feat: enforce engagement authorization framing

.env.example

@@ -65,6 +65,19 @@ RATE_LIMIT_WINDOW=3600
 # Logging
 LOG_LEVEL=INFO
 
+# -----------------------------------------------------------------------------
+# Engagement Authorization Scope (optional; JSON arrays)
+# -----------------------------------------------------------------------------
+
+# Leave both target lists empty for neutral prompt framing. When either list is
+# configured, every effective target must validate in-scope before generation
+# or execution.
+ENGAGEMENT_CLIENT=
+ENGAGEMENT_ID=
+AUTHORIZED_HOSTS=[]
+AUTHORIZED_IP_RANGES=[]
+RULES_OF_ENGAGEMENT=
+
 # -----------------------------------------------------------------------------
 # Telemetry & Monitoring (Langfuse)
 # -----------------------------------------------------------------------------

.gitignore

@@ -5,9 +5,12 @@ __pycache__/
 *$py.class
 config/chatgpt_config.py
 outputs/
+output/
 .idea
 .codeboarding/
 .kilo/
+.qodo/
+node_modules/
 SOUL.md
 logs/
 utils/logs/
@@ -208,6 +211,7 @@ pytest_full_output.txt
 final_mypy_results.txt
 final_final_mypy_results.txt
 coverage.json
+bandit-report.json
 
 # Generated reports
 reports/