Implementing the Authorization Gate with case-init.ps1 and scope.md in reverse-skill

The reverse-skill repository enforces a strict pre-execution authorization gate that requires running case-init.ps1 to generate a scope.md contract before any active operation (ACT) can execute.

The reverse-skill project is a platform-agnostic skill router designed for security automation tasks such as reverse engineering and penetration testing. Implementing the authorization gate with case-init.ps1 and scope.md ensures that every automated action operates within a predefined scope and maintains compliance with the repository's RULES.md. This mandatory checkpoint prevents unauthorized operations by validating case metadata and network profiles before execution.

Understanding the Authorization Gate Architecture

The authorization gate consists of two tightly-coupled components that work together to establish a security contract for each operation.

The Role of case-init.ps1

Located at skills/scripts/case-init.ps1, this PowerShell script serves as the entry point for case initialization. It generates a case definition containing metadata including the case name, target URL, and network profile. The script validates inputs against unsafe patterns and aborts execution if required fields are missing.

When invoked with the -Hint parameter (e.g., web pentest), the script creates two critical artifacts under work/<case>/:

• case-init.txt: Contains the case metadata
• scope.md: The authorization contract defining permitted operations

The Role of scope.md

The scope.md file acts as the scope contract that declares what the case is allowed to do. This generated markdown file contains sections such as Target, Allowed Tools, and Network Profile. The routing engine reads this file to determine whether a requested ACT is permissible within the defined boundaries.

How the Gate Enforcement Works

The repository implements multiple validation layers to ensure the gate is present before execution.

Pattern Matching in Routing Engines

The routing scripts master-route.ps1 and verify-routing-coherence.ps1 enforce the gate through pattern matching. These scripts scan for the presence of case-init and scope\.md within a 400-character window preceding any ACT command. The specific regex patterns used include:

• case-init.{0,400}ACT
• scope\.md.{0,400}ACT

If these patterns are absent, the verification fails with an error message indicating the missing gate.

Runtime Validation with case-guard.ps1

The skills/scripts/case-guard.ps1 script provides a runtime safeguard that double-checks the existence and correctness of the scope contract. Called by higher-level scripts such as smoke.ps1 and test-p0-friction.ps1, it aborts execution with a clear error if the scope is missing or malformed.

Step-by-Step Implementation

Follow this workflow to properly implement the authorization gate before executing any skill operations.

1. Initialize the case using case-init.ps1 with your task hint and target details:

# Initialize a web-pentest case called "my-pentest"

powershell -File skills/scripts/case-init.ps1 `
    -Hint "web pentest" `
    -CaseName "my-pentest" `
    -TargetUrl "https://example.com" `
    -NetworkProfile "lab_only"

This command validates the case name against unsafe patterns and writes work/my-pentest/case-init.txt and work/my-pentest/scope.md. The generated scope.md includes the Target section and Network Profile (lab_only).

2. Verify the routing coherence to confirm the gate is properly recognized:

# Verify the authorization gate is detected before any ACT

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/verify-routing-coherence.ps1

Look for Ok "$name has case-init/scope gate" in the output. A missing gate produces Bad "$name missing case-init/scope/network_profile gate".

3. Execute the skill operation only after gate validation:

# Start the IDA reverse skill after gate verification

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/ida-reverse/scripts/start.ps1 -CaseName "my-pentest"

The start.ps1 script internally invokes case-guard.ps1 to verify the scope before launching the reverse-engineering workflow.

Key Files in the Authorization Workflow

Understanding these source files helps debug gate-related issues and extend the architecture:

• skills/scripts/case-init.ps1: Generates case metadata and scope contracts; enforces input validation and safe case naming.
• skills/scripts/case-guard.ps1: Runtime guard ensuring the gate is present before downstream execution.
• skills/scripts/verify-routing-coherence.ps1: Scans routing definitions for the mandatory case-init/scope.md patterns before any ACT.
• skills/scripts/master-route.ps1: Core routing engine that parses hints, selects skills, and enforces the authorization gate.
• RULES.md: The single source of truth defining the mandatory case-init/scope gate requirement.
• examples/ctf-demo/scope.md: Reference implementation showing a typical scope contract layout.

Summary

• The authorization gate requires running case-init.ps1 before any ACT operation to generate the scope.md contract.
• Pattern matching in master-route.ps1 and verify-routing-coherence.ps1 validates the gate presence using 400-character window searches for case-init and scope.md.
• case-guard.ps1 provides runtime validation, aborting execution if the scope contract is missing or malformed.
• The gate architecture ensures pre-execution authorization as mandated by RULES.md, preventing unauthorized security operations.

Frequently Asked Questions

What happens if I try to run an ACT without initializing a case?

The routing engine will detect the missing authorization gate through pattern matching and fail with a Bad status message indicating the missing case-init/scope/network_profile gate. The case-guard.ps1 script will also abort execution with a clear error before any operational code runs.

How does the routing engine detect the authorization gate?

The engine uses regex pattern matching within a 400-character window preceding any ACT command. It searches for case-init.{0,400}ACT and scope\.md.{0,400}ACT patterns in the routing definitions to ensure the gate artifacts exist before permitting execution.

Can I manually edit scope.md after case initialization?

While technically possible, manual edits risk violating the contract validation performed by case-guard.ps1. The scope contract is designed to be generated by case-init.ps1 to ensure consistent formatting and valid content that matches the expected patterns in the routing engine.

What validation does case-init.ps1 perform on inputs?

The script validates that the case name is safe (checking against unsafe patterns), verifies the presence of required fields like network profile, and ensures the target URL is properly formatted. It aborts immediately if any validation fails, preventing the creation of incomplete or unsafe scope contracts.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}