ci(ios): phase 3 — FULL real onboarding on the simulator via a bearer invite

workflow_dispatch with an inv-… code: the sim opens /?invite=<code>, the real
deployed app auto-redeems it into the local device key through the sponsored
relay (a REAL mainnet acceptInvite from real Mobile Safari). Page-side
signals (.lh_device_key + lh_model_access=credits, set only on redeem
success) + the AUTHORITATIVE CI-side proof: the funder's on-chain
escrowedOf(address) must DROP (scripts/tab-e2e/escrowed-of.mjs, raw eth_call,
selector cast-verified). Phase 2 is skipped on invite runs so the bare app
can't pre-mint the device key and muddy the proof.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Author: compusophy

.github/workflows/ios-webkit-e2e.yml

@@ -20,6 +20,15 @@ name: iOS WebKit E2E
 
 on:
   workflow_dispatch:
+    inputs:
+      invite_code:
+        description: "OPTIONAL bearer invite (inv-…) — runs phase 3: FULL real onboarding on the sim (auto-redeem via the relay; consumes the invite, real $LH). Mint one: localharness invite create --as claude"
+        required: false
+        default: ""
+      funder:
+        description: "the invite's funder address (escrowedOf must DROP after the sim accepts)"
+        required: false
+        default: "0x63140875e00ca87ffab5110d5927698195bf8561"
   push:
     paths:
       - "web/opfs-worker.js"
@@ -79,6 +88,9 @@ jobs:
           node -e "const r=require('./e2e-report-phase1.json'); if (r.ok !== true) { console.error('phase 1 FAILED'); process.exit(1); }"
 
       - name: phase 2 — the real app boots + writes its device key via the broker
+        # Skipped on a phase-3 run: opening the bare app first would mint the
+        # device key WITHOUT the invite, muddying the full-onboarding proof.
+        if: github.event.inputs.invite_code == ''
         run: |
           xcrun simctl openurl "$UDID" "http://localhost:8080/"
           sleep 45   # foreground boot time: wasm init + Host::Other paint + device-key write
@@ -87,3 +99,21 @@ jobs:
           test -f e2e-report-phase2.json || { echo "phase 2: no report within 150s"; exit 1; }
           cat e2e-report-phase2.json
           node -e "const r=require('./e2e-report-phase2.json'); if (r.ok !== true) { console.error('phase 2 FAILED'); process.exit(1); }"
+
+      - name: phase 3 — FULL onboarding via a real invite (dispatch-only)
+        if: github.event.inputs.invite_code != ''
+        env:
+          INVITE: ${{ github.event.inputs.invite_code }}
+          FUNDER: ${{ github.event.inputs.funder }}
+        run: |
+          E0=$(node scripts/tab-e2e/escrowed-of.mjs "$FUNDER"); echo "escrowedOf(funder) BEFORE: $E0"
+          test "$E0" != "0" || { echo "funder has NO escrowed invites — mint one first (localharness invite create)"; exit 1; }
+          xcrun simctl openurl "$UDID" "http://localhost:8080/?invite=$INVITE"
+          sleep 60   # boot + auto-redeem: sponsored acceptInvite via the relay (a real mainnet tx)
+          xcrun simctl openurl "$UDID" "http://localhost:8080/e2e-ios-probe.html?phase=3"
+          for i in $(seq 1 75); do [ -f e2e-report-phase3.json ] && break; sleep 2; done
+          test -f e2e-report-phase3.json || { echo "phase 3: no report within 150s"; exit 1; }
+          cat e2e-report-phase3.json
+          node -e "const r=require('./e2e-report-phase3.json'); if (r.ok !== true) { console.error('phase 3 page-side FAILED'); process.exit(1); }"
+          E1=$(node scripts/tab-e2e/escrowed-of.mjs "$FUNDER"); echo "escrowedOf(funder) AFTER: $E1"
+          node -e "const [a,b]=[BigInt('$E0'),BigInt('$E1')]; if (!(b < a)) { console.error('on-chain escrow did NOT drop — the accept never landed'); process.exit(1); } console.log('on-chain PROOF: escrow dropped by', (a-b).toString(), 'wei — the sim accepted a REAL invite');"

scripts/tab-e2e/e2e-ios-probe.html

@@ -18,6 +18,14 @@
             foreground time to boot; this phase polls the SAME ORIGIN's OPFS
             for the .lh_device_key the app mints on Host::Other boot -> proof
             the real wasm app completed a broker write on real Mobile Safari.
+  phase=3 — FULL ONBOARDING: the workflow opened /?invite=<code> (a real
+            InviteFacet bearer invite) — the app auto-redeems it into the
+            local device key via the sponsored relay (a REAL mainnet accept
+            from real Mobile Safari). Same-origin success signals polled here:
+            .lh_device_key in OPFS + localStorage lh_model_access ===
+            'credits' (set ONLY on redeem success — events/credits.rs). The
+            AUTHORITATIVE check is CI-side: the funder's on-chain escrowedOf
+            must DROP (scripts/tab-e2e/escrowed-of.mjs).
 -->
 <pre id="log" style="font: 12px monospace; white-space: pre-wrap"></pre>
 <script>
@@ -71,19 +79,39 @@
         return report({ ok: steps.readback === true, steps });
       }
 
-      // phase 2 — poll for the app-minted device key (>= 64 chars).
+      // phases 2 + 3 — poll for the app-minted device key (>= 64 chars);
+      // phase 3 additionally requires the invite-redeem success signal.
       const t0 = Date.now();
       while (Date.now() - t0 < 90000) {
         try {
           const fh = await root.getFileHandle('.lh_device_key');
           const text = await (await fh.getFile()).text();
           if (text.length >= 64) {
-            return report({ ok: true, steps: { deviceKeyLen: text.length, waitedMs: Date.now() - t0 } });
+            steps.deviceKeyLen = text.length;
+            if (phase !== '3') {
+              return report({ ok: true, steps: { deviceKeyLen: text.length, waitedMs: Date.now() - t0 } });
+            }
+            // lh_model_access is set to 'credits' ONLY on a successful
+            // on-chain invite accept/redeem (events/credits.rs) — the
+            // same-origin success signal. Keep polling until it lands
+            // (the sponsored tx takes seconds after the key exists).
+            steps.modelAccess = localStorage.getItem('lh_model_access') || '';
+            steps.pendingInviteCleared = !localStorage.getItem('lh_pending_invite');
+            if (steps.modelAccess === 'credits') {
+              steps.waitedMs = Date.now() - t0;
+              return report({ ok: true, steps });
+            }
           }
         } catch { /* not yet */ }
         await new Promise((r) => setTimeout(r, 2000));
       }
-      return report({ ok: false, steps, err: '.lh_device_key never appeared (>=64 chars) within 90s' });
+      return report({
+        ok: false,
+        steps,
+        err: phase === '3'
+          ? 'full onboarding incomplete within 90s (need .lh_device_key + lh_model_access=credits)'
+          : '.lh_device_key never appeared (>=64 chars) within 90s',
+      });
     } catch (e) {
       return report({ ok: false, steps, err: String(e) });
     }

scripts/tab-e2e/escrowed-of.mjs

@@ -0,0 +1,33 @@
+// Read InviteFacet.escrowedOf(funder) via raw JSON-RPC — the CI-side
+// on-chain truth for the iOS full-onboarding E2E: when the simulator's app
+// accepts the bearer invite, the funder's escrowed total DROPS by the invite
+// amount. No cast/foundry needed on the runner.
+//
+//   node scripts/tab-e2e/escrowed-of.mjs <funder-0xaddr>   → prints raw wei
+//
+// Selector 0xe1e6f37c = keccak("escrowedOf(address)")[0..4] (verified with
+// `cast sig` 2026-07-07). Diamond + RPC = mainnet (src/registry/chain.rs).
+const DIAMOND = '0x8ab4f3a57643410cdf4022cdaf1faeef234f3a77';
+const RPC = process.env.LH_RPC || 'https://rpc.tempo.xyz';
+
+const addr = (process.argv[2] || '').toLowerCase().replace(/^0x/, '');
+if (!/^[0-9a-f]{40}$/.test(addr)) {
+  console.error('usage: node escrowed-of.mjs <funder-0xaddress>');
+  process.exit(2);
+}
+const res = await fetch(RPC, {
+  method: 'POST',
+  headers: { 'content-type': 'application/json' },
+  body: JSON.stringify({
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'eth_call',
+    params: [{ to: DIAMOND, data: '0xe1e6f37c' + addr.padStart(64, '0') }, 'latest'],
+  }),
+});
+const j = await res.json();
+if (j.error) {
+  console.error('eth_call error:', JSON.stringify(j.error));
+  process.exit(1);
+}
+console.log(BigInt(j.result).toString());