# Difference Between ops/scope-contract.md and case-guard.ps1 in Authorization

> Understand the difference between ops/scope-contract.md and case-guard.ps1 for authorization. Learn how declarative policy and runtime validation ensure security.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-13

---

**The [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) file defines the declarative policy that specifies what authorization fields a case must contain, while `case-guard.ps1` is the runtime PowerScript validator that enforces those rules against a concrete [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file before any security activity (ACT) proceeds.**

Understanding how authorization work gets structured in the `reverse-skill` repository requires grasping this separation between policy definition and policy enforcement. The `zhaoxuya520/reverse-skill` project uses a two-layer gate system to ensure every penetration testing or reverse-engineering activity starts from an auditable, human-approved baseline.

## What ops/scope-contract.md Does for Authorization

[`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) serves as the **single source of truth** for what constitutes a valid, authorized case scope. It is a markdown template that case owners copy and fill out before any tools run.

### Declarative Policy Fields

The contract mandates four critical authorization sections:

- **`auth.status`** — must be `granted`, `pending`, or `denied`; ACT is forbidden unless `granted`【source】
- **`network_profile.mode`** — restricted to `offline`, `lab_only`, `authorized_target_only`, or `unrestricted_lab`【source】
- **`in_scope.assets`** — non-empty list required unless operating in `offline` mode【source】
- **`signoff.ready_for_act`** — boolean flag that explicitly signals execution clearance【source】

Because the contract lives in [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md), it is version-controlled, reviewed through pull requests, and referenced by [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md) and [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) as the canonical specification.

## What case-guard.ps1 Does for Authorization

`skills/scripts/case-guard.ps1` transforms the contract from document into executable gate. It reads a generated `work/<case>/scope.md` file and validates every constraint programmatically.

### Runtime Enforcement Logic

The script performs the following checks in sequence:

1. **Authorization status** — parses `auth.status` and adds a blocking issue if not `granted`【source】
2. **Network profile validity** — verifies `network_profile.mode` exists and belongs to the allowed enumeration; applies special handling for `offline` mode【source】
3. **Asset presence** — scans the `## in_scope` section for a populated `- assets:` list, skipping this check only when `offline`【source】

4. **Signoff confirmation** — confirms `signoff.ready_for_act` equals `true`【source】

If any check fails, the script exits with code `2` to halt the ACT pipeline. The `-Force` flag downgrades failures to warnings without stopping execution.

```powershell

# Validate a case before running any scanner

powershell -File skills/scripts/case-guard.ps1 -CaseRoot work\web-audit

# Exit 0 → authorized, proceed

# Exit 2 → unauthorized or incomplete scope, block ACT

```

## Side-by-Side Authorization Comparison

| Authorization Aspect | ops/scope-contract.md | case-guard.ps1 |
|----------------------|----------------------|----------------|
| **Form** | Markdown template / policy document | PowerShell validation script |
| **Function** | Declares *what* authorization fields must exist | Verifies *that* those fields contain valid values |
| **`auth.status` handling** | Documents the `granted \| pending \| denied` state machine | Reads value from [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), fails if not `granted` |
| **`network_profile.mode`** | Lists permitted modes and their security semantics | Checks presence, validates against whitelist, applies mode-specific rules |
| **`in_scope.assets`** | Requires non-empty list (relaxed for `offline`) | Parses markdown structure, counts assets, applies conditional logic |
| **`signoff.ready_for_act`** | Defines the boolean gate for execution | Evaluates flag, blocks or warns based on result |
| **Enforcement mechanism** | Relies on human discipline and script invocation | Direct programmatic validation with process exit codes |

## How the Two Files Work Together

A typical authorization workflow in `reverse-skill` looks like this:

**Step 1: Initialize from contract**

```powershell
powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills\scripts\case-init.ps1 `
    -Hint "Enumerate internal web services" `
    -CaseName "web-audit"

```

This copies [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) to `work\web-audit\scope.md` as a template.

**Step 2: Human authorization**

The case owner fills in the scope file:

```markdown

# Case Scope

## auth

- status: granted
- basis: bug_bounty_scope

## network_profile

- mode: authorized_target_only

## in_scope

- assets:
  - 10.0.0.5

## signoff

- ready_for_act: true

```

**Step 3: Automated gate check**

```powershell
powershell -File skills/scripts/case-guard.ps1 -CaseRoot work\web-audit

```

Only with exit code `0` do downstream scripts (scanners, exploit modules, report generators) receive execution permission.

## Why This Separation Matters

The split between [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) and `case-guard.ps1` creates **auditability through transparency**. Security reviewers can inspect the contract to understand policy intent without reading PowerShell. Operators can trace validation failures to specific line numbers in `case-guard.ps1` when debugging scope issues. The architecture also allows policy updates—adding a new `network_profile.mode`, for example—to propagate automatically once the script's validation logic is synchronized.

## Summary

- **[`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md)** is the human-readable authorization policy that defines required fields and their valid values
- **`case-guard.ps1`** is the automated gate that enforces that policy against concrete case scopes at runtime
- The contract specifies `auth.status`, `network_profile.mode`, `in_scope.assets`, and `signoff.ready_for_act` as mandatory authorization controls
- The guard parses these fields from [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), validates constraints, and returns exit codes `0` (authorized), `2` (unauthorized/not ready), or `1` (usage error)
- Together they form a mandatory, auditable pre-ACT checkpoint referenced throughout [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md) and [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)

## Frequently Asked Questions

### Can I run ACT without case-guard.ps1 passing?

No. According to [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md), the guard is a mandatory step in the routing pipeline. Bypassing it violates the repository's security workflow and breaks audit trails.

### What happens if auth.status is pending?

`case-guard.ps1` adds an authorization issue and exits with code `2`. The contract in [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) explicitly forbids ACT when `auth.status` is not `granted`, so the script enforces this as a hard block.

### How do I add a new network_profile.mode?

Update both files: modify the allowed modes list in [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) to document the new mode's semantics, then add corresponding validation logic in `case-guard.ps1` to recognize and enforce it.

### Where does scope.md get created?

The `skills/scripts/case-init.ps1` helper generates it from [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md). This ensures every new case starts from the current policy template rather than an outdated copy.