test(loader): INT-02 — prove + regression-lock the host-agnostic loader bridge

[hyperpolymath]

INT-02 — host-agnostic loader bridge: proven + regression-locked

Refs #179 (not Closes — owner-gated; the affinescript-dom-loader
satellite shell is downstream). The #244 pattern: the substrate was
already built + merged; this supplies the guarantee.

State found

packages/affine-js/loader.js already implements all four INT-02 pieces
(host-agnostic readBytes, multi-namespace buildImportObject,
parseOwnershipSection, detectHost Deno/Node/browser); mod.js
consumes it — SAT-02 is gone. But:

• loader_test.js (14 tests) had no run task — green only with the
  right --allow-read/--allow-write; a naive run looked "1 failed" (a
  permission error, not a loader bug).
• Nothing proved the loader on real compiler-emitted wasm — the unit
  tests use synthetic bytes; the INT-01 xmod-link harness still
  hand-rolls Deno.readFile + a manual import object (the SAT-02
  anti-pattern the loader exists to replace).

This PR locks it in

Layer	Where	Result
14 unit tests, pinned	packages/affine-js/deno.json → deno task test	14/14 reproducible
Real-wasm e2e via the actual loader API	tests/modules/loader-bridge/ (bridge.mjs+run.sh+README)	PASS

bridge.mjs compiles the INT-01 fixtures and uses readBytes +
buildImportObject to link CrossCallee.consume(42) = 42, then
parseOwnershipSection reads a real Linear-param entry from
compiler-emitted wasm — closes INT-01 ↔ INT-02.

Finding (in the harness README)

buildImportObject spreads module members (merge-not-clobber), so a
catch-all Proxy WASI stub must be attached as a whole namespace, not via
the spread — mirroring real usage (host owns wasi; the loader owns the
affine runtime + cross-module namespaces).

Scope

Ledger truthed: ECOSYSTEM/TECH-DEBT INT-02 → PROVEN+locked, SAT-02 →
FIXED. No compiler change (loader is JS); the hermetic dune gate is
unaffected by construction (docs + deno.json + harness only; dune build clean). Reproducible harness kept out of the hermetic gate by
design (needs a wasm engine + deno), like tests/modules/xmod-link.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 47 issues detected

Severity	Count
🔴 Critical	12
🟠 High	21
🟡 Medium	14

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence