feat: establish PR 9 full-JavaScript protection contract

[owengregson]

Summary

• stack PR 9 on PR 8 and replace the compatibility claim with an explicit no-pass-through qualification contract
• broaden canonical visitor inventory for dynamic import attributes, direct eval, private members, logical assignment, classes, and async iteration while failing closed on known-unsound forms
• harden effect-graph verification against operation, operand, origin, signature, entry, count, exit, candidate, and witness tampering
• constrain the current certificate to honest canonical-graph-only evidence; it explicitly does not claim emitted-artifact protection
• add a required red product gate proving that PR 8 still emits and reports a native lane
• make the final Isogloss-versus-frozen-VM benchmark release-blocking and repair its strict protection qualification

Qualification status

This is deliberately a draft and is not a claim of completed full-JavaScript protection. The public transform still calls the PR 8 source-region pipeline, and the no-native-lane gate correctly fails because nativeRegionCount is 1. There is no emitted general BPRF regional runtime yet.

The implementation and release contract is in docs/superpowers/specs/2026-07-25-pr9-full-javascript-protection-plan.md. Its kill criteria forbid relabeling the former VM, retaining native source, or turning a per-operation interpreter into Isogloss.

Final architecture benchmark

After language and protection qualification is complete, the release must publish versioned raw JSON and a reviewed report comparing native JavaScript, fully protected Isogloss, and the frozen pre-PR-6 VM. Categories include build phases, cold bootstrap, first and warm P50/P95/P99 execution, throughput, raw/gzip/Brotli artifact and package sizes, peak and retained memory, scaling, language/host workloads, custody costs, and attacker-amplification efficiency.

The release command is bun run bench:architectures:release. It excludes all native, hybrid, partial, unsupported, and uncertified rows from protected performance comparisons. Today it correctly rejects PR 8 because no emitted-artifact certificate exists; the diagnostic quick harness reports 0/9 qualified Isogloss workloads.

Validation

• bun run typecheck: pass
• bun run build: pass
• bun run test: 233 pass, 1 fail
• bun run bench:architectures -- --quick --legacy-preset default: pass
• bun run bench:architectures:release -- --quick: expected fail-closed on missing emitted-artifact protection
• the sole test failure is the new mandatory no-native-lane product gate

Security boundary requiring a product decision

A fully client-resident JavaScript artifact cannot provide absolute secrecy against an attacker with full artifact/runtime access. The local profile can target exact, non-bypassable Isogloss mediation and analysis amplification. Client incompleteness requires a mandatory custodied, private-function, threshold, or TEE trust domain with no local fallback. The draft does not invent that deployment choice or make a false absolute-security claim.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None