The Asymmetry That Breaks Every Post-Hoc Check
Writing and reading feel like a symmetric pair, and for enforcement purposes they are nothing alike. A write leaves a diff. A gate can compare the tree to its previous state and be certain that a file was not edited. A read leaves nothing the gate can reach: no diff, no timestamp you can trust, no artifact in the tree. An operating system can be instrumented to record every file open — that facility is real, and it sits outside the workshop; the gate has the repository and nothing else. The output of a session that read the forbidden file and the output of a session that did not are, structurally, the same kind of object.
So the gate that proves "no source-language file was modified" is true, cheap, useful — and completely silent on the question anyone actually cares about, which is whether the author looked. For a while that gate was treated as if it answered both. It does not, and the belief that it did is what let the problem run.
Three Incidents, One Cause
Over two days, three separate runs on this workshop broke the same seal, across two different authoring systems and two different work batches.
In the first, a cold reviewer listed the target directory to orient itself, and the listing printed the forbidden filenames. In the second, an over-broad search during review surfaced a title from a forbidden file. In the third, a sweep looking for leaked strings ran an unscoped search across a directory and printed an entire prose field from the forbidden sibling straight into the working context.
Not one of them was a deliberate lookup. Not one of them was a file-opening tool call — every single one was a shell command pointed at a directory without a filter narrow enough to exclude the sibling. And every one of those runs passed the write-diff gate green, because none of them wrote anything.
Three Occurrences Is a Missing Guard
One incident is an accident. Two is a pattern worth a note. Three, across two independent actors and two batches, is a structural finding: the rule was correct, understood, and unenforceable by the person holding it, because the breach happens through a tool whose default behavior is to be helpfully broad.
Notice how ordinary the breaching commands are. Nobody types the dangerous version because they are being reckless; they type it because it is the version that gets the answer, and the filter that would have made it safe is an optional flag that the task at hand gives no reason to remember.