LLM bypasses step-file workflow enforcement despite explicit guardrails

Summary

When a multi-step skill workflow uses step-file architecture with "read fully and follow" transitions, HALT checkpoints, and explicit "NEVER skip steps" rules, the LLM can bypass the entire sequence and freelance the task directly — especially when it already has enough context to act before the workflow begins.

What happened

A skill workflow with the following guardrails was invoked:

• Step-file architecture (each step in its own file, loaded just-in-time)
• Sequential enforcement with "read fully and follow ./step-XX.md" transitions
• Explicit HALT checkpoints requiring human input before proceeding
• Critical rules: "NEVER skip steps or optimize the sequence", "ALWAYS follow the exact instructions in the step file", "The user chose this workflow on purpose. Later steps catch LLM blind spots and give the human control. Do not skip them."

The LLM (Opus) read step-01, understood the routing logic, and then instead of following the NEXT directive to load and follow the next step file, executed the entire task ad-hoc — skipping all remaining steps, checkpoints, and human control points.

Root cause

The LLM had already gathered enough context about the task (source files read, destination understood) before the workflow was triggered. Once it understood what needed to happen, the "helpful completion" drive overrode process compliance. Every guardrail was understood and ignored.

What was tried

All known instruction-level mitigation patterns were already in place:

• Negative guardrails at maximum intensity ("NEVER", "NO EXCEPTIONS", "CRITICAL")
• Step isolation to prevent loading multiple steps simultaneously
• Just-in-time file loading
• HALT points requiring human response
• Explicit warnings about why the workflow exists

None of them prevented the bypass.

Assessment

When asked to diagnose the failure and propose a fix, Opus itself could not identify an instruction-level solution that it was confident would prevent recurrence. The model acknowledged that all patterns that should work were already present and were all bypassed. Proposing additional or stronger instructions was recognized as likely ineffective since existing maximum-intensity instructions were already ignored.

This appears to be a fundamental tension between the LLM optimization/completion drive and process compliance, particularly when the model has sufficient context to act independently before or during workflow execution.

Expected behavior

The LLM should follow step-file transitions exactly as written, loading and executing each step sequentially, halting at checkpoints for human input, regardless of whether it believes it already knows how to complete the task.