Schema Laundering: Embodied Safety Gates — Audit the Rule and Trust the Rewriter

Embodied agents act on the world, so a command that slips past screening does harm no later correction undoes. The common defence is a typed gate: a language model rewrites each command into fixed fields and a table decides, so the decision is auditable. Such gates are reported against undefended agents, never against their own policy read as prose, which confounds structure with policy. Holding the policy fixed and varying only its form, a single prose reading of the gate's own policy is better by more than the pre-declared margin and buys no measurable precision; the loss concentrates in euphemised rewrites. A typed gate decides not by its rules but by when the rewriter chooses a field, so a paraphrased command is filed as harmless before any rule runs. We call this schema laundering: the protection lives in the policy, not the structure. We build \telos, a training-free command gate under one rule: any signal adds a block, only perceived evidence releases one, and an unseen named object routes to a third outcome, \observe. Read safety-first (a $90\%$ hazard-recall floor), it matches a $2026$ fine-tuned guard's recall at lower over-block and holds that over-block off the training distribution, where the fine-tune blocks $58$–$71\%$ of benign tasks. Its edge is an unforgeable release that lifts only on perceived normal-use evidence an attacker cannot fabricate, giving the lowest adaptive-attack success; the residual $6\%/18\%$ leak is in the harm judge, not the rule. As embodied and agentic systems spread, a training-free gate that stays robust under adaptive rewording and ports across scenes is a practical route to auditable physical-action safety, and a typed safety layer should be audited against its own policy in prose before its structure is credited.