How I built a production-hardened LLM API with HMAC-signed outputs and 30-pattern injection detection

I've been building on top of LLMs for a while, and one thing bothered me: nobody signs their outputs. You call an AI API, get back text, and you trust it. But what if something in the chain mutated that text? A caching layer, a CDN, a reverse proxy doing something unexpected? You'd never know. So I built OMEGA ARCHITECT — a FastAPI-based AI API that signs every response with HMAC-SHA256 and runs every input through 30 injection detection patterns before it ever reaches the model. Here's what I learned. Why HMAC on LLM outputs? Most APIs sign requests (inbound). HMAC on responses (outbound) is rare. The threat model: your LLM returns deterministic, structured text. If a middleware layer, a cache, or an active network attacker modifies that response, your user gets different content than what your server generated. With no signature, they can't detect this. The fix is simple: after generating your final response, compute HMAC-SHA256(signing_key, response_body) and include it in the respo