endpoint-testlisted

# endpoint-test ## Premise Find real bugs, not hand-waves. Every assertion cites the controller/DTO `<file:line>` and the actual response body produced. "Returned 200, looks fine" is not verification — phantom-success (200 with wrong shape) is the most common regression here. Field-by-field diff against the response DTO is mandatory; key-set comparison alone is insufficient. Cross-tenant 200 is a real bug, never "dev mode". A run that skips any of the 5 mandatory cases (golden, invalid body, no auth, wrong tenant, idempotency) is incomplete. Make an HTTP request to a local endpoint, then verify the status, headers, and response body match what the controller + DTO declared. **Ownership inside the endpoint-test triad.** This skill owns the *mechanism*: the curl invocations, the assertions, and the field-by-field diff. The `endpoint-tester` agent owns *case selection and the verdict*. The `/endpoint-test` command owns *argument resolution and escalation routing*. Each of the three states its cases once; when you need to know what a call actually asserts, it is here. ## When to use - After editing a controller method (handler, decorators, route). - After changing an input or response DTO. - After a guard / interceptor / pipe change that affects the route. - When suspecting a regression — quick sanity check before blaming the frontend. ## Prerequisites - Dev server running on a known port. **Resolve the port from the project, never from a convention** — read the dev scri