Ondos — the injection-safe language. Here prompt injection isn't detected, it's unrepresentable: untrusted input must cross extract<ClosedType> before it can reach an effect. check proves it at compile time; the compiled binary re-clamps at run time.

Function-calling router

Untrusted input is a model tool-call; it can only ever become one of a fixed set of commands, never a tool argument. An injected instruction cannot be represented in the closed type, so it is rejected — proven at compile time by check, and clamped again at run time by the extract domain check.

• Untrusted input: fetch<web> — a model tool-call
• Closed type: type Tool = Search | Calculator | Weather, then type ToolCall = Use(Tool) | Refuse (a payload-carrying variant — the payload is closed too)
• Sink / capability: grant invoke → invoke(call)
• Consequence axes: Trust

Run the demo

examples/apps/function-router/demo.sh

The safe agent proves SAFE, runs on a benign input, and rejects an injection payload at the trust boundary (exit 3). The vulnerable version proves UNSAFE — it never compiles to a runnable agent.

Files

• function-router_safe.wave — the correct design.
• function-router_unsafe.wave — the tempting-but-wrong version (the negative example a model must learn to reject).
• ondos.toml — the project manifest (each app is a self-contained Ondos project).

---

_{Part of the Ondos example corpus — 200 self-contained, injection-safe projects. Built with Ondos, a language whose type system makes prompt injection structurally impossible. Run ./demo.sh with the Ondos toolchain on your PATH.}