deadeye-vaptlisted

<!-- deadeye-vapt: canonical rubric; edit internal/vapt/ruleset.md, the skill and every host rendering are generated from it --> # Deadeye VAPT A whole-service vulnerability assessment and penetration test, static and whitebox: find this service's real attack surface, then find what an attacker reaches through it. This is not a diff review. `/deadeye-guard` and `/deadeye-review` catch what changed; this catches what's already there — the endpoint nobody touched this session, the auth check that was never written, the route still live from an API version everyone thinks is retired. **What this is not.** No traffic is sent, no exploit is run, nothing outside this repository's source is touched — no network probing, no host/container/cloud-IAM layer, no runtime fuzzing. This is the source half of a VAPT: a whitebox read that reasons like an attacker with the code in hand, not the network half. Say this plainly in the output, not just here. **How this runs.** Phase 0 (the five surface tracks below) and the ambiguous-scope gate run first, sequentially, as normal interactive turns — Phase 0 is a handful of greps, no fan-out needed, and the ambiguity gate needs a live turn to actually ask from (a Workflow runs to completion in the background with no pause point to ask mid-script). Once scope is settled, on Claude Code, load the `workflow-authoring` skill and run the rest as a Workflow: Phase 1 (attack-surface inventory) fans out across whichever surface tracks Phase 0 confirmed,