Your goal seems to be ultimate protection against decompilation. This can't be achieved if some form of code is executed on an (from your point of view) untrusted client computer.
You touched on a scenario that would involve run-time downloading of compiled code to the client. This is no more secure than offering a static executable as download:
- A cracker could capture the communication between the client and the server. This would allow him to capture the downloaded program, or issue fake requests. This can partially be limited by using encryption and by authentification, both of which can be circumvented.
- A cracker could inspect the downloaded program if it is stored in a tempfile or similar storage.
- Also, the client machine is fully under the clients control. He can inspect memory, run your code under debuggers, modify libraries and use a plethora of orther techniques to defeat your attempts to conceal your code.
From the clients perspective, downloading instructions for each execution of the application is bad UX. First, an internet connection is required, which is not always a given. Second, this can introduce latency. Finally, it is hard for the client to verify that this code comes from a trustworthy source, and that no malicious code was injected.
Basically, you are trying to invent the horror of Java Applets, with none of the upsides.
If you want absolute certaincy that no one can access any form of your code, you cannot execute it on client resources. Instead, create an API which can be accessed from the Web, but performs all calculations on a server under your control. Clients can invoke your code via a web interface, or from a native client that doesn't include any code that has to be protected.
If you are into games, you may want to look at the horror of the “Sims City” reboot that that partially used this model. Some calculations were supposed to be deferred to central servers, which had problems to cope with the demand. This seemed to punish the honest users who payed for the software, while within weeks exploits became known to run the game without a constant connection to the servers.
If you are really paranoid, the Cloud may not be a good option for you: Who says those VMs can be trusted? Might as well maintain your own servers. But wait, what if somebody steals backups? …
This can be continued ad absurdum. Quite likely, nobody wants to steal your code. The best defense against decompilation is an EULA drafted up by a lawyer that forbids such usage of your software, and sufficient funds to enforce this license agreement.
Also note that there are companies which give away or sell software under free licenses that encourage decompilation (e.g. the GPL), but which are yet to go bankrupt. Examples are Linux vendors like Red Hat.