[rmkr-dev]

Adds a Skillbook entry and a matching Promptbook entry for Microsoft Entra ID service-to-service auth in Spring Boot.

Skill: entra-id-spring-service-auth-guardrails

• One audience per API (v2 tokens), pinned issuer/tenant, Application-only app roles with assignment required
• roles → ROLE_, scp → SCOPE_, group object IDs mapped from config, group overage fails closed (or Graph lookup)
• Service-only routes need the role and no scp, with an optional azp/appid allowlist
• Callers use client_credentials with /.default through a cached authorized-client manager on a dedicated RestClient per downstream
• Workload identity before certificates/secrets; downstream URLs (external and svc.cluster.local) come from ConfigMap with the audience unchanged; in-cluster calls still authenticate
• Copilot / Claude Code / Codex placement notes and a SKILL.md stub

Prompt: wire-entra-service-to-service-auth

• Receiver and caller fix-up with placeholders, a ranked findings list, a test matrix, and a role matrix + URL map in the output

Catalogs go to 34 skills / 34 prompts. node scripts/site-check.mjs passes locally.