The problem this time: every "can the AI see this data" conversation turns into a policy document or a system prompt telling the AI not to look. Instructions like that are hopes, not guarantees. What I wanted instead was a structural answer — raw data and AI tools never in the same folder, period, provable from the folder structure itself rather than from a document saying so. So: a raw source folder no AI tool is ever pointed at, a plain deterministic script as the only bridge, and an output folder that's the only thing AI gets to read. I added one more piece after reading through another open-source tool's code (AI Airlock) and noticing a gap in my own first version: nothing was checking that the script's redactions actually held in what it wrote out. Now every run verifies its own output against the raw values it touched, and writes a receipt — pass/fail, a checksum, and an explicit line that passing verification isn't the same as a human clearing the data for use. That part stays a real decision, made by a person, recorded separately. Built it out properly last night — worked examples, tests, a scaffolding script, CI. First CI run caught two real Windows-only bugs I wouldn't have found otherwise, which was its own good reminder that "works on my machine" isn't a claim worth much. It's private for now — not ready for me to just drop a public link and walk away from. But I'd like a few people to actually use it on a real case and tell me where it breaks, before I open it wider. If that's you: comment here or DM me your GitHub username and I'll send an invite.