diff --git a/bazel/rules/rules_score/docs/_assets/scope_check.puml b/bazel/rules/rules_score/docs/_assets/scope_check.puml
index 898dfe99..f74f0fd1 100644
--- a/bazel/rules/rules_score/docs/_assets/scope_check.puml
+++ b/bazel/rules/rules_score/docs/_assets/scope_check.puml
@@ -31,9 +31,10 @@ package "dependable_element" as de {
 }
 
 note bottom of outofscope
-  Rejected: "Not in certified scope
-  //third_party/foo:__subpackages__,
-  stopping at other"
+  Scope violation:
+  Unit //pkg:MyUnit depends on //other/unrelated:thing,
+  but the dependency is not in any certified scope
+  (package '//other/unrelated' is not covered).
 end note
 
 @enduml
diff --git a/bazel/rules/rules_score/docs/tool_reference/scope_check.rst b/bazel/rules/rules_score/docs/tool_reference/scope_check.rst
index e267fbfc..68e081eb 100644
--- a/bazel/rules/rules_score/docs/tool_reference/scope_check.rst
+++ b/bazel/rules/rules_score/docs/tool_reference/scope_check.rst
@@ -42,8 +42,8 @@ patterns:
 ``scope`` is for dependencies that are *not* explicitly named as
 ``implementation`` targets themselves (e.g. third-party libraries pulled in
 transitively) but are still known and accepted as part of the unit. Every
-``unit`` and ``component`` also implicitly certifies its own explicitly named
-targets (``implementation``, nested ``components``).
+``unit`` also implicitly certifies its own ``implementation`` targets.
+Components aggregate the scopes of their units and nested components.
 
 Scopes are collected transitively: a ``component``'s certified scope is the
 union of its own units' and nested components' scopes, and a
@@ -57,14 +57,26 @@ What is checked
 For each ``unit``, an aspect (``cc_dependencies_aspect``) walks the
 ``deps`` / ``implementation_deps`` / ``exported_deps`` attributes of its
 ``implementation`` targets and collects every transitively reached label.
-``dependable_element`` then checks each collected label against the tree of
-certified scopes built from all ``scope`` declarations in the element: a
-label is in scope if it (or an enclosing package / subpackage wildcard) was
-declared somewhere. Any dependency that is not covered fails the check with:
+``dependable_element`` checks each collected dependency label against the
+combined certified scopes, including the units' own ``implementation``
+targets. A dependency is covered if any of the following applies:
+
+* Its exact target label is included.
+* Its package is covered by a ``__pkg__`` declaration.
+* Its package or an ancestor package is covered by a
+   ``__subpackages__`` declaration.
+
+All matches require the scope declaration and dependency to belong to
+the same repository.
+
+Uncovered dependencies are reported as warnings when the enclosing
+``dependable_element`` has ``maturity = "development"``; otherwise they
+fail the build. Each message identifies the originating unit and dependency:
 
 .. code-block:: text
 
-   Not in certified scope <label>, stopping at <path segment>
+   Unit <unit label> depends on <dependency label>, but the dependency
+   is not in any certified scope (<reason>).
 
 A certified scope that is declared more than once (e.g. by two units) is
 also rejected:
@@ -80,9 +92,10 @@ Implementation
 
    bazel/rules/rules_score/private/
    ├── cc_dependency_aspect.bzl   # CcDependencyInfo: transitive labels reached from a cc target
-   ├── unit.bzl                   # CertifiedScope(transitive_scopes = scope attr)
+   ├── unit.bzl                   # CertifiedScope: scope attr + implementation targets
    ├── component.bzl              # aggregates CertifiedScope + dependent_labels from children
-   └── dependable_element.bzl     # builds the scope tree and validates dependent_labels against it
+   ├── certified_scope.bzl        # builds the repository/package index and collects scope violations
+   └── dependable_element.bzl     # aggregates scopes and applies its maturity policy
 
 See the ``CertifiedScope``, ``UnitInfo.dependent_labels`` and
 ``ComponentInfo.dependent_labels`` providers in
diff --git a/bazel/rules/rules_score/examples/integrator/BUILD b/bazel/rules/rules_score/examples/integrator/BUILD
index e19656e2..84bf3ec5 100644
--- a/bazel/rules/rules_score/examples/integrator/BUILD
+++ b/bazel/rules/rules_score/examples/integrator/BUILD
@@ -54,7 +54,7 @@ architectural_design(
 
 unit(
     name = "integrator_unit",
-    scope = ["//:__pkg__"],
+    scope = ["@seooc//:sample_library"],
     tests = [],
     unit_design = [],
     implementation = [":integrator_lib"],
diff --git a/bazel/rules/rules_score/examples/minimal/.bazelversion b/bazel/rules/rules_score/examples/minimal/.bazelversion
index f9c71a52..df5119ec 100644
--- a/bazel/rules/rules_score/examples/minimal/.bazelversion
+++ b/bazel/rules/rules_score/examples/minimal/.bazelversion
@@ -1 +1 @@
-8.5.1
+8.7.0
diff --git a/bazel/rules/rules_score/examples/minimal/BUILD b/bazel/rules/rules_score/examples/minimal/BUILD
index 72ca078a..499afffc 100644
--- a/bazel/rules/rules_score/examples/minimal/BUILD
+++ b/bazel/rules/rules_score/examples/minimal/BUILD
@@ -56,10 +56,16 @@ architectural_design(
     static = ["docs/static_design.puml"],
 )
 
+cc_library(
+    name = "my_unit_hdr",
+    srcs = [],
+    hdrs = ["src/my_unit.h"],
+)
+
 cc_library(
     name = "my_unit_lib",
     srcs = ["src/my_unit.cpp"],
-    hdrs = ["src/my_unit.h"],
+    deps = [":my_unit_hdr"],
 )
 
 cc_test(
@@ -78,7 +84,7 @@ unit_design(
 
 unit(
     name = "MyUnit",
-    scope = ["//:my_unit_lib"],
+    scope = [":my_unit_hdr"],
     tests = [":my_unit_test"],
     unit_design = [":MyUnit_design"],
     implementation = [":my_unit_lib"],
diff --git a/bazel/rules/rules_score/private/certified_scope.bzl b/bazel/rules/rules_score/private/certified_scope.bzl
new file mode 100644
index 00000000..0e76bf93
--- /dev/null
+++ b/bazel/rules/rules_score/private/certified_scope.bzl
@@ -0,0 +1,110 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+"""Pure helpers for certified-scope validation."""
+
+_PACKAGE_SCOPE = "__pkg__"
+_SUBPACKAGES_SCOPE = "__subpackages__"
+
+def build_scope_index(certified_scopes):
+    """Index certified scopes by repository and full package path.
+
+    Args:
+        certified_scopes: Iterable of label strings or Label objects.
+
+    Returns:
+        Scope index keyed by repository and full package path.
+    """
+    scope_index = {}
+    for certified_scope in certified_scopes:
+        certified_scope = Label(certified_scope)
+        repository = scope_index.setdefault(certified_scope.workspace_name, default = {})
+        package_scope = repository.setdefault(certified_scope.package, default = {
+            "targets": {},
+            "covers_package": False,
+            "covers_subpackages": False,
+        })
+        if certified_scope.name == _PACKAGE_SCOPE:
+            package_scope["covers_package"] = True
+        elif certified_scope.name == _SUBPACKAGES_SCOPE:
+            package_scope["covers_subpackages"] = True
+        else:
+            package_scope["targets"][certified_scope.name] = True
+
+    return scope_index
+
+def find_scope_violation(scope_index, dependency):
+    """Return the reason a dependency is outside ``scope_index``, if any.
+
+    Args:
+        scope_index: An index returned by ``build_scope_index``.
+        dependency: Dependency Label to match against the certified scope.
+
+    Returns:
+        A violation reason string, or ``None`` when the dependency is covered.
+    """
+    repository = scope_index.get(dependency.workspace_name)
+    if repository == None:
+        return "repository {} is not covered".format(dependency.workspace_name or "<main>")
+
+    package_scope = repository.get(dependency.package)
+    if package_scope != None and (
+        package_scope["covers_package"] or dependency.name in package_scope["targets"]
+    ):
+        return None
+
+    package_segments = dependency.package.split("/") if dependency.package else []
+    for end_index in range(len(package_segments) + 1):
+        ancestor_scope = repository.get("/".join(package_segments[:end_index]))
+        if ancestor_scope != None and ancestor_scope["covers_subpackages"]:
+            return None
+
+    if package_scope == None:
+        return "package '//{}' is not covered".format(dependency.package)
+
+    declared_targets = package_scope["targets"]
+    return "dependency '{}' is not certified in package '{}'; declared certified targets: {}".format(
+        dependency.name,
+        dependency.package,
+        ", ".join(declared_targets) if declared_targets else "none",
+    )
+
+def collect_scope_violations(scope_index, unit_dependency_closures):
+    """Return unit-attributed messages for dependencies outside ``scope_index``.
+
+    Args:
+        scope_index: An index returned by ``build_scope_index``.
+        unit_dependency_closures: Iterable of structs with ``unit_label`` and
+            ``dependencies`` (a depset of dependency Labels) fields.
+
+    Returns:
+        List of violation messages.
+    """
+    violation_cache = {}
+    violations = []
+    for unit_dependency_closure in unit_dependency_closures:
+        for dependency in unit_dependency_closure.dependencies.to_list():
+            if dependency not in violation_cache:
+                violation_cache[dependency] = find_scope_violation(scope_index, dependency)
+
+            violation = violation_cache[dependency]
+            if violation:
+                violations.append(
+                    "Unit {} depends on {}, but the dependency is not in any certified scope ({}).".format(
+                        unit_dependency_closure.unit_label,
+                        dependency,
+                        violation,
+                    ),
+                )
+
+    return violations
diff --git a/bazel/rules/rules_score/private/dependable_element.bzl b/bazel/rules/rules_score/private/dependable_element.bzl
index 8dd2e1d7..c74eba57 100644
--- a/bazel/rules/rules_score/private/dependable_element.bzl
+++ b/bazel/rules/rules_score/private/dependable_element.bzl
@@ -51,6 +51,11 @@ load(
     "CurrentArchitectureProviderInfo",
     "collect_current_architecture_aspect",
 )
+load(
+    "//bazel/rules/rules_score/private:certified_scope.bzl",
+    "build_scope_index",
+    "collect_scope_violations",
+)
 load(
     "//bazel/rules/rules_score/private:lobster_config.bzl",
     "MERGE_LOBSTER_ITEMS_ATTR",
@@ -1073,6 +1078,17 @@ def _cond_names(*conditioned_names):
     """
     return [name for condition, name in conditioned_names if condition]
 
+def _apply_certification_violations(maturity, violations):
+    """Apply the caller-owned maturity policy to one validation phase."""
+    if not violations:
+        return
+
+    if maturity == "development":
+        for violation in violations:
+            print("WARNING: " + violation)
+    else:
+        fail("\n".join(violations))
+
 def _dependable_element_index_impl(ctx):
     """Generate index.rst file with references to all dependable element artifacts.
 
@@ -1229,6 +1245,8 @@ def _dependable_element_index_impl(ctx):
 
             if comp_info.dependent_labels:
                 collected_dependent_labels.append(comp_info.dependent_labels)
+        elif UnitInfo in comp_target:
+            collected_dependent_labels.append(comp_target[UnitInfo].dependent_labels)
         if CertifiedScope in comp_target:
             collected_certified_scopes.append(comp_target[CertifiedScope].transitive_scopes)
 
@@ -1354,62 +1372,13 @@ def _dependable_element_index_impl(ctx):
 
     # Verify that all transitive implementation dependencies are within the
     # certified scope declared for this dependable element.
-    # @todo: Make this check aware of the repository (@foo) for example.
     certified_scopes = depset(transitive = collected_certified_scopes).to_list()
-    tree = {}
-    for certified_scope in certified_scopes:
-        certified_scope = Label(certified_scope)
-        node = tree
-        path = certified_scope.package.split("/")
-        last_element = path.pop()
-        for path in path:
-            node = node.setdefault(path, default = {})
-
-        if type(node) == type([]):
-            if certified_scope.name in node:
-                msg = "The same scope is covered twice: {}".format(certified_scope)
-                if ctx.attr.maturity == "development":
-                    print("WARNING: " + msg)
-                    continue
-                fail(msg)
-            node.append(certified_scope.name)
-        else:
-            inserted_element = node.setdefault(last_element, default = [])
-            if certified_scope.name in inserted_element:
-                msg = "The same scope is covered twice: {}".format(certified_scope)
-                if ctx.attr.maturity == "development":
-                    print("WARNING: " + msg)
-                    continue
-                fail(msg)
-            inserted_element.append(certified_scope.name)
-
     dependencies = depset(transitive = collected_dependent_labels).to_list()
-    for dep in dependencies:
-        node = tree
-        for path in dep.package.split("/"):
-            if type(node) == type([]):
-                if "__subpackages__" in node:
-                    break
-                elif dep.name in node:
-                    break
-                else:
-                    msg = "Not in certified scope {}, stopping at {}".format(dep, path)
-                    if ctx.attr.maturity == "development":
-                        print("WARNING: " + msg)
-                    else:
-                        fail(msg)
-                    break
-
-            child = node.get(path)
-            if child == None:
-                msg = "Not in certified scope {}, stopping at {}".format(dep, path)
-                if ctx.attr.maturity == "development":
-                    print("WARNING: " + msg)
-                else:
-                    fail(msg)
-                break
-            else:
-                node = child
+    scope_index = build_scope_index(certified_scopes)
+    _apply_certification_violations(
+        ctx.attr.maturity,
+        collect_scope_violations(scope_index, dependencies),
+    )
 
     # Integrity-level check: a dependable element must not depend on elements
     # with a lower integrity level than its own (D > C > B > A).
diff --git a/bazel/rules/rules_score/private/unit.bzl b/bazel/rules/rules_score/private/unit.bzl
index 48f6d7a2..35fbecc6 100644
--- a/bazel/rules/rules_score/private/unit.bzl
+++ b/bazel/rules/rules_score/private/unit.bzl
@@ -141,10 +141,12 @@ def _unit_impl(ctx):
         xml_files + implementation_class_fbs + [validation_log.file],
         transitive = [design_depset],
     )
+    certified_scopes = [impl.label for impl in ctx.attr.implementation]
+    certified_scopes.extend([Label(scope) for scope in ctx.attr.scope])
 
     return [
         DefaultInfo(files = all_files),
-        CertifiedScope(transitive_scopes = depset(ctx.attr.scope)),
+        CertifiedScope(transitive_scopes = depset(certified_scopes)),
         UnitInfo(
             name = ctx.label.name,
             design_name = ctx.attr.design_name or ctx.label.name,
@@ -155,7 +157,10 @@ def _unit_impl(ctx):
             implementation_sequence_fbs = depset(),
             implementation = depset(ctx.attr.implementation),
             tests = tests_depset,
-            dependent_labels = depset(transitive = collected_dependent_labels),
+            dependent_labels = depset([struct(
+                unit_label = ctx.label,
+                dependencies = depset(transitive = collected_dependent_labels),
+            )]),
             validation_log = validation_log,
         ),
         SphinxSourcesInfo(
@@ -281,7 +286,7 @@ def unit(
         name = name,
         unit_design = unit_design,
         implementation = implementation,
-        scope = scope,
+        scope = [str(native.package_relative_label(scope_entry)) for scope_entry in scope],
         tests = tests,
         design_name = design_name or "",
         testonly = testonly,
diff --git a/bazel/rules/rules_score/providers.bzl b/bazel/rules/rules_score/providers.bzl
index 7421dae9..e44adec1 100644
--- a/bazel/rules/rules_score/providers.bzl
+++ b/bazel/rules/rules_score/providers.bzl
@@ -84,7 +84,7 @@ UnitInfo = provider(
         "implementation_sequence_fbs": "Depset of FlatBuffers binaries generated from implementation sequence diagrams.",
         "implementation": "Depset of implementation targets (cc_library, rust_library, etc.).",
         "tests": "Depset of test targets (cc_test, rust_test, etc.).",
-        "dependent_labels": "Depset of Labels that this unit's implementation depends on transitively (used for certification scope validation).",
+        "dependent_labels": "Depset containing one struct for this unit with its label and a depset of transitive implementation dependency labels.",
         "validation_log": "Struct with file and name fields describing the UnitValidate (design-vs-implementation) log entry produced by this unit target.",
     },
 )
@@ -178,7 +178,7 @@ ComponentInfo = provider(
         "components": "Depset of nested component and/or unit Targets that comprise this component.",
         "tests": "Depset of test traceability files (.lobster) generated from unit test results, collected transitively from all nested components and units.",
         "architecture": "Depset of architecture traceability files (.lobster) generated from unit architectural designs, collected transitively from all nested components and units.",
-        "dependent_labels": "Depset of Labels that this component's implementation depends on transitively (collected from all nested units and components, used for certification scope validation).",
+        "dependent_labels": "Depset of per-unit structs containing each unit label and its transitive implementation dependency depset, collected from nested units and components for certification scope validation.",
     },
 )
 
diff --git a/bazel/rules/rules_score/test/.bazelversion b/bazel/rules/rules_score/test/.bazelversion
index f9c71a52..df5119ec 100644
--- a/bazel/rules/rules_score/test/.bazelversion
+++ b/bazel/rules/rules_score/test/.bazelversion
@@ -1 +1 @@
-8.5.1
+8.7.0
diff --git a/bazel/rules/rules_score/test/BUILD b/bazel/rules/rules_score/test/BUILD
index f8415284..c1755bde 100644
--- a/bazel/rules/rules_score/test/BUILD
+++ b/bazel/rules/rules_score/test/BUILD
@@ -37,6 +37,11 @@ load(
 load("@score_tooling//bazel/rules/rules_score:sphinx_toolchain.bzl", "score_sphinx_toolchain")
 load("@score_tooling//cpp/libclang:libclang_toolchain.bzl", "libclang_toolchain")
 load("@trlc//:trlc.bzl", "trlc_requirements", "trlc_requirements_test", "trlc_specification")
+load(
+    ":certified_scope_test.bzl",
+    "certified_scope_index_test_suite",
+    "certified_scope_matching_test_suite",
+)
 load(
     ":dependable_element_aou_test.bzl",
     "aou_derived_test",
@@ -51,6 +56,7 @@ load(
 load(
     ":dependable_element_toplevel_unit_test.bzl",
     "toplevel_unit_linked_test",
+    "toplevel_unit_scope_fails_test",
 )
 load(
     ":dependable_element_unit_staging_test.bzl",
@@ -158,6 +164,7 @@ load(
     "component_sphinx_sources_test",
     "component_test_case_coverage_lock_test",
     "dependable_element_test_case_coverage_lock_check_action_test",
+    "unit_certified_scope_test",
     "unit_component_test_suite",
     "unit_provider_test",
     "unit_sphinx_sources_test",
@@ -1026,6 +1033,35 @@ toplevel_unit_linked_test(
     unit_name = "leaf_unit",
 )
 
+cc_library(
+    name = "bare_scope_impl",
+    deps = [":mock_lib1"],
+)
+
+unit(
+    name = "bare_scope_unit",
+    tests = [],
+    unit_design = [],
+    implementation = [":bare_scope_impl"],
+)
+
+dependable_element(
+    name = "bare_scope_release",
+    architectural_design = [],
+    components = [":bare_scope_unit"],
+    dependability_analysis = [],
+    integrity_level = "B",
+    maturity = "release",
+    requirements = [],
+    tags = ["manual"],
+    tests = [],
+)
+
+toplevel_unit_scope_fails_test(
+    name = "toplevel_unit_scope_release_test",
+    target_under_test = ":bare_scope_release_index",
+)
+
 # Regression fixture: two units whose designs both ship a "class_diagram.puml"
 # and a "design.rst". Each unit stages under its own units/<unit>/ directory,
 # so the two must not collide; checked by :unit_same_puml_names_test.
@@ -2203,6 +2239,34 @@ test_suite(
 # ============================================================================
 
 # Unit tests
+unit(
+    name = "caller_scope_unit",
+    scope = [
+        ":mock_lib1",
+        "//:__pkg__",
+        "//child:__subpackages__",
+        "@score_docs_as_code//x:__pkg__",
+    ],
+    tests = [],
+    unit_design = [],
+    implementation = [":mock_lib2"],
+)
+
+unit_certified_scope_test(
+    name = "unit_caller_scope_test",
+    expected_scopes = [
+        str(package_relative_label(scope_entry))
+        for scope_entry in [
+            ":mock_lib2",
+            ":mock_lib1",
+            "//:__pkg__",
+            "//child:__subpackages__",
+            "@score_docs_as_code//x:__pkg__",
+        ]
+    ],
+    target_under_test = ":caller_scope_unit",
+)
+
 unit_provider_test(
     name = "unit_provider_test",
     target_under_test = ":test_unit",
@@ -2510,6 +2574,13 @@ requirements_multi_spec_test_suite(name = "requirements_multi_spec_tests")
 # ============================================================================
 lobster_config_test_suite(name = "lobster_config")
 
+# ============================================================================
+# certified_scope.bzl unit tests
+# ============================================================================
+certified_scope_matching_test_suite(name = "certified_scope_matching")
+
+certified_scope_index_test_suite(name = "certified_scope_index")
+
 # ============================================================================
 # puml_utils.bzl unit tests (plan_view_layout)
 # ============================================================================
diff --git a/bazel/rules/rules_score/test/certified_scope_test.bzl b/bazel/rules/rules_score/test/certified_scope_test.bzl
new file mode 100644
index 00000000..c5210814
--- /dev/null
+++ b/bazel/rules/rules_score/test/certified_scope_test.bzl
@@ -0,0 +1,235 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+"""Loading-phase tests for certified-scope matching helpers."""
+
+load("@bazel_skylib//lib:unittest.bzl", "loadingtest")
+load(
+    "@score_tooling//bazel/rules/rules_score/private:certified_scope.bzl",
+    "build_scope_index",
+    "collect_scope_violations",
+    "find_scope_violation",
+)
+
+def certified_scope_matching_test_suite(name):
+    """Defines loading-phase tests for package scope matching semantics."""
+    env = loadingtest.make(name)
+    scope_index = build_scope_index([Label("//:__pkg__")])
+
+    loadingtest.equals(
+        env,
+        "pkg_scope_covers_target_in_its_package",
+        None,
+        find_scope_violation(scope_index, Label("//:library")),
+    )
+
+    loadingtest.equals(
+        env,
+        "pkg_scope_does_not_cover_child_package",
+        "package '//child' is not covered",
+        find_scope_violation(scope_index, Label("//child:library")),
+    )
+
+    loadingtest.equals(
+        env,
+        "pkg_scope_does_not_cover_nested_child_package",
+        "package '//child/nested' is not covered",
+        find_scope_violation(scope_index, Label("//child/nested:library")),
+    )
+
+    loadingtest.equals(
+        env,
+        "aggregated_scope_violation_reports_originating_unit",
+        ["Unit @@//units:my_unit depends on @@//child:library, but the dependency is not in any certified scope (package '//child' is not covered)."],
+        collect_scope_violations(
+            scope_index,
+            [struct(
+                unit_label = Label("//units:my_unit"),
+                dependencies = depset([Label("//child:library")]),
+            )],
+        ),
+    )
+
+    loadingtest.equals(
+        env,
+        "shared_uncovered_dependency_reports_every_originating_unit",
+        [
+            "Unit @@//units:first depends on @@//child:library, but the dependency is not in any certified scope (package '//child' is not covered).",
+            "Unit @@//units:second depends on @@//child:library, but the dependency is not in any certified scope (package '//child' is not covered).",
+        ],
+        collect_scope_violations(
+            scope_index,
+            [
+                struct(
+                    unit_label = Label("//units:first"),
+                    dependencies = depset([Label("//child:library")]),
+                ),
+                struct(
+                    unit_label = Label("//units:second"),
+                    dependencies = depset([Label("//child:library")]),
+                ),
+            ],
+        ),
+    )
+
+    subpackages_scope_index = build_scope_index([Label("//:__subpackages__")])
+
+    loadingtest.equals(
+        env,
+        "subpackages_scope_covers_arbitrary_nested_target",
+        None,
+        find_scope_violation(subpackages_scope_index, Label("//child/nested:any_target")),
+    )
+
+    root_and_child_scope_index = build_scope_index([
+        Label("//:root_lib"),
+        Label("//a:child_lib"),
+    ])
+
+    loadingtest.equals(
+        env,
+        "root_scope_does_not_hide_child_package_scope",
+        None,
+        find_scope_violation(root_and_child_scope_index, Label("//a:child_lib")),
+    )
+
+    external_scope_index = build_scope_index([
+        Label("@bazel_skylib//lib:unittest.bzl"),
+    ])
+
+    loadingtest.equals(
+        env,
+        "external_scope_covers_same_repository_target",
+        None,
+        find_scope_violation(external_scope_index, Label("@bazel_skylib//lib:unittest.bzl")),
+    )
+
+    loadingtest.equals(
+        env,
+        "external_scope_does_not_cover_same_named_main_repository_target",
+        "repository <main> is not covered",
+        find_scope_violation(external_scope_index, Label("//lib:unittest.bzl")),
+    )
+
+    exact_target_scope_index = build_scope_index([Label("//a/b:lib")])
+
+    loadingtest.equals(
+        env,
+        "exact_target_scope_rejects_other_target_in_same_package",
+        "dependency 'other' is not certified in package 'a/b'; declared certified targets: lib",
+        find_scope_violation(exact_target_scope_index, Label("//a/b:other")),
+    )
+
+    loadingtest.equals(
+        env,
+        "exact_target_scope_rejects_target_in_shallower_package",
+        "package '//a' is not covered",
+        find_scope_violation(exact_target_scope_index, Label("//a:other")),
+    )
+
+    nested_scope_index = build_scope_index([Label("//a/b:__subpackages__")])
+    for package_path in ["a/b", "a/b/c", "a/b/c/d"]:
+        loadingtest.equals(
+            env,
+            "subpackage_scope_covers_" + package_path.replace("/", "_"),
+            None,
+            find_scope_violation(nested_scope_index, Label("//{}:lib".format(package_path))),
+        )
+    for package_path in ["", "a", "a/bc"]:
+        loadingtest.equals(
+            env,
+            "subpackage_scope_rejects_" + (package_path.replace("/", "_") or "root"),
+            "package '//{}' is not covered".format(package_path),
+            find_scope_violation(nested_scope_index, Label("//{}:lib".format(package_path))),
+        )
+
+    for wildcard in ["__pkg__", "__subpackages__"]:
+        external_wildcard_index = build_scope_index([
+            Label("@bazel_skylib//lib:" + wildcard),
+        ])
+        loadingtest.equals(
+            env,
+            "external_{}_covers_its_package".format(wildcard),
+            None,
+            find_scope_violation(external_wildcard_index, Label("@bazel_skylib//lib:library")),
+        )
+        loadingtest.equals(
+            env,
+            "external_{}_does_not_cover_main_repository".format(wildcard),
+            "repository <main> is not covered",
+            find_scope_violation(external_wildcard_index, Label("//lib:library")),
+        )
+
+def certified_scope_index_test_suite(name):
+    """Defines loading-phase tests for certified-scope index construction."""
+    env = loadingtest.make(name)
+    mixed_depth_scope_index = build_scope_index([
+        Label("//a/b:lib"),
+        Label("//a/b/c:lib2"),
+    ])
+
+    loadingtest.equals(
+        env,
+        "mixed_depth_scopes_use_full_package_keys",
+        {
+            "": {
+                "a/b": {
+                    "targets": {"lib": True},
+                    "covers_package": False,
+                    "covers_subpackages": False,
+                },
+                "a/b/c": {
+                    "targets": {"lib2": True},
+                    "covers_package": False,
+                    "covers_subpackages": False,
+                },
+            },
+        },
+        mixed_depth_scope_index,
+    )
+
+    external_scope = Label("@score_tooling//bazel/rules/rules_score:__pkg__")
+    external_scope_index = build_scope_index([external_scope])
+
+    loadingtest.equals(
+        env,
+        "external_scope_uses_repository_name_as_index_key",
+        {
+            external_scope.workspace_name: {
+                "bazel/rules/rules_score": {
+                    "targets": {},
+                    "covers_package": True,
+                    "covers_subpackages": False,
+                },
+            },
+        },
+        external_scope_index,
+    )
+
+    declarations = [Label("//:lib"), Label("//:__pkg__"), Label("//:__subpackages__")]
+    combined_index = build_scope_index(declarations)
+    loadingtest.equals(
+        env,
+        "root_package_groups_targets_and_wildcards",
+        {"": {"": {
+            "targets": {"lib": True},
+            "covers_package": True,
+            "covers_subpackages": True,
+        }}},
+        combined_index,
+    )
+    loadingtest.equals(
+        env,
+        "repeated_targets_and_wildcards_produce_the_same_index",
+        combined_index,
+        build_scope_index(declarations + declarations),
+    )
diff --git a/bazel/rules/rules_score/test/dependable_element_toplevel_unit_test.bzl b/bazel/rules/rules_score/test/dependable_element_toplevel_unit_test.bzl
index b1136160..3734d4fe 100644
--- a/bazel/rules/rules_score/test/dependable_element_toplevel_unit_test.bzl
+++ b/bazel/rules/rules_score/test/dependable_element_toplevel_unit_test.bzl
@@ -36,3 +36,13 @@ toplevel_unit_linked_test = analysistest.make(
     _toplevel_unit_linked_test_impl,
     attrs = {"unit_name": attr.string(mandatory = True)},
 )
+
+def _toplevel_unit_scope_fails_test_impl(ctx):
+    env = analysistest.begin(ctx)
+    asserts.expect_failure(env, "bare_scope_unit depends on")
+    return analysistest.end(env)
+
+toplevel_unit_scope_fails_test = analysistest.make(
+    _toplevel_unit_scope_fails_test_impl,
+    expect_failure = True,
+)
diff --git a/bazel/rules/rules_score/test/unit_component_test.bzl b/bazel/rules/rules_score/test/unit_component_test.bzl
index 190e4e91..47459a11 100644
--- a/bazel/rules/rules_score/test/unit_component_test.bzl
+++ b/bazel/rules/rules_score/test/unit_component_test.bzl
@@ -20,7 +20,7 @@ Tests the new hierarchical structure for S-CORE process compliance:
 """
 
 load("@bazel_skylib//lib:unittest.bzl", "analysistest", "asserts")
-load("@score_tooling//bazel/rules/rules_score:providers.bzl", "ComponentInfo", "SphinxSourcesInfo", "UnitInfo")
+load("@score_tooling//bazel/rules/rules_score:providers.bzl", "CertifiedScope", "ComponentInfo", "SphinxSourcesInfo", "UnitInfo")
 
 # ============================================================================
 # Unit Tests
@@ -69,6 +69,32 @@ def _unit_provider_test_impl(ctx):
 
 unit_provider_test = analysistest.make(_unit_provider_test_impl)
 
+def _unit_certified_scope_test_impl(ctx):
+    """Test that unit rule provides the complete certified scope set."""
+    env = analysistest.begin(ctx)
+    target_under_test = analysistest.target_under_test(env)
+
+    asserts.true(
+        env,
+        CertifiedScope in target_under_test,
+        "Unit should provide CertifiedScope",
+    )
+
+    certified_scopes = target_under_test[CertifiedScope].transitive_scopes.to_list()
+    asserts.equals(
+        env,
+        {Label(scope): True for scope in ctx.attr.expected_scopes},
+        {scope: True for scope in certified_scopes},
+        "Certified scopes should exactly match the expected scopes",
+    )
+
+    return analysistest.end(env)
+
+unit_certified_scope_test = analysistest.make(
+    _unit_certified_scope_test_impl,
+    attrs = {"expected_scopes": attr.string_list(mandatory = True)},
+)
+
 def _unit_sphinx_sources_test_impl(ctx):
     """Test that unit rule provides SphinxSourcesInfo."""
     env = analysistest.begin(ctx)