Difference Between ops/scope-contract.md and case-guard.ps1 in Authorization

The ops/scope-contract.md file defines the declarative policy that specifies what authorization fields a case must contain, while case-guard.ps1 is the runtime PowerScript validator that enforces those rules against a concrete scope.md file before any security activity (ACT) proceeds.

Understanding how authorization work gets structured in the reverse-skill repository requires grasping this separation between policy definition and policy enforcement. The zhaoxuya520/reverse-skill project uses a two-layer gate system to ensure every penetration testing or reverse-engineering activity starts from an auditable, human-approved baseline.

What ops/scope-contract.md Does for Authorization

ops/scope-contract.md serves as the single source of truth for what constitutes a valid, authorized case scope. It is a markdown template that case owners copy and fill out before any tools run.

Declarative Policy Fields

The contract mandates four critical authorization sections:

• auth.status — must be granted, pending, or denied; ACT is forbidden unless granted【source】
• network_profile.mode — restricted to offline, lab_only, authorized_target_only, or unrestricted_lab【source】
• in_scope.assets — non-empty list required unless operating in offline mode【source】
• signoff.ready_for_act — boolean flag that explicitly signals execution clearance【source】

Because the contract lives in ops/scope-contract.md, it is version-controlled, reviewed through pull requests, and referenced by MASTER-ROUTING.md and RULES.md as the canonical specification.

What case-guard.ps1 Does for Authorization

skills/scripts/case-guard.ps1 transforms the contract from document into executable gate. It reads a generated work/<case>/scope.md file and validates every constraint programmatically.

Runtime Enforcement Logic

The script performs the following checks in sequence:

1. Authorization status — parses auth.status and adds a blocking issue if not granted【source】

2. Network profile validity — verifies network_profile.mode exists and belongs to the allowed enumeration; applies special handling for offline mode【source】

3. Asset presence — scans the ## in_scope section for a populated - assets: list, skipping this check only when offline【source】

4. Signoff confirmation — confirms signoff.ready_for_act equals true【source】

If any check fails, the script exits with code 2 to halt the ACT pipeline. The -Force flag downgrades failures to warnings without stopping execution.

# Validate a case before running any scanner

powershell -File skills/scripts/case-guard.ps1 -CaseRoot work\web-audit

# Exit 0 → authorized, proceed

# Exit 2 → unauthorized or incomplete scope, block ACT

Side-by-Side Authorization Comparison

Authorization Aspect	ops/scope-contract.md	case-guard.ps1
Form	Markdown template / policy document	PowerShell validation script
Function	Declares what authorization fields must exist	Verifies that those fields contain valid values
auth.status handling	Documents the granted | pending | denied state machine	Reads value from scope.md, fails if not granted
network_profile.mode	Lists permitted modes and their security semantics	Checks presence, validates against whitelist, applies mode-specific rules
in_scope.assets	Requires non-empty list (relaxed for offline)	Parses markdown structure, counts assets, applies conditional logic
signoff.ready_for_act	Defines the boolean gate for execution	Evaluates flag, blocks or warns based on result
Enforcement mechanism	Relies on human discipline and script invocation	Direct programmatic validation with process exit codes

How the Two Files Work Together

A typical authorization workflow in reverse-skill looks like this:

Step 1: Initialize from contract

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills\scripts\case-init.ps1 `
    -Hint "Enumerate internal web services" `
    -CaseName "web-audit"

This copies ops/scope-contract.md to work\web-audit\scope.md as a template.

Step 2: Human authorization

The case owner fills in the scope file:

# Case Scope

## auth

- status: granted
- basis: bug_bounty_scope

## network_profile

- mode: authorized_target_only

## in_scope

- assets:
  - 10.0.0.5

## signoff

- ready_for_act: true

Step 3: Automated gate check

powershell -File skills/scripts/case-guard.ps1 -CaseRoot work\web-audit

Only with exit code 0 do downstream scripts (scanners, exploit modules, report generators) receive execution permission.

Why This Separation Matters

The split between ops/scope-contract.md and case-guard.ps1 creates auditability through transparency. Security reviewers can inspect the contract to understand policy intent without reading PowerShell. Operators can trace validation failures to specific line numbers in case-guard.ps1 when debugging scope issues. The architecture also allows policy updates—adding a new network_profile.mode, for example—to propagate automatically once the script's validation logic is synchronized.

Summary

• ops/scope-contract.md is the human-readable authorization policy that defines required fields and their valid values
• case-guard.ps1 is the automated gate that enforces that policy against concrete case scopes at runtime
• The contract specifies auth.status, network_profile.mode, in_scope.assets, and signoff.ready_for_act as mandatory authorization controls
• The guard parses these fields from scope.md, validates constraints, and returns exit codes 0 (authorized), 2 (unauthorized/not ready), or 1 (usage error)
• Together they form a mandatory, auditable pre-ACT checkpoint referenced throughout MASTER-ROUTING.md and RULES.md

Frequently Asked Questions

Can I run ACT without case-guard.ps1 passing?

No. According to RULES.md and MASTER-ROUTING.md, the guard is a mandatory step in the routing pipeline. Bypassing it violates the repository's security workflow and breaks audit trails.

What happens if auth.status is pending?

case-guard.ps1 adds an authorization issue and exits with code 2. The contract in ops/scope-contract.md explicitly forbids ACT when auth.status is not granted, so the script enforces this as a hard block.

How do I add a new network_profile.mode?

Update both files: modify the allowed modes list in ops/scope-contract.md to document the new mode's semantics, then add corresponding validation logic in case-guard.ps1 to recognize and enforce it.

Where does scope.md get created?

The skills/scripts/case-init.ps1 helper generates it from ops/scope-contract.md. This ensures every new case starts from the current policy template rather than an outdated copy.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}