hadn't heard of breakapp! paper author Nikos Vasilakis also contributed to Mir (https://github.com/andromeda/mir).

This is similar to my work on LavaMoat (https://lavamoat.github.io/) which provides runtime supplychain security protections to js apps (nodejs or browser) by eliminating ambient authority and only exposing global capabilities per npm package according user-specified policy. LavaMoat is used in production at MetaMask, protecting ~300M users.