The measured-claims gate (issue #4) asserted the exact per-run webcrypto boundary call vector — 6 calls per role per demo run: 1 keygen, 2 signs, plus the export and option getters — by instrumenting the jco host's transpiled module (crypto_row in scripts/bench.sh, removed with the jco host leg).
The property is host-independent (the guest call sequence is deterministic); only the measurement technique was jco-specific. Candidates for reinstating it:
- host-deltic: wrap the sibling webcrypto module's import record with counting proxies before
instantiate — the import surface is a plain record, so this is a few lines in an exam/bench harness.
- host-wasmtime: a counting layer in the host-crate wiring.
Until one lands, the boundary call-count budget is unasserted (the latency/throughput budgets remain in force).
The measured-claims gate (issue #4) asserted the exact per-run webcrypto boundary call vector — 6 calls per role per demo run: 1 keygen, 2 signs, plus the export and option getters — by instrumenting the jco host's transpiled module (
crypto_rowin scripts/bench.sh, removed with the jco host leg).The property is host-independent (the guest call sequence is deterministic); only the measurement technique was jco-specific. Candidates for reinstating it:
instantiate— the import surface is a plain record, so this is a few lines in an exam/bench harness.Until one lands, the boundary call-count budget is unasserted (the latency/throughput budgets remain in force).