1.1.0 — a refused endpoint is not refused knowledge

Four commits since 1.0.1. The headline one comes from a session that wrote off thirteen
credential-gated routes as a dead end and was wrong to.

A refused endpoint is not refused knowledge

A 401 is a fact about a credential, not about a feature. A product's vendor-internal ops,
abuse and support consoles ship in the customer bundle and are gated on a staff permission you
will never hold — so do not probe them, and never seek the credential. But read them. A vendor
builds an abuse console for the failures it actually suffers, so its vocabulary is a specification
of that product's production failure modes, and therefore of what anything you build on the API
should prevent or surface.

New 0.5b in references/phase0-sourcemaps.md covers this and two neighbours:

• Fixture and mock modules (services/mockData/*, __fixtures__, *.stub.ts) are the cheapest
  response shapes in the bundle — typed against the same interfaces as production, so they hand you
  envelopes, field names, nesting and status vocabularies with no request at all. They tell you
  nothing about magnitudes: one product's mock rate limits read 1000/hour and 50/minute, and
  those are a developer's placeholders. Take shapes and vocabularies; never take a number. Mark such
  rows source-fixture — weaker than source-derived, because a hand-written literal is not even
  evidence the field is still read.
• Rule registries — a front end that does not merely contain validators but enumerates them
  (rules: [{rule, reads, messages, runsOnSave}]) is the highest-leverage artefact in a bundle. It
  is a coverage checklist you can diff against whatever you implement, and you cannot notice the
  absence of a rule you never knew was declared. runsOnSave: false is the ledger's C marking
  handed over by the vendor: browser-only, server accepts the violation.
• Recording a refused sub-surface as refused-by-credential-class, dated — and re-verifying it,
  because auth verdicts decay.

New proof-ledger recipes

• R22 — a blanket 4xx over a whole sub-surface is usually one missing shared parameter. Thirteen
  routes answered 400 naming a required key; supplying it turned every one into 401. The first
  status was a fact about the request, the second about the credential, and stopping at the first
  files the surface under the wrong heading.
• R23 — a verifier that cannot fail carries no information. Run it against the known-bad state
  first; if it passes there too, it is not a verifier.
• R24 — before believing "none found", prove your reader read anything. The positive control
  belongs on the reader, not only the query: a sweep that loads zero objects and one that finds
  zero problems are indistinguishable in the output.
• R25 — an id can be a map key, not only a value. A value-walker misses {"<id>": 1}
  entirely. And when a validator passes, diff the fields it reads against the fields the schema
  declares — one asset often lives in sibling fields with only one of them checked.

R23–R25 were paid for by a session whose reference sweep reported a confident zero.

Also

• Phase 2 gains the screen is not the oracle: a service layer that falls back to fixture data
  renders a complete, convincing panel while its endpoint 401s.
• Phase 4 asks whether your own coverage record can express bad news. A two-layer reach tracker
  whose curated half can only promote a row is biased against exactly the hard cases — the harder a
  route is to reach, the likelier its verdict lives only in the curated half. An uncovered list is
  not a roadmap until each row's reach is established.
• Eight new red flags.
• Earlier, already on main: a remote that answers 200 can be a year-stale fossil; the app you mined
  is not the whole front end; host-factory-callsites extraction for requests(BASE).verb(path).

1.0.1 — profile corrections (GoHighLevel Agent Logs, ManyChat, ClickUp)

Profiles only — the skill's phases, scripts and references are unchanged.

• GoHighLevel: the Agent Logs surface (/agent-logs/* takes Bearer or token-id, either alone — R18-proven); GHL's federated AI remotes are listed in a public build manifest with the build number in the path and ship no source maps; ledger rows for the paging cap, the timestamp-keyed cursor, types-validated-values-ignored, and conversationId dropping the splitter span on /spans.
• ManyChat: the executor, the session life and the public-key source corrected; a recovered client shape is not proof the server accepts it.
• ClickUp: the unproven draft profile dropped — only proven-live profiles ship.

Install or update: npx skills add uxieee/internal-api-reverse-engineering

v1.0.0

First release. Install: npx skills add uxieee/internal-api-reverse-engineering