REQ6: Blessed products hold remote permissions without prompting

[filvecchiato]

Requirement for Release 2.

The problem

Some products are blessed and should hold their remote permissions — reaching declared
domains, WebRTC, and submitting chain transactions, preimages and statements — without
asking the user each time. A product that has to ask for those on every run is asking the
user to re-approve the thing that makes it work.

Which products are blessed is compiled into the host binary. Two things follow from that,
and the second is the one that hurts. The blessed set cannot change without rebuilding and
shipping a host. And a build deployed under a test name is not in the set, so it does not
behave like the build the user will eventually get: the thing being tested is not the thing
being shipped.

What has to be true for Release 2

• A blessed product holds its remote permissions without the user being prompted
• The blessed set changes without rebuilding a host
• A test deployment of a blessed product behaves identically to its production
  deployment
• A decision the user already stored still wins, so a denial revokes the grant
• Device permissions, identity disclosure and cross-product access still prompt,
  whether or not a product is blessed
• Same behaviour on every host that claims support

Explicitly out of scope

• Inbound cross-product access — another product's state or accounts. That is REQ1 and
  REQ2.
• Merging blessing with the manifest's trust declaration into a single grant. They answer
  different questions, and collapsing them is a separate decision with its own design.