The Strongest Seal Available
A guard in front of the tool call has to enumerate: which commands can print, which arguments narrow the scope, which shapes count as a breach. Enumeration is where guards leak, and the leak is always some ordinary command nobody thought of.
There is one stage in this workshop where most of that category recedes. A reading pass — one that scores material rather than editing it — does not need to write anything. So the engine draws the sample itself and puts the actual text inline in the brief. The session is never handed a path, never told the directory layout, never told that a sibling file exists at all.
Contamination stops being one ordinary command away and becomes something the session would have to go looking for. Nothing in its context to point a tool at, nothing for the guard to enumerate on the brief's behalf. It is not impossible — the session still has tools and a filesystem, which is exactly why the guard stays armed — but the road the brief used to hand over is gone.
Why This Only Works Sometimes
The prerequisite is strict: the stage must not have to write files. A stage that produces edits needs paths, and no amount of design removes that. So this is not a technique that replaces the guard — it is the technique available at the one place where the guard would otherwise be doing the hardest work, and recognizing that place is the skill.
The general form is worth stating on its own: look for the stage where the output does not have to be a file. Scoring, triage, review, classification, estimation — all of these consume material and produce a small structured verdict. Every one of them can be fed as text.
Two Things That Come With the Sample
If the engine is drawing, it inherits two responsibilities that a self-selecting reader used to hold, and both improve the result.
The draw is seeded and recorded. A reader who picks their own excerpts lets bias in through the front door, and a score you cannot re-draw is a rumor. A recorded seed makes a run repeatable on a corpus that has not moved.
The brief has to declare the population. If the target has fewer passages than the sample size, it is scored on all of them and the brief says so — because a total of twelve means something different at six passages, where it is a perfect score, than at ten, where it is a middling one, and the reader must not have to guess which.