The runtime-surface spec is swaggo-generated (Makefile openapi-spec + the
openapi-spec-check drift gate), so the SSOT is the handler annotations, not the
yaml. Add @Router/@Summary/@Param/@Success/@Security blocks (+ named request/
response structs swaggo can introspect) for the 6 user-tasks routes and
GET /org/identity, then regenerate. Auth modeled to match the router:
WorkspaceAuth -> BearerAuth+OrgSlugAuth, the cross-workspace /user-tasks/pending
-> AdminAuth bearer, /org/identity open. Regen is idempotent (drift gate green).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
core-devops
266131205d