Ondos — the injection-safe language. Here prompt injection isn't detected, it's unrepresentable: untrusted input must cross extract<ClosedType> before it can reach an effect. check proves it at compile time; the compiled binary re-clamps at run time.

Chatbot command parser

Untrusted input is a chat message; it can only ever become one of a fixed set of decisions over a closed type, never a tool argument. An injected instruction cannot be represented in the closed type, so it is rejected — proven at compile time by check, and clamped again at run time by the extract domain check.

• Untrusted input: fetch<web> — a chat message
• Closed type: type Decision = ChatCmd(BotCmd) | IgnoreChat where BotCmd is closed
• Sink / capability: grant runChat → using runChat { privileged { runChat(d) } }
• Consequence axes: Trust, Capabilities

Run the demo

examples/apps/chatbot-command/demo.sh

The safe agent proves SAFE, runs on a benign input, and rejects an injection payload at the trust boundary (exit 3). The vulnerable version proves UNSAFE — it never compiles to a runnable agent.

Files

• chatbot-command_safe.wave — the correct design.
• chatbot-command_unsafe.wave — the tempting-but-wrong version (the negative example a model must learn to reject).
• ondos.toml — the project manifest (each app is a self-contained Ondos project).

---

_{Part of the Ondos example corpus — 200 self-contained, injection-safe projects. Built with Ondos, a language whose type system makes prompt injection structurally impossible. Run ./demo.sh with the Ondos toolchain on your PATH.}