CPOS-H as a Layered Pre-LLM Execution Gate

Agentic LLM systems are vulnerable to cumulative prompt and context poisoning: an attacker can gradually drift the interaction into a risky state without triggering a single obvious injection signature. This report evaluates CPOS-H, a layered pre-LLM execution gate that combines a lightweight NeuroState drift signal with action-sensitive execution gating, SDE provenance/trajectory checks, a rule-based Shadow Auditor, NEMA-style egress preconditions, and Fresh Import Quarantine. The main evidence comes from a deterministic harness with 100 repetitions per condition family over fixed attack and normal instruction tapes. In that harness, CPOS-H (H) blocks all evaluated AI-native contamination scenarios S1-S17: ASR 0.0000 over 1,700 attack trials and FPR 0.0000 over 6,400 reviewed normal trials. This is a fixed-tape runtime-control result, not a universal security guarantee for all prompt injection or all natural conversations. The report frames NeuroState not as a validated six-dimensional psychological model, but as a structured external state coordinate system whose operational effect can collapse into a low-dimensional interaction-drift signal. This black-box runtime framing complements white-box representation-engineering work showing low-dimensional safety and refusal directions inside model activations. CPOS-H uses the external drift signal operationally, without activation access, before dangerous execution.