scope-discipline

# Scope Discipline ## Overview **The Iron Law: No target without authorization.** Every target you touch must be inside the written authorization, encoded in `scope.json`. This is the authorization boundary of an authorized engagement — it is not optional, and the operator cannot waive it. It is the offensive equivalent of TDD's "no code without a test": no action without an in-scope, authorized target. **Violating the letter of this rule is violating its spirit.** ## The rule Before touching ANY target, confirm it is in scope: ```bash python skills/coding-mastery/scripts/_lib/scope_guard.py check <target> --scope .engage/scope/scope.json # exit 0 = in-scope (proceed) | exit 3 = OUT (stop) | exit 2 = error (stop) ``` For outward actions, gate through `action_guard.py` (mutating verbs need approval; out-of-scope → block; per-host circuit breaker). Bash scripts source `lib.sh` and call `_in_scope`. `scope.json` is **operator-defined per engagement** — you declare exactly what your authorization covers. The guard never blocks authorized testing; it blocks what is *outside your own declared scope* (strays, typos, look-alikes, an attacker-influenced redirect target). ## Red Flags — STOP, do not send the request - "This subdomain is obviously theirs" (not in `scope.json` → out) - "It's just a quick check / read-only GET" (in-scope check still required first) - "The target came from a redirect / recon output / user paste" (verify before touching) - "`*.acme.com` so `acme.c...