feat: guard Product CDM signer mapping

docs/backlog/24-access-streaming-v2.md

@@ -139,10 +139,11 @@ P3 first vertical slice delivered (`agent/audio-v2-p3`):
   the browser/device validation matrix, startup telemetry export, and the
   backend read-through gateway decision.
 
-Product SDK adaptation note (updated 2026-08-26):
+Product SDK adaptation note (updated 2026-08-30):
 
 - Product SDK 0.23.0 and deploy tooling 0.13.1 remain
-  prototype/reference/unaudited.
+  prototype/reference/unaudited in Dotify's pinned baseline. npm now publishes
+  Product SDK 0.25.0, which is deferred to a dedicated compatibility PR.
 - Root PAPI 3.0.0 is not adopted yet because the current Product SDK graph
   uses PAPI 2.2.x while `@polkadot-apps` still uses PAPI 1.23.x.
 - Host APIs are progressive enhancement for Product containers; standalone web

docs/backlog/README.md

@@ -115,12 +115,13 @@ decisions. Product-signed key/session verification now exists through
 explicit Product account connection. Live host evidence remains required before
 Product identity can be treated as broadly proven across devices.
 
-The Product SDK evidence snapshot used for this replanning is now
+The Product SDK evidence snapshot used for this replanning currently pins
 `@parity/product-sdk` 0.23.0 and
-`@polkadot-community-foundation/polkadot-app-deploy` 0.13.1,
-last aligned with npm on 2026-08-26. The Product SDK set remains prototype /
+`@polkadot-community-foundation/polkadot-app-deploy` 0.13.1. npm was rechecked
+on 2026-08-30 and now publishes Product SDK 0.25.0; that migration is deferred
+to a dedicated compatibility PR. The Product SDK set remains prototype /
 reference / unaudited code. Root `polkadot-api` 3.0.0 exists but is not yet
-adopted because the current Product SDK packages use PAPI 2.2.x and
+adopted because the current pinned Product SDK packages use PAPI 2.2.x and
 `@polkadot-apps` packages use PAPI 1.23.x, so a single PAPI 3 root breaks
 Dotify's Bulletin/wallet type seams.
 Product SDK contracts target `pallet-revive` / PolkaVM CDM flows, not Dotify's

docs/backlog/improvement-plan.md

@@ -68,7 +68,9 @@ sound. Only the baseline rows marked delivered may be presented as live.
 Product SDK snapshot used for this plan:
 
 - `@parity/product-sdk` 0.23.0, host 0.16.0, statement-store 0.6.5, and
-  descriptors 0.10.0 (aligned with npm on 2026-08-26);
+  descriptors 0.10.0 (pinned baseline; npm rechecked on 2026-08-30 and now
+  publishes Product SDK 0.25.0 / host 0.18.0 / statement-store 0.6.7 /
+  descriptors 0.11.0, deferred to a dedicated compatibility PR);
 - `@polkadot-community-foundation/polkadot-app-deploy` 0.13.1;
 - deferred PAPI drift: root `polkadot-api` 3.0.0 is published, but the current
   Product SDK graph uses PAPI 2.2.x and `@polkadot-apps` uses PAPI 1.23.x, so

docs/backlog/polkadot-product-readiness-and-killer-dapp-roadmap.md

@@ -3,12 +3,14 @@
 Status: active execution note; the Product DevNet baseline is delivered on
 `dev` and remains tracked through Product compatibility issue #85.
 
-Last Product SDK package check: 2026-08-26. Dotify now pins the current
-published Product SDK set: `@parity/product-sdk` 0.23.0, host 0.16.0,
-statement-store 0.6.5, descriptors 0.10.0, and
-`@polkadot-community-foundation/polkadot-app-deploy` 0.13.1. npm also
-publishes `polkadot-api` 3.0.0, but Dotify keeps root PAPI on 1.23.3 because
-the current Product SDK packages use PAPI 2.2.x and `@polkadot-apps`
+Last Product SDK package check: 2026-08-30. Dotify currently pins
+`@parity/product-sdk` 0.23.0, host 0.16.0, statement-store 0.6.5,
+descriptors 0.10.0, and
+`@polkadot-community-foundation/polkadot-app-deploy` 0.13.1. npm now publishes
+Product SDK 0.25.0, host 0.18.0, statement-store 0.6.7, and descriptors 0.11.0;
+that upgrade is deferred to a dedicated compatibility PR. npm also publishes
+`polkadot-api` 3.0.0, but Dotify keeps root PAPI on 1.23.3 because the current
+Product SDK packages use PAPI 2.2.x and `@polkadot-apps`
 chain-client/keys/signer use PAPI 1.23.x. Root PAPI 3 remains blocked until
 the official SDK graph converges.
 
@@ -160,8 +162,8 @@ Goal: prove the Product host path with small spikes before committing the app.
 - Delivered: connect the app-scoped Product account only on explicit action and
   separate identity capability from EVM signing capability.
 - Delivered: publishable Bulletin/DotNS build and dual-origin Fly boundary.
-- Delivered: align the Product SDK set with the 2026-08-26 npm latest while
-  keeping standalone/Product builds green.
+- Delivered: align the Product SDK set with the 2026-08-26 npm latest at that
+  time while keeping standalone/Product builds green.
 - Remaining: prototype host transaction signing and resource allocation.
 - Compare Dotify's Hardhat/EVM runtime with Product SDK PolkaVM/CDM contracts.
 - Delivered on the room-beacon branch: Statement Store presence with strict
@@ -205,15 +207,22 @@ Goal: deepen the delivered Product mode one adapter at a time.
   now has an explicit unsupported `product-cash` rail, so future CASH work can
   add receipt/bridge settlement without pretending CASH is already executable
   through `msg.value`.
+- Delivered on the next follow-up branch: Product CDM writes now verify both
+  the selected host signer public key and its derived `pallet-revive` H160
+  address against the Product account Dotify connected for key/session requests.
+  This prevents a Product-host transaction from marking access for a different
+  runtime account than the one the UI and backend authenticated.
 - Settled: the chain question. Product DevNet is a preset over the Paseo system
   parachains (Asset Hub 1000, People 1004, Bulletin 1010) at EVM chain
   420420417, not a separate network. Dotify's contracts are already there,
   verified by byte-identical ArtistDirectory code served from both the DevNet
   and Hub TestNet endpoints. No contract redeploy is needed to port to DevNet.
   The SDK's `paseo` preset is Paseo Next (1500/1502), a different network, so
   `devnet` is the only environment Dotify can serve a catalog from.
-- Next: `pallet-revive` account mapping plus real host-signed transaction smoke
-  tests before Product writes can replace the EVM wallet path.
+- Next: real host-signed transaction smoke tests before Product writes can
+  replace the EVM wallet path. The remaining evidence is native value
+  forwarding, host approval UX, and post-payment `musicAccCanAccess` reads from
+  inside the Product container.
 - Next: revisit root `polkadot-api` 3 after Product SDK and `@polkadot-apps`
   packages publish on a compatible PAPI major line.
 - Next: confirm the Product-supported CASH settlement model before exposing any

docs/explanation/product-devnet-architecture.md

@@ -380,12 +380,14 @@ selection as reads: `viem` uses the connected EVM/passkey wallet, and
 default remains `viem`, since routing a payment or a publication through an
 unproven signer is not a reasonable default.
 
-The remaining gate for Product contract _writes_ is now narrow: `pallet-revive`
-account mapping for the signing account, and real host-signed transaction smoke
-evidence from inside the container, including native value forwarding for
-Classic unlock. The chain question is settled, the manifest and types exist,
-and reads/writes share one port. Until that write evidence exists,
-`VITE_DOTIFY_RUNTIME_ADAPTER` defaults to `viem`.
+The remaining gate for Product contract _writes_ is now narrow. Dotify verifies
+the selected host signer public key and derived `pallet-revive` H160 address
+against the Product account that the UI and backend use for key/session
+requests before any Product CDM write can be submitted. The remaining evidence
+must come from inside the container: native value forwarding for Classic unlock,
+host approval UX, and post-payment `musicAccCanAccess` reads. The chain question
+is settled, the manifest and types exist, and reads/writes share one port. Until
+that write evidence exists, `VITE_DOTIFY_RUNTIME_ADAPTER` defaults to `viem`.
 
 The backend authentication protocol now has an explicit signature scheme field.
 Standalone clients use the default `eip191` scheme. Product-host clients can
@@ -466,11 +468,13 @@ The current baseline is:
 | Public gateway                                       | `https://dotify-test01.dev-dot.li` |
 | Asset Hub EVM chain ID                               | `420420417`                        |
 
-Checked against npm on 2026-08-26: the Product SDK set above is current. npm
-also publishes `polkadot-api` `3.0.0`, but Dotify keeps root PAPI on `1.23.3`
-for now. The current official Product SDK packages bring their own PAPI
-`2.2.x` tree, while `@polkadot-apps` chain-client/keys/signer still depend on
-PAPI `1.23.x`. A direct root PAPI 3 trial removed the public
+Checked against npm on 2026-08-30: npm now publishes Product SDK `0.25.0`,
+host `0.18.0`, statement-store `0.6.7`, and descriptors `0.11.0`. Dotify keeps
+the baseline above for this branch and defers that migration to a dedicated SDK
+compatibility PR. npm also publishes `polkadot-api` `3.0.0`, but Dotify keeps
+root PAPI on `1.23.3` for now. The current pinned Product SDK packages bring
+their own PAPI `2.2.x` tree, while `@polkadot-apps` chain-client/keys/signer
+still depend on PAPI `1.23.x`. A direct root PAPI 3 trial removed the public
 `PolkadotSigner` export and broke `ChainDefinition` / `TypedApi` compatibility
 at the Bulletin and wallet seams. Root PAPI 3 therefore remains a blocked
 compatibility migration until the upstream SDK graph converges.

docs/index.html

@@ -1547,8 +1547,9 @@ <h3>Product DevNet now, sovereignty adapters next</h3>
                 current viem implementation, API-side Product sr25519 verification with frontend Product
                 proof submission for protected key/session requests, and an opt-in CDM/PAPI path that can
                 route runtime reads and write submissions through the Product host signer. The tracked
-                deployment still defaults to viem until account mapping, native payment forwarding,
-                host-signed transaction evidence, and Product CASH receipt design are verified. Product
+                deployment still defaults to viem; Product writes now fail closed on Product public-key /
+                pallet-revive H160 mismatch, and still need native payment forwarding, host-signed
+                transaction evidence, and Product CASH receipt design before becoming default. Product
                 Mobile in-app live audio pending a host-exposed WebRTC capability, Humanity/Individuality proofs,
                 consented provenance, and ambassador mechanics remain sequenced behind verified security
                 and privacy boundaries.

docs/operations/dependency-security-status.md

@@ -1,6 +1,6 @@
 # Dependency and Security Status
 
-Last checked: 2026-08-26.
+Last checked: 2026-08-30.
 
 This record captures the dependency/security evidence for the maintenance pass
 that follows the Product payment-label work. It is not a blanket policy change:
@@ -20,14 +20,16 @@ inside their reviewed scope.
 
 ## Official Version Drift
 
-Checked against npm published versions on 2026-08-26.
+Checked against npm published versions on 2026-08-30.
 
 | Package | Current pinned/locked value | Latest published value | Decision |
 | --- | --- | --- | --- |
-| `@parity/product-sdk` | `0.23.0` | `0.23.0` | Current. |
-| `@parity/product-sdk-host` | `0.16.0` | `0.16.0` | Current. |
-| `@parity/product-sdk-statement-store` | `0.6.5` | `0.6.5` | Current. |
-| `@parity/product-sdk-descriptors` | `0.10.0` | `0.10.0` | Current. |
+| `@parity/product-sdk` | `0.23.0` | `0.25.0` | Defer to a dedicated Product compatibility PR; this PR changes signer/account mapping, not the SDK graph. |
+| `@parity/product-sdk-host` | `0.16.0` | `0.18.0` | Defer with the Product SDK compatibility PR. |
+| `@parity/product-sdk-statement-store` | `0.6.5` | `0.6.7` | Defer with the Product SDK compatibility PR. |
+| `@parity/product-sdk-descriptors` | `0.10.0` | `0.11.0` | Defer with the Product SDK compatibility PR. |
+| `@parity/product-sdk-signer` | `0.14.0` transitively via `@parity/product-sdk/wallet` | `0.14.2` | No direct dependency; import through the Product SDK export and upgrade with the SDK set. |
+| `@parity/product-sdk-address` | `0.2.0` transitively via `@parity/product-sdk/address` | `0.2.0` | Current through the Product SDK export. |
 | `polkadot-api` | `1.23.3` | `3.0.0` | Blocked as a root migration: Product SDK `0.23.0` currently depends on PAPI `2.2.x`, while `@polkadot-apps/chain-client` / keys / signer depend on PAPI `1.23.x`; a direct root PAPI 3 trial removes `PolkadotSigner` and breaks `ChainDefinition` / `TypedApi` compatibility. |
 | `@polkadot-community-foundation/polkadot-app-deploy` | `0.13.1` | `0.13.1` | Current. |
 | `react` / `react-dom` | `18.3.1` | `19.2.8` | Defer as a UI/runtime migration. |
@@ -52,13 +54,15 @@ Checked against npm published versions on 2026-08-26.
 - `npm audit --omit=dev --audit-level=moderate` reports the same 26 Product /
   PAPI chain findings because those packages are runtime dependencies. npm does
   not offer a non-breaking fix for the `deepmerge-ts` path.
-- Product SDK latest does not remove that audit chain. A root
+- Product SDK `0.25.0` has not yet been tested against Dotify's Product
+  manifest, host permissions, CDM resolver, and mobile fallback. A root
   `[email protected]` trial also did not produce a deployable graph because
   the official Product SDK and `@polkadot-apps` packages still use different
   PAPI major lines.
 - Next safe action: Product host-signed transaction/resource-allocation smoke
-  tests on this SDK set, plus upstream monitoring for a Product SDK /
-  `@polkadot-apps` PAPI 3 convergence release. Do not run
+  tests on this SDK set, then a dedicated Product SDK `0.25.x` compatibility
+  PR, plus upstream monitoring for a Product SDK / `@polkadot-apps` PAPI 3
+  convergence release. Do not run
   `npm audit fix --force` on the Product stack.
 
 `contracts/evm`:
@@ -73,6 +77,8 @@ Checked against npm published versions on 2026-08-26.
 
 - Run real Product host smoke tests for Product sr25519 key/session requests
   and the opt-in `product-cdm` runtime adapter with the SDK `0.23.0` set.
+- Test the Product SDK `0.25.x` line in a dedicated compatibility PR before
+  changing the published Product profile.
 - Track root `polkadot-api` `3.0.0` separately until Product SDK and
   `@polkadot-apps` publish compatible packages on the same PAPI major line.
 - Plan a Hardhat 3 migration separately from app/runtime changes.

docs/operations/deployment-configuration.md

@@ -165,19 +165,21 @@ when deciding whether to refresh a previously opened app.
 
 Current Product host SDK dependencies:
 
-| Package                                      | Current value | Latest checked 2026-08-26 |
+| Package                                      | Current value | Latest checked 2026-08-30 |
 | -------------------------------------------- | ------------- | ------------------------- |
-| `@parity/product-sdk`                        | `0.23.0`      | `0.23.0`                  |
-| `@parity/product-sdk-host`                   | `0.16.0`      | `0.16.0`                  |
-| `@parity/product-sdk-statement-store`        | `0.6.5`       | `0.6.5`                   |
-| `@parity/product-sdk-descriptors`            | `0.10.0`      | `0.10.0`                  |
+| `@parity/product-sdk`                        | `0.23.0`      | `0.25.0`                  |
+| `@parity/product-sdk-host`                   | `0.16.0`      | `0.18.0`                  |
+| `@parity/product-sdk-statement-store`        | `0.6.5`       | `0.6.7`                   |
+| `@parity/product-sdk-descriptors`            | `0.10.0`      | `0.11.0`                  |
 | `polkadot-api`                              | `1.23.3`      | `3.0.0`                   |
 | `@polkadot-community-foundation/polkadot-app-deploy` | `0.13.1` | `0.13.1`                  |
 | `engine.io-client`                           | `6.6.6`       | `6.6.6`                   |
 
 Keep the Product SDK packages pinned exactly during Product DevNet hardening.
 Recheck npm and the official Product docs before changing them because the
-mobile host API is still moving quickly. `polkadot-api` remains on `1.23.3` at
+mobile host API is still moving quickly. The 2026-08-30 check found a newer
+Product SDK line; upgrade it in a dedicated compatibility PR rather than mixing
+it into Product write-signer mapping work. `polkadot-api` remains on `1.23.3` at
 the Dotify root even though npm publishes `3.0.0`: the current official Product
 SDK packages bring their own PAPI `2.2.x` tree, while `@polkadot-apps`
 chain-client/keys/signer still depend on PAPI `1.23.x`. A direct root PAPI 3
@@ -356,8 +358,10 @@ an explicit Product-host account connection.
 including Classic unlock payments, through the Product CDM contract adapter. The
 tracked Product profile does not enable that flag yet. Keep `viem` as the
 production default until Product-host transaction evidence proves account
-mapping, fees/native value handling, and user approval for real writes. Validate
-Product protected playback through host smoke tests after each Product
+mapping, fees/native value handling, and user approval for real writes. Product
+CDM writes now fail closed unless the host signer public key maps to the same
+pallet-revive H160 address that Dotify connected for key/session requests.
+Validate Product protected playback through host smoke tests after each Product
 publication before treating Product identity as production-ready for gated
 listening.