reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-runtime-routing/references/runtime-routing.md

@@ -0,0 +1,26 @@
+# Runtime Routing Checklist
+
+## Inputs That Commonly Matter
+
+- `Host`, `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Forwarded-Port`
+- Path prefixes, base path rewrites, tenant prefixes, cookie domain or path scope
+- `Origin`, websocket upgrade headers, absolute URL generation, callback base URLs
+
+## Route Map To Build
+
+1. Client-visible host, scheme, port, and path
+2. Reverse proxy or ingress rule that matches it
+3. Target service, container, pod, or local process
+4. Downstream store, worker, or peer node if the request fans out
+
+## Verification Pattern
+
+- Change one routing input at a time
+- Compare both request traces and backend behavior
+- Keep checked-in config separate from live config when they differ
+
+## Common Pitfalls
+
+- Treating a cloud-looking or public-looking hostname as external without checking sandbox routing
+- Mixing auth failures with route resolution failures
+- Explaining the path from code only without capturing one real request that proves the route