feat(pvm): run App Manifest v2 runtimes in Dotli

.github/workflows/test.yml

@@ -32,6 +32,9 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Verify PVM bridge assets
+        run: bun run check:pvm-runtime
+
       - name: Run tests
         run: bunx --bun turbo run test
 

.prettierignore

@@ -3,3 +3,4 @@ node_modules/
 bun.lock
 tests/results/
 docs/
+apps/sandbox/public/pvm-runtime/

README.md

@@ -62,6 +62,7 @@ Each product gets its own `<label>.app.paseo.li` origin, so versions of the same
 1. **Resolves** `.dot` names via an in-browser [smoldot](https://github.com/paritytech/smoldot) light client connected to Asset Hub Paseo, querying dotNS contracts.
 2. **Fetches** content from the [Bulletin Chain](https://github.com/paritytech/polkadot-bulletin-chain) via smoldot `bitswap_v1_get` JSON-RPC or an IPFS gateway.
 3. **Renders** the content in a sandboxed iframe with the Rust-backed TrUAPI bridge, so loaded SPAs can request accounts, sign transactions, connect to chains, and use scoped storage.
+4. **Runs** verified framebuffer PolkaVM products by translating `app.polkavm` to WebAssembly at load time inside a worker, with a bounded interpreter fallback.
 
 ```
 host-playground.paseo.li
@@ -100,12 +101,31 @@ When a CID points to an IPFS directory (not a single file):
 4. The iframe loads from `/dotli-app/index.html` — the SW intercepts all requests and serves files from the in-memory archive
 5. Relative imports (`<script src="main.js">`, `<link href="styles.css">`) just work
 
+## How PolkaVM apps work
+
+An archive whose `manifest.json` declares `runtime.kind: "polkavm"` never
+executes package-owned HTML. The sandbox instead creates a host-owned canvas,
+loads the verified `app.polkavm` and immutable package assets, and translates
+the program to WebAssembly inside a worker. Keyboard, pointer, framebuffer,
+PCM-audio, asset, and save traffic stays on the bounded PolkaVM host ABI.
+
+The initial profile supports Epoca framebuffer ABI version 1, including CoreVM
+products such as `doom.paseo`. Tri2D, WebGPU, and TruAPI guest hostcalls fail
+closed until their capability boundaries are implemented independently.
+
+Translated Wasm bytes are cached in product-origin IndexedDB by the SHA-256 of
+the PVM program and the pinned translator version. Warm launches skip PVM
+instruction lowering; WebAssembly compilation remains browser-owned. If
+translation or Wasm compilation fails, the same worker retries through the
+bounded interpreter.
+
 ## Caching and verification
 
-dotli uses a two-layer cache for fast repeat visits:
+dotli uses three cache layers for fast repeat visits:
 
 1. **CID cache** (IndexedDB) — maps `.dot` labels to their last-known CID
 2. **Archive cache** (Service Worker) — stores fetched file maps keyed by domain; a cache hit additionally requires the stored CID (and content backend) to match
+3. **PVM translation cache** (IndexedDB) — stores translated Wasm bytes keyed by translator version and PVM program digest
 
 On repeat visits, content renders instantly from the cache while it is resolved in the background. The topbar shield shows how the current page was loaded:
 

THIRD_PARTY_NOTICES.md

@@ -8,9 +8,11 @@ alphabetically. Copyright and permission notices for each package are retained
 in its distribution under `node_modules`.
 
 GPL-family components (GPL-3.0 with the Classpath linking exception) are
-compatible with this project's AGPL-3.0 outbound license. Build-time-only
-tooling under weak-copyleft (MPL-2.0) or source-available (FSL-1.1-MIT) terms is
-used to build the application and is not redistributed as part of it.
+compatible with this project's AGPL-3.0 outbound license. The vendored Epoca
+PolkaVM browser runtime remains under MPL-2.0, with its PolkaVM-derived portions
+under Apache-2.0 OR MIT. Its complete notices and source provenance ship beside
+the runtime. Build-time-only tooling under source-available FSL-1.1-MIT terms is
+not redistributed as part of the application.
 
 > Generated from the resolved dependency tree (595 distinct third-party
 > packages). Platform-specific binary packages (for example
@@ -76,7 +78,7 @@ smoldot, verifiablejs
 
 ## MPL-2.0
 
-lightningcss, lightningcss-darwin-arm64
+Epoca PolkaVM browser runtime, lightningcss, lightningcss-darwin-arm64
 
 ## FSL-1.1-MIT
 

apps/host/package.json

@@ -7,12 +7,13 @@
   "scripts": {
     "build": "tsc && bunx --bun vite build",
     "build:prod": "tsc && bunx --bun vite build && bun ../../scripts/compress-dist.ts",
-    "test:functional": "playwright test --config=tests/functional/playwright.config.ts tests/functional/loading.spec.ts tests/functional/resolution.spec.ts tests/functional/navigation.spec.ts",
+    "test:functional": "playwright test --config=tests/functional/playwright.config.ts tests/functional/loading.spec.ts tests/functional/resolution.spec.ts tests/functional/navigation.spec.ts tests/functional/pvm.spec.ts",
     "test:e2e": "playwright test --config=tests/e2e/playwright.config.ts",
     "test:e2e:local": "E2E_PRODUCT_URL=${E2E_PRODUCT_URL:-http://localhost:5199} SIGNER_BOT_BASE_URL=${SIGNER_BOT_BASE_URL:-http://localhost:3737/} SIGNER_BOT_SVC_TOKEN=${SIGNER_BOT_SVC_TOKEN:-admin} SIGNER_BOT_NETWORK=${SIGNER_BOT_NETWORK:-paseo-next-v2} playwright test --config=tests/e2e/playwright.config.ts",
     "test:perf": "PERF_RUNS=10 PERF_DOMAIN_A=explore PERF_DOMAIN_B=host-playground npx playwright test --config=tests/performance/playwright.config.ts tests/performance/cold-start.spec.ts",
     "test:perf:base": "PERF_RUNS=20 PERF_SAVE_BASE=1 PERF_DOMAIN_A=explore PERF_DOMAIN_B=host-playground npx playwright test --config=tests/performance/playwright.config.ts tests/performance/cold-start.spec.ts",
     "test:perf:compare": "bun tests/performance/compare.ts",
+    "test:pvm:doom": "playwright test --config=tests/performance/playwright.config.ts tests/performance/pvm-doom.spec.ts",
     "test:perf:compare:md": "bun tests/performance/compare.ts --markdown",
     "lint": "bunx eslint src/",
     "typecheck": "tsc --noEmit"
@@ -21,10 +22,14 @@
     "@dotli/eslint-config": "workspace:*",
     "@dotli/typescript-config": "workspace:*",
     "@playwright/test": "^1.59.1",
+    "@ipld/car": "^5.4.3",
+    "@ipld/dag-pb": "^4.1.5",
     "playwright": "^1.59.1",
     "@types/node": "^25.9.3",
     "eslint": "^10.5.0",
     "jsqr": "^1.4.0",
+    "ipfs-unixfs": "^13.0.0",
+    "multiformats": "^14.0.0",
     "prettier": "^3.8.3",
     "simple-statistics": "^7.9.0",
     "typescript": "~6.0.3",