From 0c83d1d69d99ed769ba175c5c5a9a3d1357aeb28 Mon Sep 17 00:00:00 2001
From: jhuang-tw <77732008+jhuang-tw@users.noreply.github.com>
Date: Mon, 17 Aug 2026 23:33:28 -0700
Subject: [PATCH] fix(p0): keep scope hard gates non-bypassable on bash

---
 skills/scripts/case-guard.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/skills/scripts/case-guard.sh b/skills/scripts/case-guard.sh
index 8a6e050..b873b78 100755
--- a/skills/scripts/case-guard.sh
+++ b/skills/scripts/case-guard.sh
@@ -2,7 +2,7 @@
 # Lightweight scope gate before ACT. Exit 0=ok, 2=not ready, 1=usage/error.
 # Usage:
 #   bash skills/scripts/case-guard.sh --case-root work/my-case
-#   bash skills/scripts/case-guard.sh --case-root work/my-case --force
+#   bash skills/scripts/case-guard.sh --case-root work/my-case --force  # compatibility flag; never bypasses scope hard gates
 set -euo pipefail
 
 CASE_ROOT=""
@@ -120,9 +120,8 @@ echo "CASE-GUARD NOT READY: $CASE_ROOT"
 for i in "${ISSUES[@]}"; do echo " - $i"; done
 
 if [[ $FORCE -eq 1 ]]; then
-  echo "CASE-GUARD: --force set; continuing with warnings only."
-  exit 0
+  echo "CASE-GUARD: --force does not bypass scope hard gates."
 fi
 
-echo "Fix scope (or re-run case-init with --auth-granted --target-url ...) or pass --force."
+echo "Fix scope (or re-run case-init with --auth-granted --target-url ...)."
 exit 2