chore(toolchain): provision OCaml/wasmtime/Deno + migrate harnesses to Deno (#133/#253) (#150)

## What

Two related estate-toolchain changes:

**1. Durable provisioning** — `tools/provision.sh` (exposed as `just
provision` / `just setup`, wired into `setup.sh`) installs:
- **Deno** — the JS runtime, fetched from the **GitHub release assets**.
`deno.land` / `dl.deno.land` are denied by the network policy
(`x-deny-reason: host_not_allowed`), but `github.com` release downloads
are reachable — same channel that works for wasmtime/just.
- **wasmtime** — the #132 capstone execution gate, via crates.io.
- **AffineScript** — the parser/codegen compiler. It is an **OCaml**
program (built from `hyperpolymath/affinescript` with opam + dune at the
SHA pinned in `c5-regenerate.yml`), **not** an npm package —
`@hyperpolymath/affinescript` 404s on npmjs.

The stale `deps` recipe (which ran `npm ci` against the `package.json`
that #133 removed) is replaced with a real toolchain check.

**2. node → Deno harness migration** (estate #133 / standards#253) — the
`node tests/*.mjs` runners now run under **Deno** with scoped
permissions (`--allow-read --allow-write --allow-run --allow-env
--allow-sys`):
- `deno.json` (tasks + config), the Justfile `deno_run` recipes,
`e2e.yml` (smoke + build-e2e jobs install Deno from the release assets),
and `tests/e2e.sh`.
- The `.mjs` were already Deno-shaped (`node:` imports,
`import.meta.url`-derived `__dirname`), so the change is mechanical — no
source edits to the harnesses.

**Cleanup** — removed the ReScript-era leftovers `deno.lock` +
`package-lock.json`, and the stale `rescript build` /
`node_modules/@rescript` references in the E2E script.

## Why

`@hyperpolymath/affinescript` is OCaml, so it was never an npm/Deno/Bun
package — there's nothing to "migrate" for the compiler. The only
JS-runtime surface is the `.mjs` harnesses, and the estate standard is
**Deno** (#133/#253), not Bun. This PR makes the toolchain reproducible
and finishes the node→Deno harness move.

## Verification (local, deno 2.8.1)

- `deno task test-aspect` / `test-proof` — green
- `just deps` (deno/cargo/wasmtime ok), `just test-aspect` /
`test-proof` — green
- `E2E_BUILD=0 bash tests/e2e.sh` — **47 passed / 0 failed / 7 skipped**
- `tools/provision.sh` runs clean (idempotent skip when tools present)

The CI Deno-install steps + full `e2e.yml` flow are verified by this
PR's own run.

## Note on AffineScript

`provision.sh` *can* build AffineScript here (`github.com` clone is
reachable, opam is apt-installable) but it's a ~5-min OCaml build, so I
didn't run it in this session — it's codified per the authoritative
`c5-regenerate.yml` recipe. Building it is the unblock for the #127
front-end→IR seam.

https://claude.ai/code/session_01Rq4da8i2uGnDUfanSB1Hx4

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Rq4da8i2uGnDUfanSB1Hx4)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -26,6 +26,32 @@ cd ffi/zig && zig build test
 cd src/abi && idris2 --check Proofs.idr
 ```
 
+## Environment & Toolchain (operational)
+
+**Provisioning:** `just provision` (→ `tools/provision.sh`) installs the full toolchain;
+`just setup` runs provision + `just deps` (a presence check). `setup.sh` bootstraps `just`
+then calls `just setup`.
+
+- **JS runtime is Deno**, not node (estate npm→Deno migration, #133 / standards#253). The
+  `.affine` parser sources compile to `.mjs` (`affinescript.json`); those `.mjs` run under
+  Deno. Test harnesses use `deno run` via the Justfile `deno_run` var / `deno.json` tasks,
+  with scoped perms `--allow-read --allow-write --allow-run --allow-env --allow-sys`. There
+  is **no `package.json`** (removed in #133) and no lockfile (only `node:` builtins).
+- **AffineScript is an OCaml compiler, NOT an npm package** (`@hyperpolymath/affinescript`
+  404s on npmjs). Built from `hyperpolymath/affinescript` with opam + dune at the SHA pinned
+  in `.github/workflows/c5-regenerate.yml` (`AFFINESCRIPT_SHA`); binary is
+  `_build/default/bin/main.exe`. Building it is the unblock for the #127 front-end→IR seam.
+- **wasmtime** (the #132 capstone execution gate) installs via `cargo install wasmtime-cli`.
+
+**Network policy (Claude Code remote env):** `github.com` release assets, crates.io, npmjs,
+and ubuntu apt are reachable; `deno.land`/`dl.deno.land`, `api.github.com`, and `wasmtime.dev`
+are denylisted (`x-deny-reason: host_not_allowed`). Fetch deno/just from **github.com release
+assets** (not the vendor install scripts); wasmtime via crates.io.
+
+**Git proxy:** serves only `hyperpolymath/typed-wasm`, but direct `git clone
+https://github.com/...` works (github.com is allowed). Ref-deletes return HTTP 403 —
+**branch deletion is GitHub-UI-only** (there is no MCP delete-branch tool either).
+
 ## Key Design Decisions
 
 - Follows hyperpolymath ABI-FFI standard (Idris2 ABI, Zig FFI)

.github/workflows/e2e.yml

@@ -5,7 +5,7 @@
 #
 # Runs on every PR and push to main. Three jobs:
 #   structural   — fast structural checks (no compiler required)
-#   smoke        — Node.js smoke test (AffineScript parser + example files)
+#   smoke        — Deno harnesses (AffineScript parser + aspect/proof envelopes)
 #   build-e2e    — Full Idris2 + Zig build then E2E
 #   cargo-verify — Cargo workspace build + test (typed-wasm-verify crate)
 name: E2E Validation
@@ -39,80 +39,76 @@ jobs:
         run: E2E_BUILD=0 bash tests/e2e.sh
 
   # --------------------------------------------------------------------------
-  # Job 2: Smoke test — Node.js parser validation
+  # Job 2: Smoke test — Deno harness validation
   # --------------------------------------------------------------------------
   smoke:
-    name: Smoke test (Node.js AffineScript parser)
+    name: Smoke test (Deno AffineScript harnesses)
     runs-on: ubuntu-latest
+    env:
+      # Scoped permissions covering the harnesses' needs (file read/write,
+      # subprocess spawn for idris2, env). See deno.json / Justfile `deno_run`.
+      DENO_RUN: "deno run --allow-read --allow-write --allow-run --allow-env --allow-sys"
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '25'
-
-      - name: Install npm deps (skip if no package.json — repo is Deno-first since #133)
+      # Deno is the project's JS runtime (estate npm→Deno migration, #133 /
+      # standards#253). deno.land is denied by some network policies, so install
+      # straight from the GitHub release assets — the same curl pattern the
+      # Idris2 / Zig steps use below.
+      - name: Install Deno
         run: |
-          if [ -f package.json ]; then
-            npm install --no-audit --no-fund --silent
-          else
-            echo "::warning::no root package.json (Deno migration, #133) — skipping npm install."
-          fi
-
-      # Phase 0 NOTE (issue #48): Track A's parser migration replaced
-      # ReScript (.res + rescript.json + rescript build) with AffineScript
-      # (.affine + affinescript.json + @hyperpolymath/affinescript compiler).
-      # The compiler isn't yet declared as an npm dep in package.json so
-      # `npm install` can't fetch it on a clean CI runner. Detect the
-      # AffineScript or ReScript binary if either is present after install,
-      # build with whichever is available, otherwise skip and let downstream
-      # steps handle the artefact-absent case (they're already guarded).
-      - name: Build parser (AffineScript preferred, ReScript fallback)
+          DENO_VERSION="2.8.1"
+          curl -fsSL -o /tmp/deno.zip \
+            "https://github.com/denoland/deno/releases/download/v${DENO_VERSION}/deno-x86_64-unknown-linux-gnu.zip"
+          mkdir -p "$HOME/.deno/bin"
+          unzip -oq /tmp/deno.zip -d "$HOME/.deno/bin"
+          echo "$HOME/.deno/bin" >> "$GITHUB_PATH"
+          "$HOME/.deno/bin/deno" --version
+
+      # The AffineScript parser compiler is OCaml (opam + dune, NOT npm — see
+      # tools/provision.sh). Building it is expensive (~5 min) and is exercised by
+      # c5-regenerate.yml, not here. If it happens to be on PATH, build; otherwise
+      # skip and let the guarded steps below handle the artefact-absent case.
+      - name: Build parser (AffineScript, if provisioned)
         run: |
-          if [ -x node_modules/.bin/affinescript ]; then
-            echo "Building with AffineScript..."
-            node_modules/.bin/affinescript build
-          elif [ -x node_modules/.bin/rescript ]; then
-            echo "Building with ReScript (migration fallback)..."
-            node_modules/.bin/rescript build
+          if command -v affinescript >/dev/null 2>&1; then
+            echo "Building parser with AffineScript..."
+            affinescript build
           else
-            echo "::warning::No parser compiler available — skipping build."
-            echo "::warning::Track A parser-migration is incomplete; see #48."
-            echo "::warning::Downstream smoke / aspect / property / benchmark"
-            echo "::warning::steps will skip if src/parser/Parser.mjs is absent."
+            echo "::warning::affinescript (OCaml) not provisioned — skipping parser build."
+            echo "::warning::smoke / property / benchmark steps will skip if src/parser/Parser.mjs is absent."
           fi
 
       - name: Run smoke test (skip if parser artefacts absent)
         run: |
           if [ -f src/parser/Parser.mjs ]; then
-            node tests/smoke/e2e-smoke.mjs
+            $DENO_RUN tests/smoke/e2e-smoke.mjs
           else
             echo "::warning::src/parser/Parser.mjs absent — skipping smoke test."
           fi
 
       - name: Run aspect tests (claim + security envelopes — no parser dep)
         run: |
-          node tests/aspect/claim-envelope.mjs
-          node tests/aspect/security-envelope.mjs
+          $DENO_RUN tests/aspect/claim-envelope.mjs
+          $DENO_RUN tests/aspect/security-envelope.mjs
 
       - name: Run property tests (skip if parser artefacts absent)
         run: |
           if [ -f src/parser/Parser.mjs ]; then
-            node tests/property/property_test.mjs
+            $DENO_RUN tests/property/property_test.mjs
           else
             echo "::warning::src/parser/Parser.mjs absent — skipping property tests."
           fi
 
       - name: Run proof regression (named theorems + idris2 typecheck if present)
-        run: node tests/proof/regression.mjs
+        run: $DENO_RUN tests/proof/regression.mjs
 
       - name: Run parser benchmark (skip if parser artefacts absent)
         run: |
           if [ -f src/parser/Parser.mjs ]; then
-            BENCH_ITERS=20 node benchmarks/parser-bench.mjs
+            BENCH_ITERS=20 $DENO_RUN benchmarks/parser-bench.mjs
           else
             echo "::warning::src/parser/Parser.mjs absent — skipping benchmark."
           fi
@@ -163,11 +159,18 @@ jobs:
           tar -xJf /tmp/zig.tar.xz -C /opt
           ln -s "/opt/${ZIG_DIR}/zig" /usr/local/bin/zig
 
-      # ---- Node (for smoke test within E2E script) ----
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '25'
+      # ---- Deno (JS runtime for the smoke harness within the E2E script) ----
+      # Installed from the GitHub release assets (deno.land is denied by some
+      # network policies); matches the curl pattern above. See tests/e2e.sh.
+      - name: Install Deno
+        run: |
+          DENO_VERSION="2.8.1"
+          curl -fsSL -o /tmp/deno.zip \
+            "https://github.com/denoland/deno/releases/download/v${DENO_VERSION}/deno-x86_64-unknown-linux-gnu.zip"
+          mkdir -p "$HOME/.deno/bin"
+          unzip -oq /tmp/deno.zip -d "$HOME/.deno/bin"
+          echo "$HOME/.deno/bin" >> "$GITHUB_PATH"
+          "$HOME/.deno/bin/deno" --version
 
       # ---- Full E2E ----
       # Phase 0 NOTE (issue #48): this step has been persistently red since

CHANGELOG.md

@@ -11,6 +11,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Toolchain provisioning + node→Deno harness migration (#133 / standards#253) (2026-06-01)
+
+`tools/provision.sh` (exposed as `just provision` / `just setup`, wired into
+`setup.sh`) installs the full toolchain: **Deno** (the JS runtime — fetched from
+the **GitHub release assets**, since `deno.land` is denied by some network
+policies while `github.com` is reachable), **wasmtime** (the #132 execution
+gate, via crates.io), and **AffineScript** (the parser/codegen compiler — an
+**OCaml** program built from `hyperpolymath/affinescript` with opam + dune at
+the SHA pinned in `c5-regenerate.yml`; it is **not** an npm package — the name
+`@hyperpolymath/affinescript` 404s on npmjs). The stale `deps` recipe — which
+ran `npm ci` against the `package.json` that #133 removed — now checks the real
+toolchain instead.
+
+The `node tests/*.mjs` harnesses now run under **Deno** with scoped permissions
+(`deno.json`, the Justfile `deno_run` recipes, `e2e.yml`'s smoke + build-e2e
+jobs, and `tests/e2e.sh`); the `.mjs` were already Deno-shaped (`node:` imports,
+`import.meta.url`-derived `__dirname`), so the change is mechanical. Removed the
+ReScript-era leftovers `deno.lock` and `package-lock.json`, and the stale
+`rescript build` / `node_modules/@rescript` references in the E2E script.
+
 ### Capstone execution gate: run on Wasmtime (#132) (2026-05-31)
 
 The producer now exports the linear **memory** (so a host — Wasmtime, JS — can

Justfile

@@ -22,6 +22,11 @@ REPO := "typed-wasm"
 version := "0.1.0"
 tier := "infrastructure"  # 1 | 2 | infrastructure
 
+# JS runtime: Deno (estate npm→Deno migration, #133 / standards#253). The .affine
+# parser sources compile to .mjs; those .mjs run under Deno with scoped permissions
+# (file read/write, subprocess spawn for idris2/zig, env access). See deno.json.
+deno_run := "deno run --allow-read --allow-write --allow-run --allow-env --allow-sys"
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # DEFAULT & HELP
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -98,25 +103,25 @@ clean-all: clean
 test *args:
     @echo "Running AffineScript parser tests..."
     affinescript build
-    node tests/parser/ParserTests.mjs
+    {{deno_run}} tests/parser/ParserTests.mjs
     @echo ""
     @echo "Running contract tests..."
-    node tests/contracts/airborne-step-state-contract.mjs
+    {{deno_run}} tests/contracts/airborne-step-state-contract.mjs
     @echo ""
     @echo "Running E2E driver (parse + check every example)..."
-    node tests/e2e/e2e-driver.mjs
+    {{deno_run}} tests/e2e/e2e-driver.mjs
     @echo ""
     @echo "Running per-level test suites (L1-L10)..."
-    node tests/levels/L1.mjs
-    node tests/levels/L2.mjs
-    node tests/levels/L3.mjs
-    node tests/levels/L4.mjs
-    node tests/levels/L5.mjs
-    node tests/levels/L6.mjs
-    node tests/levels/L7.mjs
-    node tests/levels/L8.mjs
-    node tests/levels/L9.mjs
-    node tests/levels/L10.mjs
+    {{deno_run}} tests/levels/L1.mjs
+    {{deno_run}} tests/levels/L2.mjs
+    {{deno_run}} tests/levels/L3.mjs
+    {{deno_run}} tests/levels/L4.mjs
+    {{deno_run}} tests/levels/L5.mjs
+    {{deno_run}} tests/levels/L6.mjs
+    {{deno_run}} tests/levels/L7.mjs
+    {{deno_run}} tests/levels/L8.mjs
+    {{deno_run}} tests/levels/L9.mjs
+    {{deno_run}} tests/levels/L10.mjs
     @echo ""
     @echo "Running Zig FFI tests..."
     cd ffi/zig && zig build test
@@ -127,49 +132,49 @@ test *args:
 test-verbose:
     @echo "Running all tests (verbose)..."
     affinescript build
-    node tests/parser/ParserTests.mjs
+    {{deno_run}} tests/parser/ParserTests.mjs
     cd ffi/zig && zig build test
-    node tests/smoke/e2e-smoke.mjs
+    {{deno_run}} tests/smoke/e2e-smoke.mjs
 
 # End-to-end smoke test — parse example, verify ABI correspondence
 test-smoke:
     @echo "Running E2E smoke test..."
     affinescript build
-    node tests/smoke/e2e-smoke.mjs
+    {{deno_run}} tests/smoke/e2e-smoke.mjs
 
 # ABI contract tests
 test-contract:
     @echo "Running ABI contract tests..."
-    node tests/contracts/airborne-step-state-contract.mjs
+    {{deno_run}} tests/contracts/airborne-step-state-contract.mjs
 
 # End-to-end test surface
 test-e2e:
     @echo "Running end-to-end tests..."
     affinescript build
-    node tests/smoke/e2e-smoke.mjs
-    node tests/e2e/e2e-driver.mjs
+    {{deno_run}} tests/smoke/e2e-smoke.mjs
+    {{deno_run}} tests/e2e/e2e-driver.mjs
 
 # Aspect tests for cross-surface claim coherence
 test-aspect:
     @echo "Running aspect tests..."
-    node tests/aspect/claim-envelope.mjs
-    node tests/aspect/security-envelope.mjs
+    {{deno_run}} tests/aspect/claim-envelope.mjs
+    {{deno_run}} tests/aspect/security-envelope.mjs
 
 # Property-based tests of parser/checker invariants
 test-property:
     @echo "Running property tests..."
-    node tests/property/property_test.mjs
+    {{deno_run}} tests/property/property_test.mjs
 
 # Proof-level regression (named-theorem presence; idris2 typecheck if available)
 test-proof:
     @echo "Running proof regression..."
-    node tests/proof/regression.mjs
+    {{deno_run}} tests/proof/regression.mjs
 
 # Parser benchmark surface
 bench:
     @echo "Running parser benchmark..."
     affinescript build
-    node benchmarks/parser-bench.mjs
+    {{deno_run}} benchmarks/parser-bench.mjs
 
 # Type-check Idris2 ABI modules (formal proofs)
 check-abi:
@@ -204,15 +209,15 @@ fmt-check:
 # Run linter
 lint:
     @echo "Linting AffineScript sources with warnings-as-errors..."
-    npx affinescript build --warn-error "+3+4+45+102"
+    affinescript build --warn-error "+3+4+45+102"
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # RUN & EXECUTE
 # ═══════════════════════════════════════════════════════════════════════════════
 
 # Run the application
 run *args: build
-    node tests/smoke/e2e-smoke.mjs
+    {{deno_run}} tests/smoke/e2e-smoke.mjs
 
 # Run with verbose output
 run-verbose *args: build
@@ -228,21 +233,34 @@ install: build-release
 # DEPENDENCIES
 # ═══════════════════════════════════════════════════════════════════════════════
 
-# Install/check all dependencies
+# Check the toolchain is present (install everything with `just provision`)
 deps:
-    @echo "Checking dependencies..."
-    @command -v node >/dev/null
-    @command -v npx >/dev/null
-    @command -v zig >/dev/null
-    @command -v idris2 >/dev/null
-    @test -d node_modules || npm ci
-    @npm ls >/dev/null
-    @echo "All dependencies satisfied"
+    #!/usr/bin/env bash
+    set -uo pipefail
+    echo "Checking toolchain (install with \`just provision\`)..."
+    have() { command -v "$1" >/dev/null 2>&1; }
+    report() { if have "$1"; then echo "  ok    $1"; else echo "  $2  $1 — $3"; fi; }
+    report deno         FAIL "JS runtime, required (estate npm→Deno, #133/#253)"
+    report cargo        FAIL "Rust verifier + codegen, required"
+    report affinescript warn "AffineScript parser compiler (OCaml)"
+    report wasmtime     warn "capstone execution gate (#132)"
+    report zig          warn "Zig FFI"
+    report idris2       warn "Idris2 proofs"
+    if have deno && have cargo; then echo "Required toolchain present."; \
+    else echo "Missing a required tool — run \`just provision\`."; exit 1; fi
+
+# Install the full toolchain — Deno, wasmtime, AffineScript (OCaml) — see tools/provision.sh
+provision:
+    bash tools/provision.sh
+
+# First-run setup: provision the toolchain then verify it (invoked by setup.sh)
+setup: provision deps
+    @echo "Setup complete — try \`just build\` then \`just test\`."
 
 # Audit dependencies for vulnerabilities
 deps-audit:
     @echo "Auditing for vulnerabilities..."
-    @npm audit --omit=dev --audit-level=high
+    @command -v cargo-audit >/dev/null && cargo audit || echo "  (cargo-audit absent — \`cargo install cargo-audit\`; no npm deps since #133)"
     @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true
     @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true
     @echo "Audit complete"

deno.json

@@ -0,0 +1,13 @@
+{
+  // typed-wasm JS-runtime config — estate npm→Deno migration (#133 / standards#253).
+  // The .affine parser sources compile to .mjs (see affinescript.json); those .mjs
+  // run under Deno. AffineScript itself is an OCaml compiler, not an npm package —
+  // see `just provision`. There are no remote (npm:/https:) imports, only node:
+  // builtins, so no lockfile is needed.
+  "lock": false,
+  "nodeModulesDir": "none",
+  "tasks": {
+    "test-aspect": "deno run --allow-read --allow-write --allow-run --allow-env --allow-sys tests/aspect/claim-envelope.mjs && deno run --allow-read --allow-write --allow-run --allow-env --allow-sys tests/aspect/security-envelope.mjs",
+    "test-proof": "deno run --allow-read --allow-write --allow-run --allow-env --allow-sys tests/proof/regression.mjs"
+  }
+}