Thriving 
RS Native Rust runtime for adversarial JavaScript/TypeScript extension workloads: native-only core execution (no V8/JSC/QuickJS), deterministic replay of high-impact decisions, and Ed25519-signed evidence for every containment action. Research-grade; automation ships advisory-only.
// readme
A native Rust runtime for adversarial JavaScript/TypeScript extension workloads, built around four constitutional rules: native-only core execution (no V8/JSC/QuickJS bindings), deterministic replay of high-impact decisions, signed evidence for every containment action, and claim-language that cannot exceed its evidence.
Each rule pays for itself by closing a class of failure that binding-led runtimes cannot close cheaply.
| Rule | Failure class it closes | Concrete mechanism |
|---|---|---|
Native-only core execution (Charter §2) | Binding-led runtimes ship with megabytes of upstream unsafe C++/Zig that is outside the IFC/capability algebra. Retrofitting type-safe authority membranes around them is structurally lossy. | The lowering pipeline owns parser-to-scheduler semantics in Rust with #![forbid(unsafe_code)]. IFC labels are computed at IR2; capability checks gate every hostcall edge. |
Deterministic replay (Charter §3) | Streaming policy decisions made under wall-clock pressure are not reproducible from a postmortem. Forensic causation breaks. | Replay captures the IR3 program, policy snapshot,… |