A gate can only refuse
what it can name.
Type any command that destroys a protected file. The first guard reads the command and decides. The second never reads it at all.
Both guards are the same twenty lines of Python you already write, hung on two different events. The first can be phrased around forever, because a shell has more ways to remove a file than anyone can enumerate. The second compares a content fingerprint taken before the call against the one taken after, so the phrasing stops mattering. It does not prevent the deletion. It refuses to let the turn end pretending it did not happen.
Worth a 15-min chat?Runs against an in-memory sandbox. No shell is executed on this server.
Frederic de Lavenne de Choulot