kiro-rails

name	kiro-rails
description	Index of the kiro-rails engineering toolbox in this repo: every review command, spec workflow, subagent, and steering rule, with when to use each. Load this to decide which review or workflow to run, or to discover what kiro-rails offers. Routing only - each entry points at its own command, skill, or agent.

kiro-rails toolbox

GENERATED by scripts/export-to-claude.sh from .kiro/ - do not edit by hand. This is a routing index: it points you at the right command, skill, agent, or steering section; it does not do the work itself. The full source→target map with fidelity grades is in docs/references/kiro-claude-sync-ledger.md.

Review commands

Invoke as /<name>. Each audits one dimension; see the "Periodic Review Policy" section of CLAUDE.md for when each triggers and the recommended sequencing.

• /review-ai-agent-surface - Audit the AI and agent attack surface: prompt injection, tool-permission scope, unbounded agent loops, and unsafe handling of model output. Produces an AISR report.
• /review-api-contracts - Audit API boundary code for contract drift: response envelope consistency, error response shapes, HTTP status-code semantics, and frontend/backend type agreement.
• /review-cicd-pipeline - Audit CI/CD pipelines for missing quality gates, unpinned actions, secret exposure in logs, and deploy steps that can run without passing tests.
• /review-code-maintainability - Structural maintainability audit: god objects, hidden coupling, dead code, comment-standard compliance, and drift from documented architecture. Produces an MRR report.
• /review-code-security - Tiered application security audit (T1 pre-commit, T2 feature complete, T3 sprint end) covering OWASP, secrets, authorization, crypto quality, and supply chain. Produces an SRR report.
• /review-commit-pr-discipline - Review the current branch's commits and working tree for commit and pull-request discipline, then produce well-structured commit messages and a PR description.
• /review-css-architecture - Audit CSS and design-token usage against the console-idiom rubric: ad hoc overrides, magic values, duplicated spacing scales, and design-system drift.
• /review-dependency-risk - Audit dependency manifests for supply-chain risk: unmaintained or typosquatted packages, license conflicts, unpinned versions, and known vulnerabilities.
• /review-frontend-performance - Audit frontend performance: bundle size and code splitting, render waterfalls, N+1 data fetching, unmemoized work, and lazy-loading gaps.
• /review-hardcoded-values - Scan for embedded literals that belong in config or a constants module: URLs, magic numbers, thresholds, error message strings, and environment-dependent values.
• /review-iac-consistency - Audit infrastructure-as-code for per-environment drift, over-permissive IAM policies, unencrypted resources, and infrastructure changed outside version control.
• /review-observability - Audit logging, metrics, tracing, and correlation IDs across pipelines and background jobs. Flags blackbox code paths that emit no telemetry and cannot be debugged in production.
• /review-spec-readiness - Grade a Kiro spec (requirements, design, tasks) against the spec quality standards before implementation begins. Flags thin specs that will cause rework.
• /review-test-quality - Audit test suite quality: coverage gaps, weak assertions, missing negative cases, over-mocking, and tests that cannot fail regardless of implementation.
• /review-ux-audit - Full UX audit of a frontend codebase. Produces persona cards, journey maps, heuristic sweep, anti-pattern findings, and a prioritized fix register formatted for Kiro spec output.
• /review-ux-live - Live browser-walk UX review using the console-idiom rubric. Requires a browser MCP (Playwright, Chrome DevTools, or equivalent). Walks each page/route with a 9-step protocol, collects quantitative evidence, and produces a scored report with rubric IDs.
• /review-ux-preflight - Pre-implementation UX gate. Run before coding any UI feature to validate layout decisions, interaction placement, and hierarchy. Produces a PROCEED/REVISE/BLOCK decision.

Skills

Invoke by name (the model also auto-surfaces them by their triggers).

• auth-implementation - Authentication, SSO, OAuth, OIDC, login, redirect, token implementation patterns. Use when implementing auth flows, login pages, token refresh, SSO integration, or redirect handling.
• incident-response - Security incident response, breach containment, evidence preservation, and recovery verification. Use when a breach, compromise, or security incident is detected or suspected.
• review-guide - Interactive guide to kiro-rails review prompts, agents, and tools. Explains which review to run, when, and why. Invoke with /review-guide or ask "what reviews should I run?", "which prompt?", or "how do I audit?".
• spec-archive - Archive a completed and verified spec. Moves it from active specs to the docs archive, updates the spec registry. Use after spec-verify passes.
• spec-implement - Implement a proposed spec. Reads the spec folder, follows the task checklist, writes code using TDD. Use after spec-propose is complete and approved.
• spec-propose - Propose a new feature or change. Creates a structured spec folder with proposal, requirements, design, and tasks before any code is written. Use when starting new work.
• spec-verify - Verify a completed implementation against its spec. Checks all acceptance criteria, runs tests, validates coverage. Use after spec-implement is done.

Subagents

Spawn via the Agent/Task tool for restricted, focused work (most are read-only).

• code-security-reviewer - Performs structured code security and quality audits with restricted tool access. Supports tiered review (T1 pre-commit, T2 feature, T3 sprint).
• security-verifier - Adversarial verification agent. Assumes each security finding is a false positive and searches for compensating controls that disprove it. Use after the code-security-reviewer produces findings.
• ux-red-team - Hostile UX reviewer. Assumes the implementation is flawed. Finds friction, hierarchy issues, accessibility gaps, pointer travel problems, and pattern violations. Read-only - cannot modify code.
• ux-reviewer - Performs live browser-walk UX audits using the console-idiom rubric. Restricted to read-only browser interaction - no writes, deletes, or submissions. Requires a browser MCP.

Spec-driven workflow

For feature-sized work (a new capability, multi-file/multi-layer, new endpoints/models/UI), follow the Kiro spec cycle rather than coding ad hoc: spec-propose → spec-implement → spec-verify → spec-archive (the skills above). Specs live under .kiro/specs/.

Engineering rules (always loaded)

Every steering rule is concatenated into CLAUDE.md. Start with Agent Boundaries (the hard stops), then Git & Focus Discipline, Change Discipline, Testing Standards, and Database Conventions. The review commands above exist to enforce these rules.