Well, take cryptpad. The link could define the version of the code, and the browser could enforce that it never changes. everything else is communication with the server - something you can audit, given never-changing code. Bugfixes are of course prevented, but that just means you need to bake in a "check for updates" link - there's no reason that URL needs to change, just the contents at it, which you don't need to trust like the cryptpad's pad source.

How to achieve this, no idea. Or, several ideas, but nothing general enough ¯\_(ツ)_/¯