Add experimental Express and Hono support with opt-in Node runtime

.github/workflows/compat-matrix.yml

@@ -400,3 +400,26 @@ jobs:
             echo "Push failed; snapshot is in the compat-report artifact."
             exit 0
           fi
+
+      # Preserve and publish the full failure report before failing the gate.
+      # A complete run may still contain failing tests.
+      - name: Require a complete passing canonical snapshot
+        run: |
+          php <<'PHP'
+          <?php
+          $snapshot = json_decode(file_get_contents('compat.json'), true, 512, JSON_THROW_ON_ERROR);
+          $total = $snapshot['discovery']['testFileCount'] ?? null;
+          $totals = $snapshot['test262']['totals'] ?? [];
+          $passed = ($snapshot['complete'] ?? false) === true && is_int($total) && $total > 0
+              && ($snapshot['test262']['skippedFeatures'] ?? null) === [];
+          foreach (['pass', 'attempted', 'known', 'total'] as $key) {
+              $passed = $passed && ($totals[$key] ?? null) === $total;
+          }
+          foreach (['fail', 'skip', 'blocked', 'pending', 'running'] as $key) {
+              $passed = $passed && ($totals[$key] ?? null) === 0;
+          }
+          if (!$passed) {
+              fwrite(STDERR, "Canonical test262 did not pass every discovered file. See compat.json and COMPAT.md.\n");
+              exit(1);
+          }
+          PHP

.github/workflows/frameworks.yml

@@ -0,0 +1,143 @@
+name: Framework Compatibility
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'tests/Frameworks/**'
+      - 'scripts/node-*/**'
+      - 'composer.json'
+      - 'composer.lock'
+      - '.github/workflows/frameworks.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'tests/Frameworks/**'
+      - 'scripts/node-*/**'
+      - 'composer.json'
+      - 'composer.lock'
+      - '.github/workflows/frameworks.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: frameworks-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  XDEBUG_MODE: 'off'
+  TZ: UTC
+
+jobs:
+  upstream:
+    name: PHP ${{ matrix.php }} / ${{ matrix.suite }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.4', '8.5']
+        suite: [express, hono-main, hono-jsx-runtime-default, hono-jsx-runtime-dom, hono-node, http2]
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: mbstring, bcmath, curl, intl, openssl, sodium, zlib, sockets
+          coverage: none
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '26.12.0'
+          cache: npm
+          cache-dependency-path: tests/Frameworks/package-lock.json
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+
+      - name: Install pinned dependencies
+        run: |
+          composer install --no-interaction --prefer-dist
+          npm ci --prefix tests/Frameworks
+
+      - name: Prepare Express source
+        if: matrix.suite == 'express'
+        run: python3 -B tests/Frameworks/express/setup.py
+
+      - name: Prepare Hono source
+        if: startsWith(matrix.suite, 'hono-')
+        run: python3 -B tests/Frameworks/hono/setup.py
+
+      - name: Express original tests
+        if: matrix.suite == 'express'
+        run: |
+          python3 -B tests/Frameworks/express/test_runner.py
+          python3 -B tests/Frameworks/express/run.py --runtime both --jobs 1 --timeout-scale 10 --output framework-results/express
+
+      - name: Hono harness deadline differential
+        if: startsWith(matrix.suite, 'hono-')
+        run: |
+          python3 -B tests/Frameworks/hono/test_runner.py
+          python3 -B tests/Frameworks/hono/selftest.py
+
+      - name: Hono original runtime tests
+        if: startsWith(matrix.suite, 'hono-')
+        env:
+          FRAMEWORK_SUITE: ${{ matrix.suite }}
+        run: python3 -B tests/Frameworks/hono/run.py --project "${FRAMEWORK_SUITE#hono-}" --timeout 1800 --timeout-scale 10
+
+      - name: Hono independent native Vitest baseline
+        if: startsWith(matrix.suite, 'hono-') && !cancelled()
+        env:
+          FRAMEWORK_SUITE: ${{ matrix.suite }}
+        run: |
+          mkdir -p framework-results
+          if [ "$FRAMEWORK_SUITE" = 'hono-main' ]; then
+            node tests/Frameworks/hono/prepare-toolchain.mjs
+          fi
+          PHASIS_HONO_PROJECT="${FRAMEWORK_SUITE#hono-}" node tests/Frameworks/node_modules/vitest/vitest.mjs run \
+            --config tests/Frameworks/hono/vitest.config.mjs \
+            --reporter=json --outputFile="$PWD/framework-results/hono-native.json"
+
+      - name: Compare every Hono case with native Vitest
+        if: startsWith(matrix.suite, 'hono-') && !cancelled()
+        run: |
+          python3 -B - <<'PY'
+          import json
+          from pathlib import Path
+          import subprocess
+          results = Path('tests/Frameworks/hono/results')
+          run_id = json.loads((results / 'manifest.json').read_text())['id']
+          manifest = results / 'runs' / run_id / 'manifest.json'
+          statuses = [subprocess.run([
+              'python3', '-B', 'tests/Frameworks/hono/compare-native.py',
+              'framework-results/hono-native.json', str(manifest), '--runtime', runtime,
+          ]).returncode for runtime in ['node', 'phasis']]
+          raise SystemExit(int(any(statuses)))
+          PY
+
+      - name: Hono original declaration tests
+        if: matrix.suite == 'hono-main' && !cancelled()
+        run: python3 -B tests/Frameworks/hono/run-toolchain.py
+
+      - name: HTTP2 native Node interoperability
+        if: matrix.suite == 'http2'
+        run: |
+          mkdir -p framework-results
+          node tests/Frameworks/http2/interop.mjs | tee framework-results/http2.jsonl
+
+      - name: Preserve complete manifests and failure logs
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: frameworks-php${{ matrix.php }}-${{ matrix.suite }}-${{ github.sha }}
+          path: |
+            framework-results/
+            tests/Frameworks/hono/results/runs/
+          if-no-files-found: warn

AGENTS.md

@@ -8,6 +8,21 @@ Keep agent instructions in `AGENTS.md` only. Use nested `AGENTS.md` files when
 guidance needs a narrower scope. Do not add `CLAUDE.md` files, symlinks, or
 forwarding stubs for repository guidance.
 
+Node compatibility is opt-in through `Engine::enableNode()` or `phasis --node`.
+JavaScript still executes entirely in PHP. Node/npm may prepare pinned assets or
+run test oracles, but must never become an execution backend. Explicit
+`child_process` operations use PHP host processes; a JavaScript child launched
+through `process.execPath` runs the Phasis PHP entry point. New host resources
+must register cleanup with their owning NodeRuntime. Keep original framework
+assertions, report all discovered cases and upstream skips, and retain source
+identity for complete-run claims. Express and Hono support is experimental;
+their CI runners explicitly use `--timeout-scale 10` while performance work is
+deferred. Preserve original timeout values and record effective limits in the
+results; a scaled run is a functional compatibility result, not a claim to meet
+upstream performance deadlines. Never relax test262 assertions, coverage or
+timeouts to accommodate framework workloads. Close and reap owned test
+processes and listeners after every run.
+
 ## Releases
 
 Follow the [shared release rule](https://github.com/inline0/_cp/blob/main/AGENTS.md#canonical-github-releases).

CHANGELOG.md

@@ -2,11 +2,30 @@
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-10-24
+
 ### Added
+- Opt-in Node-compatible realms and `phasis --node`, with CommonJS package loading, Buffer and streams, filesystem and process I/O, HTTP/HTTPS/HTTP2, TLS, compression, timers, async context, and isolated VM realms.
+- Experimental Express and Hono support with pinned upstream runners, original assertions, case inventories, source hashes, bounded workers and real network interoperability checks.
+- Ed25519 WebCrypto keys, MessageEvent and in-process BroadcastChannel support.
 - Keyed Promise combinators, iterator chunk/window/zip helpers, and immutable ArrayBuffers with protected typed-array, DataView, and Atomics writes.
 - Locale variants and locale-specific calendar, collation, hour-cycle, text-direction, and week information.
 
 ### Fixed
+- Live Fetch request and response bodies retain streaming, cancellation and clone behavior; Node fetch can communicate with servers in the same engine.
+- Promise reactions preserve registration-time async context; cross-realm generators preserve their realm prototypes; global-property deletion and CommonJS cache behavior remain observable.
+- JSON property names and Unicode separators, callable proxies, and UTF-16 string indexing preserve JavaScript behavior across framework workloads.
+- Recursive compiled calls keep captured bindings separate, completed VM frames release their references, and WeakMap entries release unreachable keys without overflowing the host stack on deep chains.
+- Symbol property writes preserve Proxy traps and receivers; typed-array copies clamp array-like lengths before checking destination bounds.
+- Array literals and built-in array results retain their realm's intrinsic prototype when the global Array constructor is replaced.
+- Compiled identifier updates and strict program assignments retain their original references through coercion and right-hand-side effects.
+- Generated PHP preserves numeric truthiness and literal precision, evaluates operands once, and falls back before observable effects.
+- Generated binding and string-method preflight checks do not invoke host property-map or descriptor overrides.
+- Template strings outside pure loops no longer prevent those loops from using verified compiled code.
+- Calls, getters and constructors retain caller and argument records; non-callable errors do not invoke object conversion hooks.
+- Same-type typed-array copies preserve byte payloads and prototype-validation order; host byte views and inlined callbacks retain their defining realms.
+- Typed-array `set` checks bounds before content-type mismatches and copies matching native element types without changing stored bits.
+- Stream controllers, readers and writers retain their originating realm after VM context creation; pending Promise finalizers retain their registered async context.
 - Temporal calendar fields, arithmetic, rounding, parsing, timezone boundaries, and Intl formatting use consistent calendar data and option validation.
 - Module evaluation, source and typed imports, resource disposal, cross-realm intrinsics, numeric serialization, and compiled global bindings follow current language semantics.
 - Array callbacks observe mutations and holes, and global declarations create own properties without invoking inherited accessors.
@@ -15,8 +34,15 @@
 - Intl option precedence, legacy constructors, plural notation, numbering systems, and plain date/time formatting.
 
 ### Changed
+- Framework runners accept an explicit timeout scale and record original and effective limits. Experimental Express/Hono CI uses a scale of 10 while performance work is deferred; test262 limits and engine budgets are unchanged.
+- Bytecode compilation handles captured bindings, default initializers, array bindings and assignments, optional chains, spread calls, computed methods, object prototypes, regular-expression literals and strict tail calls; reusable syntax templates keep closure state separate.
+- Proven disjoint lexical scopes reuse frame slots, ordinary function prototypes materialize when observed, and numeric typed-array writes avoid redundant conversions while retaining buffer-resize and detachment behavior.
+- Completed frames clear their local slots in one allocation while releasing activation references.
+- Fresh functions initialize their name and length descriptors without redundant allocation while preserving host subclass hooks.
+- Protected returns preserve finalizer completion order in bytecode, and logical assignments and object relational operators use the shared JavaScript semantics.
+- Bounded regular-expression preparation and cached UTF-16 searches reduce repeated work while preserving fresh objects and observable coercions.
 - The test262 runner executes both variants of unflagged scripts, preserves raw sources and module parse goals, requires async completion, and checks negative-test error types and phases.
-- Compatibility shards retain full file manifests; merging rejects overlapping or stale results and keeps missing coverage visible. Incomplete or failing coverage cannot round up to 100%.
+- Compatibility shards retain full file manifests; merging rejects overlapping or stale results and keeps missing coverage visible. Incomplete or failing coverage cannot round up to 100%; the canonical workflow fails on nonpassing results after preserving the report.
 
 ## [0.8.0] - 2026-10-16