feat: implement RFC-0024 ring VRF key management

explorer/diagnosis-reports/pairing-host-cli.md

@@ -2,6 +2,7 @@
 
 | Method | Status | Details |
 | --- | --- | --- |
+| `Account/ring_vrf_registry_e2e` | ✅ |  |
 | `Account/connection_status_subscribe` | ✅ |  |
 | `Account/get_account` | ✅ |  |
 | `Account/get_account_alias` | ✅ |  |
@@ -10,6 +11,9 @@
 | `Account/get_user_id` | ✅ |  |
 | `Account/request_login` | ✅ |  |
 | `Account/sign_vrf` | ✅ |  |
+| `Account/register_ring_vrf_key` | ✅ |  |
+| `Account/list_ring_vrf_keys` | ✅ |  |
+| `Account/ring_vrf_sign` | ✅ |  |
 | `Chain/follow_head_subscribe` | ✅ |  |
 | `Chain/get_head_header` | ✅ |  |
 | `Chain/get_head_body` | ✅ |  |
@@ -68,3 +72,4 @@
 | `System/navigate_to` | ✅ |  |
 | `Theme/subscribe` | ✅ |  |
 | `Resource Allocation/auto_signing_e2e` | ✅ |  |
+| `Account/auto_signing_ring_vrf_e2e` | ✅ |  |

explorer/diagnosis-reports/signing-host-cli.md

@@ -2,6 +2,7 @@
 
 | Method | Status | Details |
 | --- | --- | --- |
+| `Account/ring_vrf_registry_e2e` | ✅ |  |
 | `Account/connection_status_subscribe` | ✅ |  |
 | `Account/get_account` | ✅ |  |
 | `Account/get_account_alias` | ✅ |  |
@@ -10,6 +11,9 @@
 | `Account/get_user_id` | ✅ |  |
 | `Account/request_login` | ✅ |  |
 | `Account/sign_vrf` | ✅ |  |
+| `Account/register_ring_vrf_key` | ✅ |  |
+| `Account/list_ring_vrf_keys` | ✅ |  |
+| `Account/ring_vrf_sign` | ✅ |  |
 | `Chain/follow_head_subscribe` | ✅ |  |
 | `Chain/get_head_header` | ✅ |  |
 | `Chain/get_head_body` | ✅ |  |
@@ -68,3 +72,4 @@
 | `System/navigate_to` | ✅ |  |
 | `Theme/subscribe` | ✅ |  |
 | `Resource Allocation/auto_signing_e2e` | ✅ |  |
+| `Account/auto_signing_ring_vrf_e2e` | ✅ |  |

rust/crates/truapi-codegen/tests/golden_rust_emit.rs

@@ -93,6 +93,15 @@ fn workspace_root() -> PathBuf {
         .to_path_buf()
 }
 
+fn workspace_tempdir(workspace: &Path) -> tempfile::TempDir {
+    let parent = workspace.join("target/codegen-test-tmp");
+    fs::create_dir_all(&parent).expect("create workspace codegen temp directory");
+    tempfile::Builder::new()
+        .prefix("golden-")
+        .tempdir_in(parent)
+        .expect("workspace tempdir")
+}
+
 fn rustfmt_generated(files: &[PathBuf]) {
     if files.is_empty() {
         return;
@@ -129,6 +138,8 @@ fn prettier_generated(workspace_root: &Path, files: &[PathBuf]) {
             "--",
             "prettier",
             "--write",
+            "--ignore-path",
+            "/dev/null",
             "--config",
         ])
         .arg(workspace_root.join(".prettierrc"));
@@ -153,7 +164,7 @@ fn golden_dispatcher_and_wire_table() {
     let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
     let workspace = workspace_root();
 
-    let tempdir = tempfile::tempdir().expect("tempdir");
+    let tempdir = workspace_tempdir(&workspace);
     let rustdoc_json = produce_rustdoc_json(&workspace, &tempdir.path().join("rustdoc-target"));
 
     let out = Command::new(env!("CARGO_BIN_EXE_truapi-codegen"))
@@ -207,11 +218,11 @@ fn golden_dispatcher_and_wire_table() {
 #[test]
 fn binary_emission_is_idempotent() {
     let workspace = workspace_root();
-    let tempdir = tempfile::tempdir().expect("tempdir");
+    let tempdir = workspace_tempdir(&workspace);
     let rustdoc_json = produce_rustdoc_json(&workspace, &tempdir.path().join("rustdoc-target"));
 
     let run_once = || -> (String, String) {
-        let tmp = tempfile::tempdir().unwrap();
+        let tmp = workspace_tempdir(&workspace);
         let status = Command::new(env!("CARGO_BIN_EXE_truapi-codegen"))
             .args([
                 "--input",
@@ -242,7 +253,7 @@ fn golden_host_callbacks_ts() {
     let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
     let workspace = workspace_root();
 
-    let tempdir = tempfile::tempdir().expect("tempdir");
+    let tempdir = workspace_tempdir(&workspace);
     let truapi_json = produce_rustdoc_json(&workspace, &tempdir.path().join("rustdoc-target"));
     let platform_json = produce_rustdoc_json_for_package(
         &workspace,

rust/crates/truapi-host-cli/README.md

@@ -306,9 +306,9 @@ Five scripts ship under `js/scripts/`:
 - `whoami.ts` — calls `getUserId` and prints `WHOAMI <primary username>`; this
   remains available as an explicit `/script <path>` example.
 - `signing-smoke.ts` — a focused product-account signing check.
-- `ring-vrf-smoke.ts` — calls `getAccountAlias` and `createAccountProof`
-  against the Paseo Next v2 LitePeople ring, then verifies both calls return
-  the same contextual alias.
+- `ring-vrf-smoke.ts` — registers and lists an explicit RFC-0024 key, derives
+  its alias, verifies a fresh non-member key returns `NotMember` for a proof,
+  and exercises direct ring-VRF signing.
 - `preimage-smoke.ts` — a focused Bulletin preimage flow check.
 
 The generated examples are baked to the `truapi-playground.dot` product. With

rust/crates/truapi-host-cli/SPEC.md

@@ -664,7 +664,7 @@ The top-level `--script` option does not update remembered `/script` state.
 | `battery.ts` | Run every generated Playground example and write the role-specific compatibility report. |
 | `whoami.ts` | Print the primary username. |
 | `signing-smoke.ts` | Focused product-account signing test. |
-| `ring-vrf-smoke.ts` | Verify alias/proof behavior for the Paseo Next v2 LitePeople ring. |
+| `ring-vrf-smoke.ts` | Verify RFC-0024 registration, listing, alias, non-membership proof, and direct signing behavior. |
 | `preimage-smoke.ts` | Exercise Bulletin preimage submission and lookup. |
 
 `battery.ts` writes to `explorer/diagnosis-reports/<role>-cli.md` unless
@@ -724,8 +724,9 @@ Before a signing host answers a link, it:
 2. decodes the V2 handshake;
 3. derives its RFC-0022 `uid.dot` identity account;
 4. reads the pairing device Statement Store account from the proposal;
-5. finds the signer's LitePeople ring through the `peopl.dot` index-1 key,
-   scanning back from the current ring;
+5. finds the signer's LitePeople ring through the pairing-attestation bootstrap
+   `peopl.dot` index-1 key, scanning back from the current ring (RFC-0024
+   operational key selection uses the registry instead);
 6. grants or reuses Statement Store allowance for the identity account;
 7. grants or reuses allowance for the pairing device; and
 8. starts the real SSO responder.

rust/crates/truapi-host-cli/js/diagnosis.test.ts

@@ -47,24 +47,20 @@ describe("generated-example battery", () => {
     );
   });
 
-  test("classifies only the committed unsupported CLI battery failures as expected", () => {
-    expect(expectedCliBatteryFailureReason("Chat")).toBe(
-      "Chat service not yet wired up by hosts",
-    );
-    expect(expectedCliBatteryFailureReason("Coin Payment")).toBe(
-      "Coin Payment service not yet wired up by hosts",
-    );
-    expect(expectedCliBatteryFailureReason("Payment")).toBe(
-      "Payment service not yet wired up by hosts",
-    );
-    expect(expectedCliBatteryFailureReason("Signing")).toBe(undefined);
-  });
+  test("classifies only the committed unsupported CLI services as expected", () => {
+    const unsupported = new Set(["Chat", "Coin Payment", "Payment"]);
 
-  test("does not ignore account proof failures", () => {
-    expect(
-      knownUnsupportedReason("Account", "Account/create_account_proof"),
-    ).toBe(undefined);
-    expect(expectedCliBatteryFailureReason("Account")).toBe(undefined);
+    for (const service of services) {
+      const expected = unsupported.has(service.name)
+        ? `${service.name} service not yet wired up by hosts`
+        : undefined;
+      expect(
+        knownUnsupportedReason(service.name, `${service.name}/example`),
+      ).toBe(expected);
+      expect(
+        expectedCliBatteryFailureReason({ serviceName: service.name }),
+      ).toBe(expected);
+    }
   });
 
   test("prints failures as concise test-reporter rows", () => {

rust/crates/truapi-host-cli/js/diagnosis.ts

@@ -98,10 +98,10 @@ export function knownUnsupportedReason(
 }
 
 export function expectedCliBatteryFailureReason(
-  serviceName: string,
+  row: Pick<DiagnosisRow, "serviceName">,
 ): string | undefined {
-  if (SKIPPED_SERVICES.has(serviceName)) {
-    return `${serviceName} service not yet wired up by hosts`;
+  if (SKIPPED_SERVICES.has(row.serviceName)) {
+    return `${row.serviceName} service not yet wired up by hosts`;
   }
   return undefined;
 }