[Feat/Security]: Build Non-Invasive Layer-4 Wire-Level Input Sanitizer Intercepting Prompt Injections

Problem

Traditional LLM guardrails or prompt compliance proxies process validation checks entirely inside the user-space context application parameters layers [1.5]. This approach fails under high-concurrency enterprise cluster transactions because string parsing reflection blocks introduce heavy scheduling tail latencies that destroy our sub-2ms network hot-swap thresholds during multi-turn runtime failure events [1.5, 1.6].

Proposed Solution

Scaffold an ultra-low-overhead asynchronous packet content scanner filter under internal/security/sanitizer.go:

1. The Transport Boundary Interceptor: Hook directly into the Layer 4 transport socket boundary to snip outgoing chunk bytes on-the-fly without copying payload fields into heavy heap user-space memories [1.5, 1.6].
2. The Atomic Content Guard Regex Mesh: Build a thread-safe token checking buffer matrix utilizando native Go pointer atomic registers (sync/atomic) to immediately drop or redirect connections the millisecond adversarial prompt injection signatures cross the wire [1.5].

Use Case

Captures massive enterprise data governance budgets, providing system operators with absolute mathematical proof that FaultPlane blocks multi-tenant threat vectors at wire-speed natively [1.5].

Start by reading internal/security/sanitizer.go and mapping whether the repository exposes a Layer-4 transport socket entry point. Verify that the proposed interception boundary and sync/atomic approach are supported before implementation. Done should include a working sanitizer with reproducible tests demonstrating prompt-injection detection without violating the stated latency target.