Math proves no finite rulebook can fully vet AI-generated code — and characterizes exactly what gatekeepers can still guarantee

A formal impossibility result: no finite, machine-checkable whitelist AND blacklist can both be complete for safety properties like 'never leaks a secret' or 'always terminates.'

Imagine you're a building inspector. You can check that a house has smoke detectors (present, visible, done). But can you certify that a house will *never* catch fire? You'd need to watch it forever. This paper proves that the same asymmetry applies to AI code gatekeeping — and that it's not a limitation of current tools, but a mathematical wall. The committed claim: for any fixed, finite, machine-checkable rulebook that an AI gatekeeper uses to approve or reject programs, completeness on both sides — catching every unsafe program AND clearing every safe one — is impossible. Specifically, safety properties ("never do X") can be violated and caught by finite observation (you see the violation happen), but can never be confirmed safe by finite evidence (you'd have to watch forever). For confidentiality and liveness ("always eventually respond"), neither confirmation nor refutation is finitely settleable. The paper characterizes exactly which behavioral properties sit on which side of this line. The proof machinery is rooted in computability theory and the topology of observable behavior, drawing on classical results about the arithmetical hierarchy. The key technical move: any sound rulebook of n bits necessarily omits at least one compliant program of roughly n bits. This is not a vague "undecidability means things are hard" hand-wave — it's a precise, quantified incompleteness bound. You can make the rulebook bigger, but there's always a safe program that slips through the gap, and the gap scales with the rulebook itself. The authors then examine the obvious escape hatch: impose a time limit. If you bound execution time, everything becomes checkable — but only by running the program for essentially the entire time limit. A finite-time gatekeeper is technically complete but practically useless, because checking a program takes as long as just running it. This is a sharp distinction between decidability and feasibility that most AI safety discussions elide. What can a gatekeeper still do? The paper constructs a "best-effort" regime: not a verdict on every program, but a checkable list that contains everything the gatekeeper must allow and nothing it must refuse. Think of it as a curated menu rather than a universal filter. The constructive part of the result is arguably more useful than the impossibility: it tells system designers exactly what guarantees are achievable. Simulations on 2.2 million random programs and adversarial self-referential inputs confirm that the impossibility is adversarial, not typical. Most programs in practice are easy to classify. The hard cases are pathological constructions — but in security, adversaries build pathological constructions on purpose. The one error that longer testing never eliminates is the liveness component of confidentiality: you can never finitely confirm that a program will always eventually respond without leaking information. The paper is a single-author, 34-page formal treatment. It does not propose a new algorithm or system. It draws a permanent boundary around what any gatekeeping system — current or future — can achieve with finite, machine-checkable evidence. For the growing industry of AI agent sandboxing and code-review guardrails, this is the speed-of-light limit.