Deltic leg: the conformance suite runtime-linked on stock Deno

.github/justfile

@@ -33,6 +33,7 @@ rust-checks:
 
 conformance-checks:
     @just gha::_step conformance-ct::all
+    @just gha::_step deltic-module-check
     @just gha::_step wpt::parity
     @just gha::_step wpt::parity-chromium
     @just gha::_step demo::test

.github/workflows/ci.yml

@@ -63,6 +63,10 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+      - name: Install Deno
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: "2.9.5"
       # Explicit restore/save instead of setup-node's `cache: pnpm`:
       # setup-node restores on the exact lockfile hash only; the
       # restore-keys prefix reuses the previous store and refetches only
@@ -139,6 +143,7 @@ jobs:
             composed=conformance/driver-ct/results/composed.jsonl
             jco-node=conformance/driver-ct/results/jco-node.jsonl
             jco-browser=conformance/driver-ct/results/jco-browser.jsonl
+            deltic-deno=conformance/driver-ct/results/deltic-deno.jsonl
           summary-title: Conformance matrix
           cli: target/ct-tools/bin/component-test
           cargo-lock: Cargo.lock

AGENTS.md

@@ -31,14 +31,27 @@ Layout (each directory's justfile module in parentheses):
 - `js/jco/` — `websocket.js`, the browser-first host module. Its knobs are
   exported functions (`setMaxInboundBufferBytes`, `setConnectTimeoutMs`,
   `setCloseTimeoutMs`); the module reads no ambient configuration.
+- `js/deltic/` (`just deltic-module-check`) — `websocket.ts`, the same
+  logic ported to [deltic](https://github.com/lann/deltic)'s embedder
+  conventions (typed streams, `WitError`) for its runtime-linked,
+  no-transpile conformance leg (`conformance/driver-ct/deltic/`). The
+  deltic release is pinned in `conformance/driver-ct/deltic/fetch-translator.ts`
+  (TAG + translator-shim sha256) and in TWO import maps —
+  `js/deltic/deno.json` and `conformance/driver-ct/deltic/deno.json` —
+  which must agree byte-for-byte on the `@deltic/runtime/embedder` URL
+  (deltic's `wasi-shims` imports it by bare specifier internally, so a
+  drift would load the embedder module twice and break `instanceof
+  WitError` across the boundary). Bump procedure:
+  `conformance/driver-ct/deltic/README.md`.
 - `js/componentize/` (`just wpt::…`) — `websocket.js`, the WHATWG-API
   shim for componentize-js guests (deviations registry in its header), and
   the WPT parity gate (`wpt/README.md` is the vendoring policy; losses
   ratchet in `wpt/parity/losses.js`).
 - `conformance/` (`just conformance-ct`) — the conformance suite on the
   `polymorph:test` harness: `guest-ct/` (the suite component; the
   committed `tests.lock` is the corpus inventory),
-  `driver-ct/` (wasmtime + jco-node + jco-browser + composed legs, `targets.toml`
+  `driver-ct/` (wasmtime + jco-node + jco-browser + composed + deltic-deno
+  legs, `targets.toml`
   with the expected-fail mechanism, the committed `matrix.md`), and
   `server/` (echod; `server/PROTOCOL.md` is its wire contract,
   `server/echod.mjs` the shared Node spawn helpers). The suite crates

README.md

@@ -46,10 +46,11 @@ in-guest.
 | --- | --- |
 | [`wit/`](wit) | The `polymorph:websocket` package: a `types` interface for structural types and a `connections` interface owning the `websocket` resource. One copy at the root; consumers pull it in via `wit/deps` symlinks. Package-wide contracts live in [`wit/README.md`](wit/README.md). |
 | [`js/jco`](js/jco) | The **browser-first host library** (`websocket.js`): the standard `WebSocket` API only, no `node:` modules, no runtime dependencies. Shared verbatim by the demo runners and the conformance jco legs. |
+| [`js/deltic`](js/deltic) | The **deltic-native host module** (`websocket.ts`): the same logic as `js/jco/websocket.js`, ported to [deltic](https://github.com/lann/deltic)'s embedder conventions (typed streams, `WitError`) for its runtime-linked, no-transpile conformance leg. |
 | [`rust/wasmtime`](rust/wasmtime) | The **Wasmtime host crate** (`wasmtime-websocket`): `add_to_linker` + `WasiWebsocketView`, per-store `WasiWebsocketCtx` knobs for the bounds the WIT leaves implementation-defined. |
 | [`js/componentize`](js/componentize) | The **browser-API shim** for componentize-js guests: the WHATWG `WebSocket` interface implemented over the WIT imports — the inverse of `js/jco` — plus the **WPT parity gate**: vendored web-platform-tests run round-trip (shim → WIT → jco → platform WebSocket) and held to the platform baseline's pass set. |
 | [`rust/guest-provider`](rust/guest-provider) | The **in-guest provider** (`websocket-guest-provider`): a WebSocket client stack over `wasi:sockets` TCP, exporting the package surface as a composable component; `wss:` via the composed [`polymorph:tls`](https://github.com/polymorph-components/polymorph-tls) component. See its README for the TLS posture and configuration channel. |
-| [`conformance/`](conformance) | The **cross-implementation conformance suite** on the [`polymorph:test`](https://github.com/polymorph-components/polymorph-test) harness: a shared guest suite (`guest-ct`, its committed `tests.lock` the corpus inventory), a suite-owned echo server with fault-injection modes, and the driver (`driver-ct`) that runs every target (wasmtime, jco under Node, jco under headless Chromium) into [the matrix](conformance/README.md). |
+| [`conformance/`](conformance) | The **cross-implementation conformance suite** on the [`polymorph:test`](https://github.com/polymorph-components/polymorph-test) harness: a shared guest suite (`guest-ct`, its committed `tests.lock` the corpus inventory), a suite-owned echo server with fault-injection modes, and the driver (`driver-ct`) that runs every target (wasmtime, jco under Node, jco under headless Chromium, composed, and deltic under stock Deno) into [the matrix](conformance/README.md). |
 | [`examples/`](examples) | The **echo-demo guest component** plus native (`just demo::wasmtime`) and Node (`just demo::node`) runners against the suite echo server. |
 
 ## The interface
@@ -96,7 +97,7 @@ trees).
 ```sh
 ./scripts/setup.sh
 just check           # fmt + clippy + WIT validation + native tests
-just conformance-ct  # the full matrix: wasmtime, composed, jco-node, jco-browser
+just conformance-ct  # the full matrix: wasmtime, composed, jco-node, jco-browser, deltic-deno
 just demo::wasmtime  # the echo demo on the native host
 just demo::node      # the same component under Node + jco
 just ci              # exactly what CI runs

conformance/driver-ct/deltic/README.md

@@ -0,0 +1,47 @@
+# `conformance/driver-ct/deltic` — the deltic-native conformance leg
+
+The `deltic-deno` target in the conformance matrix: the suite runs
+runtime-linked under stock Deno — no transpile step, no generated tree,
+no engine flag (the WIT contract's async exports run on the callback ABI)
+— against [`js/deltic/websocket.ts`](../../../js/deltic/websocket.ts).
+This is the deltic analogue of the jco Node leg
+(`conformance/driver-ct/jco/run-node.mjs`); see `run.ts`'s header for the
+exact mirror.
+
+## Running it
+
+```sh
+just conformance-ct::run-deltic
+```
+
+which builds the suite + echod, fetches (and caches) the pinned
+translator-shim release asset, and runs the suite through `ct-runner`,
+writing `conformance/driver-ct/results/deltic-deno.jsonl`.
+
+## The pin
+
+deltic is pinned to a release tag in **three** places, cross-checked at
+run time by `fetch-translator.ts`:
+
+- `deno.json` (this directory) — import-map URLs
+  (`raw.githubusercontent.com/lann/deltic/<tag>/…`) for `@deltic/ct-runner`,
+  `@deltic/runtime/embedder`, `@deltic/runtime/shim`, `@deltic/wasi-shims`.
+  `deno.lock` carries integrity hashes for that module graph, enforced
+  with `--frozen`.
+- [`../../../js/deltic/deno.json`](../../../js/deltic/deno.json) — the
+  SAME `@deltic/runtime/embedder` URL (the module-identity constraint:
+  deltic's `wasi-shims` imports that specifier by bare name internally,
+  so every config resolving it must agree, or the embedder module loads
+  twice and `instanceof WitError` stops holding across the boundary).
+- `fetch-translator.ts` — `TAG` + `TRANSLATOR_SHA256` for the
+  `deltic-translator-shim.wasm` release asset (cached under
+  `target/deltic/<tag>/`).
+
+To bump: update the tag in all three files (this `deno.json`,
+`js/deltic/deno.json`, and `fetch-translator.ts`) and the sha256 from the
+release's `SHA256SUMS`, delete BOTH `deno.lock` files (this directory and
+`js/deltic/`), re-run `deno cache run.ts fetch-translator.ts` here and
+`deno cache websocket.ts tests/websocket_test.ts` in `js/deltic/` to
+regenerate them, then re-run `just conformance-ct::run-deltic` and commit
+the diff (including the regenerated `matrix.md`, via
+`just conformance-ct::matrix-update`).

conformance/driver-ct/deltic/deno.json

@@ -0,0 +1,12 @@
+{
+  "//": "MODULE-IDENTITY CONSTRAINT: deltic's wasi-shims module imports @deltic/runtime/embedder by bare specifier internally. The @deltic/runtime/embedder entry here must map to the IDENTICAL URL as ../../../js/deltic/deno.json's entry, or the embedder module loads twice and `instanceof WitError` stops holding across the module boundary.",
+  "imports": {
+    "@deltic/ct-runner": "https://raw.githubusercontent.com/lann/deltic/pre-66a6b8c/ct-runner/src/mod.ts",
+    "@deltic/runtime/embedder": "https://raw.githubusercontent.com/lann/deltic/pre-66a6b8c/runtime/src/embedder/mod.ts",
+    "@deltic/runtime/shim": "https://raw.githubusercontent.com/lann/deltic/pre-66a6b8c/runtime/src/shim/mod.ts",
+    "@deltic/wasi-shims": "https://raw.githubusercontent.com/lann/deltic/pre-66a6b8c/wasi-shims/src/mod.ts"
+  },
+  "tasks": {
+    "check": "deno check run.ts fetch-translator.ts"
+  }
+}