The Strongest Seal Available
A guard in front of the tool call has to enumerate: which commands can print, which arguments narrow the scope, which shapes count as a breach. Enumeration is where guards leak, and the leak is always some ordinary command nobody thought of.
There is one stage in this workshop where the whole category disappears. A reading pass — one that scores material rather than editing it — does not need to write anything. So the engine draws the sample itself and puts the actual text inline in the brief. The session never receives a path, never learns the directory layout, never learns that a sibling file exists at all.
Contamination stops being forbidden and becomes impossible. Nothing to point a tool at, nothing to refuse, nothing to enumerate.
Why This Only Works Sometimes
The prerequisite is strict: the stage must not have to write files. A stage that produces edits needs paths, and no amount of design removes that. So this is not a technique that replaces the guard — it is the technique available at the one place where the guard would otherwise be doing the hardest work, and recognizing that place is the skill.
The general form is worth stating on its own: look for the stage where the output does not have to be a file. Scoring, triage, review, classification, estimation — all of these consume material and produce a small structured verdict. Every one of them can be fed as text.
Two Things That Come With the Sample
If the engine is drawing, it inherits two responsibilities that a self-selecting reader used to hold, and both improve the result.
The draw is seeded and recorded. A reader who picks their own excerpts lets bias in through the front door, and a score you cannot re-draw is a rumor. A recorded seed makes a run repeatable on a corpus that has not moved.
The brief has to declare the population. If the target has fewer passages than the sample size, it is scored on all of them and the brief says so — because a total of twelve means something different at six passages, where it is a perfect score, than at ten, where it is a middling one, and the reader must not have to guess which.