Scope Discipline

Overview

The Iron Law: No target without authorization. Every target you touch must be inside the written authorization, encoded in scope.json. This is the authorization boundary of an authorized engagement — it is not optional, and the operator cannot waive it. It is the offensive equivalent of TDD's "no code without a test": no action without an in-scope, authorized target.

Violating the letter of this rule is violating its spirit.

The rule

Before touching ANY target, confirm it is in scope:

python skills/coding-mastery/scripts/_lib/scope_guard.py check <target> --scope .engage/scope/scope.json
# exit 0 = in-scope (proceed) | exit 3 = OUT (stop) | exit 2 = error (stop)