refactor(polkavm): isolate optional host composition

.changeset/pvm-host-runtime-authority.md

@@ -0,0 +1,8 @@
+---
+"@parity/truapi-host": minor
+---
+
+Add the product-scoped PolkaVM application runtime and its version-two guest transport. Route host capabilities through
+runtime authority checks and preserve the existing consent requirements for signing and resource allocation.
+
+Keep the SDK usable in no-std guest builds, including Pocket message types.

.github/workflows/ci.yml

@@ -63,6 +63,8 @@ jobs:
       - name: cargo build
         run: cargo build --workspace --all-targets --all-features
 
+      - name: cargo check no-std guest SDK
+        run: cargo check --locked -p truapi -p truapi-client --no-default-features
       - name: Check Rust library documentation
         env:
           RUSTDOCFLAGS: "-D warnings"

CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to the TrUAPI protocol are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 generated from [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [Unreleased]
+
+### Changed
+
+- isolate the optional PolkaVM runtime in `truapi-polkavm-host`; keep the base
+  server and browser asset distribution independent, and pin cooperative update
+  deadlines, multi-touch input, and image clipboard output (#540)
+- let browser signing hosts request personhood-backed Statement Store
+  allowances for products instead of reporting the allocator as native-only
+- migrate the generic runtime and Rust client to SDK 0.16's scoped wire codec 2;
+  product guests must be rebuilt rather than sending codec-1 frames
+
+### Added
+
+- report local-wallet registration stages and retryable chain-read errors through
+  a request-scoped browser callback without resubmitting accepted claims
+- expose local signing-wallet username registration and chain-verified identity
+  refresh through the browser worker, with native UID proofs and RFC-0004
+  X25519 identifier keys
+- Generate a transport-neutral `no_std` Rust client with typed request responses,
+  subscription interrupts, and host-initiated Renderer subscription codecs.
+- Generate complete App, Widget, Worker, and Worker-only method catalogs from
+  the canonical protocol schema.
+
+### Fixed
+
+- keep host-backed allowance helpers available on Wasm with browser-compatible
+  polling clocks, while excluding the native-only renewal driver (#540)
+- report the immutable PolkaVM runtime revision actually pinned by the optional
+  composition crate (#540)
+- return a decode error instead of trapping when subscription helpers receive a
+  request descriptor
 ## [0.20.0] - 2026-09-23
 
 ### Added

CLAUDE.md

@@ -16,6 +16,8 @@ rust/crates/
   truapi-platform/       Host syscall traits (storage, navigation, consent, ...)
   truapi-provider/       network provider backends (WebSocket RPC or smoldot light-client)
   truapi-server/         Rust runtime hosts implement; ships as WASM (browser/node)
+  truapi-polkavm-host/  optional native composition pinned to
+                        paritytech/polkavm-host-runtime
   truapi-host-cli/       CLI pairing/signing hosts; Bun scripts share the container web API gates
 js/packages/
   truapi/                  @parity/truapi TS package; generated TS lives under ignored paths
@@ -80,6 +82,13 @@ scripts/cli-runner-package.test.ts
                            documents intentionally unpublished npm package versions
 ```
 
+The PolkaVM runtime implementation, wire crates, browser package, and ABI
+contract live in `paritytech/polkavm-host-runtime`. The base `truapi-server`
+must remain PolkaVM-free. Native integrations use the optional
+`truapi-polkavm-host` composition crate; browser integrations consume
+`@parity/polkavm-browser-runtime` directly. Never copy or export browser assets
+from this repository.
+
 ### Crate + binding invariants
 
 - `truapi` is canonical; runtime crates re-export rather than redefine. New