feat(individuality): withLiteAlias runs a call under a lite-person origin

[peetzweg]

Second piece of the lite-personhood sign-up flow (#354): withLiteAlias(signer, info), the lite sibling of withAsPerson, filling the PeopleLiteAuth extension inside signTx.

Why: the two-transaction lite sign-up (unsigned PeopleLite.set_alias_account bind, then the signed, fee-free Game.sign_up_with_account_lite_invite) needs this extension on both legs, and dim2 hand-encodes it today.

How: three variants. AliasWithAccount reads the nonce back out of the CheckNonce slot PAPI filled, so the two cannot disagree. AliasWithProof forces VerifyMultiSignature=Disabled, so the host emits an unsigned general transaction with origin None. AliasWithAccountRevised builds the pallet's (implication, "revise", account, nonce) tuple. Every value round-trips through a codec built from the metadata being signed against, so devnet's shorter field list throws instead of emitting plausible wrong bytes. AsLitePerson is deliberately absent: it authenticates the host-custody canonical lite account, which no product-side signer can be.

Both signers now run one ordered signTx body through an internal withOriginExtension, each keeping its own buildValue; that order is the fragile part and was previously implemented and explained twice. buildImplication and implicationMessage now require the extension identifier instead of defaulting to AsPerson, which turned a silent wrong-slice hash into a compile error at 19 call sites. Neither is exported, so nothing changes for withAsPerson.

The individuality skill now documents the flow end to end: the ordering trap (Custom(175), NoAliasBinding, when the bind leg has not landed), the two contexts the chain allowlists for the bind (peopleLiteAuth and score, both peopl.<tld>), and that the proof therefore comes from the personhood product rather than from dim2.

489 package tests pass; workspace tests, typecheck and biome clean.

[Imod7]

Please update the individuality skill doc also.

In product-sdk/packages/individuality/src/as-person-implication.ts, lines 72 and 110, both:

    identifier: string = AS_PERSON,

Now that a second extension calls these, could the identifier become required?

[Imod7]

Please update the individuality skill doc also.

Fixed in 0f1efd1. The skill gained a lite-flow section, the frontmatter and the write-half bullet name withLiteAlias, the "ask for them to be exported" sentence is gone, and index.ts names both signers. One claim in that new section was itself wrong and was corrected in e7fcc22: the chain's context allowlist is the gate, not host-side identity.

In product-sdk/packages/individuality/src/as-person-implication.ts, lines 72 and 110, both:

    identifier: string = AS_PERSON,

Now that a second extension calls these, could the identifier become required?

Fixed in c7c9382. Making the parameter required flushed out 19 call sites that had been taking the AsPerson default silently, including in as-person-implication.ts's own tests.

[github-actions]

📦 Bundle size impact

Comparing 2026-09-01T16:20:26.660Z → 2026-09-01T16:20:06.742Z

	Package	Entry	Bundled before	Bundled after	Δ	Ship gzip Δ	Shake ratio
🟢	@parity/product-sdk	./individuality	73.3 KB	74.6 KB	+1.3 KB (+1.8%)	0 B	—

Thresholds — 🟡 ≥10% or ≥5.0 KB · 🟠 ≥20% or ≥15.0 KB (bundled). Percentage only applies once the baseline is ≥ 10 KB. Informational — this check never blocks merge.