feat(polkavm): run App Manifest v2 runtimes in Dotli

.env.example

@@ -52,14 +52,18 @@ VITE_SENTRY_DSN=
 SENTRY_AUTH_TOKEN=
 
 # E2E (apps/host/tests/e2e) — pairing and signing via the truapi-host CLI
-# from paritytech/host-rust-core. Install it with the repo's installer script
-# or set SIGNING_HOST_BIN to a locally built binary (defaults to PATH lookup).
+# from paritytech/host-rust-core. Build the upstreamRevision recorded in
+# vendor/truapi-host.lock.json (see README's local E2E instructions), then set
+# SIGNING_HOST_BIN to its absolute path (defaults to PATH lookup).
+# Set TRUAPI_HOST_NO_UPDATE=1 to keep the matching binary from self-updating.
 SIGNING_HOST_BIN=
 # MUST match the host's `defaultNetwork()` in `packages/config/src/network.ts`.
 # Drift produces a silent "pair OK, user-badge never appears" failure: the
 # CLI attests on one chain, the host listens on another, and the chain-side
 # handshake never reaches the host.
 SIGNING_HOST_NETWORK=paseo-next-v2
+# The local host-playground fixture must select this same network's Asset Hub.
+NEXT_PUBLIC_NETWORK_GENESIS_HASH=0x4349b00e54897e21196fd331015fc5be0f14e118beb0375ed2bb1793737bb57a
 # CLI state dir (accounts, sessions). Defaults to apps/host/tests/e2e/.auth/
 # signing-host so repeat runs reuse one test account. Override to isolate.
 SIGNING_HOST_BASE_PATH=

.github/workflows/deploy.yml

@@ -18,6 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       environments: ${{ steps.plan.outputs.environments }}
+      smoke_environments: ${{ steps.plan.outputs.smoke_environments }}
       ref: ${{ steps.plan.outputs.ref }}
     steps:
       - id: plan
@@ -39,6 +40,7 @@ jobs:
               ;;
             push)
               echo 'environments=["paseoli.dev"]' >> "$GITHUB_OUTPUT"
+              echo 'smoke_environments=["paseoli.dev"]' >> "$GITHUB_OUTPUT"
               echo "ref=" >> "$GITHUB_OUTPUT"
               ;;
             pull_request)
@@ -56,6 +58,12 @@ jobs:
                   | select(IN($allowed[])) ]
                 | unique')"
               echo "environments=$ENVS" >> "$GITHUB_OUTPUT"
+              # Smoke whatever this label actually deployed. The old filter
+              # named `westendli.dev`, which no PR label can select, so a
+              # label deploy shipped published products without ever loading
+              # one — that is how a broken product reached paseo.fyi unnoticed.
+              SMOKE_ENVS="$ENVS"
+              echo "smoke_environments=$SMOKE_ENVS" >> "$GITHUB_OUTPUT"
               echo "ref=$PR_HEAD_SHA" >> "$GITHUB_OUTPUT"
               ;;
           esac
@@ -82,6 +90,8 @@ jobs:
 
       - name: Type check
         run: bunx --bun turbo run typecheck
+      - name: Verify PolkaVM runtime assets
+        run: bun run check:polkavm-runtime
 
       - name: Unit tests
         run: bunx --bun turbo run test
@@ -161,3 +171,46 @@ jobs:
             | jq -e 'type == "object" and (.attester | type == "string" and test("^0x[0-9a-fA-F]{64}$"))'
         env:
           DEPLOY_SITE: ${{ matrix.environment }}
+
+  product-smoke:
+    name: Smoke ${{ matrix.environment }} products
+    needs: [plan, deploy]
+    if: needs.plan.outputs.smoke_environments != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        environment: ${{ fromJSON(needs.plan.outputs.smoke_environments) }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.plan.outputs.ref || github.sha }}
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.3.13"
+
+      - run: bun install --frozen-lockfile
+
+      - name: Install product smoke browser
+        working-directory: apps/host
+        run: bunx playwright install --with-deps chromium
+
+      - name: Smoke published PolkaVM products
+        working-directory: apps/host
+        run: bun run test:smoke:products
+        env:
+          DOTLI_SMOKE_ROOT: ${{ matrix.environment }}
+          DOTLI_WEBGPU: "1"
+
+      # Capability coverage against the deployed host: the paired E2E suite
+      # only ever talks to a local build, so without this a deployment could
+      # serve a host the published products cannot call.
+      - name: Smoke published TrUAPI capabilities
+        # Run even when a product smoke fails: a broken published product
+        # and a broken host capability are separate findings.
+        if: ${{ !cancelled() }}
+        working-directory: apps/host
+        run: bun run test:smoke:truapi
+        env:
+          DOTLI_SMOKE_ROOT: ${{ matrix.environment }}

.github/workflows/test.yml

@@ -32,6 +32,9 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Verify PolkaVM runtime assets
+        run: bun run check:polkavm-runtime
+
       - name: Run tests
         run: bunx --bun turbo run test
 
@@ -69,14 +72,26 @@ jobs:
         working-directory: apps/host
         env:
           VITE_METRICS: "true"
-        run: bunx --bun playwright test --config=tests/functional/playwright.config.ts tests/functional/loading.spec.ts tests/functional/resolution.spec.ts tests/functional/navigation.spec.ts tests/functional/network-transport.spec.ts || true
+        run: bun run test:functional || true
 
       - name: Apply functional threshold
         working-directory: apps/host
         run: |
-          TOTAL=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]?] | length' tests/functional/results.json)
-          if [ "$TOTAL" -lt 12 ]; then
-            echo "::error::expected at least 12 tests, got $TOTAL."
+          TOTAL=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select(any(.tests[]?.results[]?; .status != "skipped"))] | length' tests/functional/results.json)
+          if [ "$TOTAL" -lt 11 ]; then
+            echo "::error::expected at least 11 executed tests, got $TOTAL."
+            exit 1
+          fi
+          RUNTIME_EXECUTED=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select(.file == "polkavm.spec.ts" or .file == "chinpokomon.spec.ts") | select(any(.tests[]?.results[]?; .status != "skipped"))] | length' tests/functional/results.json)
+          RUNTIME_FAILED=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select((.file == "polkavm.spec.ts" or .file == "chinpokomon.spec.ts") and .ok == false)] | length' tests/functional/results.json)
+          echo "Executed PolkaVM functional specs: $RUNTIME_EXECUTED"
+          echo "PolkaVM functional failures: $RUNTIME_FAILED"
+          if [ "$RUNTIME_EXECUTED" -lt 4 ]; then
+            echo "::error::expected at least 4 executed PolkaVM functional specs, got $RUNTIME_EXECUTED."
+            exit 1
+          fi
+          if [ "$RUNTIME_FAILED" -gt 0 ]; then
+            echo "::error::PolkaVM functional specs must have 0 failures"
             exit 1
           fi
           LOADING_FAILED=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select(.file == "loading.spec.ts" and .ok == false)] | length' tests/functional/results.json)
@@ -107,24 +122,28 @@ jobs:
             exit 1
           fi
 
-  # E2E run of host-playground product tests against the local preview server,
-  # with pairing and signing handled headlessly by the truapi-host CLI from
-  # paritytech/host-rust-core (no Android emulator, no Maestro).
+  # E2E run of the pinned host-playground source against the local preview
+  # server. The product client and signing CLI use the same SDK as dotli;
+  # the independently deployed host-playground.dot can use an older wire codec.
   e2e-product:
     name: E2E
     runs-on: ubuntu-latest
     needs: unit
-    # Headroom over Playwright's globalTimeout (30 min) so a stuck run is
-    # cut off by Playwright with diagnostics, not by GHA mid-stream.
-    timeout-minutes: 35
+    # Allow source-build time plus headroom over Playwright's globalTimeout
+    # (30 min), so a stuck test run is cut off with Playwright diagnostics.
+    timeout-minutes: 60
     if: ${{ github.event.sender.type != 'Bot' }}
     env:
       # Must match the host's `defaultNetwork()` in
       # `packages/config/src/network.ts`. Setting explicitly so a host
       # network bump can't silently leave the CLI on the wrong chain.
       SIGNING_HOST_NETWORK: paseo-next-v2
+      # The product must query the same Asset Hub as the host and signing CLI.
+      NEXT_PUBLIC_NETWORK_GENESIS_HASH: "0x4349b00e54897e21196fd331015fc5be0f14e118beb0375ed2bb1793737bb57a"
       # The CLI self-updates by default; keep CI runs deterministic.
       TRUAPI_HOST_NO_UPDATE: "1"
+      E2E_PRODUCT_REPO: ${{ github.workspace }}/.build/e2e-host-playground
+      E2E_PRODUCT_URL: http://localhost:5199
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -134,14 +153,77 @@ jobs:
         with:
           bun-version: "1.3.13"
 
-      # Installs the current stable prebuilt binary (release pointer
-      # `truapi-host-cli-stable` in host-rust-core). Pin with
-      # TRUAPI_HOST_VERSION=x.y.z if a release ever breaks the suite.
-      - name: Install truapi-host CLI
+      # Build from the same immutable source as this branch's vendored SDK.
+      # Released CLI versions can lag behind the protocol used by the client.
+      - name: Resolve signing-host source
+        id: signing-host-source
+        run: |
+          set -euo pipefail
+          revision="$(jq -er '.upstreamRevision | select(type == "string") | select(test("^[0-9a-f]{40}$"))' vendor/truapi-host.lock.json)"
+          echo "revision=$revision" >> "$GITHUB_OUTPUT"
+          echo "Signing-host source: https://github.com/paritytech/host-rust-core/commit/$revision"
+
+      - name: Checkout signing-host source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: paritytech/host-rust-core
+          ref: ${{ steps.signing-host-source.outputs.revision }}
+          path: .signing-host-src
+          persist-credentials: false
+
+      # Match host-rust-core's codegen toolchains; generated Rust is not tracked.
+      - name: Setup nightly Rust for codegen
+        uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
+        with:
+          toolchain: nightly
+          components: rustfmt
+
+      - name: Setup stable Rust
+        uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache signing-host Rust build
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
+        with:
+          workspaces: .signing-host-src -> target
+          save-if: ${{ github.event_name == 'push' }}
+
+      - name: Setup Node for codegen
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+
+      - name: Checkout product fixture source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: paritytech/host-playground
+          ref: 63ba2274648c39ed2431b7548dcd93d50862ea9e
+          path: .build/e2e-host-playground
+          persist-credentials: false
+
+      - name: Install product fixture dependencies
+        working-directory: .build/e2e-host-playground
+        run: |
+          corepack enable
+          corepack prepare yarn@1.22.22 --activate
+          yarn install --frozen-lockfile
+
+      - name: Link product fixture to the pinned SDK
+        run: bun scripts/link-truapi-local.ts --product-vendor
+
+      - name: Generate signing-host sources
+        working-directory: .signing-host-src
+        run: |
+          npm ci --ignore-scripts
+          TRUAPI_SKIP_PACKAGE_BUILD=1 ./scripts/codegen.sh
+
+      - name: Build truapi-host CLI
+        working-directory: .signing-host-src
         run: |
-          curl -fsSL https://raw.githubusercontent.com/paritytech/host-rust-core/main/scripts/truapi-host-installer.sh | bash
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-          "$HOME/.local/bin/truapi-host" --version
+          cargo build --locked -p truapi-host-cli --bin truapi-host
+          echo "SIGNING_HOST_BIN=$PWD/target/debug/truapi-host" >> "$GITHUB_ENV"
+          ./target/debug/truapi-host --version
 
       - name: Build
         env:
@@ -150,6 +232,8 @@ jobs:
           # protocol/app iframes, so every test times out. deploy.yml supplies
           # this from repo vars; the test build needs its own value.
           VITE_NETWORKS: paseo-next-v2,previewnet
+          # The fixture is served through dotli's existing loopback-only proxy.
+          VITE_APP_DEBUG: "true"
         run: bunx --bun turbo run build
 
       # Exit code 99 from playwright = pairing/signing infrastructure down

.prettierignore

@@ -3,4 +3,5 @@ node_modules/
 bun.lock
 tests/results/
 docs/
+apps/sandbox/public/polkavm-runtime/
 vendor/

MIGRATION.md

@@ -24,9 +24,11 @@ The active launch path is `packages/ui/src/bridge.ts`:
 - calls `createIframeHost(...)` with the product URL, sandbox policy, allowed
   origin, and the worker-backed provider.
 
-Modern product frames enter the Rust core through the iframe `MessageChannel`.
-The temporary Nova compatibility shim forwards legacy `window.postMessage`
-frames into the same product-scoped provider.
+SDK 0.16 product frames enter the Rust core through the iframe `MessageChannel`,
+using wire codec 2's scoped trait, method, and message-type envelope. Legacy Nova
+`window.postMessage` frames are rejected with a product-update notice rather
+than forwarded into an incompatible decoder. Products must rebuild against
+`@parity/truapi` 0.16 or newer and use its MessagePort transport.
 Account, signing, statement-store, SSO pairing, restore, and logout are
 core-owned and do not cross the JS host callback boundary as Nova-specific
 routes.