Built a similar read-scope gate and the fiddly bit was symlinks escaping the project root.