Confinement by Construction: Capability Surfaces Derived from an Architecture Model

Architecture models in mainstream use describe what a system's components may do; they do not constrain it. This paper reports a demonstrator in which the model constrains the artifact mechanically. The primary artifact is a signal graph — a functional reactive program in which each node declares its authority as typed capability handles in a with clause — and a node's with clause determines the set of interfaces its compiled WebAssembly component may import: derived from the graph and checked against the built binary, so a world that over-grants fails the build rather than shipping. Because the components carry no WASI adapter, they import no filesystem, socket, environment, or clock function their clause does not grant, so confinement to the granted interfaces is a property of the artifact rather than of how a host happened to configure it — a distinction we found only by building the tier twice. Alongside it, a trust lattice with no upward coercion, applied uniformly to edges and node bodies, rejects trust laundering that type-checks on every edge, and an evaluation harness pins each rejection to the check that must produce it. A capability-boundary crossing costs tens of microseconds while marshalling typed values. The design was frozen at its last state before the executable demonstrator was built, and we report the artifact against its 24 predictions without revising them: 3 substantiated at the demonstrator's scale, 10 only under restrictions the vision did not attach, 4 still conditional, and 7 not attempted — together with two design corrections building forced, each legible as a correction only because the pre-build text survives with its predictions unamended. We are explicit about what does not follow. The mutation corpus is curated, so its counts are not a soundness result, and no noninterference proof is attempted; the host tier's escapes are recorded as passing tests rather than omitted; prompt injection is attenuated, not eliminated — adversarial text survives in a permitted free-text field even on the confined tier, and what bounds the damage is the capability scope rather than the type or the sandbox; and trust is declared rather than inferred, so content a capability returns reaches the lattice unlabelled.