submilli / submilli-runtime

Execute agent-generated TypeScript in isolated WebAssembly, with runtime-enforced semantic permissions.