Track remaining work for the shared Rust core integration on iOS

[pgherveou]

Context

Track the remaining work to land the initial Rust integration , complete the migration to the shared Rust core, and address the main production-readiness gaps.

other references: https://hackmd.io/rNkC3LdOSpy4yL--s1XoBw

Initial integration blockers

• Permission-gating:
  • Outbound network requests
  • WebRTC access inside the container, #444, merged as 46082c7a. The host peeks the decision before the product realm exists and bakes it in as a literal; the container removes RTCPeerConnection and its vendor aliases unless the answer was an explicit grant. In-realm enforcement is required because ICE is UDP to an arbitrary host, so no rule list, shouldInterceptRequest or CSP directive sees it, and an async permission request from inside the realm would be forgeable. Hosts must now inject the container into every frame (forMainFrameOnly: false); the bootstrap stays main-frame-only so subframes fail closed. A fresh grant applies from the next load.
    • NOTE: iOS only. Android publishes the decision but injects no container, so nothing consumes it and WebRTC stays reachable there whatever the decision says.
• Add Extrinsic V5 support TrUAPI #333.
  • Related WIP PRs: frame-decode #104, Subxt #2268.
  • Encode the transaction-extension pipeline version from metadata rather than a constant — #382, merged as 0b1ae564. Raised by @kianenigma below: mainnet keeps two extension pipelines, and the allowance builder wrote a hardcoded 0x00 while selecting its extension set by extrinsic-format version. Both the extrinsic body and the ring-VRF proof message now carry the version the runtime declares.
• Make sure that PGAS allowances are supported.
  • Claim on Asset Hub, shared by the direct and SSO allocation paths — #391, merged as f0761139. Live-verified against paseo-next-v2 Asset Hub.
  • truapi-host-cli serves Asset Hub as a chain role, so the claim is reachable from a host — #404, merged as d88d3414.
  • supported_chains must return Asset Hub from dotli, iOS, and Android before products see anything but NotAvailable.
• Statement store allowances: when no slot are available - Native replace the oldest one that can be replaced and replace it, rust does not. — #378, merged as b5734119. Replaces the oldest slot past Resources.StmtStoreReplacementCooldown, aged against the chain's clock rather than the host's, and reports exhaustion only when nothing is replaceable.
  • NOTE: this covers choosing the victim. When nothing is replaceable the core reports exhaustion but nobody acts on it — the host CLI rotates its auto-managed account, the renewal loop only logs a warning, and a product gets a bare NotAvailable. The core→host exhaustion signal is tracked as a #308 follow-up.
• Complete Chat modality support (#326, [specification], completed by #430 (register_bot), #453 (every message variant, Android host surface) and #459 (inbound actions and custom rendering on a JS host).
  • NOTE: feat(platform,server): match manifest execution kinds and serve custom chat rendering from a JS host #459 moved ProductExecutionKind to App | Widget | Worker with SCALE discriminants 0/1/2. A host still encoding 1 for its worker now reads as a widget and loses Chat access silently. Both apps must update their encoding.
  • NOTE: four of the six Chat V1 methods have no live end-to-end coverage on any host. The chat battery drives create_room and post_message; its other cases are content-screening refusals.(https://hackmd.io/@pgherveou/rJrdTHcBMg)).
• Build and packaging. Swift framework artifacts should be published so that the app can be outside of the current submodule
• SignVRF not implemented on Android (Tarik's breakdown)

Full integration follow-up

• Move SSO to the shared Rust core. Related work: polkadot-app-ios-v2#1313. The mobile-host SSO message-handling bindings landed in #433, merged as 20393e7e.
• Implement RFC 0017 in Rust.
• Route payment functions and subscriptions for products such as T3rminal through the native/shared core, or add temporary callbacks for payment subscriptions.
• Add background processing for statement-store allowance renewal (#308) and Coinage.
  • Renewal engine, target ledger, and periodic driver — #308, merged as f54d0c5c. Targets persist in CoreStorageKey::StatementRenewalTargets as derivation recipes; live-verified against paseo-next-v2.
  • Export the renewal entry points over UniFFI — #417, merged as b4292f68. Four calls on NativeTrUApiHostRuntime and NativeTrUApiCore, forwarded by both host shells. The report is a named record because UniFFI has no tuple type, and a target's account id is length-checked because UniFFI carries bytes as Vec<u8>.
  • Drive them from an OS worker (WorkManager / BGTaskScheduler). App-side; neither app calls renewal yet. iOS already has the pattern in CoinageRecyclingTaskRegistrator. See Drive statement-store allowance renewal from a host OS scheduler #376.
  • Coinage background processing — #344.

Performance and resilience

• Investigate the PAPI provider memory issue when the app is backgrounded. @ERussel to provide details.
• Support background execution for in-flight async work such as extrinsic submission, using a Rust callback/task abstraction. @ERussel to provide details.
• Revalidate OS permissions before each protected operation because the host or OS may suspend, revoke, or reset them. #471
• Add diagnostics that notify the user when an operation takes too long.

[kianenigma]

Add Extrinsic V5 support #333.

I don't know how this is managed, but on mainnet, unlike all testnets, we want to keep two versions for transaction extensions. I believe this implies encoding an extra "extension pipeline version" in the transactions: polkadot-fellows/runtimes#1233 (comment)

It is something you need to keep in mind, if you are "manually" building extrinsics, vs. fully relying on metadata. I remember at least for some time, people were building v5 extrinsics manually, hardcoding some metadata stuff.

Just an FYI. Please comment in polkadot-fellows/runtimes#1233 (comment) if any support needed.

[TarikGul]

Currently pushing the allowances to completion. Finishing #308 - along with PGAS allowance, and statement store allowance when slot are not available.

[ERussel]

Unchecked for now "Route payment functions and subscriptions for products such as T3rminal through the native/shared core, or add temporary callbacks for payment subscriptions.". I think we need temporary callbacks for payments calls

[TarikGul]

SO action_subscribe and custom_message_render are all working on native but are broken on wasm. Only things that need to be fixed for chat v1.

[TarikGul]

Chat extension additional links and work

Merged:

• #326 integrate the Chat modality with the shared Rust core (2026-08-09)
• #430 implement Chat::register_bot in the shared Rust core (2026-08-18)
• #400 serve Chat from a JS host as an optional capability (2026-08-19)
• #453 forward every message variant and add the Android host surface (2026-08-19)

Open:

• #459 match manifest execution kinds and serve custom chat rendering from a JS host