conformance: consume deltic from JSR; retire the release-asset fetch

AGENTS.md

@@ -77,7 +77,7 @@ design record.
 | --- | --- |
 | `just check` | fmt, clippy (all features), workspace tests (RFC 9001 vectors, profile/provider pinning, class-D key rejection), wasm build |
 | `just ci` | every gating CI job's body, exactly as CI runs it — each CI job runs one gha:: job recipe (.github/justfile). The timing lab is schedule-only and excluded |
-| `just conformance` | the cross-implementation conformance suite (see `conformance/README.md`): the shared guest suite composed with each delivery — the `tls` world's in-guest Ed25519 posture and the `tls-delegated` world with the fixture signer — run under the pinned component-test runner, runtime-linked under deltic on stock Deno (the deltic-deno targets — no transpile, no engine flag; release-pinned in `conformance/driver-ct/deltic/`), and runtime-linked in headless Chromium (the deltic-browser targets; CI or CONFORMANCE_BROWSER=1), with import-satisfaction and signer-reachability gates, validated against the committed case inventory (`tests.lock`) and target manifest, and diffed against the committed matrix. `just conformance-ct::run-webcrypto` (on demand: clones the sibling repo) adds the delegated posture over a real `polymorph:webcrypto` provider |
+| `just conformance` | the cross-implementation conformance suite (see `conformance/README.md`): the shared guest suite composed with each delivery — the `tls` world's in-guest Ed25519 posture and the `tls-delegated` world with the fixture signer — run under the pinned component-test runner, runtime-linked under deltic on stock Deno (the deltic-deno targets — no transpile, no engine flag; JSR-pinned in `conformance/driver-ct/deltic/`), and runtime-linked in headless Chromium (the deltic-browser targets; CI or CONFORMANCE_BROWSER=1), with import-satisfaction and signer-reachability gates, validated against the committed case inventory (`tests.lock`) and target manifest, and diffed against the committed matrix. `just conformance-ct::run-webcrypto` (on demand: clones the sibling repo) adds the delegated posture over a real `polymorph:webcrypto` provider |
 | `just smoke-quic` | QUIC over `wasi:sockets` UDP under Wasmtime |
 | `just smoke-tls-virt` | both tls-virt deliveries against `openssl s_server` over real TCP (needs openssl + python3): the composed guest virtualizer (handle-address and import-satisfaction gates), and the wasmtime host provider on both sockets generations — wasip3 and `std::net`/0.2 guests — with handle-address and profile-cipher-suite gates plus plain-TCP passthrough-delegation legs |
 | `just interop` | cross-implementation, over real transports, fresh Ed25519 private PKI per run: the composed TLS component against OpenSSL and Go peers over TCP in both directions (including the close_notify-vs-truncation and reset scenarios), and the noq leg against quic-go over UDP in both directions |

conformance/README.md

@@ -27,7 +27,7 @@ A target is a composition, not a runtime configuration: the suite is
 `wac plug`-ged with one TLS stack, and the resulting artifact imports
 only wasi and `polymorph:test/test-context`. The wasmtime rows run
 under the generic component-test host runner; the deltic rows
-runtime-link the same artifacts under the release-pinned deltic
+runtime-link the same artifacts under the JSR-pinned deltic
 runtime (`driver-ct/deltic/`) — one suite, one composition, two
 engines.
 

conformance/driver-ct/deltic/README.md

@@ -26,11 +26,17 @@ target here.
 
 ## Pinning
 
-deltic is pinned to a release tag in `deno.json` (import-map URLs;
-`deno.lock` carries the module-graph integrity, enforced with
-`--frozen`) and `fetch-translator.ts` (TAG + sha256 for the
-`deltic-translator-shim.wasm` release asset, cached under
-`target/deltic/<tag>/`), cross-checked at run time. To bump: update the
-tag in both files and the sha from the release's `SHA256SUMS`, delete
-`deno.lock`, re-run `deno cache run.ts fetch-translator.ts` here, and
-commit the diff.
+deltic is pinned to an exact JSR prerelease (`0.1.0-pre.ga67ee83`; the
+hash names one upstream commit) via `deno.json`'s import-map (`deno.lock`
+carries module-graph integrity, enforced with `--frozen`). The browser
+leg's embedder bundle and translator wasm are built from that SAME
+pinned graph (`../justfile`'s `_deltic-browser-build` recipe: `deno
+bundle` for the embedder, `deno info` + copy for the translator wasm) —
+no sha256 bookkeeping, no GitHub release-asset fetch. A repo-wide pin
+gate (`../justfile`'s `_deltic-pin-check`) asserts every `deno.json` in
+the repo agrees on one `@deltic` version.
+
+To bump: update the version in this directory's `deno.json` import-map
+entries, delete `deno.lock`, run `deno install --config deno.json
+--entrypoint run.ts browser-bundle-entry.ts` here, and commit the diff
+(the pin gate asserts agreement).

conformance/driver-ct/deltic/browser-bundle-entry.ts

@@ -0,0 +1,10 @@
+// Bundle entry for the deltic-browser leg: this is upstream
+// tools/release-bundle/entry.ts's exact public surface, vendored here so
+// the browser bundle is built from the SAME pinned JSR graph as the Deno
+// legs instead of a sha256-pinned release asset (see README.md's
+// "Pinning" section and ../justfile's `_deltic-browser-build` recipe).
+export * from "@deltic/runtime/embedder";
+export { Translator } from "@deltic/runtime/shim";
+export * from "@deltic/ct-runner";
+export { wasiShims } from "@deltic/wasi-shims";
+export type { WasiShims, WasiShimsOptions } from "@deltic/wasi-shims";

conformance/driver-ct/deltic/deno.json

@@ -1,12 +1,14 @@
 {
-  "//": "The deltic release pin (TAG in fetch-translator.ts must match; its assertPinConsistency checks). @deltic/runtime/embedder is mapped because wasi-shims imports it by bare specifier internally.",
+  "//": "The deltic pin: every @deltic/* import is an exact-pinned JSR prerelease (0.1.0-pre.ga67ee83); the hash names one upstream commit and @deltic/translator ships the translator wasm for that SAME commit. deno.lock carries integrity, --frozen enforced. One version repo-wide is asserted by the pin gate (../justfile).",
   "imports": {
-    "@deltic/ct-runner": "https://raw.githubusercontent.com/lann/deltic/pre-83fff30/ct-runner/src/mod.ts",
-    "@deltic/runtime/embedder": "https://raw.githubusercontent.com/lann/deltic/pre-83fff30/runtime/src/embedder/mod.ts",
-    "@deltic/runtime/shim": "https://raw.githubusercontent.com/lann/deltic/pre-83fff30/runtime/src/shim/mod.ts",
-    "@deltic/wasi-shims": "https://raw.githubusercontent.com/lann/deltic/pre-83fff30/wasi-shims/src/mod.ts"
+    "@deltic/ct-runner": "jsr:@deltic/ct-runner@0.1.0-pre.ga67ee83",
+    "@deltic/runtime/embedder": "jsr:@deltic/runtime@0.1.0-pre.ga67ee83/embedder",
+    "@deltic/runtime/shim": "jsr:@deltic/runtime@0.1.0-pre.ga67ee83/shim",
+    "@deltic/wasi-shims": "jsr:@deltic/wasi-shims@0.1.0-pre.ga67ee83",
+    "@deltic/translator": "jsr:@deltic/translator@0.1.0-pre.ga67ee83"
   },
+  "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*"] },
   "tasks": {
-    "check": "deno check run.ts fetch-translator.ts"
+    "check": "deno check run.ts browser-bundle-entry.ts"
   }
 }