kora-testing-blackboxlisted

# Kora Testing Black-Box — E2E via HTTP API > **Kora sub-skill — obey the [kora-v1 meta rules](../../SKILL.md) on every task:** **R0** ensure `.kora-agent/` docs+examples are cloned · **R1** read this sub-skill before writing code · **R2** Kora APIs only — no Spring/Micronaut/Quarkus, no invented annotations or config keys · **R3** journal any incorrect Kora usage. Add comments/Javadoc only if asked. Black-box tests run the **packaged application** (the `distTar`/`installDist` artifact) inside a Docker container and exercise it only through the public HTTP API. The test never injects into or modifies the Kora graph — it runs the same code that ships. Kora builds its dependency graph at compile time, so startup is fast enough to make black-box tests a primary confidence source, not just a smoke suite. They catch what narrower tests miss: routing, `@Json` (de)serialization, `@Valid` validation, config loading, migrations, and probes all exercised together. > Kora ships **no** Testcontainers wrapper. Use the standard `org.testcontainers:*` API directly. For in-process tests with `@KoraAppTest`/`@TestComponent`, use the `kora-testing-junit-java` / `kora-testing-junit-kotlin` skills instead. --- ## Contents - [Quick Start](#quick-start) — deps, Dockerfile, AppContainer, first test - [What's in references/](#whats-in-references) and [assets/](#whats-in-assets) - [When to use vs NOT](#when-to-use-vs-not) - [Core patterns](#core-patterns) - [Common pitfalls](#common-pitfalls)