Replace legacy VM execution with fail-closed Isogloss

[owengregson]

What changed

• Replaced the shipped VM transform with guarded Isogloss source execution. Accepted pure return regions are lowered into scalarized 3×3 BPRF realizations with exact runtime domain guards; configured failures stop the build and never retain the original relation as fallback.
• Physically removed the VM runtime, interpreter/loader, bytecode encoder and encryption backend, opcode mutation/shuffle infrastructure, legacy presets/options, manifests, benchmarks, and execution-specific tests.
• Added canonical semantic IR/CFG, effect-delimited region planning, sound direct-call evidence, exact pure-region lowering, and constructive black-box learnability upper-bound gates.
• Added statefully masked moving-cover custody, fixed 4/8/16/32 transcript buckets, keyed rejection-sampled placement, owner/client schema separation, and fail-closed product planning for local, custodied, private-function, and attested profiles.
• Cut the public API, package identity, CLI, browser worker, playground, website copy, and README over to Isogloss. Nonlocal profiles require a real owner-proven boundary and forbid a complete local fallback.

Threat-model constraints

holographic-local is intentionally reported as client-complete with hardnessLowerBound: null. It raises analysis cost but does not claim secrecy against unrestricted execution/instrumentation. The known exact degree-9/three-input oracle attack remains 220 queries. Custodied/private/TEE modes are admitted only through the owner planner with the required real boundary/capabilities.

The custody attack harness confirms corrected hidden placement is not empirically distinguishable above its declared baselines (46.35% full classifier vs 50% binary chance; 25.78% stage-count classifier vs 25% chance), while honestly retaining declared bucket leakage.

Root causes fixed during cutover

• Late discovery of a source input shifted already-emitted step references. The compiler now freezes the complete ingress prefix before assigning step references, with a permanent multi-stage reproducer.
• The public planner imported a server/reference custody module just to obtain transcript bucket constants. Bucket classes now live in a dependency-free product module, and the package-entry isolation test proves reference evaluators/custodians remain unreachable.

Validation

• bun test: 179 passed, 0 failed, 34,277 assertions
• bun run typecheck: passed
• package bun run build: passed, including declarations
• browser worker rebuild: passed
• web bun run typecheck && bun run build: passed, static export generated
• built package API/CLI smoke tests: passed
• npm pack --dry-run: 6 expected files, 59.8 kB tarball
• full local benchmark: checksum agreement; 25.061 ms build, 211.69× size expansion, 56.80× steady-state runtime overhead for the guarded kernel (engineering cost only, not a hardness claim)

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/ci.yml

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.