A Fail-Closed Admission Gate You Can Embed: Three-Valued Verdicts, a Generated Rust Crate and an Import-Free WASI Component

Pitch

An admission gate whose non-refusing answer is deliberately not "admitted", generated from a self-hosted spec, drift-gated byte for byte, and packaged as a WASI component with an empty import section so the verdict is a deterministic function of its arguments (determinism only; termination and memory rest on the resource bounds).

Abstract

Systems that let an agent author code need a check they can call in their own process. Common embeddable policy engines return allow or deny, and a host that reads "no deny" as "allow" fails open. We describe revl's embeddable admission gate, built around the opposite default. The verdict type of the Rust crate and the wasm component has three arms, Refused, NoObjection and OutsideFrontier, and no admitting arm: their wire form reports admitted:false on every arm (the Python revl.gate.Verdict is a separate surface that does admit), so a consumer written against a two-valued shape reads the gate as "never admits" instead of misreading silence as approval. The Rust and wasm gate is a refuse-only layer that, on its covered corpus (the composition and guarantee layer, plus one slice of the type layer in Rust), never admits what the reference refuses; in one measured 12-candidate batch it returns no-objection for 4 of the 8 candidates the reference refuses, which is the tolerated direction. A separate type, reachable only after NoObjection and only inside a deliberately small admission surface, can issue an admission. The Rust crate is generated from the self-host compiler sources and committed, and a test regenerates it and fails on any byte difference (tests/test_gate_crate_drift.py:47; CI wiring not checked). The same crate is packaged as a WASI-P2 component whose import section is empty, so no clock, file system or random source can change a verdict, and a test checks the built binary rather than the interface. We state the gate's threat model (an agent author whose code disagrees with its advertised effects) and its non-goals. We also report what it costs: the Python facade admits a representative candidate in a median 0.165 ms, whereas the Rust form measures 7.1 ms on a 276-byte candidate and grows super-linearly, which we attribute to the emitted front end. We report no wasm latency.

Problem and claim

An embedder (an MCP server, a CI step, an edge worker) wants a local, in-process verdict on agent-generated code. Two failure modes recur. A gate that is permissive on its blind spots admits what the full compiler would refuse. A gate that is correct but reachable only over a subprocess or network hop is too slow or too far from the host to sit inside an agent loop.

The claim has three parts. (1) Verdict design: with no admitting arm on the verdict surface, "this gate found nothing it can refuse" cannot be confused with "admitted", and the unsafe divergence direction (admitting what the reference refuses) is closed on that surface by having no admitting arm; on the separate admission surface it is checked by a test on the covered corpus, not proved. (2) Provenance: a gate generated from the self-host spec and committed with a regenerate-and-compare gate cannot drift silently from its source. (3) Determinism, not termination: a component with an empty import list is a deterministic function of its arguments, and that is checkable from the artifact.

The claim is not that the gate is complete, fast in every form, or sufficient for safety. The dependency contract says the gate "never confines its host" and that admission is a compile-time judgment scoped to the frontier.

Contributions

1. A three-valued verdict (Refused, NoObjection, OutsideFrontier) with no admitting arm and admitted:false on every wire arm, plus a separate Admission type reachable only after NoObjection and inside a stated admission surface.
2. A two-layer API: layer 1, pure verdict functions that reproduce the reference verdict verbatim on the Python tier; layer 2, a stateful Gate session facade that fails closed.
3. A generated Rust crate with a derived (not hand-listed) frontier table, resource bounds that turn stack-exhaustion inputs into refusals, and a byte-drift CI gate.
4. A WASI-P2 component built for wasm32-unknown-unknown so that its import list is empty, with a test that reads the built binary's import section.
5. A four-clause dependency contract and a gate threat model with non-goals and an offensive test suite.
6. A measured cost profile for the Python and Rust forms, including the negative result for Rust.

Related work

Citations to be checked: eBPF verifier documentation and Gershuni et al. PLDI 2019 (citation to be checked); Cedar (Cutler et al., OOPSLA 2024) (citation to be checked); Haas et al. PLDI 2017 for WebAssembly (citation to be checked); Klein et al. SOSP 2009 for seL4 (citation to be checked).

Evidence on main

Numbers that exist

• Python in-process admission, compile_source(candidate, manifest=running): median 0.165 ms, p90 0.179 ms, p99 0.659 ms, n = 4000; compile-only baseline median 0.149 ms; gate share about 0.015 ms. Apple M1 Max, Python 3.14.3. Source: bench/results/admission-latency.md (Result and Methodology). This is the Python facade, and the scenario is one candidate of two declarations (a service and a component) against a running composition of two components (bench/admission_latency.py).
• Python size sweep: medians 0.409 ms (small) to 3.435 ms (large, 48 methods), n = 400 per cell; the representative scenario re-measured at 0.276 ms. Source: bench/results/inprocess-gate.md (cost table and headline).
• Rust form, one revl_gate::admit call: median 7.239 ms (218 B), 79.898 ms (636 B), 935.718 ms (2364 B), n = 25 per cell; representative 276 B scenario median 7.125 ms, p99 42.275 ms. The file says "super-linear", that cost "tracks TOKENS", and "Do not quote a single figure from this table as 'the rust gate's latency'". Source: bench/results/inprocess-gate-rust.md, "Cost" section.
• Rust agreement: of 8 candidates the Python gate refuses, the Rust gate refuses 4 (same code and sentence); the other 4 return NoObjection. Source: same file, "What the screen catches, measured". Batch size 12.
• wasm form: no latency number and no component size number exist yet.
• Test counts (functions, not expanded): tests/test_gate_crate_drift.py 19, tests/test_gate_wasm_vector.py 13, tests/test_adversarial_gate.py 28, tests/test_gate_verdict_parity.py 12.

Paper outline

1. Motivation: embedding a check in an agent loop; the fail-open reading of "no deny".
2. Design: the three-arm verdict, the separate admission type, the dependency contract.
3. Generation and drift: self-host spec to Rust crate to component; the regenerate-and-compare gate.
4. The empty import section: what it proves and what it does not (traps, aborts, host obligations).
5. Evaluation: agreement, cost per form, size, adversarial suite.
6. Limits and related work.

Threats to validity and limits

• The non-refusing arm is explicitly not an admission. A host that must admit still needs a reference verdict, except inside the small admission surface on the Rust tier (crates/revl-gate/README.md:99-127). The wasm tier has no admitting arm at all (docs/gate-dependency-contract.md:17-24).
• The wasm gate does not run the reference type layer (crates/revl-gate-wasm/README.md:14-19). The Rust crate runs one slice of it, the fn-body statement layer (crates/revl-gate/README.md:60-64), and its README gives a concrete example the reference refuses and the gate does not.
• Four of eight reference-refused candidates in the Rust batch pass as NoObjection. The design tolerates this direction; a reader will still count it as low recall.
• The Rust form's cost is milliseconds and super-linear, measured with --iters 25 on a shared machine, and the bench file warns the medians "move by a FACTOR of a few between runs". The cost is attributed to the emitted lexer and parser (a declaration-heavy 1212 B input at 225 ms against a comment-padded 1248 B input at 8.7 ms, n = 6); a profile of the emitted front end has not been done, and the measured Rust form does not meet the sub-millisecond edge goal stated in docs/design/335-wasm-edge-gate.md.
• The empty-import property makes the verdict deterministic, not sound. It gives no termination or memory bound; the resource bounds cover those. Soundness rests on agreement with the reference, measured on a fixed corpus and a 12-candidate batch, not at scale.
• A wasm trap is not a verdict; correctness of the failure path is a host obligation.
• The gate "defends the declaration, not the runtime" and does not sandbox host code (docs/threat-model.md:113-135).
• The offensive suite targets the reference compiler; it has not been run against the Rust and wasm forms.
• No measured baseline against Cedar or OPA-Wasm exists.
• Nothing is published; no external user has depended on it. The .wasm is not committed, so reproducibility of the binary is by source pin and conformance vector only.
• The corpus and the offensive suite were written by the project itself.

Fact-check

Claims in this draft were checked against revl main at commit 45bec431f: 28 checked, 9 corrected.

Cite this draft

@misc{revlp44,
  author       = {Thomas Moussajee},
  title        = {A Fail-Closed Admission Gate You Can Embed: Three-Valued Verdicts, a Generated Rust Crate and an Import-Free WASI Component},
  year         = {2026},
  howpublished = {\url{https://inso1337.github.io/revl/research/P44.html}},
  note         = {Research draft, not peer reviewed. Written against revl commit 45bec431f. Licensed CC BY 4.0.}
}

Text licensed CC BY 4.0, author Thomas Moussajee.