jcuervo

Build the full-stack frontend of a Rails 8.1 app with Hotwire — Turbo Drive/Frames/Streams (including Turbo 8 morphing page refreshes), Stimulus controllers, the view layer (ERB partials, ViewComponent, or Phlex), forms, assets, and rich-text editing with Action Text (the bundled Trix editor) — plus real-time features via Action Cable and Turbo Stream broadcasting over Solid Cable or Redis. Menu-driven: presents the view-layer and Cable-adapter options as vetted menus with a Recommended default, detects the app's already-chosen CSS/JS stack (owned by rails-scaffold) and existing Hotwire wiring first, and verifies pages render and live updates broadcast. Apply when building interactive UI, wiring Turbo Frames/Streams, writing Stimulus controllers, choosing a view-component approach, adding a rich-text editor, adding live/broadcast updates, or making views accessible (WCAG/Section 508). Web apps only — not API-only.

Add background jobs to a Rails 8.1 app via Active Job — choose the backend (Solid Queue, the Rails 8 default, or Sidekiq / GoodJob), write jobs with retries/discards/idempotency, enqueue with perform_later, and schedule recurring tasks (Solid Queue recurring, sidekiq-cron, or whenever). Menu-driven with a Recommended default per menu; detects the installed backend (Solid Queue is preconfigured in Rails 8, or skipped via --skip-solid), applies equally to API-only and full-stack apps, and verifies a job actually enqueues and runs. Apply when moving work off the request thread, configuring a queue backend, adding retries/error handling to a job, or scheduling recurring/cron work.

Design and evolve the ActiveRecord domain layer of a Rails 8.1 app — models, associations, validations, scopes, enums, callbacks, concerns, and type modeling (plain / STI / delegated types / polymorphic) — plus the persistence layer beneath them: migrations, indexing, constraints, schema format, multiple databases, full-text search, and seeds. Menu-driven: presents type-modeling, schema-format, and search options as vetted menus with a Recommended default, detects the app's adapter and existing models first, and verifies every change against a booted schema. Apply when adding or changing a model, writing a migration, indexing a table, modeling inheritance/variants, wiring search, splitting databases, or seeding data.

Stand up a new Ruby on Rails 8.1 app (API-only, full-stack Hotwire, or API+frontend) through a guided, menu-driven interview. The agent asks about app type, database, asset pipeline, CSS/JS, test framework, auth, and the Rails 8 omakase backends (Solid Queue/Cache/Cable, Kamal, Thruster) — each as a vetted menu with a Recommended default — assembles the right `rails new` flags, runs the generator, verifies the app boots, then routes to sibling rails-* skills to wire each concern. Also detects an existing app and routes without re-scaffolding. Apply when creating a new Rails project, choosing `rails new` flags, or deciding how to bootstrap a Rails codebase.

Make a Rails 8.1 app discoverable and correctly indexed by search engines and link unfurlers — per-page title/description/canonical meta tags, Open Graph + Twitter/X cards, JSON-LD structured data (Schema.org), XML sitemaps, robots.txt, and human/SEO-friendly URLs (slugs). Menu-driven for the genuine choices (meta-tag approach, sitemap approach, slug strategy) with a Rails-idiomatic Recommended default; detects what's already installed first, branches on config.api_only (a JSON API has no HTML to index — the rendering frontend owns its SEO), and verifies every tag/sitemap/slug actually renders and is crawlable. Apply when adding meta tags, social-share previews, structured data, a sitemap or robots.txt, or pretty URLs. Page-speed/Core Web Vitals is rails-performance; routing mechanics is rails-controllers; the view layer is rails-hotwire.

Build the JSON API surface of a Rails 8.1 app — response serialization (Jbuilder, Alba, jsonapi-serializer, Blueprinter), API versioning, pagination (Pagy/Kaminari), consistent error envelopes, CORS, OpenAPI/Swagger docs, and the token-auth surface — for API-only apps and the JSON endpoints of full-stack apps. Covers both the REST path and GraphQL (graphql-ruby) as the alternative API style. Menu-driven: presents the API style (REST vs GraphQL) plus serializer, versioning, pagination, and docs options as vetted menus with a Recommended default, detects api_only and any installed serializer/pagination/graphql gem first, and verifies endpoints return well-shaped responses with correct status codes. Apply when shaping JSON responses, versioning an API, paginating a collection endpoint, standardizing error responses, enabling CORS, documenting an API, or building a GraphQL schema.

Build the request layer of a Rails 8.1 app — routing, RESTful resources, controllers, actions, strong parameters (Rails 8 params.expect and the require/permit fallback), filters/before_actions, controller concerns, rescue_from error handling, the session/flash/cookies surface, and per-request locale selection / i18n — for both API-only and full-stack apps. Branches on config.api_only (API skips flash/views, Web uses them), detects existing routes/controllers before generating, presents the params and routing idioms as menus with a Recommended default, and verifies routes resolve and actions respond. Apply when adding routes or controllers, shaping strong params, sharing controller behavior, handling request errors, wiring sessions/flash, or setting up internationalization/locale switching.

Send transactional email from a Rails 8.1 app with Action Mailer — mailer classes, multipart HTML+text templates, layouts, attachments, inline images, previews, and delivery via SMTP (the Rails default, pointed at any provider) or Postmark / SendGrid / SES — and receive inbound email with Action Mailbox (ingress config, mailbox routing, processing). Menu-driven delivery selection with a Recommended default; detects any configured delivery method and credentials first, sends asynchronously through Active Job (deliver_later), and verifies mail renders and delivers in development. Apply when adding a mailer, building email templates, configuring email delivery, attaching files to email, previewing/testing mail, or routing/processing incoming email.

Make a full-stack Rails 8.1 Hotwire UI accessible to WCAG 2.2 AA — semantic HTML, ARIA patterns, keyboard operability, visible focus, color contrast, screen-reader support, and the focus-management gotchas specific to Turbo Drive/Frames/Streams swaps — then prove it with axe automation in system tests. Menu-driven for the conformance target and the testing approach (default WCAG 2.2 AA, axe-core in Capybara system tests). This is the canonical accessibility rubric the other design-* skills cross-link to instead of repeating; apply when auditing or fixing a11y, adding ARIA, wiring keyboard/focus behavior, or setting up automated a11y tests. Web apps only.

Build a reusable UI component library for a full-stack Rails 8.1 app — choose the component architecture (ViewComponent, Phlex, or ERB partials), adopt a UI kit (daisyUI, Flowbite, Tailwind UI, or hand-rolled Tailwind), and preview/document components in isolation with Lookbook. Menu-driven with a Recommended default per menu; detects the view layer the app already chose (honors installed view_component/phlex-rails) and the installed UI kit first, builds components from the tokens design-foundations established, and verifies they render in isolation and in a page. Apply when creating buttons/cards/badges/component primitives, organizing a design system, integrating a UI kit, or setting up component previews. Web apps only.

Design the forms of a full-stack Rails 8.1 Hotwire app for usability and accessibility — the form builder (form_with helpers, simple_form, or a form object), the layout (stacked, floating, or inline labels), and the validation/error UX (server-rendered errors via Turbo Streams with a 422, inline hints, or full reload), plus multi-step flows and accessible input patterns. Menu-driven with a Recommended default per menu; detects the installed form gem and validation approach first, builds from design-foundations tokens and design-components inputs, and verifies forms submit, show errors correctly, and pass an accessibility check. Owns form layout and error UX; defers params to rails-controllers, validations to rails-models, and Turbo response codes to rails-hotwire. Web apps only.

Establish the design-system foundations of a full-stack Rails 8.1 app — the color/spacing/typography tokens, the theming strategy, dark mode, and the modular type & spacing scale — on top of the app's chosen CSS stack (Tailwind v4 CSS-first `@theme`, Tailwind v3 `tailwind.config.js`, daisyUI semantic themes, or plain CSS custom properties). Menu-driven with a Recommended default per menu; detects the Tailwind major and any installed UI kit first (v4 configures tokens in CSS via `@theme`, v3 in JS), and verifies the stylesheet builds and the tokens render. Start here before building components — every other design-* skill consumes these tokens. Web apps only; API-only apps have no design layer.

Design the interactive UX micro-patterns of a full-stack Rails 8.1 Hotwire app — modals/dialogs, drawers, dropdowns, tabs, toast/flash notifications, inline editing, loading/skeleton states, empty states, and infinite scroll — built with Turbo Frames/Streams and Stimulus. Menu-driven with a Recommended default per menu (native <dialog> + Turbo Frame + Stimulus for overlays, Stimulus auto-dismiss + Turbo Stream for toasts, Turbo loading states + skeletons for feedback). Owns the visual/UX shape of these patterns and the accessibility contract each must meet (the canonical a11y rules live in design-accessibility); the Turbo/Stimulus plumbing is rails-hotwire. Detects the installed UI kit and Hotwire wiring first, then verifies the interaction works and is keyboard/screen-reader accessible. Apply when building any of these patterns. Web apps only.

Build the page structure and navigation of a full-stack Rails 8.1 Hotwire app — the application shell (layout + content regions, header/main/footer landmarks), primary navigation (top navbar, sidebar, or hybrid), breadcrumbs and active-state highlighting, responsive/mobile navigation, and pagination UX (Pagy). Menu-driven with a Recommended default per menu; detects the existing layout, nav, and pagination gem first, builds from design-foundations tokens and design-components primitives, and verifies the shell renders responsively with correct landmarks. Apply when creating the app layout, a navbar/sidebar, breadcrumbs, a responsive menu, or paginating a list. Web apps only.

Prove the UI of a full-stack Rails 8.1 Hotwire app actually works — system tests that exercise the rendered Turbo/Stimulus flows, visual-regression screenshots to catch unintended visual changes, automated accessibility checks (axe) wired into the suite, and Lookbook-based component review. Menu-driven with a Recommended default per menu (Selenium/headless Chrome driver, built-in screenshot diffing, axe-core a11y assertions). Owns the visual/UX assertions; the test stack itself — framework, driver, CI — is owned by rails-testing, and the a11y rules by design-accessibility. Detects the installed test framework and driver first, then verifies the UI renders, matches its baseline, and is accessible. Apply when testing UI flows, catching visual regressions, or gating a11y in CI. Web apps only.

Audit the dependency tree of an Expo React Native project for known CVEs, outdated packages, license compliance issues, lockfile tampering, and supply-chain risks specific to native modules. Apply ONLY when the task is a dependency-focused security or compliance review — vulnerability triage, pre-submission license check, response to a CVE disclosure, or lockfile diff review. Do NOT apply for routine `npm install`, package additions, or version bumps that are part of normal feature work.

Bridge native iOS (Swift) and Android (Kotlin) code into Expo React Native apps. Prefer the Expo Modules API for new modules; fall back to React Native Turbo Modules only when Expo Modules cannot express the requirement. Apply when wrapping a native SDK, exposing platform APIs, or writing a config plugin.

Build, sign, and ship Expo React Native apps to the App Store and Google Play via EAS (Expo Application Services). Covers EAS Build profiles, EAS Submit, EAS Update (OTA), iOS and Android code signing, and store metadata. Apply when configuring build pipelines, releasing to production, setting up OTA updates, or troubleshooting signing.

Scaffold and wire up a new Expo (managed) React Native project using curated menus per concern. The agent presents 2-5 vetted alternatives for each of navigation, state, server data, styling, storage, forms, lists, animations, auth, and observability — and implements whichever the user picks. Apply when creating a new project, adding a core library, restructuring folders, or wiring up an unmet concern in an existing project.

Audit Expo React Native apps for mobile-specific security issues — JS bundle secret leakage, insecure storage of tokens, unvalidated deep links, WebView misconfiguration, over-broad native permissions, and OWASP MASVS gaps. Apply ONLY when the task explicitly asks for a security review, threat model, store-submission security check, or remediation of a known mobile vulnerability. Do NOT apply for general code review, performance work, or routine feature work.

Test strategy and setup for Expo React Native apps. Jest + React Native Testing Library for unit/component tests, Maestro for end-to-end. Apply when writing tests, configuring CI test runs, or mocking native modules.

Bootstrap a new, production-leaning Ruby on Rails application on the latest Rails (8.1.x) and Ruby (4.0.x), with version pinning, sensible defaults, and verification. Use this skill whenever the user wants to start, scaffold, generate, or set up a new Rails app, mentions `rails new`, asks for a Rails project skeleton or starter, or says things like "spin up a Rails API", "create a new Rails 8 app", or "bootstrap a Rails project" — even if they don't name the skill explicitly. Do NOT use it for modifying an existing Rails app, upgrading Rails versions, or non-Rails projects. To only verify an app that already exists, use the rails-verify skill instead.

Verify that an existing Ruby on Rails application actually works: it eager-loads cleanly, boots a real web server that answers the /up health check, and passes its test suite. Use this skill when the user wants to confirm a Rails app is healthy, sanity-check a checkout or a freshly cloned repo, gate a deploy, or run a "does this thing even boot?" check — against an app that ALREADY EXISTS. Do NOT use it to create or scaffold a new app (use rails-bootstrap for that); the rails-bootstrap skill already calls this same verification at the end of a bootstrap, so there is no need to run both back to back.

Comprehensive Ruby on Rails application audit covering coding standards, testing, security, architecture, and generates results as a PDF deck