Deltic legs: both suites runtime-linked on stock Deno; expected-fail ledger for the Deno platform gaps - #352
Merged
Merged
Conversation
…ledger for the Deno platform gaps The deltic execution leg of the jco-replacement migration (polymorph-components/polyengine#14), following the websocket/tls pattern: a fifth conformance target `deltic-deno` running BOTH suites runtime-linked under stock Deno — no transpile step, no generated tree, no JSPI flags. - js/deltic/: the polymorph:webcrypto host module, upstreamed from lann/deltic ports/webcrypto (merged there as polymorph-components/polyengine#40, built from this repo's own js/jco/webcrypto.js as the reference). Sole adaptation: deltic-repo-relative imports rewritten to the pinned `@deltic/runtime/embedder` specifier. KAT suite included (17 cases, vectors by file+tcId against ../../conformance/vectors), plus `deltic-module-check` as a root gate. - conformance/driver-ct/deltic/: run.ts + fetch-translator.ts, pinned to release pre-58b2404 via import-map URLs + frozen deno.lock files + sha256-pinned translator asset. The embedder module URL is byte-identical across every import map (module identity; assertPinConsistency refuses otherwise, negative-tested). Case failures do not set the runner's exit status: the aggregate owns that verdict (this is the one target carrying declared debt). - targets: deltic-deno in both manifests (shared: missing-features ["sha1-checked"]; signing: [] — Deno serves the gated RSA private-key mints, the Node posture). Plus a 416-entry expected-fail ledger (332 shared / 84 signing), every entry tracking #351: the five verified Deno platform gaps (imported-8192-bit RSA verify, AES-GCM IV window, AES-CTR counter widths, RSA-OAEP non-standard modulus sizes, RSA-OAEP Constructed+EncryptionWithLabel refusals). These are capability gaps, but the natural feature-tag representation is blocked by the frozen census (census-fixture.lock pins names+features; tagging means amending the freeze — maintainer proposal in #351). expected-fail keeps them visible with staleness detection: if a Deno/ring update starts serving any case, the aggregate fails loud and forces the ledger's cleanup. - CI: pinned setup-deno (2.9.5) in the conformance job; deltic-deno wired into the justfile aggregates AND both publish-action results lists (the two independent enumeration points). Gates (all green locally, from-scratch): build; deltic shared 18757 passed | 332 failed | 1 n/a in 501.8s and signing 686 | 84 | 2 in 8.2s; aggregate "5 targets, 95450 results, 0 failing (332 expected-fail), 0 validation errors" and signing "4 targets, 3088 results, 0 failing (84 expected-fail)"; matrix-check byte-clean for both regenerated matrices; lock-check (tests.lock unchanged — no inventory change); wasmtime/composed/jco-node/jco-browser legs unchanged; js/deltic KATs 17/17 with frozen locks.
lann
enabled auto-merge
August 10, 2026 13:45
The first CI run failed exactly one case beyond the local ledger: probe/large-stream, killed by the 60s per-case bound at 72s on the 2-core Actions runner (run 31394527207) after measuring 6.1s locally — a 12x hardware ratio on the leg's most boundary-heavy case, with the next-slowest at 10.3s. A ledger entry would be wrong (it would flap with runner speed; expected-fail staleness fires on pass), so the leg gets a wider hang guard instead: 300s clears the observed worst case ~4x while still catching real hangs. No other change; local counts unchanged (shared 18757/332/1, signing 686/84/2), aggregates 0 failing / 0 validation errors.
This was referenced Aug 10, 2026
Open
lann
added a commit
that referenced
this pull request
Aug 10, 2026
The deltic host module (js/deltic, #352) and its conformance targets (deltic-deno #352, deltic-browser #355) landed without the top-level docs learning about them. Name deltic in the README/AGENTS rosters and layout maps, list its entry points (conformance-ct::run-deltic, deltic-module-check) ahead of the jco demo, and correct the gated-target roster. The jco host, its conformance targets, and the WPT parity carrier are deliberately retained — unlike the sibling repos, this one keeps both JS hosts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The deltic execution leg of the jco-replacement migration (polymorph-components/polyengine#14), following the websocket/tls pattern: a fifth conformance target
deltic-denorunning both suites runtime-linked under stock Deno — no transpile, no generated tree, no JSPI.polymorph:webcryptohost module, upstreamed from lann/delticports/webcrypto(merged there as ports/webcrypto: complete the polymorph:webcrypto@0.1.0 surface (#3) polyengine#40; built against this repo's ownjs/jco/webcrypto.jsas reference). Sole adaptation: repo-relative imports → the pinned@deltic/runtime/embedderspecifier. 17-case KAT suite (vectors by file+tcId), wired asdeltic-module-check.pre-58b2404(import-map URLs + frozendeno.locks + sha256-pinned translator asset; embedder URL byte-identical across all import maps, guard negative-tested). Case failures don't set the runner's exit status — the aggregate owns the verdict, since this is the one target carrying declared debt.Constructed+EncryptionWithLabelrefusals). Capability-feature tags would be the natural representation, but every affected row is census-frozen — maintainer proposal in Deno platform gaps: the deltic targets' expected-fail ledger #351. expected-fail keeps the debt visible with staleness detection: if a Deno/ring update starts serving any case, the aggregate fails loud.deltic-denoin the justfile aggregates and both publish-action results lists.Gates (from-scratch local run): deltic shared
18757 passed | 332 failed | 1 n/a (501.8s), signing686 | 84 | 2 (8.2s); aggregates0 failing (332 expected-fail) / 0 failing (84 expected-fail), 0 validation errors; matrix-check byte-clean (both matrices regenerated, browser legs included); lock-check clean (no inventory change); existing four targets unchanged; KATs 17/17 frozen.