[rdlabo]

Workers applications using Node APIs encounter missing exports, incomplete crypto/filesystem behavior, and no authenticated TLS upgrade for an existing native socket. This development checkpoint expands those implementations and adds reproducible comparison and native acceptance runners against workerd 1.20261012.1, compatibility date 2026-10-17.

The maintainer explicitly authorized merging this checkpoint after CI passed. This is a PR-specific exception to CONTRIBUTING's whole-module merge gate. No module is newly certified complete by this PR, and this authorization does not establish release acceptance or waive the gate for other changes.

Changes

• Add the WebView events profile and process integration, request-local writable /tmp, module/HTTP helpers, and stream cancellation fixes.
• Expand crypto key generation/import/export, signatures, RSA, ECDH, prime operations, Certificate SPKAC, and X509Certificate using a reproducible bundled OpenSSL backend.
• Upgrade an existing native TCP connection to authenticated TLS. iOS uses OpenSSL memory BIOs with mandatory SecTrust chain/hostname validation; Android uses the existing Netty channel and platform SSLEngine. Application bytes wait for authentication. TLS half-close preserves response reads.
• Add Brotli/Zstd codecs, surface inventory checks, shared Workers comparison contracts, and installed-package native runners.

Validation

Runtime evidence for commit 2467e00125fbab6a049fe185912aa82d4a966303 (subsequent commits update documentation, type declarations, test harness separation, and CI dependency installation; SDK runtime behavior is unchanged):

• 633 unit tests, 240 expansion differential tests, typecheck and formatting passed.
• Installed-package regression: 966 common feature checks, plus public imports/builds, page/worker, Node CJS, development startup, direct/isolated dispatch and preferences checks passed.
• iOS simulator and Android emulator: all 29 expansion groups matched Workers in both page and Dedicated Worker modes.
• Native TLS on each OS: 14 TCP connections, 10 authenticated application exchanges, zero unexpected application requests; successful TLS 1.2/1.3, repeated half-close/response reads, and rejection of hostname mismatch and an untrusted root.
• Both native runs used the same independently installed tarball, SHA-256 5286e982eee18c9d650c61fd9bd56531d91b4066627f6c7b352709b51e6f9937.

Reproduce with npm test, npm run typecheck, npm run format:check, npm run test:node-expansion --prefix demo, npm run test:node-completion --prefix demo, and npm run test:package. Native preparation and commands are documented beside the runners. Generated local evidence is retained under artifacts/validation/x509-starttls/; it is not a tracked repository artifact.

Remaining compatibility work

The inventory covers 70 modules: 64 surface-aligned, six with surface gaps, and zero certified for whole-module behavior. Surface alignment and passing selected profiles do not establish module completeness. Additional crypto options/error contracts, filesystem descriptor/cross-volume behavior, codec edge cases and inherited gzip/deflate behavior, and full TLS/HTTP state contracts remain open. Custom Duplex TLS wrapping is unsupported. X509 key checks and name options preserve the documented pinned Workers restrictions. The backend is not certified FIPS.

The maintainer's merge authorization does not establish complete Node compatibility. Release acceptance remains separate, and the limitations above remain in effect.

Independent review cycle

Separate manager and third-party acceptance reviewers inspected the final branch and independently checked the recorded package hash, native reports and test evidence. The manager identified a stale TLS README statement; commit a101b03fa69514db9a7a357f7be03d9794a7e26b corrects it, and both reviewers rechecked the correction. Typecheck and format were rerun successfully; the acceptance reviewer additionally ran 12 transport tests successfully.

Both reviewers approve draft submission, with zero outstanding required corrections in this review. They do not approve whole-module acceptance, merge or release. Native results above were independently checked from complete stored reports, not rerun on simulators during the review. Earlier review cycles also corrected premature plaintext TLS writes, crypto constructor instances, DH validation, RSA/OAEP interoperability, and Hmac key encoding.

Local review records: artifacts/reviews/node-completion/manager-round-4.md and acceptance-round-4.md (generated local artifacts). Their conclusions and acceptance limits are reproduced here so this PR does not depend on access to those local files.

CI verification after fixes

Final head 2b836878fb85b7a77bbb32217c24b6cdd0c505e6 passed Compatibility, including aggregate CI, native iOS/Android embedding, and all three CodeQL analyses. No checks are failing or pending.

The CI follow-up adds a directly resolvable crypto Wasm declaration, separates browser-only VFS/module setup from the real-workerd test entry without removing cases, and directs APT (including the hosted runner mirror list) to Ubuntu's HTTPS archive to prevent dependency-download timeouts. Test requirements and timeout limits remain unchanged. Local regression also passed the Workers Node contract, 66 Chromium/WebKit runtime tests, eight browser tests, and demo typechecking.