scope-fencelisted

# Scope Fence ## Purpose Assert that the actual set of changed files in Build is a subset of the active plan phase's declared `Touches` list, flagging any file changed outside that declared scope. Catches scope expansion at the moment it happens, inside Build, rather than letting it reach Review undetected. This is a power skill, not a lifecycle phase. It is gate-bound: it runs at every Build phase's Exit Gate. ## Invocation Context Use this skill when: - a Build phase is about to be marked complete and its Exit Gate is evaluated - Build's `git status` shows changed files and the active plan phase's `Touches` list needs to be checked against them Do not invoke it before any files have been changed — there is nothing to fence yet. ## What To Load **Foundation** (confirm in context; load if not already present): - Root `AGENTS.md` - `workflow/router.md` - `workflow/lifecycle.md` - `workflow/rules.md` **Minimum for invocation**: - This file - `references/output-schema.md` **Before starting work**: - `references/comparison-method.md` — how to compare `git status` output against a plan phase's `Touches` list - The active plan phase's `Touches` entry from the plan artifact - Current `git status --short` output ## Inputs - The active plan phase's declared `Touches` file list. - Current `git status --short` output (changed, added, deleted files). - Any scope-expansion waiver already recorded in the task artifact. ## Refusal / Stop Conditions Stop or return a failed fen