One partial answer is to not make it a single brain. If the reasoning layer that evaluates a request is independently audited by a second pass at lower temperat

One partial answer is to not make it a single brain. If the reasoning layer that evaluates a request is independently audited by a second pass at lower temperature with an explicit skepticism mandate, compromising the evaluator requires compromising both passes simultaneously — and they're running the same local model with different system prompts and no shared state between them. Doesn't eliminate the attack surface but raises the cost considerably compared to a single inference gate.