TECHNICAL ARTICLE

Eber Cruz — Software Engineer | C-FARARONI Project
February 2026 · Architecture Notes
Fararoni Ironclad: Defense in Depth for LLM Coding Agents

The integration of Large Language Models (LLMs) into automated software engineering promises to accelerate development, but introduces critical risks due to the stochastic nature of these models. A persistent problem is "destructive hallucination", where the model truncates files, deletes existing business logic, or inserts placeholders (e.g., // ... rest of the code) during refactoring operations. Current approaches based exclusively on prompt engineering prove insufficient, with observed failure rates of up to 20% in production environments.

This article presents Fararoni Ironclad, a defense-in-depth architectural framework designed under Zero-Trust principles to guarantee code integrity at runtime. Our architecture implements a protection triad: (1) A kinematic cut mechanism (Kill-Switch) that uses Jaccard similarity metrics and volume preservation ratios to block destructive edits; (2) Transactional isolation through the Saga pattern applied to ephemeral Git branches; and (3) Instant physical recovery through atomic Shadow Backups. Empirical results demonstrate that this architecture reduces permanent data loss to 0% and blocks 99.99% of destructive hallucinations, transforming unreliable coding agents into resilient-grade secure tools for mission-critical systems.

Keywords: Code Integrity, LLM Hallucinations, Zero-Trust Architecture, Automated Refactoring, Defense in Depth.

The adoption of coding agents based on Generative Artificial Intelligence has transformed the software development lifecycle. However, the transition from code completion assistants to autonomous agents with file system write capability has exposed critical vulnerabilities in project integrity. Unlike syntax errors, which are easily detectable by compilers, LLMs are prone to semantic "destructive hallucinations": the silent deletion of class fields, the invention of file paths, or the substitution of complex logic with lazy completion comments.

1.1 Problem Statement

In high-security or "Military Grade" systems, implicit trust in the output of a stochastic model is unacceptable. Our research identified that, without architectural guardrails, an LLM can irreversibly compromise business logic. A case study on the CreditoBancario.java class revealed that a model could delete up to 57% of business fields (4 out of 7 fields) and rename critical identifiers during a routine operation, resulting in unrecoverable data corruption if no immediate backups exist. Conventional mitigation strategies, such as the "Conservation Law" through System Prompt instructions, demonstrated a 20% leakage rate, which is insufficient for high-value enterprise environments.

1.2 Limitations of Current Solutions

Existing code assistance tools (e.g., IDEs with integrated AI) often delegate final validation to the human user. However, in autonomous or semi-autonomous workflows, the user cannot audit every line of generated code in real time. Furthermore, the lack of integration between the security layer and the file service layer (FilesystemService) creates gaps where direct writes can bypass security validations.

1.3 Contribution and Proposed Solution

To address this challenge, we propose an architectural inversion of control: instead of trying to make the model perfect, we build a deterministic environment that makes it impossible to execute destructive actions. We present Fararoni Ironclad, an I/O architecture that implements the Zero-Trust principle through the Decorator pattern.

Our main contributions are:

1. Dual-Ring Kill-Switch Mechanism: A runtime decision algorithm that blocks writes based on volume preservation (ratio < 0.50) and Jaccard semantic similarity (similarity < 0.40), effectively filtering unauthorized substitutions and truncations.
2. Explicit Intentionality Protocol: A system that distinguishes between model errors and legitimate refactorings (such as dead code removal) by requiring explicit "destructive force" parameters (force_destruction), preventing blocks on valid operations.
3. Transactional Resilience: The integration of ephemeral Git branches (Saga Pattern) and automatic Shadow Backups, ensuring that any failure in the prevention layers is contained without affecting the main development branch.

2.1 General Vision: Protection Triad

2.2 Kill-Switch Algorithm: Decision Flow

2.3 Decorator Pattern: Security Layers

2.4 Sequence Diagram: Full Operation

3.1 Calculation Formulas

3.2 Empirical Results

4.1 Attack Scenario

The Fararoni Ironclad architecture demonstrates that it is possible to use LLM agents for automated coding tasks without compromising source code integrity. Through the implementation of deterministic guardrails across multiple layers, we achieved:

1. Proactive Prevention: 99.9% of destructive hallucinations are blocked before writing
2. Reactive Containment: 0.09% of escapes are contained through Git transactions
3. Guaranteed Recovery: The remaining 0.01% is recoverable via Shadow Backups

This architecture transforms unreliable LLM agents into resilient-grade tools suitable for mission-critical environments.

Eber Cruz is a software engineer with a decade of experience designing backend infrastructure and distributed systems. This document reflects the design work behind C-FARARONI, an experimental ecosystem focused on technological sovereignty and secure execution of local AI models.

Repository: github.com/ebercruzf/fararoni-ecosystem
Notes and contact: ebercruz.com