feat: add Chat v2 product authority operations

.changeset/chat-product-authority.md

@@ -0,0 +1,89 @@
+---
+"@parity/truapi-host": minor
+---
+
+Add product-scoped Chat v2 authority with dedicated Chat authorization, separate from username disclosure. Apply the
+boundary to local and SSO sessions, expose it in the iOS permission flow, and avoid cloning secret-bearing pairing
+results.
+
+Use the unified runtime's native UniFFI gates and shared clock, dotNS discovery and runtime view-response decoding
+for Chat and Coinage without changing product authorization or payment review policy.
+
+Keep renewal-ledger mutation native-only and use the chain metadata's extension version for Coinage extrinsics.
+Trusted products still honor explicit network-permission denials.
+
+Align Android's durable core store with suspend callbacks while retaining serialized, committed writes.
+Carry the existing scoped AGPL license exception onto the unified runtime crate.
+
+Support keyless Statement Store allowances for a selected product account in the native signing host.
+
+Replace raw guest Chat crypto with a narrow authenticated Host boundary on account method 12; retire method 11,
+including over SSO. Products own ordinary Chat, subscriptions, transport and ACKs. Keep identity/device keys and
+outgoing payment secrets private; require trusted per-payment review for main-purse debits. Incoming bearer keys may
+enter encrypted product recovery storage and are imported through generic `payment.top_up(Coins)`. Retain private nested
+HOP recovery and resumable file/image/video preparation with trusted selection/export. The combined signing runtime
+includes AGPL-3.0-only code; retain the included provenance, licenses and exact Corresponding Source.
+
+Include the complete native Chat wire, attachment and cryptography implementation as the source-owned `truapi-chat-v2`
+crate, with upstream provenance and licensing. Remove the release dependency on unpublished local Cargo overrides.
+
+Align Coinage keys with current iOS MAIN_PURSE/page-0 derivations, including the soft coin item junction. Keep complete
+exported coin secrets stable for durable payment replay. Authenticate the new purse layout through snapshot version 3;
+reject legacy `//pps` snapshots without discarding pending wallet state. Inject native wallet custody at runtime
+construction: reference iOS supplies its existing Coinage service adapter; browser/CLI use Rust when none is registered.
+
+Read origin-specific free Coinage unload-token limits from the runtime view at the finalized planning snapshot, rather
+than a removed metadata constant. Preserve committed payment ciphertext and native request IDs when renewing statement
+expiry. Statement submission, backpressure and ordinary retry queues belong to the product.
+
+Accept validated native push-token metadata without discarding the surrounding iOS acceptance batch. Authenticate native
+identity/device ACK direction and reject own-signer ciphertext reflections before opening private payloads.
+
+Use request/response V2 and encrypted SSO V3; reject the former actor request rather than returning fake compatibility
+responses. Provide bounded replayable HOP and public-state pages with original native IDs. Transfer legacy ordinary
+history, pending ciphertext and caller/native ID mappings only after explicit durable migration acknowledgment.
+
+Import incoming keys through the selected owner's durable custody: the encrypted Rust main-purse WAL or native
+IncomingPaymentService. Recover owner-bound accepted imports after unlock independently of Chat grants or a running
+guest. Expose trusted denomination metadata without opening a wallet allocator: native memo totals and top-up minimums
+are raw u128 chain units, while Chat cards use checked native cents. Preserve exact import amounts on retries and do not
+report ambiguous or underfunded claims as fully cleared.
+
+Allow outgoing payments once an active, keyed peer device acknowledges the legacy-device revocation update. Encrypt only
+for acknowledged devices and reject payment acknowledgments from devices excluded from the committed envelope. Reset
+eligibility after authenticated roster changes while preserving payment identity and exact memo custody through
+rewrapping and retries.
+
+Document the method 12 request/response, compatibility, custody, device eligibility, and per-spend consent contract in
+the unnumbered [draft native Chat/main-purse RFC](../docs/rfcs/native-chat-main-purse.md), submitted for review with
+this implementation. Clarify its relationship to [RFC 0017](../docs/rfcs/0017-coinage-payment.md), including the
+distinct integer amount/asset contracts and the absence of general purse APIs or a Chat balance query. Keep the native
+Rust-purse storage guard: the adapter does not permit competing allocators or automatic fallback. This specification
+link does not assert RFC approval, publication, native iOS compilation, or cross-platform qualification.
+
+Mark native Chat payments as transitional pending RFC 0017 receivables, encrypted cheques, and deposits using the main
+purse. Preserve current native-peer payments and pending custody without claiming RFC 0017 support or introducing a
+separate Chat allocator. The Host no longer runs ordinary Chat receivers when the product is closed.
+
+Generate current request/success envelopes with compatible older domain-error envelopes instead of silently omitting the
+method. Preserve wire discriminants after retiring a version prefix, and exercise the generated client against V2 Chat
+responses and V1 errors.
+
+Add an optional Host-private native-wallet dependency, fixed at runtime construction. Absence uses Rust by default;
+registered native failures never switch owners. Remove the explicit wallet-selection callback and enum. Route reference
+iOS outgoing payments, incoming imports and status through the coordinator's existing Coinage service. Retain native
+outgoing custody atomically with native transaction registration before exposing a memo to trusted Host crypto, then
+track ciphertext acceptance, peer delivery and finality separately. Preserve per-payment and privacy review,
+source/idempotency bindings, activation fencing and authoritative native wallet balance. Native callback infrastructure
+errors are sanitized; product callback overrides cannot replace the runtime-wide wallet owner.
+
+Bind native incoming receipts to wallet root, chain and asset instance in the additive Core Data schema upgrade.
+Preserve unowned pre-upgrade incoming rows and source secrets without automatically claiming them into the current
+wallet. Pending imports without provable ownership require explicit ownership recovery before resumption.
+
+Add a host-private native Chat contacts snapshot for signing hosts, with authenticated readiness, authorization,
+wallet/network isolation, encrypted-state restoration, identity deduplication and conservative verified names. Persist
+the native product index when actors open; historical unindexed products need one open on the upgraded host. Fence reads
+against actor commits and session changes, invalidate contact handles on trusted mutations, and reject late worker
+responses. Preserve provider-scoped Contacts UI callbacks without replacing the shared owner directory. Pairing hosts
+remain unsupported; no product wire or SSO directory API is added.

.changeset/olive-schools-shave.md

@@ -10,6 +10,10 @@ the statement-proof and preimage paths ask for without requesting an
 allocation. A changed permission answer reaches the core, and product storage
 is readable under the name `@parity/host-api-test-sdk` gives it.
 
+`ProductStatementStoreAllowance` withholds product-account statement
+allowances at every derivation index without withholding the separate
+`StatementStoreAllowance` resource.
+
 Surface a migrating suite has to match:
 
 - `PermissionLogEntry` carries `decision` and `timestamp` as required fields,

.changeset/pvm-host-runtime-authority.md

@@ -14,3 +14,10 @@ requests its shared or static library artifacts.
 Build each iOS XCFramework slice with its own `cargo rustc` invocation.
 Explicit static-library output cannot be combined with multiple target triples
 in one invocation.
+
+Qualify callback contracts through executable codec and WASM checks rather than
+full-source declaration snapshots, while retaining deterministic code generation.
+
+Preserve incoming-payment ownership and native Coinage ledger records when
+migrating either the historical Chat store or current main's iOS store to the
+combined model. Retain both historical model variants for migration detection.

.github/workflows/ios-pr.yml

@@ -101,8 +101,8 @@ env:
   # DEBUG MODE: Set to 'true' to enable enhanced debugging for build failures
   # What it does:
   #   - Enables verbose xcodebuild logging
-  #   - Collects and uploads build artifacts (logs, test results)
-  #   - Continues build even on failures to gather maximum information
+  #   - Collects and uploads build artifacts
+  # Test results and diagnostics are uploaded regardless of this setting.
   DEBUG_CI: false
 
 jobs:
@@ -517,13 +517,27 @@ jobs:
             bundle exec fastlane run_unit_tests
           fi
 
-      # Upload test artifacts for debugging - only when DEBUG_CI is enabled
+      - name: Export test diagnostics
+        if: always()
+        working-directory: hosts/ios
+        run: |
+          set -euo pipefail
+          result="fastlane/test_output/polkadot-app.xcresult"
+          if [[ -d "$result" ]]; then
+            xcrun xcresulttool get test-results summary --path "$result"
+            xcrun xcresulttool get test-results tests --path "$result"
+            xcrun xcresulttool export diagnostics --path "$result" \
+              --output-path fastlane/test_output/diagnostics
+          fi
+
       - name: Upload test artifacts
-        if: env.DEBUG_CI == 'true' && (failure() || success())
+        if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: test-artifacts-${{ github.run_number }}
+          name: test-artifacts-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
             hosts/ios/fastlane/test_output/
             hosts/ios/fastlane/build_logs/
+            ~/Library/Logs/DiagnosticReports/*.ips
+            ~/Library/Logs/DiagnosticReports/*.crash
           retention-days: 3

CHANGELOG.md

@@ -14,11 +14,19 @@ generated from [Conventional Commits](https://www.conventionalcommits.org/).
   deadlines, multi-touch input, and image clipboard output (#540)
 - let browser signing hosts request personhood-backed Statement Store
   allowances for products instead of reporting the allocator as native-only
-- migrate the generic runtime and Rust client to SDK 0.16's scoped wire codec 2;
-  product guests must be rebuilt rather than sending codec-1 frames
+- migrate the generic runtime and Rust client to SDK 0.16's scoped wire codec 3;
+  the handshake requires an exact codec match, so product guests built against
+  an earlier codec must be rebuilt
 
 ### Added
 
+- Add shared native and browser Chat main-purse payment authority, explicit
+  payment review and durable receipt state; keep Chat cryptography inside the
+  Host rather than product or platform adapters (#709).
+
+- Add `account.deviceChat` for host-private Chat v2 identity binding and
+  identity-route sealing/opening through local or paired account authorities,
+  guarded by a dedicated, product-scoped Chat-authority permission.
 - report local-wallet registration stages and retryable chain-read errors through
   a request-scoped browser callback without resubmitting accepted claims
 - expose local signing-wallet username registration and chain-verified identity
@@ -31,6 +39,15 @@ generated from [Conventional Commits](https://www.conventionalcommits.org/).
 
 ### Fixed
 
+- persist typed Statement Store allowance approvals and denials per product and
+  account selector for implicit, idempotent provisioning; explicit requests for
+  additional quota retain per-operation confirmation and increase semantics.
+  Stop unscoped product background renewal, including previously recorded
+  targets, so artifact-scoped revocation cannot be bypassed.
+- require separate Chat-authority consent on the local product API as well as
+  SSO; existing username-disclosure grants do not authorize Chat operations,
+  and denial or revocation blocks subsequent binding, sealing, and opening (#709)
+- move the secret-bearing SSO pairing result instead of cloning it (#709)
 - keep host-backed allowance helpers available on Wasm with browser-compatible
   polling clocks, while excluding the native-only renewal driver (#540)
 - report the immutable PolkaVM runtime revision actually pinned by the optional