publish continuous
+update telemetry. The game scenarios retain their continuous rendering, audio, and input checks.
+
 ```bash
 cd apps/host
 DOTLI_SMOKE_ROOT=paseo.fyi DOTLI_WEBGPU=1 npm run test:smoke:products -- --output=test-results/products
@@ -550,6 +556,22 @@ native resource-allocation API and require an explicit request confirmation; nat
 exposes allocation outcomes, not remaining quota, balances, amounts or fees. Results are labeled as last observed
 outcomes, and uncertain results are not retried automatically.
 
+Native Chat uses the wallet-owned main purse, private device records and a durable product index in the protocol
+origin's IndexedDB. Closing a product connection does not stop receiving while the page's wallet core remains alive. A
+page-product change retires the previous signer and releases its custody before starting the replacement; reload
+restores only previously authorized devices, without prompting for fresh Chat authority in the background. Each payment
+requires a new host review of the authenticated product and recipient, exact amount, maximum debit including fees,
+selected chain and Coinage asset, and payment operation. Chat or automatic-signing grants never approve spending.
+Private core records are authenticated-encrypted at rest; immutable attachment source Blobs are private to the trusted
+host but are not encrypted at rest. They never enter product storage or the product RPC interface.
+
+Contacts are read from the active native wallet and People-chain binding, never from a product-provided roster. The
+Solid host picker cancels when its connection closes or the session, roster, wallet or network changes, and revalidates
+a selection before returning a contact handle. Product prompts have connection-owned modal scopes; authentication,
+private storage and attachment custody stay with the one page core.
+
+Picker rows show verified contact names, with a generic label for unnamed contacts; raw account IDs are not displayed.
+
 Use the existing **List**, **Timeline**, and **Resolution** tabs for activity and diagnostics. Wallet does not duplicate
 their event viewer or capture controls.
 
@@ -561,14 +583,16 @@ deletion controls are confined to Recovery.
 
 **Import / replace test wallet** accepts checksum-valid English BIP-39 phrases of 12, 15, 18, 21 or 24 words, without a
 passphrase or custom derivation path. It uses native Polkadot host/Substrate derivation, not Bitcoin/Ethereum seed
-derivation. Importing an exported phrase restores the same account keys on the same network, but not permissions; use
-**Check username** to rediscover its registered name. Back up the previous test wallet before replacing it. Successful
-import replaces the shared wallet for trusted product hosts, clears wallet-bound experimental session/signing grants,
-activates the imported wallet and reloads open tabs; Mobile pairing and grants remain separate.
-
-**Delete test wallet** requires confirmation and removes the shared wallet's stored entropy, experimental
-session/signing grants and this origin's preserved legacy copy. Without a recovery phrase backup, deleting the wallet or
-clearing site data permanently loses access.
+derivation. Importing an exported phrase restores the same account keys on the same network, but not permissions; its
+registered username is looked up automatically. Back up the previous test wallet before replacing it. Successful import
+replaces the shared wallet for trusted product hosts, clears wallet-bound experimental session/signing grants, activates
+the imported wallet and reloads open tabs; Mobile pairing and grants remain separate.
+
+**Delete test wallet** requires confirmation and removes the shared wallet's stored entropy and this origin's preserved
+legacy copy, while retiring experimental session/signing grants. Wallet-scoped purse and Chat records are retained
+separately, not silently erased by identity replacement or deletion; restoring the same identity still requires fresh
+permissions. A recovery phrase restores identity keys, not a backup of private purse or Chat records. Clearing site data
+can therefore destroy private state even when the phrase is backed up.
 
 Only one tab of a browser profile runs the test wallet at a time, because two tabs starting their own wallet cores would
 claim allowances twice and overwrite each other's state. Opening an app with the test wallet in another tab moves it

THIRD_PARTY_NOTICES.md

@@ -10,10 +10,24 @@ outbound license. The vendored `@useragent-kit/polkavm-runtime` browser artifact
 notices, per-file hashes, and source provenance ship beside the runtime. Build-time-only tooling under source-available
 FSL-1.1-MIT terms is not redistributed as part of the application.
 
+The vendored `@parity/truapi` client is MIT-licensed. The `@parity/truapi-host` distribution is `MIT AND AGPL-3.0-only`,
+not MIT-only: its Rust signing runtime/WASM includes the native Chat, HOP and Coinage implementations. Both packages
+come from
+[host-rust-core revision `437a46c5af88b3c4a962d763f8fa5732e9c48183`](https://github.com/paritytech/host-rust-core/commit/437a46c5af88b3c4a962d763f8fa5732e9c48183).
+Archive and installed artifact hashes are recorded in `vendor/truapi-host.lock.json`, including the local dependency
+override. The Host's `LICENSE`, `LICENSE-AGPL-3.0` and `NOTICE` are retained in `vendor/truapi-host/`; the notice
+identifies the adapted components and their source revisions. Corresponding Source for redistribution must include that
+exact Host source, its component provenance and build instructions, plus any local modifications; a repository URL alone
+does not supply unpublished changes.
+
 > Generated from the resolved dependency tree (841 distinct third-party packages) by `scripts/third-party-notices.ts`.
 > Platform-specific binary packages (for example `*-darwin-arm64`, `@esbuild/*`, `@rolldown/*`) reflect the build host;
 > other platforms resolve their own equivalents under the same licenses. Regenerate after dependency changes.
 
+## MIT AND AGPL-3.0-only
+
+@parity/truapi-host
+
 ## MIT
 
 @apideck/better-ajv-errors, @astrojs/astro2tsx, @astrojs/check, @astrojs/compiler-binding,
@@ -62,8 +76,8 @@ FSL-1.1-MIT terms is not redistributed as part of the application.
 @esbuild/darwin-arm64, @eslint-community/eslint-utils, @eslint-community/regexpp, @eslint/js, @img/colour,
 @jridgewell/gen-mapping, @jridgewell/remapping, @jridgewell/resolve-uri, @jridgewell/source-map,
 @jridgewell/sourcemap-codec, @jridgewell/trace-mapping, @keyv/bigmap, @keyv/serialize, @napi-rs/wasm-runtime,
-@noble/ciphers, @noble/curves, @noble/hashes, @oslojs/encoding, @oxc-project/types, @parity/truapi, @parity/truapi-host,
-@pkgr/core, @polkadot-api/cli, @polkadot-api/codegen, @polkadot-api/ink-contracts, @polkadot-api/json-rpc-provider,
+@noble/ciphers, @noble/curves, @noble/hashes, @oslojs/encoding, @oxc-project/types, @parity/truapi, @pkgr/core,
+@polkadot-api/cli, @polkadot-api/codegen, @polkadot-api/ink-contracts, @polkadot-api/json-rpc-provider,
 @polkadot-api/json-rpc-provider-proxy, @polkadot-api/known-chains, @polkadot-api/logs-provider,
 @polkadot-api/merkleize-metadata, @polkadot-api/metadata-builders, @polkadot-api/metadata-compatibility,
 @polkadot-api/observable-client, @polkadot-api/pjs-signer, @polkadot-api/raw-client, @polkadot-api/raw-tx-creator,

apps/host/src/errors.ts

@@ -1,7 +1,7 @@
 // Copyright 2026 Parity Technologies (UK) Ltd.
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import { WALLET_OWNER_BUSY_ERROR } from '@dotli/protocol';
+import { CORE_CUSTODY_BUSY_ERROR, WALLET_OWNER_BUSY_ERROR } from '@dotli/protocol';
 import { ProtocolFatalError, ProtocolInitFailedError } from '@dotli/protocol';
 import { getActiveServicesConfig, BACKEND_LABELS } from '@dotli/config';
 
@@ -184,7 +184,7 @@ function classifyError(
   // compile error rather than a silently unkeyed error page.
   const msg = err instanceof Error ? err.message : String(err);
 
-  if (err instanceof Error && err.name === WALLET_OWNER_BUSY_ERROR) {
+  if (err instanceof Error && (err.name === WALLET_OWNER_BUSY_ERROR || err.name === CORE_CUSTODY_BUSY_ERROR)) {
     return walletInOtherTab();
   }
   if (err instanceof ProtocolFatalError) {