@parity/product-lab 0.0.1-placeholder → 0.1.0

package/adapters/host/truapi-wasm/README.md

@@ -0,0 +1,228 @@
+# @product-lab/host-truapi-wasm
+
+Status: **spike**. `VERIFIED_VERSION` retains the last recorded live conformance version, 0.23.0; the 0.26.0 dependency move alone does not advance that evidence marker. Host provider for the npm WASM test host (`@parity/truapi-host` 0.26.0 for the current SDK graph, 0.23.0 before; `testing/server` + host page). Deny-by-default networking since Phase 3: in its Phase 3 run the conformance kit passed 9 contracts with 2 unsupported (`productAccountRead`, `openPath`).
+
+
+Implements the `HostProvider` port (`@product-lab/ports/host` since refactor step 7 part b); `product-lab host verify --host truapi-wasm --config tools/verify/src/truapi-wasm.ts` (the targets moved there from this adapter's `src/verify.ts` in refactor step 7: they compose this host with a relay-less People node and the Node system adapters) runs the conformance kit headless against a relay-less People node (`PRODUCT_LAB_BASELINE` or `PRODUCT_LAB_PEOPLE_WS`, optional `PRODUCT_LAB_PORT_BASE`, default 13700).
+
+## What works
+
+- `resolve()` records the npm version and the sha256 of the signing-enabled WASM (`dist/wasm/testing`).
+- `truapiWasmHost({ browser, port, routes, … })` takes the environment's routing (the domain's `HostNetworkRoutes`, step 7 part b; before, `network` and a `LocalChain[]`): `localChains(routes)` derives the host page's chains (People and Asset Hub required with their genesis, Bulletin when routed) and the routing's network is the one the host reports. The factory's options no longer carry `network`; `routes` is a dependency.
+- `prepare()` starts the package's host page server on a caller-assigned port.
+- `createSession({ actor, app, approvals, path })` opens the host page in its own browser context with faithful settings only by default: `allowances: "chain"`, no in-page statement store, hashed proxies to loopback chains. `mode: "faked"` must be asked for and is labelled in `session.evidence.coverage`. `session.stop()` closes the page and the context whatever happens to the first and reports a close that fails (`AggregateError`).
+- An actor with an identity is signed in at boot, before the app loads (`src/sign-in.ts`, `session.evidence.signedIn: "at boot"`): the page is requested with `login=manual` and no account, and an init script running only in the host page's origin adds `accounts=<name>:<entropy>` and `login=auto` to the page's own address from session storage before the host reads them; the provider removes them once the host has booted. The entropy never appears in a requested URL, a server log or the network log. Before (and still without an identity) the page booted signed out and imported afterwards, which apps that ask for their account once at load cannot survive: the core declines while signed out and the frame gets its host port once.
+- One scrollbar, the app's (C5, 6 October 2026, `src/host-page-layout.ts`): the test host page (`@parity/truapi-host` 0.23.0 `testing/server`) sizes its product frame `height: 100%` but leaves it inline, so the page is 4 px taller than its window and scrolls as well as the app (two scrollbars in a lab-window tile). An init script, acting only in the host page's origin, makes the frame a block; the app's own document is never touched (`tests/host-page-layout.test.ts` in Chromium, with the control that the page without it overflows). Upstream: the page's rule should say `display: block`.
+- Said up front (C6, 6 October 2026): `TRUAPI_WASM_LIMITS`, on the provider (`HostProvider.limits`) and `TRUAPI_WASM_HOST`, says truAPI WASM cannot read Bulletin yet (upstream, backlog 173); every person on this host carries it (`ActorHost.limits`) and the lab window shows it on their row, with the lab's line on the host after it (Notes: older notes show "not readable" after 60 s each).
+- Probed, not assumed (backlog 247, 9 October 2026, `src/bulletin-read-probe.ts`): it declares `probes: ["bulletin-read"]`, and `probe({ capability: "bulletin-read", content })` loads the sessions' own host package's `web/create-mock-host.js`, builds `createMockHost` with the host page's chain settings (`mockSettings`), and asks its `preimage.lookupPreimage` for content another account stored on Bulletin, within `timeoutMs`; bytes that hash to the content id (`checkContent`) are `holds`, anything else `lacks`, and every reason says it was probed in Node, not in the host page. The provider's `limits` follow the last probe: none once it holds, the probe's reason when it lacks, and the C6 words with "not probed: <why>" (or "not probed yet") otherwise. `@parity/truapi-host` 0.23.0 lacks it (`tests/bulletin-read-probe.test.ts`, with a fake package that answers only what it was given as the control).
+- The host's own traffic (C7, 6 October 2026): `networkEvidence()` marks traffic whose document (`DirectConnection.document`, the frame the browser named for it, a worker's the frame that started it) is the host page's as `purpose: "host"`, never an app finding; the app's stays as observed. The shared-context gap ("host-owned and app-owned worker traffic cannot be distinguished") is said only when some traffic has no document. In a lab-window tile the tab's evidence is the window's, by the tile's frame (`observeFramesNetwork`); a locked session there says `NETWORK_SOCKETS_LISTED_LABEL` ("network locked: sockets observed and listed, not blocked") where its tab has evidence, else `NETWORK_PARTLY_LOCKED_LABEL`. The headless lock's words say the same for a worker's sockets (`TRUAPI_WASM_HOST_OPTIONS`): no browser control sees them to block. A socket with no document is the host's when its handshake's `Origin` (`DirectConnection.origin`, which the browser sets and a page cannot choose) is the host page's: a locked session's chain sockets go through the browser automation's WebSocket routing, which opens the real socket itself, so the browser names no frame for them (lane wasm, 6 October 2026; `tests/provider.test.ts`: the host's origin is the host's, the app's origin or none stays a finding).
+- A stopped session's signing evidence stays readable: `stop()` reads the signing log once while the page is still open, and `approvals.signing()` answers from it afterwards, as the truAPI CLI host's log files are read after it stops. A lab keeps its stopped sessions for their evidence (a person moved into their lab-window tile leaves the first one stopped), and the host check used to say "Signing evidence failed: page.evaluate: Target page, context or browser has been closed" for it (6 October 2026). A page gone before the stop leaves no log, and `signing()` says so.
+- `importIdentity()` switches a running session to a `ProvisionedIdentity` (entropy + lite username) with the page's `setAccounts`; the app sees the switch live, and later reloads sign in as it. The test host takes the account name as the lite username, so a wallet without one gets the placeholder `<actor>.0`, recorded in `session.evidence.usernamePlaceholder`.
+- `session.reload()` reloads the host page (signed in again as the current identity) and returns the new product frame. The mock keeps product storage in the page's memory (`createMockHost`: `storage = new Map()`), so a reload loses what the app stored; apps that read chain state are unaffected.
+- Backlog 185: the factory declares "network locked" (`networkLocked`, per identity; `TRUAPI_WASM_HOST_OPTIONS`), which,
+  when set, decides `denyByDefault`.
+- Deny-by-default networking (`denyByDefault: true`, factory option too; `networkExceptions` for declared origins with a reason): every request and page or frame WebSocket of a session's context is decided by the domain's `NetworkPolicy` (the routes, the host page's and the app's origins, the exceptions) through the Browser port's `route` and `routeWebSocket`. Denied HTTP is aborted (`blockedbyclient`), denied sockets closed (4403); `session.network.blocked()` reports them and `session.network.log()` (also `session.networkLog()`) lists every decision; `session.network.request(url)` makes the app request a URL from its own document, and where a placement routes the session's requests but not its sockets, `session.network.observed()` is the place's observation of the session (the framework's host network sentences read all four); `session.evidence.network` records the policy. Playwright routing does not see SharedWorker traffic or a dedicated worker's sockets, so the browser must be launched with `--host-resolver-rules=${policy.hostResolverRules()}`; `prepare()` fetches `NetworkPolicy.BACKSTOP_CANARY` and refuses a browser without the backstop. Only then is `denyByDefaultNetwork` declared. The app shares the host page's browser context, so routing cannot tell its chain sockets from the host's: since backlog 92 a host given `chainGates` (the composition root's, or a targets module's) routes its page through origin gates in front of the local nodes and admits only the page's origin (the core's worker shares it); the app's page, frame or worker connection to a node is reset and reported in `session.network.blocked()` with the gate's URL.
+- `page()` is the product frame (a `BrowserPage`); `hostPage()` (a `BrowserTab`) and `control()` reach the host page.
+- Approvals are chosen per session (`approve-all` or `deny-all`); `approvals.decisions()` lists the reviews the mock answered, and `approvals.signing()` (backlog item 63) the signing requests among them, from the test host's signing log (`payload`, `createTransaction`: a transaction; `raw`: a message).
+- `session.account(index)` (backlog item 62) answers from the identity the session is signed in as, when the adapter is given a `ProductAccountDerivation` (`accounts`, also a `TruapiWasmHostFactory` setting; the composition root passes one): `source: "identity"`. Otherwise it uses the page reader the caller gave (`readAccount`, `source: "app"`), and with neither it throws `UnsupportedHostOperation`; the test host's control surface has no product-account read. With a derivation that gives them, `session.resourceAccounts()` lists the RFC-0010 accounts of the identity it is signed in as (none while signed in as no identity); the bulletin one carries `signs: true`, as on the truAPI CLI host, so the host check credits a Bulletin store it signs to this session's app. `session.connection()` reports whether the product's calls reached the host (`getHostCallCount`). Unit-tested against a fake control surface (`tests/provider.test.ts`); not run live in this change.
+- An identity the truAPI CLI onboarded is read by `readTruapiCliIdentity()` in `@product-lab/host-truapi-cli` (moved there in step 7) and imported here as a `ProvisionedIdentity`; `entropyFromMnemonic` stays here.
+- A session can open in a placement (backlog 108, `HostSessionRequest.placement`, `capabilities.placement`): a lab-window tile. The host page then opens through the placement's browser (the tile), not a context of the host's own, so the page the person watches is the session. Its address carries `product-lab-session=<tag>` (never a secret), and the sign-in script acts only in the host page with its own tag, under a session storage key of its own (`signInKey`), so two placed people in one window never sign in as each other. A placement that cannot route one session alone (`network.unavailable`) gets no deny-by-default policy: `evidence.network` is `{ unavailable: <reason> }` and the session has no `network` report, never a policy it did not enforce. A placement that routes its requests but not its sockets (`network.sockets`, C4, 6 October 2026: the lab-window tile) gets the policy on requests, blocked and listed in `network.blocked()`, its sockets left open: `evidence.network` is `{ policy, socketsOpen: <reason> }` (no resolver backstop there), and the session's `networkNote` ("network partly locked: sockets open", `NETWORK_PARTLY_LOCKED_LABEL`, in place of the option `NETWORK_LOCKED_LABEL`) is what the person's row and tile both show (`tests/provider.test.ts`, with the control that an unlocked host routes and says nothing). No conditions from the session there (the tile's own apply). `evidence.placement` names the place.
+- `session.navigations` streams the host's native navigation log as `NavigationRequested` (observation time, the log has none); `session.control()` reaches the signing log, reviews, sent RPC and the rest of the test host surface.
+
+## Lab patch
+
+`entropy-length`: the test host page refuses entropy that is not 32 bytes, but CLI identities are 16 bytes and the core accepts every BIP-39 length. Since 7 October 2026 a product is served the released page byte for byte: the provider rewrites nothing unless `shortEntropy` is set, which the composition root sets only in product-lab's own checkout (`composition/src/checkout.ts`). There the provider rewrites that one check in the served bundle, only for a session whose person has short entropy, or has no person yet (who may import one), and fails if the check no longer matches exactly once. Recorded in `session.evidence.patches` (empty for a released page) and `resolve().patches`. The lab makes new people from 24-word phrases (`NEW_PERSON_ENTROPY_BITS`), which the released page accepts. A person from a shorter phrase is refused by name (`shortEntropyRefusal`, an `UnsupportedHostOperation`): at boot or on import in a product, and on import into a checkout session that started with a 32-byte person. The selected page is checked for exactly one occurrence (`tests/entropy-patch.test.ts` bundles the installed page). In the checkout the patch is applied to a cached official package too (`hostPackage`, below). Local only: no patched host is published. Upstream: a draft, not filed; the patch retires when a release accepts every length. Tests: `tests/provider.test.ts` (the released page byte for byte, by sha256, at the session's own address and through the server; the named refusals; the checkout's control).
+
+## Each session's bundle from an address of its own
+
+The host opens its chain sockets in its page (the mock host's `chain.connect`), and the lab window tells a page
+socket's tile by the script that created it. Every session's host page is the same page, so with two truAPI WASM
+people in the window each chain socket named both tiles, and the host check and `@deny-by-default` could not say whose
+it was (6 October 2026). Each session's
+route now answers the page's `/test-host.js` with a one-line module that imports the bundle from `/s/<n>/test-host.js`,
+and serves the server's bundle there, read once and patched as below (`src/own-script.ts`): the code that opens the
+sockets then names an address one tile alone loaded. The page itself is left as served: a document a route answers
+counts as not local to Chromium, which then refuses its loopback loads (its app's modules, its chain sockets).
+`tools/verify/tests/wasm-tile-sockets.test.ts` runs the installed page in two tiles of one window in Chromium, with
+the shared address as its control.
+
+## Another official release from the lab's cache
+
+`installHostPackage({ version, cacheDir, commands, integrity?, signal?, log? })` (`src/host-package.ts`, backlog 27) installs the official `@parity/truapi-host@<version>` into the lab's cache and returns its package directory. Give that directory to the host as `hostPackage`; its version, WASM core (`resolve()`) and test server (`dist/testing/server.js`) are then the ones used.
+
+- The install goes through the CommandRunner port to `<cacheDir>/hosts/truapi-wasm/<version>/`, and npm's own download cache to `hosts/truapi-wasm/.npm`, so nothing leaves the lab's cache. npm runs with `--ignore-scripts` and installs the adapter's own esbuild beside the release, which its test server needs. Nothing is published.
+- The registry's `dist.integrity` for the release is recorded, and npm's lock must carry the same one. If the caller passes `integrity`, it must match too.
+- Every reuse hashes the cached files again (`treeDigest`) and refuses a copy that differs from the digest taken at install, naming the folder to delete.
+- `prepare()` still checks the truAPI pairing, against the `@parity/truapi` in the lab's install (the apps' client), not the one npm put beside the cached copy.
+
+
+## A suite row's release (`routeRelease`)
+
+Backlog 27: a suite row may resolve another `host:truapi-wasm` release, from npm (`versions.npm`, the `@parity/truapi-host` package; `@product-lab/versions-npm`). Before the row's run, `TruapiWasmHostFactory.routeRelease` decides how it runs (`src/route-release.ts`):
+
+- **official**, when the release speaks the truAPI of the apps' `@parity/truapi` (the lab's install). It is installed with `installHostPackage` into the lab's cache, its tarball checked against the integrity the resolution recorded (the entry's `tarball` digest, sha512). The route file's selection names the package directory. The WASM host carries no lab patch beyond the entropy one, applied to every host page at load, so there is nothing to probe or build.
+- **unsupported**, otherwise: a release of another truAPI, with the pairing refusal as the reason; a resolution with no sha512 tarball digest; or a lab install where no `@parity/truapi` is found.
+
+A dry run (`decideOnly`) decides without installing. The row's run reads the route file (`PRODUCT_LAB_HOST_ROUTE`, the factory's `routeFile`) and serves from its package directory (`hostPackage`). Without a route, a run that resolved a release other than the installed one is refused, never served by the wrong package. The composition root gives the factory the lab's cache directory and the route file.
+
+## truAPI pairing
+
+The core speaks the truAPI of its own release; the apps speak the `@parity/truapi` installed beside it, and on 0.x a minor release changes the wire. `prepare()` refuses, by name (`UnsupportedHostOperation`), a host (the lab's own or `hostPackage`) whose major.minor differs from that client's (`src/truapi-pairing.ts`: `truapiPairing`, `clientVersionBeside`). From 1 October 2026 the workspace's override gave the apps 0.23.0 while this host stayed 0.20.0, and every publish failed at `createTransaction` with `MalformedFrame: Input buffer has still data left after decoding!` (0.23 added `contacts` to the request); `tests/truapi-pairing.test.ts` names that pair and checks the installed one.
+
+- Per-identity conditions (backlog 31) in the `main-thread` topology only (`capabilities.conditions`): each session asks its page for its conditions before the first navigation (`BrowserTab.conditions`), exempting `session.localLinks()` (the host page's and the app's origins: the core reaches the host through the page, not the network), so offline cuts the core's chain sockets and the app's other requests, and a CPU slowdown slows the page. The page's own socket routes (the deny-by-default policy) still decide where a conditioned socket goes.
+
+## A person's member key (`ringVrfMemberKey`)
+
+For onboarding a person without the truAPI CLI host (composition's `environments.fast.onboarding: "released"`, 7
+October 2026): the released core's `ringVrfMember` (`@parity/truapi-host/wasm/testing`) turns a person's 32-byte
+ring-VRF entropy into their 32-byte member key. The core is initialised with its own `_bg.wasm` bytes read from the
+package. Its verifier (`truapi_verifiable_bg.wasm`) is loaded by a snippet inside the core that `fetch`es it by a
+`file:` URL, which Node's fetch refuses, and the package has no entry that takes those bytes: so for that one first call
+the adapter answers `file:` URLs under the package's own folder from disk, then restores `fetch` (every other request
+goes to the real `fetch` meanwhile); the verifier stays loaded. Test: `tests/ring-vrf-member.test.ts`.
+
+## Blocked (fails clearly, never faked)
+
+- Per-identity conditions in the default `worker` topology (no `conditions` declared): the core's chain sockets leave from a Web Worker, which the browser's routes do not see, nor does page CPU throttling slow it (Playwright 1.63, probed 3 October 2026). Needs the core's chain URLs through a conditioned link (`ConditionedLinks`), which needs a port range this host does not take yet.
+
+- `approvals.deny()` in an approve-all session, and `approve()` in a deny-all session: `confirmUserActions` is one boot-time policy for every review. Needs an upstream pending-review hook. A `per-request` session is refused with `UnsupportedHostOperation`: the truAPI CLI's local `request-decisions` patch (host-rust-core's `truapi-host-cli` crate) does not reach this npm package's mock host.
+- `account()` without an app-supplied `readAccount`: the control surface has no product-account read. Needs upstream `getProductAccount(productId, index)`.
+- Opening a path in a running session (`openPath: false`): the test host page has no control to load the product elsewhere, and the iframe receives its host port once at boot; reloading it was not tried. A new session can start at a path.
+- Deny-by-default without `denyByDefault: true` (`denyByDefaultNetwork: false`). With it, traffic routing cannot see (SharedWorker, a dedicated worker's sockets) is stopped by the resolver backstop for public names and IP literals, but not reported, and an undeclared loopback port reached that way is not blocked.
+- Product storage across a reload (see `session.reload()` above): needs upstream persistence or a storage seed on the control surface.
+
+## The contract
+
+The host contract moved to `@product-lab/core/host` (24 September 2026) and to `@product-lab/ports/host` in refactor step 7 part b; the browser it drives is the Browser port (`@product-lab/ports/browser`, refactor step 2), passed as `browser` (for example a launched `PlaywrightBrowser`). Its former structural types (`BrowserLike`, `HostPageLike`, `RouteLike`, `FrameElementLike`) are gone.
+
+## Live check
+
+```sh
+PRODUCT_LAB_WASM_LIVE=1 \
+PRODUCT_LAB_WASM_CLI_BASE=/abs/cli-data/host \
+PRODUCT_LAB_WASM_APP_URL=http://127.0.0.1:14510/ \
+PRODUCT_LAB_WASM_PRODUCT_ID=example.paseo \
+PRODUCT_LAB_WASM_EXPECT_TEXT='<text your app shows>' \
+node --import tsx --test tools/verify/tests/truapi-wasm-live.test.ts   # from the repository root
+```
+
+The live check moved to `tools/verify` in step 7: it reads the CLI host's identity and drives this host in one test, which neither adapter may do.
+
+## Package
+
+Every session forwards passive `networkEvidence()` from its browser tab, including reloads and new
+pages. It records a coverage gap when the browser cannot observe traffic. The embedded host and app
+share a browser context, so host-owned and app-owned worker traffic cannot be distinguished and remains
+listed with that attribution gap. The installed `getSigningLog()` records reviews and request payloads,
+without actual returned signatures or complete transactions; `approvals.signing()` therefore reports an
+explicit signing coverage gap, including when the log is empty. Review approvals never prove a finalized
+extrinsic and no payload bytes are retained in this evidence. Since backlog 110 each observation names the chain
+whose route its endpoint is (`chain`, `src/endpoint-chains.ts`), through a chain gate's port too, so
+`ws://127.0.0.1:40000` reads as People (`tests/endpoint-chains.test.ts`).
+
+| | |
+| --- | --- |
+| Nx project | `host-truapi-wasm` |
+| Tags | `scope:provider`, `type:adapter` |
+| Exports | `.` (`src/index.ts`: `truapiWasmHost` (with `NetworkEvent`, `WasmHostSession.reload`, `networkLog`), `SIGN_IN_KEY`, `accountEntry`, `signInScript`, config (`localChains`, `hostSettings`, `hostPageUrl`, `LocalChain`), the own bundle address (`ownScript`, `ownLoader`), entropy patch and identity helpers (`entropyFromMnemonic`, `assertBip39Entropy`), `installHostPackage`, `hostPackageCacheDir`, `hostPackageDir`, `treeDigest`, `truapiPairing`, `ringVrfMemberKey` and `RING_VRF_MODULE` (a person's ring-VRF member key from the released core's `ringVrfMember`, for onboarding without the CLI host; `src/ring-vrf-member.ts`), `appsClientVersion`, the row route (`routeWasmRelease`, `readWasmRouteSelection`, `integrityOf`, `TRUAPI_WASM_COMPONENT`, `WasmRouteSelection`), `TruapiWasmFactorySettings`, `status`, `VERIFIED_VERSION`, `TruapiWasmHostFactory`, `TRUAPI_WASM_KIND`, `truapiWasmHostOptionsSchema`). The `./verify` subpath was removed in step 7 |
+| Implements | `HostAdapterFactory` (`TruapiWasmHostFactory`, refactor step 5; `routeRelease` since backlog 27) and `HostProvider` (step 7 part b), both `@product-lab/ports/host`. Uses the domain's `HostNetworkRoutes` and `NetworkPolicy`, the Browser port's `BrowserContext` routes, and the CommandRunner port (`installHostPackage`) |
+| Depends on | `domain` (host helpers, identity entropy), `ports`, `zod`, `@scure/bip39`, `esbuild`, `@parity/truapi-host` 0.26.0 (`@playwright/test` is a dev dependency only). No other adapter since step 7 |
+| Used by | the composition root (`composition/src/adapter-catalogue.ts`, host kind `truapi-wasm`), `tools/verify`, `examples/notes` (host `truapi-wasm`, `PRODUCT_LAB_HOST=truapi-wasm`), another example (`--host truapi-wasm`) |
+
+Tests: `bunx nx run host-truapi-wasm:test`; the live check (`tools/verify/tests/truapi-wasm-live.test.ts`) is skipped unless
+`PRODUCT_LAB_WASM_LIVE=1` (above).
+
+Private, workspace-only package. Consumers will install the single umbrella package `@parity/product-lab` once it is published.
+
+Framing reuse (item82): normal product framing checks call the injected `AppFramingInspector` through system dependencies. The optional legacy `documentHeaders` callback remains a compatibility override and delegates policy to the shared pure domain helper. Session evidence retains allowed/refused/unknown status, including absent or failed reader evidence as unknown. No Node reader, application use case or panel code is imported by the adapter. Capability declarations and existing live WASM qualification are unchanged; the framing source controls do not qualify new signing or host behavior.
+
+The current package pin follows truAPI 0.26 for the lab's current SDK clients. Historical conformance counts above retain their original versions.
+
+## Opt-in shared browser shell
+
+`createSharedWasmHostServer({ port })` serves a lab-owned browser shell assembled from the installed
+release's public `web`, `testing` and `worker-runtime` APIs. The caller allocates a free loopback port,
+launches the browser, gives each actor an isolated browser context, and closes the returned server.
+`SharedWasmHostServer` exposes `url`, the installed `version`, SHA-256 `assets`, and idempotent `close()`.
+It neither launches a browser nor provisions a wallet. Existing `truapiWasmHost` sessions, capabilities,
+options and defaults do not select this shell.
+
+The page's `window.__PRODUCT_LAB_SHARED_HOST__` control accepts a single `boot` with 32 entropy bytes,
+the provisioned public identity, its namespace and lite username, a canonical app catalogue, and released
+mock/runtime configuration (the same format `hostSettings` returns). It independently derives the
+`uid.<namespace>` index-0 owner through the released WASM before activating the session. Each catalogue
+entry has `id`, `label`, `productId` and `url`; the URL's hostname must equal its product identity. A
+second boot, duplicate identity or origin-changing path is refused.
+
+`open(id, path?)`, `reload(id)`, `account(productId, index)`, `settled()`, `snapshot()`, `signingLog()`
+and `dispose()` control that actor's page. The normal host navigation callback opens registered
+products through origin-pinned iframe ports. One signing worker and one set of real platform storage
+callbacks serve the actor's separate product providers. Callback writes persist in that context's
+local storage, and a new shell page restores those original bytes and keys. No allocation or preimage
+unchecked flag is enabled. The selected released signing glue and WASM are served without byte changes;
+its worker uses the same signing-bundle selection as the release's testing server.
+
+The caller must supply faithful chain settings for real-chain coverage. Snapshots contain private host
+storage and belong in private evidence files, never public logs. The shell has no per-request approval
+UI and declares no additional provider capabilities. The Node server, browser APIs and WASM have no
+macOS, visible-display or camera requirement. A journey that uses media must launch headless Chromium
+with its fake-device and fake-UI flags and verify the resulting synthetic stream separately.
+
+The focused tests (`tests/shared-host.test.ts`) exercise bundling, released-asset digests, HTTP routes,
+port refusal and server ownership. They do not qualify product navigation, on-chain writes or media.
+
+The shell exports `SharedWasmHostApp`, `SharedWasmHostBoot` and `SharedWasmHostControl` for the page
+control above. It refuses mock responses/faults, in-page statements, known mock genesis hashes, missing
+or unhashed chain proxies, public chain endpoints, and runtime/genesis disagreement. The caller still
+verifies real chain identities and the handle's finalized binding. Browser Web Locks enforce one live
+shell page for that storage origin within an actor's context; dispose it before opening a replacement.
+All opens and reloads share one queue, and a failed open is recorded without preventing later opens.
+Storage writes are serialized and persisted before the released in-memory callback runs, so a quota
+refusal leaves its memory unchanged. Persistence needs the same browser context and host origin/port;
+app-owned storage inside credentialless frames has its upstream browser lifetime. Disable Playwright
+tracing around secret-bearing boot calls, or keep any such trace private with the wallet.
+
+`tests/shared-page.test.ts` uses the release's real callback storage and core-key codec with doubles
+for the DOM, worker and derivation. It covers restoration, clear, ownership, quota/rollback, queued
+navigation and teardown, without claiming product or runtime qualification. A failed activation and a
+dispose during activation clean up the runtime, worker and callbacks before releasing ownership.
+Normal disposal drains queued work and respects the released runtime's 30-second background-operation
+grace before terminating its worker. Hitting that ceiling closes the resources and reports an error.
+A storage snapshot can include a durable write before its in-memory callback has acknowledged it;
+use `settled()` before taking a quiescent snapshot.
+
+The boot control also takes optional `requestTimeoutMs` and `operationGraceMs` (each defaults to
+30000 and accepts an integer from 1 to 120000). The latter is passed to the released runtime as well
+as its shutdown wait. Worker requests have deadlines; disposal asks the runtime to stop immediately,
+keeps callbacks/ownership during its grace, and releases them even if activation never answers.
+
+An opt-in `reviewBridge` names an existing own-window async function installed by the caller before
+boot. It receives `{ kind: "action" | "permission", review }`. The shell retains the release's original
+review, approves an action only for the literal result `true`, and always returns `Deny` for `confirmPermission`
+requests. Bridge mode also sets the release's device/remote callback policy to `deny-all`; those callbacks
+otherwise default to `allow-all` and are separate from confirmation reviews. Existing durable core
+authorizations must still be admitted independently. `permissionLog()` exposes the separate original
+device/remote decisions. Bridge failures/timeouts deny and enter the shell's errors. A bridge requires
+`mock.confirmUserActions: false`. `reviews()` returns all original review tags; `signingLog()` keeps
+its existing signing-only meaning. No provider capability or live conformance claim is added.
+
+The optional shared shell's `authorizationStatus(productId, request)` reads the active released
+runtime's public permission administration API without prompting or setting a status. It requires
+a registered product and preserves Authorized, Denied and NotDetermined; unknown replies/errors
+refuse. This does not inspect ResourceAllocation or AutoSigning authority. Callback/runtime-double
+tests cover the method; live effective-grant qualification remains open.
+
+A released runtime can also answer NotDetermined after its underlying core has gone away;
+a status reply alone is not a liveness or consent proof. The caller must refuse an unadmitted state.
+
+Without `transportBridge`, provider forwarding keeps its original synchronous path and adds no
+transport queue or caps. The optional `transportBridge` names an existing own-window async function, with deny-all defaults.
+It receives `SharedWasmHostTransportEvent`: the registered provider's `productId`, a shell-assigned
+`channel`, direction (`request` or `response`), and copied original public wire `bytes` as hex.
+Literal `true` admits forwarding to the provider or product; false, thrown errors and timeouts latch
+refusal for the whole page. Queued frames recheck refusal/disposal before forwarding, including after
+a delayed decision. Limits are 2 MiB per frame, 200000 frames and 128 MiB for both directions combined.
+The caller must decode, archive and correlate those bytes and impose its own exact signing policy.
+The shell supplies no approve-all signing policy. Its bridge is separate from confirmation callbacks,
+which trusted released-host products can bypass. This optional composition is tested with provider/DOM
+and worker doubles; live transport conformance and source compatibility remain unqualified.

package/adapters/host/truapi-wasm/src/bulletin-read-probe.d.ts

@@ -0,0 +1,42 @@
+import type { HostLimit } from "@parity/product-lab/domain";
+import type { HostProbe, HostProbeRequest } from "@parity/product-lab/ports/host";
+/** One answer of the lookup, as the package's callbacks give it (a neverthrow `Result`). */
+interface LookupAnswer {
+    isOk(): boolean;
+    readonly value?: unknown;
+    readonly error?: unknown;
+}
+/** What the probe needs of the package's `web/create-mock-host.js`. */
+export interface MockHostModule {
+    createMockHost(config: object): {
+        readonly callbacks: {
+            readonly preimage: {
+                lookupPreimage(key: Uint8Array): AsyncIterable<LookupAnswer>;
+            };
+        };
+    };
+}
+export interface BulletinReadProbeOptions {
+    /** Loads the sessions' own host package's mock host module. */
+    load(): Promise<MockHostModule>;
+    /** The host page's mock settings (`hostSettings(...).mock`): its chain proxies and chains. */
+    mock: object;
+    /** The package's version, named in the answer. */
+    version: string;
+    request: HostProbeRequest & {
+        content: NonNullable<HostProbeRequest["content"]>;
+    };
+    now(): number;
+}
+/** How the probe asks, said in every answer. */
+export declare const PROBED_HOW = "probed in Node with the host package's own preimage lookup (createMockHost), not in the host page";
+/** The limit as the window states it before the host is probed and when it cannot be (the C6 text). */
+export declare const BULLETIN_LIMIT_LABEL = "can't read Bulletin";
+export declare const BULLETIN_LIMIT_WHY = "truAPI WASM cannot read Bulletin yet (upstream, backlog 173): what was stored there before this page opened shows as not readable, each item once the app stops waiting for it";
+export declare function bulletinReadProbe(options: BulletinReadProbeOptions): Promise<HostProbe>;
+/**
+ * The host's Bulletin limit after `probe`: none once it reads Bulletin; the probe's reason when it does not; the C6
+ * text with why it was not probed otherwise (never probed: "not probed yet").
+ */
+export declare function bulletinLimits(probe: HostProbe | undefined): HostLimit[];
+export {};

package/adapters/host/truapi-wasm/src/bulletin-read-probe.js

@@ -0,0 +1,69 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { checkContent } from "@parity/product-lab/domain/statements";
+export const PROBED_HOW = "probed in Node with the host package's own preimage lookup (createMockHost), not in the host page";
+export const BULLETIN_LIMIT_LABEL = "can't read Bulletin";
+export const BULLETIN_LIMIT_WHY = "truAPI WASM cannot read Bulletin yet (upstream, backlog 173): what was stored there before this page opened shows as not readable, each item once the app stops waiting for it";
+const said = (error) => (error instanceof Error ? error.message : String(error)).split("\n")[0];
+function described(answer) {
+    if (!answer.isOk())
+        return { words: `an error (${said(answer.error)})` };
+    return answer.value instanceof Uint8Array ? { bytes: answer.value } : { words: "not found" };
+}
+export async function bulletinReadProbe(options) {
+    const { request, version } = options;
+    const { cid, key, stored } = request.content;
+    const started = options.now();
+    const done = (state, reason) => ({ capability: "bulletin-read", state, reason, ms: Math.round(options.now() - started) });
+    const host = `the truAPI WASM test host (@parity/truapi-host ${version})`;
+    const content = `content another account stored on Bulletin (${cid}, ${stored})`;
+    let iterator;
+    try {
+        const module = await options.load();
+        iterator = module.createMockHost(options.mock).callbacks.preimage.lookupPreimage(key)[Symbol.asyncIterator]();
+    }
+    catch (error) {
+        return done("not-probed", `the lab could not build ${host}'s mock host to ask it: ${said(error)}`);
+    }
+    let timer;
+    const bound = new Promise((resolve) => {
+        timer = setTimeout(() => resolve("timeout"), request.timeoutMs);
+        request.signal?.addEventListener("abort", () => resolve("timeout"), { once: true });
+    });
+    let last = "nothing";
+    try {
+        for (;;) {
+            const next = await Promise.race([iterator.next().catch((error) => new Error(said(error))), bound]);
+            if (next instanceof Error) {
+                last = `an error (${next.message})`;
+                break;
+            }
+            if (next === "timeout" || next.done)
+                break;
+            const answer = described(next.value);
+            if ("words" in answer) {
+                last = answer.words;
+                continue;
+            }
+            const check = checkContent(cid, answer.bytes);
+            if (check.status === "mismatch")
+                return done("lacks", `${host} returned bytes for ${content} that do not hash to it (${check.why}); ${PROBED_HOW}`);
+            return done("holds", `${host} returned ${content}: ${answer.bytes.length} bytes in ${Math.round(options.now() - started)} ms; ${PROBED_HOW}`);
+        }
+    }
+    finally {
+        clearTimeout(timer);
+        void iterator.return?.().catch(() => undefined);
+    }
+    if (request.signal?.aborted)
+        return done("not-probed", `the probe of ${host} was stopped before it answered`);
+    return done("lacks", `${host} did not return ${content}: its preimage lookup answered ${last === "nothing" ? "nothing" : `"${last}"`} within ${request.timeoutMs / 1000} s; ${PROBED_HOW}`);
+}
+export function bulletinLimits(probe) {
+    if (probe?.state === "holds")
+        return [];
+    if (probe?.state === "lacks")
+        return [{ label: BULLETIN_LIMIT_LABEL, why: probe.reason }];
+    const why = probe ? `not probed: ${probe.reason}` : "not probed yet (a lab probes it when it reads its scenario conditions)";
+    return [{ label: BULLETIN_LIMIT_LABEL, why: `${BULLETIN_LIMIT_WHY}; ${why}` }];
+}

package/adapters/host/truapi-wasm/src/config.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Host page configuration for the `@parity/truapi-host` test host.
+ *
+ * Built from the documented `MockHostConfig` (`chainProxies`,
+ * `supportedChains`) and `runtimeConfig` fields rather than by importing
+ * `fromNetworks` from `testing/playwright`: that module pulls in the browser
+ * runtime, which fails to load under Node 25's default Web Storage
+ * (`globalThis.localStorage.getItem is not a function`).
+ */
+import { type HostNetworkRoutes } from "@parity/product-lab/domain";
+export type ChainRole = "people" | "assetHub" | "bulletin";
+export interface LocalChain {
+    role: ChainRole;
+    /** Loopback WebSocket endpoint of the local node. */
+    rpcUrl: string;
+    /** The node's own `chain_getBlockHash(0)`; a fork keeps the public genesis. */
+    genesisHash: string;
+}
+export interface HostPageOptions {
+    productUrl: string;
+    productId: string;
+    /** Network name the host reports (`HostChainSet.network`), e.g. `paseo-next-v2`. */
+    network: string;
+    chains: readonly LocalChain[];
+    /** `faithful` = real allocation and real statement store (the only mode that counts as coverage). */
+    mode: "faithful" | "faked";
+    /** Approval policy for every review the core requests (fixed when the page boots). */
+    approvals: "approve-all" | "deny-all";
+    topology?: "worker" | "main-thread";
+    logLevel?: string;
+}
+/**
+ * The host page's chains (its wire format) from the domain's routing
+ * (refactor step 7 part b): People and Asset Hub are required, Bulletin is
+ * used when routed; each needs its genesis.
+ */
+export declare function localChains(routes: HostNetworkRoutes): LocalChain[];
+export declare function assertLocalChains(chains: readonly LocalChain[]): void;
+/** The mock host's settings the page boots with (`MockHostConfig`): its chain proxies and chains. */
+export declare function mockSettings(options: Pick<HostPageOptions, "network" | "chains" | "mode" | "approvals">): {
+    chainProxies: {
+        loopbackStatements?: boolean | undefined;
+        genesisHash: string;
+        rpcUrl: string;
+    }[];
+    supportedChains: {
+        network: string;
+        chains: {
+            identifier: "AssetHub" | "People" | "Bulletin";
+            genesisHash: string;
+        }[];
+    };
+    confirmUserActions: boolean;
+};
+export declare function hostSettings(options: HostPageOptions): {
+    readonly mock: {
+        chainProxies: {
+            loopbackStatements?: boolean | undefined;
+            genesisHash: string;
+            rpcUrl: string;
+        }[];
+        supportedChains: {
+            network: string;
+            chains: {
+                identifier: "AssetHub" | "People" | "Bulletin";
+                genesisHash: string;
+            }[];
+        };
+        confirmUserActions: boolean;
+    };
+    readonly runtimeConfig: {
+        [k: string]: {
+            genesisHash: string;
+        };
+    };
+    readonly allowances: "chain" | "granted";
+};
+/** URL of the served host page (`testing/browser-entry` reads these parameters). */
+export declare function hostPageUrl(base: string, options: HostPageOptions): string;

package/adapters/host/truapi-wasm/src/config.js

@@ -0,0 +1,80 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { LoopbackUrl } from "@parity/product-lab/domain";
+const ROUTE = { people: "people", assetHub: "asset-hub", bulletin: "bulletin" };
+const IDENTIFIER = {
+    people: "People",
+    assetHub: "AssetHub",
+    bulletin: "Bulletin",
+};
+export function localChains(routes) {
+    const needed = "The truAPI WASM test host";
+    return Object.keys(ROUTE).flatMap((role) => {
+        if (role === "bulletin" && !routes.chains[ROUTE[role]])
+            return [];
+        const chain = routes.verifiedChain(ROUTE[role], needed);
+        return [{ role, rpcUrl: chain.ws, genesisHash: chain.genesis }];
+    });
+}
+export function assertLocalChains(chains) {
+    const roles = new Set();
+    const hashes = new Set();
+    for (const chain of chains) {
+        if (!LoopbackUrl.test(chain.rpcUrl, { protocols: ["ws:", "wss:"] })) {
+            throw new Error(`chain ${chain.role} must be a loopback WebSocket endpoint, got ${chain.rpcUrl}`);
+        }
+        if (!/^0x[0-9a-f]{64}$/.test(chain.genesisHash)) {
+            throw new Error(`chain ${chain.role} genesis must be a 0x-prefixed 32-byte hash`);
+        }
+        if (roles.has(chain.role))
+            throw new Error(`duplicate chain role ${chain.role}`);
+        if (hashes.has(chain.genesisHash))
+            throw new Error(`duplicate genesis ${chain.genesisHash}`);
+        roles.add(chain.role);
+        hashes.add(chain.genesisHash);
+    }
+    for (const role of ["people", "assetHub"]) {
+        if (!roles.has(role))
+            throw new Error(`the WASM host needs a ${role} chain`);
+    }
+}
+export function mockSettings(options) {
+    assertLocalChains(options.chains);
+    const faithful = options.mode === "faithful";
+    return {
+        chainProxies: options.chains.map((chain) => ({
+            genesisHash: chain.genesisHash,
+            rpcUrl: chain.rpcUrl,
+            ...(!faithful && chain.role === "people" ? { loopbackStatements: true } : {}),
+        })),
+        supportedChains: {
+            network: options.network,
+            chains: options.chains.map((chain) => ({
+                identifier: IDENTIFIER[chain.role],
+                genesisHash: chain.genesisHash,
+            })),
+        },
+        confirmUserActions: options.approvals === "approve-all",
+    };
+}
+export function hostSettings(options) {
+    const faithful = options.mode === "faithful";
+    const mock = mockSettings(options);
+    const runtimeConfig = Object.fromEntries(options.chains.map((chain) => [chain.role, { genesisHash: chain.genesisHash }]));
+    return { mock, runtimeConfig, allowances: faithful ? "chain" : "granted" };
+}
+export function hostPageUrl(base, options) {
+    const { mock, runtimeConfig, allowances } = hostSettings(options);
+    const url = new URL(base);
+    url.searchParams.set("product", options.productUrl);
+    url.searchParams.set("productId", options.productId);
+    url.searchParams.set("mock", JSON.stringify(mock));
+    url.searchParams.set("runtimeConfig", JSON.stringify(runtimeConfig));
+    url.searchParams.set("allowances", allowances);
+    url.searchParams.set("login", "manual");
+    if (options.topology)
+        url.searchParams.set("topology", options.topology);
+    if (options.logLevel)
+        url.searchParams.set("logLevel", options.logLevel);
+    return url.toString();
+}

package/adapters/host/truapi-wasm/src/endpoint-chains.d.ts

@@ -0,0 +1,5 @@
+import type { DirectConnection, HostNetworkRoutes } from "@parity/product-lab/domain";
+/** The chain whose route (in any of `routings`) is at `endpoint`'s host and port; undefined when none is. */
+export declare function chainAt(endpoint: string, routings: readonly HostNetworkRoutes[]): string | undefined;
+/** Each observation named with the chain its endpoint routes to, when one does (one already named keeps its name). */
+export declare function namedByChain(observations: readonly DirectConnection[], routings: readonly HostNetworkRoutes[]): DirectConnection[];

package/adapters/host/truapi-wasm/src/endpoint-chains.js

@@ -0,0 +1,30 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+function place(address) {
+    try {
+        const url = new URL(address);
+        const secure = url.protocol === "https:" || url.protocol === "wss:";
+        return `${url.hostname}:${url.port || (secure ? "443" : "80")}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function chainAt(endpoint, routings) {
+    const at = place(endpoint);
+    if (at === undefined)
+        return undefined;
+    for (const routes of routings)
+        for (const [chain, route] of Object.entries(routes.chains))
+            if (place(route.ws) === at)
+                return chain;
+    return undefined;
+}
+export function namedByChain(observations, routings) {
+    return observations.map((observation) => {
+        if (observation.chain !== undefined)
+            return observation;
+        const chain = chainAt(observation.endpoint, routings);
+        return chain === undefined ? observation : { ...observation, chain };
+    });
+}

package/adapters/host/truapi-wasm/src/entropy-patch.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Temporary lab patch for `@parity/truapi-host` (written for 0.20.0; the 0.23.0 page carries the same check once).
+ * Product-lab's checkout only, and only for a session whose person has short entropy (7 October 2026): a product is
+ * served the released page byte for byte (the user's rule: released hosts only), the lab makes new people from
+ * 32-byte entropy (24-word phrases), which the released page accepts, and a person from a shorter phrase on this host
+ * is refused there by name (`shortEntropyRefusal`). The patch retires when upstream accepts every BIP-39 length
+ * (docs/upstream/2026-10-07/wasm-host-entropy-lengths.md, not filed).
+ *
+ * The test host page (`resolveAccount` in `testing/dev-accounts`) and the
+ * Playwright fixture (`accountNames`) reject any entropy that is not 32 bytes.
+ * The truAPI CLI onboards identities from 12-word mnemonics (16 bytes), and the
+ * core itself (`derive_root_keypair_from_entropy`, `substrate_bip39`) accepts
+ * every BIP-39 length. The provider rewrites the one check in the served host
+ * page bundle and fails loudly if upstream changes it, so the patch cannot
+ * silently stop applying.
+ *
+ * Upstream fix: accept 16/20/24/28/32 bytes in `resolveAccount` and in the
+ * fixture's `accountNames` (host-rust-core `js/packages/truapi-host/src/testing/`).
+ */
+export declare const ENTROPY_CHECK = "spec.entropy.length !== 32";
+export declare const ENTROPY_CHECK_REPLACEMENT = "![16, 20, 24, 28, 32].includes(spec.entropy.length)";
+export declare const ENTROPY_PATCH_ID = "entropy-length";
+/** The entropy the released host page accepts: 32 bytes (a 24-word phrase). */
+export declare const RELEASED_PAGE_ENTROPY_BYTES = 32;
+/** Why a person whose entropy the released page refuses cannot sign in on it (a product, or a session served it as released). */
+export declare function shortEntropyRefusal(bytes: number, served: "product" | "released-session"): string;
+export declare function patchEntropyCheck(bundle: string): string;

package/adapters/host/truapi-wasm/src/entropy-patch.js

@@ -0,0 +1,23 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export const ENTROPY_CHECK = "spec.entropy.length !== 32";
+export const ENTROPY_CHECK_REPLACEMENT = "![16, 20, 24, 28, 32].includes(spec.entropy.length)";
+export const ENTROPY_PATCH_ID = "entropy-length";
+export const RELEASED_PAGE_ENTROPY_BYTES = 32;
+export function shortEntropyRefusal(bytes, served) {
+    const words = (bytes * 8 + (bytes * 8) / 32) / 11;
+    const why = served === "product"
+        ? "a product is served the released WASM test host page as published"
+        : "this session's page was served as released, since it started with a 32-byte person: start a new session for this one";
+    return (`a person made from a ${words}-word phrase (${bytes} bytes of entropy) cannot sign in: the released page accepts ${RELEASED_PAGE_ENTROPY_BYTES} bytes only (a 24-word phrase), and ${why}. ` +
+        "The lab makes new people from 24-word phrases; a shorter phrase is unsupported on this host until it accepts every BIP-39 length " +
+        "(docs/upstream/2026-10-07/wasm-host-entropy-lengths.md)");
+}
+export function patchEntropyCheck(bundle) {
+    const occurrences = bundle.split(ENTROPY_CHECK).length - 1;
+    if (occurrences !== 1) {
+        throw new Error(`truapi-host entropy patch expected the 32-byte check once, found it ${occurrences} times; ` +
+            "the host page changed upstream, re-verify the patch");
+    }
+    return bundle.replace(ENTROPY_CHECK, ENTROPY_CHECK_REPLACEMENT);
+}

package/adapters/host/truapi-wasm/src/framing.d.ts

@@ -0,0 +1,10 @@
+import { type AppFramingInspection } from "@parity/product-lab/domain";
+import type { AppFramingInspector } from "@parity/product-lab/ports/system";
+/** Legacy injection: the final document's address and response header getter. */
+export type DocumentHeaders = (url: string) => Promise<{
+    url: string;
+    header(name: string): string | null;
+}>;
+export declare function inspectFraming(app: string, url: string, hostOrigin: string, framedBy: string, read?: DocumentHeaders, inspect?: AppFramingInspector): Promise<AppFramingInspection>;
+/** Legacy message helper; unknown evidence remains distinguishable through inspectFraming. */
+export declare function frameRefusal(app: string, url: string, hostOrigin: string, framedBy: string, read?: DocumentHeaders, inspect?: AppFramingInspector): Promise<string | undefined>;