Ondos — the injection-safe language. Here prompt injection isn't detected, it's unrepresentable: untrusted input must cross extract<ClosedType> before it can reach an effect. check proves it at compile time; the compiled binary re-clamps at run time.

Pump controller

Untrusted input is a request; it can only ever become one of a fixed set of decisions over a closed type, never a tool argument. An injected instruction cannot be represented in the closed type, so it is rejected — proven at compile time by check, and clamped again at run time by the extract domain check.

• Untrusted input: fetch<web> — a request
• Closed type: type Decision = RunPump(Pump) | StopPump where Pump is closed
• Sink / capability: grant runPump → privileged { runPump(d) }
• Consequence axes: Trust

Run the demo

examples/apps/pump-controller/demo.sh

The safe agent proves SAFE, runs on a benign input, and rejects an injection payload at the trust boundary (exit 3). The vulnerable version proves UNSAFE — it never compiles to a runnable agent.

Files

• pump-controller_safe.wave — the correct design.
• pump-controller_unsafe.wave — the tempting-but-wrong version (the negative example a model must learn to reject).
• ondos.toml — the project manifest (each app is a self-contained Ondos project).

---

_{Part of the Ondos example corpus — 200 self-contained, injection-safe projects. Built with Ondos, a language whose type system makes prompt injection structurally impossible. Run ./demo.sh with the Ondos toolchain on your PATH.}