← All writing

Build log

How my AI inventoried 1,671 sensitive files without reading one

Aug 14, 2026

My complete career evidence archive holds employer reviews, transcripts, and legal and financial records. The AI-built tool that governs its integrity is allowed to ask each file exactly three questions: path, size, modified time.

My AI keeps a verified inventory of 1,671 sensitive files without opening one. The tool it runs is only allowed to ask each file three questions: path, size, modified time.

Most AI privacy is a promise not to look. A promise is prose, and prose doesn't bind an agent; I've measured how often mine ignores written rules. So when the job was taking custody of my complete career evidence archive, just over 2.1 GB of employer reviews, transcripts, and legal and financial records, I didn't write "don't read the files" and hope. I had the AI build an inventory tool for which reading a file is not one of its operations.

How can you trust an inventory that never opens the files?

Because integrity lives in metadata, and metadata is enough to prove presence, absence, movement, and drift. The archive was reviewed once, in three bounded cohorts of 1,587, 47, and 37 files. Each review produced a frozen register of what it observed, pinned by SHA-256 hash (a fingerprint of the exact bytes): nine pinned fingerprints the processor re-verifies before trusting a single row. Those registers are the only inputs it parses.

For the raw sources themselves, the processor performs a stat: the file-system call that returns a file's path, size, and last-modified time. Nothing else. The script's own docstring is the contract: it never hashes, parses, or opens the body of any raw career, employer, property, academic, or resume source.

The frozen seed register is never rewritten to look current. Files move; a live archive keeps living. Instead, a deterministic reconciliation (same inputs, same output, no judgment calls) explains every difference between the seed and today's tree: audited moves, later additions, one file with a second copy, one disposed as non-career metadata. The relocation rules are deliberately narrow. Each maps an exact audited path prefix to an exact destination and answers nothing outside its range — no fuzzy matching, no searching by size until something plausible turns up. When the processor can't bind a file, it stops and demands "an authoritative metadata-only binding manifest instead of guessing." That error message is the whole philosophy in one sentence.

What happens when a file goes missing?

Two restricted files are missing right now, and the graph says so. They ride along as missing-unbound rows: flagged, unopened, no credential action taken. Every run re-asserts the flag instead of papering over it, so the accounting always closes: 1,668 present (one of them with an audited second copy), 1 disposed, 2 missing — 1,671 rows, none silently dropped. Rendering a missing record as a clean green check is a failure mode I've written up before.

There's a trap behind the flag, too. If metadata matching a missing restricted file ever reappears, the processor does not cheerfully re-bind it and move on. It halts and requires an authoritative restricted-source reconciliation, because a sensitive file that comes back is a question, not an answer.

How do I know the checks themselves can fail?

A check that can't fail is decoration. So the processor ships with a --self-test mode that runs planted failures: it stages a real transactional write, injects a crash on the third file replacement, and asserts the rollback restored the prior generation byte-for-byte. A mixed generation fails the test. Normal writes get the same paranoia — staged outside the register, swapped in transactionally (all four outputs land together or not at all), then read back byte-for-byte. Even the stat scan distrusts itself: it runs twice and aborts if the snapshot changed between passes.

Trust is also split across two checker profiles. A portable profile validates the tracked control plane anywhere. A private-full profile additionally reconciles the private evidence and fails closed when that evidence is absent, and the domain's own rule states it plainly: a portable pass does not prove the private inventory is current. On 2026-08-09 the private-full readback passed on the live tree: 1,767 governed physical files, zero validation failures.

What does no-read custody actually buy?

Real repairs on a sensitive archive, executed without new exposure. The same repair cycle untracked exactly 100 raw files from the repository tip (path-list hash recorded, zero deletions, every physical file preserved), while the irreversible step, purging git history, stays gated behind human approval. Every row in the newest cohort also carries a do-not-auto-open flag, and the validator fails if any row's flag is ever downgraded.

The judgment this design encodes is negative: the default agent pattern of reading everything into context and then summarizing is the wrong tool for an archive like this. Every read is an exposure, and private context leaks out of AI systems in ways their owners don't predict.

Two honest limits. The no-read rule is a property of the governed pipeline, not a lock on the folder; nothing at the operating-system level stops a different tool from opening a file. And skipping live hashing has a cost: current identity rests on path-plus-size matched against frozen hashed receipts, which is weaker than re-hashing content. I accept both trades, because the claim I actually need is narrow and checkable: the tool that keeps this archive honest has never ingested what's in it. Details are generalized to protect the people and organizations named inside those files.

If your AI assistant took custody of your most sensitive folder tomorrow, what's the first file it would open — and would anything even count how many it read?

I'm Ali — I run real life-and-work admin on AI agents, then check their work in the open. More at /about.

Published under my standards. Found an error? Tell me — corrections go in the corrections log, dated, never silent.

@online{ali2026inventory,
  author = {Ali},
  title  = {How my AI inventoried 1,671 sensitive files without reading one},
  date   = {2026-08-14},
  url    = {https://alidoes.ai/inventory-without-reading/}
}

Caught something I got wrong? Send it directly. Confirmed corrections go in the corrections log.