case-init auth.basis default + case-guard offline sample cue (contract/parity; seeking maintainer direction)

[Yu-0312]

Summary

Unreported finding (no open PR on this topic). Two related authorization / scope contract gaps in the case-gate scripts.

Reporter note: 先徵求作者方向，我會根據意見再開 PR；本 issue 不直接改行為。

Finding 1 — case-init.sh default auth.basis violates the scope contract + bash/PS drift

Evidence

• skills/scripts/case-init.sh line 16: AUTH_BASIS="unknown"
• skills/scripts/case-init.ps1 line 18: [string] $AuthBasis = 'own_system'
• skills/ops/scope-contract.md line 52 allows only: written_contract | bug_bounty_scope | ctf_public | own_system | lab_only

Repro (bash)

bash skills/scripts/case-init.sh --hint "offline elf review" \
  --case-name offline-elf --package-root "$scratch" \
  --auth-granted --network-profile offline --sample "$scratch/target.elf"

Emits auth.status=granted ... ready_for_act=true and:

## auth
- basis: unknown

Impact

• Same CLI shape writes different basis on Windows vs Linux/macOS.
• Bash writes a value the scope contract does not allow.

Finding 2 — case-guard offline “sample cue” is effectively a no-op

Evidence

• skills/scripts/case-guard.sh ~line 79 / case-guard.ps1 ~line 64 require cue tokens:
  sample|offline.?path|本地.?样本|\.apk\b|\.bin\b|\.exe\b
• Default case-init network_profile.notes always includes the preset name offline-sample, so the substring sample matches even when no real sample readiness exists.
• Accepted extensions omit common RE types (.elf / .so / .dll / .dex / .wasm / .dylib / .img).
• CI only fixtures sample.apk.

Impact

• Offline gate does not actually verify sample readiness.
• Hand-written scopes without that notes line may false-fail; standard init output may false-pass.

Proposed directions (please choose / adjust)

1. Minimal parity fix — bash default AUTH_BASIS=own_system when --auth-granted without --auth-basis; leave offline cue logic unchanged for now.
2. Contract-strict — require explicit --auth-basis when --auth-granted (fail init otherwise); validate basis against the scope-contract allow-list in both .sh and .ps1.
3. Offline cue — check in_scope.assets paths (or a dedicated sample field) instead of grepping free text; either extend the extension list or accept any existing file path recorded by init.

Please tell us which option (or hybrid) you want, and whether case-guard may accept a non-empty sample path under in_scope.assets without matching .apk/.bin/.exe.

I will open a PR only after your decision.

Scope exclusion

• Not test-bash-workflow.sh fails on macOS: BSD sed rejects GNU-style sed -i, so Test 4/5 (case-guard reject path) never run #135 / PR fix(scripts): portable sed for macOS bash workflow tests #145 (macOS sed in the test harness).
• Not open PRs test(coherence): fail on routes with no benchmark case #131–test(routing): add bilingual R40 case-review benchmark cases #133, fix(kali): catalog yara in tool-discovery so refresh-tool-index reports it #137, fix(bootstrap): binwalk winget id does not exist, mark it manual #140–feat(docker): all-in-one Docker environment #147.
• Not triage “do not close via PR” topics (建议使用 uv 代替 pip #51, ios逆向，证据都到200了，合理吗工作流 #62, 听说容易被封号? #63, worth contributing to radare2-skills? #80, Whenever integrate with my codex environment it can not sync , it display Not Synchorousable. #83, …).