api-error-contract-testing

API Error Contract Testing

Design consistency candidates from error contracts, status codes, error codes, field structures, and sensitive information evidence, and output AEC-## findings. It only organizes traceable API quality candidates; it does not execute tests, nor does it write design checklists as coverage, pass, or release evidence.

When to Use

• When you need to extract error contract consistency candidates from error response schemas, HTTP status code conventions, error code catalogs, authentication rules, logging and redaction requirements.
• When you need to explain the rationale for selection, applicable constraints, evidence gaps, and minimum verification actions.
• When materials are incomplete but a limited first version must still be delivered, with blocked or unassessed boundaries clearly stated.

Not applicable to directly executing tests, generating unsourced contracts or behaviors, replacing a complete test strategy, or accepting risk on behalf of the Human.

Output Format Options

• Default output is Markdown; use tables, JSON, or CSV only when the user explicitly requires it or the existing delivery format requires it.
• Keep static analysis, unexecuted items, evidence status, and Human decisions separate; when there is no runtime evidence, keep unassessed, blocked, or NOT_RUN.

How to Use

1. Read prompts/api-error-contract-testing.md and provide the goal, scope, materials, environment, and existing evidence.
2. First complete the six-category input audit: known, missing, conflicting, stale, out_of_scope, assumptions.
3. Use AEC-## to record the object, preconditions, behavior of concern, source evidence, and verification method, retaining impact/priority, responsible role, closure conditions, and evidence status.
4. When materials conflict, constraints are missing, or there is no execution evidence, retain both sides and the open questions.

Domain Execution Points

• Build a contract table by operation and error trigger: HTTP status, business code, required fields/types, correlation ID, retry semantics, and redaction rules; allow sourced operation exceptions.
• Deliver an operation×error consistency table, retaining contract expectations, response observations, and sources item by item; list findings only when applicable rules are violated—differences alone are not defects.
• When forming domain candidates, you must read and follow the domain operations and determination process of prompts/api-error-contract-testing.md , retaining legitimate comparisons, evidence gaps, and verification actions item by item.

Core Constraints

• Do not execute tests, do not assume rules, versions, thresholds, data, or responses that were not provided, and do not treat the number of candidates as proof of coverage.
• File existence, name matching, design declarations, or Eval configuration do not equal real execution evidence.
• Mark unknowns as unassessed, blocked, or to be confirmed; do not fill them in with common sense.
• Do not modify requirements, code, test assets, or the target system.

Pre-Delivery Self-Check

• The six-category input audit—known, missing, conflicting, stale, out_of_scope, assumptions—has been recorded.
• Each AEC-## has a source, evidence status, impact/priority, responsible role, closure conditions, and verification method.
• Facts, inferences, recommendations, unexecuted items, and Human decisions have been distinguished.
• Design candidates have not been written as execution results, coverage proof, or release conclusions.

Reference Files

• During regression, read evals/eval.yaml and matching cases; configuration does not prove real project results.
• Trigger validation uses evals/trigger-prompts.csv and evals/local-rules.json; when skill.selection evidence is missing, report BLOCKED.

Common Pitfalls

• When the scope or evidence is incomplete, do not write method names, file existence, or candidate counts as evidence that tests were executed, covered, passed, or released.
• Do not use common sense to fill in rules, thresholds, data, environments, or results that were not provided; retain unassessed, blocked, and to-be-confirmed items.
• Do not expand this Skill's specialized candidates into a complete strategy, complete test cases, actual execution, or release decisions.

Best Practices

• Complete the six-category input audit first, then choose the smallest, traceable, and verifiable discovery scope.
• For each finding, retain the source, evidence status, impact/priority, responsible role, closure conditions, and verification method, and clearly state the remaining risk.
• Write verification recommendations as next-step actions, and do not upgrade the Skill package structure, candidate counts, or local Eval configuration into real quality conclusions.