Because bitcoin script is strictly a verification language, each opcode can be used in forward or reverse. This insight gives us the first two parts of how OP_CAT covenants work.
If a bitcoin script could get access to a hash of the transaction it's verifying, it could require that the spend stack provide the hash preimage, split in whatever way the script requires, and then validate any particular part of that preimage. This is exactly what a covenant is.
[
add
]
[
|
|
...
]