NeuroState as a Pre-LLM Execution Gate

Agentic LLM systems are vulnerable to cumulative prompt and context poisoning: an attacker can gradually drift the interaction into a risky state without triggering a single obvious injection signature. This paper tests whether a small stateful gate, NeuroState, can mitigate that risk when placed before dangerous execution decisions. We evaluate a CPOS-based ablation suite with fixed-rule Watchdog baseline conditions, CPOS-native NeuroState conditions, an external neurostate-engine projection, and action-sensitive WARN + EXEC gating. The main evidence comes from a deterministic harness with 100 repetitions per condition family over fixed attack and normal tapes. In that harness, the CPOS-native C4 policy achieves ASR 0.0000 and FPR 0.0000 while blocking the adaptive S4 attack through a WARN + EXEC rule. A separate benign executable workflow check over 1,000 repetitions also remains at FPR 0.0000. A smaller LLM-in-the-loop pilot provides supporting external validity, but the deterministic CPOS result is the main evidence path. We conclude that NeuroState is best framed as a pre-LLM execution gate rather than as another LLM judge.