chore(deploy): Seity layer + JamPeerTransport (#1001 + #1010)

.changeset/pvm-host-runtime-authority.md

@@ -21,3 +21,6 @@ full-source declaration snapshots, while retaining deterministic code generation
 Preserve incoming-payment ownership and native Coinage ledger records when
 migrating either the historical Chat store or current main's iOS store to the
 combined model. Retain both historical model variants for migration detection.
+
+Centralize iOS permission presentation for consent prompts and app settings,
+preserving the separate Chat and genesis-scoped JAM peer disclosures.

.changeset/pvm-jam-peer-transport.md

@@ -0,0 +1,19 @@
+---
+"@parity/truapi": minor
+"@parity/truapi-host": minor
+---
+
+Add the `JamPeerTransport` host service (trait 111): host-terminated JAMNP-S QUIC or WebTransport streams to JAM peers
+with `dial`, `open`, `send`, `recv`, `reset`, `close` and `events`. Access is the runtime permission
+`RemotePermission::JamPeers { genesis }`, appended as variant 5: before a `dial` connects, the host checks the
+product's stored decision, prompts when it is undetermined and persists the answer per product and genesis. App
+manifests declare nothing. The trait's default implementation returns `NotGranted`, and the browser core keeps it.
+Ships the browser WebTransport adapter, whose `createJamPeerTransportSession({ authorize })` asks once per genesis per
+session, and the deterministic PolkaJAM certificate-hash derivation under `@parity/truapi/jam-peer-transport`. Native
+Rust product runtimes (iOS, Android, CLI) serve the service over JAMNP-S QUIC with the same session rules, and the iOS
+and Android hosts show their remote-permission prompt for `JamPeers`.
+
+The browser adapter pins two certificates per validity period: PolkaJAM's stock serial-0 certificate and one whose
+serial is derived from the peer's P-256 key and period (first 8 bytes of SHA-256(compressed key ‖ period as big-endian
+u64), top bit cleared, 1 if zero). Firefox's NSS rejects a second certificate with the same issuer and serial, so with
+stock nodes it reaches one validator; nodes that use the derived serial are all reachable, and stock nodes keep working.

.changeset/scoped-authority-approval-lifecycle.md

@@ -0,0 +1,6 @@
+---
+"@parity/truapi": patch
+"@parity/truapi-host": patch
+---
+
+Product clearing revokes only that product's in-flight signing, resource allocation, identity disclosure and contact authority, while account replacement or disconnection revokes all prior authority. Resource reviews and allowance-cache commits revalidate their product and account. Identity disclosure retains identity-owner checks and lookup-error propagation, and contact selection and labels retain independent directory-mutation fences. Cancelled CLI signing requests withdraw their permission and signature reviews, including on product disconnection, without authorizing late answers or losing the command draft.

CHANGELOG.md

@@ -17,6 +17,7 @@ generated from [Conventional Commits](https://www.conventionalcommits.org/).
 - migrate the generic runtime and Rust client to SDK 0.16's scoped wire codec 3;
   the handshake requires an exact codec match, so product guests built against
   an earlier codec must be rebuilt
+- Code-generation verification checks deterministic protocol and host output instead of pinning implementation-text snapshots; generated bindings are compiled and exercised against the runtime.
 
 ### Added
 
@@ -36,9 +37,20 @@ generated from [Conventional Commits](https://www.conventionalcommits.org/).
   subscription interrupts, and host-initiated Renderer subscription codecs.
 - Generate complete App, Widget, Worker, and Worker-only method catalogs from
   the canonical protocol schema.
+- Host-owned background notification receiving on Notifications actions 2 through 7, with durable consent, revision-fenced watches and receipts, authenticated delivery and activation, and resident native/WASM transport hooks. Receipt results distinguish confirmed OS display from an outstanding display claim; explicit display failures release the claim. Hosts without an adapter explicitly report unsupported.
+- Generic Ed25519 notification assertions in bounded standard Gordian envelopes, with opaque byte-leaf digest witnesses and exact chain/channel plus authenticated topic filtering, exposed through `@parity/truapi/notification-envelope`.
+- A wallet-free, single-writer browser receiving runtime and immutable execution-scope dispatch. Receiving consent lasts only through its approved watch expiry (at most 30 days); transport leases may renew within that bound without product UI. Native/provider adapters and real-device qualification remain host responsibilities; resident hooks do not imply delivery after a desktop host fully quits.
+- Browser host account selection fences all persisted product authorities, including closed products. Explicit logout durably revokes every authority before identity removal; ordinary client closure retains consent. Receiving storage uses reserved key 20 without colliding with the PolkaVM runtime's existing keys.
+- Foreground receipts distinguish confirmed OS display from an unresolved durable display reservation. Hosts confirm successful presentation or cancel a known failure; an unknown outcome after restart remains pending until event expiry and must not trigger a competing OS alert. Provider-rendered APNs alerts remain advisory until authenticated local processing.
 
 ### Fixed
 
+- Browser receiving synchronizes and revokes each authority scope independently, so account or verified-artifact replacement cannot leave the current enrollment in a revoke/register loop.
+- Message catch-up receipts preserve an already queued notification activation until the product explicitly acknowledges its sequence.
+- Generated WASM bridges preserve owned `String` parameters instead of emitting unsized `str` arguments.
+- Generated host tagged-union codecs preserve explicit SCALE discriminants, including receiving storage slot 20 when slots 13–19 are absent from the generic runtime.
+- Swift's unsupported receiving callbacks use the generated native rejection case.
+
 - persist typed Statement Store allowance approvals and denials per product and
   account selector for implicit, idempotent provisioning; explicit requests for
   additional quota retain per-operation confirmation and increase semantics.

Cargo.toml

@@ -26,6 +26,7 @@ console_error_panic_hook = "0.1"
 convert_case = "0.6"
 crossterm = "0.29"
 derive_more = { version = "2", default-features = false }
+ed25519-dalek = { version = "2", default-features = false, features = ["alloc"] }
 flate2 = "1"
 frame-metadata = { version = "23", default-features = false }
 fs2 = "0.4"