Endpoint Surface Map

Most services cannot answer a simple question: for each endpoint, who is allowed to call it, what credential proves that, and what authority does it run with? The answer is spread across a platform console, a config file, a middleware, and the handler bodies, and those four sources drift apart silently.

This skill produces a versioned manifest of every endpoint's trust boundary and a CI gate that fails when reality stops matching it. The report is a by-product. The manifest is the deliverable, because a report ages the moment someone adds a route.

The one rule: enumerate the universe, not the compliant subset

The instinct is to find the handlers that have a guard and check the guards agree. That check is structurally blind to the only case that matters. A privileged handler with no guard at all is absent from a guard-first model, so the job stays green.