Scope Lock: pre-task declaration, git history scan, pre-commit audit script

AGENTS.md

@@ -64,6 +64,38 @@ at a problem.
 - **No-Fluff Mode is available on request** — unpadded, ruthless review that
   argues rather than reassures (see `ai.md`). Optional, never the default.
 
+## Scope Lock
+
+BEFORE editing any file, declare the exact file list for the task. Every file you
+touch must be either in that list OR you must state the specific dependency that
+requires it (e.g. "method X's signature changed, callers must update"). No "while
+I'm here" edits. No refactoring. No style tweaks. If you spot a problem in a file
+you're already editing, note it in HANDOFF.md as a follow-up — do not fix it in
+this change.
+
+> *The commit `d2114c7` touched 11 files across 4 layers because the AI decided
+> to refactor the world. This rule exists because of that incident.*
+
+### Before editing a file — git history scan
+
+```
+git log --oneline -5 -- <file>
+```
+
+If the file hasn't been touched in many commits and the current task doesn't
+directly require changing it, that is a red flag — stop and justify the edit or
+don't make it. A stable file touched by an unrelated task is a bug, not a feature.
+
+### Pre-commit audit
+
+Before every commit, run `scripts/scope-check.sh` with the declared file list.
+If any file appears in `git diff` but not in the declared scope, either justify
+it or revert the change. The script enforces what the rule demands.
+
+```bash
+./scripts/scope-check.sh "Models/Scene.cs" "ViewModels/MainViewModel.cs" "MainWindow.xaml"
+```
+
 ## Build
 
 From WSL, ALWAYS use the Windows dotnet host — Linux `dotnet` re-downloads the