egress-tracelisted

# Skill: egress-trace ## Premise Data transfer is the cost line with no owner. It does not appear in an application's metrics, it is not attached to a resource anyone provisioned, and it is billed on a dimension — bytes crossing a boundary — that no engineer has in their head while writing code. It is therefore routinely the largest line nobody can explain. Every finding names the **boundary crossed**, the **component pair**, the observed bytes, and the price with an as-of date. A transfer finding without a boundary is not a finding, because the price differs by an order of magnitude across boundaries. ## Halt conditions - **Network flow logs unavailable** and the transfer line cannot be decomposed. Report the total, name the missing telemetry, and stop — attributing transfer by guesswork produces confident nonsense. - **Topology unknown** — which components sit in which zone, region, and network. Transfer cost is a property of the topology, not of the code. - **Provider boundary pricing unknown** for the boundaries in play (they differ substantially, and several bill both directions on internal crossings). - **Managed-service internal transfer opaque** — some services bill transfer inside their own line item and expose no breakdown. Say so rather than assigning it to a component pair. ## When to run - Transfer is more than a few percent of the bill and nobody can say why. - After any topology change: a new zone, a new region, a service moved, a peering or gateway adde