The Refusal Engine

The shape is a policy layer: a request comes in, you route it to the refusers that apply, and you compose their verdicts into one yes/no with reasons. The refusers are built — you write the rulebook that decides which apply.

Start with one refuser and one rule. Add refusers as you find the bad moves you want to stop.

REFUSERS = [verify_skin, conflict_check, no_command]  # each returns (ok, reason)

def gate(request):
    verdicts = [r(request) for r in REFUSERS if r.applies(request)]
    refused = [why for ok, why in verdicts if not ok]
    return (not refused, refused)   # pass only if nobody refused; reasons shown

The five parts below walk it: conflict blocks broken merges, verify-skin blocks injection, switchboard structurally cannot carry a command, dwell won't let you commit without actually choosing. Bolted together they're a gate a person or agent must pass.

You supply the policy layer — which refusals apply to which request, and how their verdicts compose.

Every gift here is visibility, not immunity, and the recipe is honest about it: ward checks the witness agrees, not that you picked the right witness. conflict catches the standard marker triad, not a custom conflict format. verify-skin proves a value can't break out of a CSS declaration, not that it's semantically safe.

The gate is only ever as good as the rules you feed it — and it says so, which is the point. A refusal engine that pretended to catch everything would be the most dangerous thing on the list.

For real use: make every refusal's reason inspectable (a silent no is undebuggable), and treat the rulebook as the actual security surface — that's where your review effort goes, not the refusers.