# Scope Contract (scope.md) in reverse-skill: Required Fields and Authorization Structure

> Understand the reverse skill scope contract. Discover required fields like authorization, network permissions, assets, deliverables, and the readiness flag for successful ACT execution.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: api-reference
- Published: 2026-08-01

---

**The scope contract ([`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md)) is a mandatory operations document that defines authorization status, network permissions, in-scope and out-of-scope assets, deliverables, and a readiness flag that must be set to `true` before any ACT can proceed.**

The scope contract serves as the formal "ops contract" for every engagement in the `zhaoxuya520/reverse-skill` repository. Before any action (ACT) is performed, this file must be created and validated to ensure clear operational boundaries and proper authorization. The contract template is defined in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) and enforced by the routing guard scripts.

## Required Fields in the Scope Contract

The scope contract must contain specific sections that define what is permitted during an engagement. According to the source code in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) and validation logic in `skills/scripts/verify-routing-coherence.ps1`, the following fields are mandatory:

### Authorization Status and Network Profile

The **`auth`** field specifies the authorization status, typically structured as `status: granted`. The contract is invalid for ACT operations until this value is explicitly set to *granted*.

The **`network_profile`** field defines network usage permissions, with values such as `authorized_target_only` or `full_access`. This determines what network actions are permitted during the engagement.

### Scope Boundaries

The **`in_scope`** section lists assets explicitly allowed for testing, including hosts, URLs, binaries, and other targets. This is defined under the `## in_scope` heading in the markdown file.

The **`out_of_scope`** section delineates assets that are explicitly excluded from testing, defined under the `## out_of_scope` heading. These boundaries are critical for maintaining operational safety and legal compliance.

### Deliverables and Readiness

The **`deliverables`** field specifies expected outputs such as reports, artifacts, and screenshots that the engagement must produce.

The **`ready_for_act`** boolean flag indicates whether the case is prepared to begin ACT. This is set to `true` only after `auth` is granted and `in_scope` assets are populated. The guard script `skills/scripts/case-guard.ps1` checks this flag at lines 71-73 to determine if operations can proceed.

## Validation and Enforcement Mechanisms

The scope contract is not merely documentation—it is actively validated by the routing infrastructure. The script `skills/scripts/verify-routing-coherence.ps1` asserts that the contract must contain at least the five core fields: `auth`, `network_profile`, `in_scope`, `out_of_scope`, and `deliverables` (see lines 115-116).

The **`case-guard.ps1`** script performs additional validation:

- It parses the **`mode`** field (mirroring `network_profile`) at lines 41-44
- It verifies that **`assets`** are non-empty at lines 51-55
- It confirms `ready_for_act` is set to `true` before allowing operations to proceed

If any mandatory fields are missing or invalid, the case is rejected and ACT is blocked.

## Creating a Valid Scope Contract

To generate a new scope contract, use the initialization script:

```powershell
powershell -File skills/scripts/case-init.ps1 -Hint "WebApp PenTest"

```

This creates `work/<case>/scope.md` pre-filled with the template from [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md).

A minimal valid scope contract follows this structure:

```powershell

# Example of a minimal, valid scope.md

auth:
  status: granted          # <-- Must be "granted"

network_profile: authorized_target_only  # <-- Defines allowed network actions

## in_scope

- assets:
  - https://example.com/login
  - 10.0.0.5

## out_of_scope

- assets:
  - 10.0.0.50   # <-- Explicitly excluded

## deliverables

- report: pentest-report.pdf
- screenshots: ./screenshots/

ready_for_act: true      # <-- Set once auth and in_scope are filled

```

After editing [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) to include the required fields, validate the contract:

```powershell
powershell -File skills/scripts/case-guard.ps1 -CaseRoot work\<case>

```

This returns exit code 0 if all required fields are present and `ready_for_act` equals `true`.

## Summary

- The **scope contract** ([`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md)) is a mandatory prerequisite for ACT operations in the `zhaoxuya520/reverse-skill` repository.
- **Core required fields** include `auth`, `network_profile`, `in_scope`, `out_of_scope`, and `deliverables`.
- The **`ready_for_act`** flag must be set to `true` before any operations can begin.
- **Validation scripts** (`case-guard.ps1` and `verify-routing-coherence.ps1`) enforce contract completeness and block ACT if requirements are not met.
- Use **`case-init.ps1`** to generate new contracts from the template defined in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md).

## Frequently Asked Questions

### What happens if the auth status is not set to granted?

If the `auth.status` field is missing or set to any value other than `granted`, the scope contract is considered invalid. The `case-guard.ps1` script will block ACT operations and return an error, preventing any action from being taken until proper authorization is documented.

### Can I modify the scope contract after creating it?

Yes, you can edit [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) after initialization, but you must re-run the validation script (`case-guard.ps1`) to verify that all required fields remain present and that `ready_for_act` is still appropriately set. Any changes to `in_scope` or `network_profile` should be accompanied by updated authorization documentation.

### What is the difference between network_profile and mode?

The `network_profile` field (e.g., `authorized_target_only`, `full_access`) is defined in the scope contract template at [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md). The `mode` identifier is extracted from this profile by `case-guard.ps1` (lines 41-44) to determine routing behavior, effectively serving as the operational interpretation of the network permissions.

### Where are scope contracts stored in the repository?

Scope contracts are stored in individual case directories under the `work/` folder (e.g., `work/<case>/scope.md`). The template used to generate these files is located at [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md), which defines the required sections and MUST clauses for proper contract structure.