Deltic legs: both suites runtime-linked on stock Deno; expected-fail ledger for the Deno platform gaps

.github/justfile

@@ -14,11 +14,13 @@ rust-checks:
     @just gha::_step demo::test-composed
 
 # Everything the conformance CI job runs: the cross-implementation
-# conformance matrix (component-test stack, all four targets including
-# jco-browser) and the committed-matrix check.
+# conformance matrix (component-test stack, all five targets including
+# jco-browser and deltic-deno), the committed-matrix check, and the
+# deltic host module's own unit gate (same module, fast local check).
 conformance-checks:
     @just gha::_step conformance-ct::all
     @just gha::_step conformance-ct::matrix-check
+    @just gha::_step deltic-module-check
 
 # Everything the jco CI job runs. The three WPT parity engines run in
 # parallel over one shared artifact build (wpt::_parity-gates).

.github/workflows/ci.yml

@@ -45,9 +45,10 @@ jobs:
         run: just gha::rust-checks
 
   # The cross-implementation conformance matrix (component-test stack):
-  # both suites across all four targets — wasmtime-rustcrypto, composed,
-  # jco-node, and jco-browser (headless Chromium) — plus the aggregates
-  # and the committed-matrix check.
+  # both suites across all five targets — wasmtime-rustcrypto, composed,
+  # jco-node, jco-browser (headless Chromium), and deltic-deno
+  # (runtime-linked under stock Deno) — plus the aggregates, the
+  # committed-matrix check, and the deltic host module's unit gate.
   conformance:
     runs-on: ubuntu-latest
     # Warm runs take a few minutes, but a full cache bootstrap (dependency
@@ -114,6 +115,16 @@ jobs:
         with:
           node-version: 24
 
+      - name: Install Deno
+        # For the deltic-deno conformance target and js/deltic's own unit
+        # gate: deltic runs the suites RUNTIME-LINKED under stock Deno,
+        # its runtime graph pinned by the conformance/driver-ct/deltic and
+        # js/deltic import maps + frozen deno.lock files (no npm tree, no
+        # transpile). Version-pinned like every other toolchain here.
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: "2.9.5"
+
       - name: Install dependencies
         run: ./scripts/setup.sh
         env:
@@ -170,6 +181,7 @@ jobs:
             composed=conformance/driver-ct/results/composed.jsonl
             jco-node=conformance/driver-ct/results/jco-node.jsonl
             jco-browser=conformance/driver-ct/results/jco-browser.jsonl
+            deltic-deno=conformance/driver-ct/results/deltic-deno.jsonl
           summary-title: Conformance matrix
           cli: target/ct-tools/bin/component-test
           cargo-lock: Cargo.lock
@@ -184,6 +196,7 @@ jobs:
             wasmtime-rustcrypto=conformance/driver-ct/results/wasmtime-signing.jsonl
             jco-node=conformance/driver-ct/results/jco-node-signing.jsonl
             jco-browser=conformance/driver-ct/results/jco-browser-signing.jsonl
+            deltic-deno=conformance/driver-ct/results/deltic-deno-signing.jsonl
           summary-title: Signing conformance matrix
           cli: target/ct-tools/bin/component-test
           cargo-lock: Cargo.lock

conformance/driver-ct/deltic/README.md

@@ -0,0 +1,79 @@
+# `conformance/driver-ct/deltic` — the deltic-native conformance leg
+
+The `deltic-deno` target in both conformance matrices: the suites run
+runtime-linked under stock Deno — no transpile step, no generated tree, no
+npm install, no engine flag (the suites' async exports run on the callback
+ABI) — against [`js/deltic/src/mod.ts`](../../../js/deltic/src/mod.ts).
+This is the deltic analogue of the jco Node leg
+(`conformance/driver-ct/jco/runner.mjs`); see `run.ts`'s header for the
+leg-for-leg mirror.
+
+Both suites run under the **one** target key `deltic-deno`, exactly as
+`jco-node` does, writing:
+
+| suite | results file | `missing-features` |
+| --- | --- | --- |
+| shared (`conformance_guest_ct`) | `results/deltic-deno.jsonl` | `sha1-checked` |
+| signing (`conformance_signing_guest_ct`) | `results/deltic-deno-signing.jsonl` | — |
+
+## Running it
+
+```sh
+just conformance-ct::run-deltic
+```
+
+which builds the suites, fetches (and caches) the pinned translator-shim
+release asset, and runs both suites through `ct-runner`.
+
+The suite artifacts are the **bare** suites — the same components the jco
+leg transpiles, with `polymorph:webcrypto/*` still imported and served by
+the host module under test. Because that is the locked artifact, the
+envelope's `artifact-sha256` is the lockfile's identity directly; no
+`--suite-artifact` indirection is needed (the composed leg needs one
+because its artifact has the provider plugged in).
+
+## Expected-fail debt
+
+`deltic-deno` is the only target with declared expected failures
+(`targets.toml`, `targets-signing.toml`, tracked in
+[#351](https://github.com/polymorph-components/polymorph-webcrypto/issues/351)):
+Deno's WebCrypto is narrower than Node's and the browsers' in a few
+parameter windows the WIT admits. `run.ts` therefore does not derive its
+exit status from case failures — **the aggregate is the verdict**, and it
+fails on an undeclared failure *or* on a declaration that has gone stale
+(declared-but-passing). Never silence a new failure by adding an entry
+without a named cause and a tracking link.
+
+## The pin
+
+deltic is pinned to a release tag in **three** places, cross-checked at
+run time by `fetch-translator.ts`:
+
+- `deno.json` (this directory) — import-map URLs
+  (`raw.githubusercontent.com/lann/deltic/<tag>/…`) for `@deltic/ct-runner`,
+  `@deltic/runtime/embedder`, `@deltic/runtime/shim`, `@deltic/wasi-shims`.
+  `deno.lock` carries integrity hashes for that module graph, enforced
+  with `--frozen`.
+- [`../../../js/deltic/deno.json`](../../../js/deltic/deno.json) — the
+  SAME `@deltic/runtime/embedder` URL (the module-identity constraint:
+  deltic's `wasi-shims` imports that specifier by bare name internally,
+  so every config resolving it must agree, or the embedder module loads
+  twice and `instanceof WitError` stops holding across the boundary).
+- `fetch-translator.ts` — `TAG` + `TRANSLATOR_SHA256` for the
+  `deltic-translator-shim.wasm` release asset (cached under
+  `target/deltic/<tag>/`).
+
+The runtime is consumed as pinned raw **source** over those import maps,
+not as the release's prebuilt `deltic-embedder.mjs` bundle: the bundle
+would be a second, separately-pinned copy of the same modules, which is
+exactly what the module-identity constraint forbids.
+
+To bump: update the tag in all three files (this `deno.json`,
+`js/deltic/deno.json`, and `fetch-translator.ts`) and the sha256 from the
+release's `SHA256SUMS`, delete BOTH `deno.lock` files (this directory and
+`js/deltic/`), re-run `deno cache run.ts fetch-translator.ts` here and
+`deno cache src/mod.ts tests/families_test.ts` in `js/deltic/` to
+regenerate them, then re-run `just conformance-ct::run-deltic` plus
+`just conformance-ct::aggregate aggregate-signing` and commit the diff
+(including the regenerated matrices, via
+`just conformance-ct::matrix-update`).

conformance/driver-ct/deltic/deno.json

@@ -0,0 +1,12 @@
+{
+  "//": "MODULE-IDENTITY CONSTRAINT: deltic's wasi-shims module imports @deltic/runtime/embedder by bare specifier internally. The @deltic/runtime/embedder entry here must map to the IDENTICAL URL as ../../../js/deltic/deno.json's entry, or the embedder module loads twice and `instanceof WitError` stops holding across the module boundary.",
+  "imports": {
+    "@deltic/ct-runner": "https://raw.githubusercontent.com/lann/deltic/pre-58b2404/ct-runner/src/mod.ts",
+    "@deltic/runtime/embedder": "https://raw.githubusercontent.com/lann/deltic/pre-58b2404/runtime/src/embedder/mod.ts",
+    "@deltic/runtime/shim": "https://raw.githubusercontent.com/lann/deltic/pre-58b2404/runtime/src/shim/mod.ts",
+    "@deltic/wasi-shims": "https://raw.githubusercontent.com/lann/deltic/pre-58b2404/wasi-shims/src/mod.ts"
+  },
+  "tasks": {
+    "check": "deno check run.ts fetch-translator.ts"
+  }
+}