feat(pvm): expose standalone runtime through host bridge

[replghost]

Summary

• add truapi-pvm-host as the reviewed Host SDK integration boundary for PolkaVM App runtimes.
• pin standalone runtime release v0.1.5 at source c85878f5492a9f8b9d511dab7079d9b833a0fabf.
• expose the native runtime, UniFFI surface, GPU wire contract, and optional browser assets through one bridge revision.
• keep runtime implementation, browser workers, deterministic artifacts, conformance fixtures, and the App ABI contract in paritytech/pvm-host-runtime.

Runtime boundary

truapi-server depends on truapi-pvm-host with the ffi feature. The bridge re-exports the standalone runtime API while preserving the existing pvm_runtime UniFFI namespace and committed Swift/Kotlin bindings. Browser Hosts may enable browser-assets to consume the asset set tied to the same runtime revision.

Host applications consume this bridge rather than pinning the standalone repository directly.

Standalone runtime

• repository: https://github.com/paritytech/pvm-host-runtime
• release: v0.1.5
• source: c85878f5492a9f8b9d511dab7079d9b833a0fabf
• conformance update: fix: align App ABI contract and conformance pvm-host-runtime#13
• release preparation: chore: prepare v0.1.5 pvm-host-runtime#14
• required check: Merge readiness
• path-aware lanes: Rust runtime; browser runtime and assets
• release artifacts: browser npm tarball, embedded asset archive, source-bound release manifest

Baseline TrUAPI transport

• every PolkaVM App receives the canonical host_truapi_send / host_truapi_poll ABI without a manifest capability.
• cooperative, CoreVM, native, Wasm, and translated browser paths share bounded opaque-frame queues.
• limits: 1 MiB per frame, 32 frames, and 4 MiB per direction.
• ABI v1 documents the transport and v0.1.5 adds one reproducible native/browser round-trip conformance guest.

Verification

• standalone Rust: 43 passed across 8 suites; Clippy with warnings denied
• standalone browser package: 7 passed; embedded assets byte-identical
• conformance guest rebuild: byte-identical
• host bridge: 2 passed with all features; Clippy with warnings denied
• truapi-server: 789 passed with all features
• iOS UniFFI bindings: current
• exported browser assets: byte-identical

[replghost]

@pgherveou @eugypalu all required checks are green, including Rust/Clippy, Android, iOS, browser artifacts, and license policy. Could one of you provide the required host-sdk-team approval so the merge queue can admit this dependency?

[pgherveou]

can we remove the generated files in the new js packages. Can't these be built from the src files ?

for the new bindings we can also added then to .gitattributes with linguist-generated=true, so that at least they show up as generated artifacts in the code review

[replghost]

Addressed in b0e178e: removed the committed browser dist/ tree, ignored it, and kept build/test/release generation source-driven. npm test now proves a clean package checkout builds the WASM and split workers before checksum verification; npm pack --dry-run --json still contains all ten release files. Added linguist-generated=true for the new Swift and FFI binding outputs in .gitattributes.

[replghost]

Cleanup CI is fully green; ready for rereview and merge queue admission.

[pgherveou]

DQ: why do all these things need to live in host-rust-core, they don't seem to have dependency on the rust-core stuff, and could be shipped independently ?

[replghost]

They share the Rust core directly rather than only co-locating artifacts:

• @parity/pvm-browser-runtime compiles rust/crates/pvm-runtime to wasm32-unknown-unknown; its JS workers are the adapter around that Wasm ABI.
• The same pvm-runtime crate is linked into truapi-server, so the existing UniFFI cdylib/XCFramework/AAR exports the native Swift/Kotlin runtime. A separate repository would require a second native library and package lifecycle in every host.
• pvm-gpu-wire is shared by the native and browser implementations, keeping bounds and binary GPU records identical.
• The existing host-rust-core CI/release jobs already regenerate UniFFI and publish the browser/native artifacts from one reviewed commit.

They could be split, but that would duplicate the Rust source/pins and create independent browser, XCFramework, and AAR versioning with an ABI-drift boundary. Keeping the runtime here makes the host-neutral Rust implementation the single source for all three targets; Epoca/Dotli/Brevity/Desktop remain independent consumers.

[replghost]

Does that shared Rust/UniFFI dependency path resolve the repository-placement concern, or do you want the runtime split into a separate repository before merge?

[replghost]

Additional review completed. Fixed three concrete boundary issues:

• Native constructors now enforce the same program, gas, asset-count, per-file, aggregate-byte, and safe-path limits as the browser ABI before guest compilation.
• The browser compiler backend now enforces the manifest graphics profile, one Tri2D submission per update, CoreVM framebuffer-only behavior, and GPU state/sequence errors consistently with the interpreter.
• Browser worker termination now closes its timer and MessageChannel ports; invalid launches no longer leak host-thread channels.

Added behavioral browser tests for malformed launch inputs and cross-profile framebuffer submission. Full workspace result: 1,205 tests passed, Clippy -D warnings passed, package tests 4/4 passed, and committed iOS bindings remain current.

Vendored commit 56c67a306fc276129829f94db85a622061e17882 into both consumers and exercised it end to end: Epoca App v2 10/10 plus seven-app browser matrix 45/45; Dotli Doom, Quake, Duke3D, NES, egui, GPU Cube, and Scene Lab all passed on the compiler backend.

[replghost]

PolkaVM dependency update:

• Rebased epoca/aarch64-jit-0.37 onto current paritytech/polkavm@master; branch head is e06cce9, 6 commits ahead / 0 behind.
• Ported the AArch64 JIT across the current code-blob, 32-bit address, dynamic-paging, memset, and 16 KiB page semantics.
• PolkaVM verification: 4,090 passed, 2 ignored; AArch64 assembler clippy passes with warnings denied.
• This PR now pins e06cce9 in commit 23f50c64.
• Host CI is green, including Rust workspace, native build, iOS bindings/package, browser provider, codegen, and dependency licenses.

[replghost]

Added in 2c08d25:

• renamed the WebGPU Raster guest imports from epoca_gpu_* to the Host-neutral host_gpu_* namespace in the native and browser runtimes;
• added the draft docs/runtime/polkavm-app-abi-v1.md contract covering lifecycle, memory, Host imports, bounds, failure behavior, and conformance scope.

Consumer cutovers:

• paritytech/polkavm-app-kit#2
• paritytech/epoca#385

Verification remains green: cargo test -p pvm-runtime -p pvm-gpu-wire (33 passed), browser package tests (4 passed), App Kit tests (4 passed), reproducible example build/verify (six artifacts), and Epoca GPU tests (4 passed).

[replghost]

The repository-placement concern is now resolved by the extraction:

• the runtime implementation, GPU wire contract, browser workers/Wasm, tests, ABI documentation, and releases live in paritytech/pvm-host-runtime;
• the current immutable release is v0.1.4 at 235d1d407f3340fb73cb7a698fe973a9dad5251f;
• this PR now retains only the thin truapi-pvm-host integration boundary, truapi-server/UniFFI wiring, and the reviewed runtime/asset pin.

Generated browser output remains source-built and verified in the standalone repository; committed Swift/FFI bindings are marked generated. The full bridge matrix is green.