anantbhandarkar
UserMake It Right — constraint-first backend reliability skills for AI coding agents. 3 tiers (generic → runtime → framework) across 9 runtimes; stops AI shipping confident-but-wrong backend code. Apache-2.0.
Categories
Indexed Skills (46)
mir-backend-beam-phoenix
Make It Right (Phoenix module). Phoenix + LiveView + Ecto + Plug + PostgreSQL specific reliability augmentation. Chains: mir-backend (generic gates) -> mir-backend-beam (BEAM runtime) -> this (Phoenix/LiveView/Ecto/Plug library mechanics). Adds the mechanical footguns the framework-agnostic tiers omit: LiveView per-connection process memory, with streams vs temporary_assigns for large collections; the async-assign APIs (assign_async/4, start_async/4 + handle_async/3, cancel_async/3) and why a bare Task.async in a LiveView kills the LiveView on crash; handle_event as a public websocket endpoint that must re-authorize on every event; Phoenix 1.8 scopes threading %Scope{} through context functions; Ecto N+1 on unloaded associations; changeset cast/4 as the mass-assignment allow-list; and migration safety on populated tables (concurrently, disable_ddl_transaction, expand/contract, NOT VALID + VALIDATE). TRIGGER only when the BEAM backend stack is Phoenix - building, reviewing, or debugging a Phoenix controller, L
mir-backend-beam
Make It Right (BEAM runtime tier). Erlang VM / BEAM reliability footguns shared across every BEAM-based backend (Phoenix, Nerves, Broadway, pure Erlang/OTP) — distinct from the generic backend gates and from any one framework's mechanics. Covers: let-it-crash + supervision tree design (restart strategies, max_restarts escalation, poison-message crash-loops and why a catch-all handle_info does NOT stop them), unbounded mailbox growth and real backpressure (a GenServer.call timeout does not shed load; GenStage/Broadway; OTP 28 priority messages are not backpressure), hot GenServer as a serial bottleneck and when to use ETS / :counters / :persistent_term instead, blocking handle_call timing out callers, per-process heap isolation and refc-binary retention, distributed Erlang hazards (netsplits, :global, pairwise ordering, :erpc), what Elixir's set-theoretic type checker does and does not catch, and VM-level security (binary_to_term, atom exhaustion, distribution cookie/EPMD, :os.cmd vs System.cmd, OTP TLS/term-d
mir-backend-bun-hono
Make It Right (Hono module). Hono 4 reliability augmentation for backends on the Web-standard Request/Response model - Bun, Cloudflare Workers, Deno, and Node via @hono/node-server. Footguns the runtime tiers omit: the request body is a stream read once, so c.req.raw throws after a validator ran; use cloneRawRequest; `await next()` never throws, so try/catch cleanup middleware sees nothing and the error lands in c.error instead; validator() parses but does not authorize, and yields an empty object when Content-Type is missing; the hono/bun vs hono/cloudflare-workers adapter split, where Node built-ins, the filesystem, and module-scope state work on Bun and fail on Workers. Plus 2026 advisories: CORS credentials-with-wildcard origin reflection (CVE-2026-54290, HIGH). Chains: mir-backend -> mir-backend-bun (or mir-backend-node when served through @hono/node-server) -> this. TRIGGER only when the web framework is Hono - a Hono route, middleware, validator, RPC client, adapter, or stream handler, on any runtime.
mir-backend-bun
Make It Right (Bun runtime tier). Bun 1.3 reliability footguns shared across every Bun backend (Bun.serve, Hono, Elysia, or Express under bun) - Bun is a separate runtime on JavaScriptCore, not a faster Node. Covers: Node API gaps that present as silent stubs rather than errors, caught in CI or not at all; native addons that require() cleanly then abort on first real use; Bun.serve defaults that differ from node:http (10s idleTimeout that kills SSE, development:true leaking source in 500 pages); the single-thread model and silently ignored worker_threads options; bun:test running every file in ONE process with leaking globals; the text bun.lock and the blocked-install-scripts default. Chains: mir-backend -> this -> framework module. TRIGGER when the service runs on Bun in production, or when a Node-deployed project uses bun install / bun test in CI (then only the lockfile, install-script, and test sections apply). SKIP when the production runtime is Node.js with npm/pnpm/yarn - that is mir-backend-node, which
mir-backend-dotnet-aspnetcore
Make It Right (ASP.NET Core module). ASP.NET Core 10 + Minimal APIs + EF Core 10 footguns. Covers: DI lifetime errors (AddDbContext Scoped vs singleton capture, IHttpContextAccessor caveats), middleware pipeline ORDER (UseRouting -> UseAuthentication -> UseAuthorization -> UseAntiforgery -> endpoints; wrong order silently disables auth), model binding overposting onto EF entities and why [Bind] does NOT work on JSON bodies, response DTO discipline against field leakage, EF Core N+1 and the EF Core 10 parameterized-collection translation change, ExecuteUpdate/ExecuteDelete bypassing the change tracker, object-level authorization (IDOR via a valid token, no resource check), .NET 10 AddValidation, the non-short-circuiting antiforgery middleware, and CORS credentials misconfiguration. Chains: mir-backend -> mir-backend-dotnet (CLR runtime) -> this, which adds only ASP.NET Core / EF Core library mechanics. TRIGGER only when the .NET backend stack uses ASP.NET Core or Minimal APIs — building, reviewing, or debuggin
mir-backend-dotnet
Make It Right (.NET runtime tier). CLR/CoreCLR reliability footguns shared across every .NET backend framework. Covers: runtime version currency (.NET 10 is the current LTS; 8 and 9 leave support 10 Nov 2026), sync-over-async deadlock and thread-pool starvation (.Result/.Wait()/.GetAwaiter().GetResult()), ConfigureAwait(false) in library code, ValueTask misuse, IDisposable/IAsyncDisposable discipline and HttpClient socket/DNS exhaustion, DbContext thread-safety and lifetime, DI captive dependency (Scoped or Transient injected into Singleton) with ValidateScopes only running in Development, CancellationToken propagation, BackgroundService host-kill semantics, the DATAS server-GC default, trimming/Native AOT reflection breakage, and CLR-level security (BinaryFormatter removal, ProcessStartInfo.ArgumentList, Path.Combine traversal, SSRF via HttpClient redirects, NuGet lockfile and package source mapping). Chains: mir-backend -> this -> framework module. TRIGGER when the backend runtime is .NET / CLR — any C# or
mir-backend-go-echo
Make It Right (Echo module). Echo web framework reliability augmentation for Go backends, covering Echo v5 (current) and v4 (maintained). Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Echo library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: echo.Context comes from a sync.Pool and must never be retained past the handler or handed to a goroutine; the v4->v5 rewrite that AI mixes up (Context became a *echo.Context struct, Logger became *slog.Logger, HTTPErrorHandler's arguments swapped, e.Shutdown and e.Close removed in favour of StartConfig); Bind never validates, so a missing c.Validate ships unchecked input, and Bind merges path and query values into one struct, a mass-assignment path; middleware ordering and graceful shutdown; and Echo's insecure defaults - c.RealIP() trusts X-Forwarded-For unless IPExtractor is set, and middleware.Secure sends no HSTS or CSP. TRIGGER only when the Go backend uses the Echo framework - building, reviewing, or debuggi
mir-backend-go-fiber
Make It Right (Fiber module). Fiber web framework reliability augmentation for Go backends, covering Fiber v3 (current) and v2 (still patched). Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Fiber library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: fiber.Ctx and every value read from it (Body, Params, Query, Headers) are pooled and reused after the handler returns, so retaining them corrupts or discloses another request's data; the v2->v3 API rewrite that AI mixes up (Ctx is now an interface, BodyParser became c.Bind().Body(), c.Context() returns a context.Context, TrustedProxies became TrustProxyConfig); c.Bind() silently skips validation when fiber.Config.StructValidator is nil; fasthttp's incompatibility with net/http middleware; and graceful shutdown via ListenConfig.GracefulContext or app.ShutdownWithContext, which hangs on keep-alive connections when ReadTimeout is 0. TRIGGER only when the Go backend uses the Fiber framework - building, reviewin
mir-backend-go-gin
Make It Right (Gin module). Gin web framework reliability augmentation for Go backends. Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Gin library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: *gin.Context is request-scoped and pooled, so it must be copied with c.Copy() before any spawned goroutine touches it; passing *gin.Context as a context.Context silently drops cancellation unless engine.ContextWithFallback is set; binding and validation discipline (ShouldBindJSON, binding tags, a separate request struct, EnableDecoderDisallowUnknownFields); middleware ordering and graceful shutdown wiring (http.Server.Shutdown on SIGTERM); and Gin's insecure defaults - SetTrustedProxies defaults to 0.0.0.0/0 so c.ClientIP() is attacker-controlled, and gin-contrib/cors will emit credentials with a reflected origin. TRIGGER only when the Go backend uses the Gin framework - building, reviewing, or debugging a Gin handler, middleware, or router. SKIP for Fiber (mir-ba
mir-backend-go
Make It Right (Go runtime tier). Go 1.25/1.26 runtime reliability footguns shared across every Go backend framework (Gin, Fiber, Echo, chi, stdlib net/http) — distinct from the generic backend gates and from any one framework's mechanics. Covers: goroutine leaks (the #1 Go reliability bug) and the runtime goroutineleak profile, context propagation and cancellation, data races and `go test -race`, channel ownership rules, goroutine-level panic recovery, the nil-interface/nil-pointer trap, defer-in-loop resource buildup, slice aliasing, error wrapping with errors.Is/As/AsType, sync.WaitGroup.Go, the Go 1.22 per-iteration loop-variable change and its go.mod gating, deterministic concurrency tests with testing/synctest, container-aware GOMAXPROCS, log/slog structured logging, and Go-level security mechanics (http.Server timeouts, net/http CrossOriginProtection, os.Root path containment, SSRF dialer control, module checksum verification, govulncheck). TRIGGER when the backend runtime is Go — sits between mir-backe
mir-backend-jvm-micronaut
Make It Right (Micronaut module). Micronaut 5.x / 4.x + Micronaut Data + Micronaut Security + Netty footguns. Covers: compile-time DI and AOT (bean definitions are generated at build, but resolution is still runtime, so NoSuchBeanException/NonUniqueBeanException surfaces after startup because singletons are lazy), bean scope pitfalls (@Singleton default), blocking the Netty event loop (@ExecuteOn(TaskExecutors.BLOCKING), virtual-thread backed where supported, or reactive types), Micronaut Data repository transaction scoping and self-invocation, compile-time AOP interceptor limits on final/private/new-ed instances, and Micronaut security (CORS wide open when enabled with no configurations, allowCredentials defaulting to true on 4.x and false on 5.x, @Secured object-level authorization, and the HTTP-client credential-leakage and unbounded-redirect advisories). Chains: mir-backend -> mir-backend-jvm -> this, which adds only Micronaut library mechanics. TRIGGER only when the JVM backend stack is Micronaut — build
mir-backend-jvm-quarkus
Make It Right (Quarkus module). Quarkus 3.x (LTS 3.33) + Hibernate ORM/Panache + Quarkus REST (formerly RESTEasy Reactive) + Mutiny footguns. Covers: build-time DI (reflection must be registered with @RegisterForReflection or it fails only at native runtime), the Quarkus REST execution model (the return type picks the thread — Uni/Multi/CompletionStage run on the Vert.x event loop, everything else on a worker thread), blocking inside Mutiny pipelines, @RunOnVirtualThread, build-time vs runtime config keys and secrets baked into a native binary, native-image gotchas, and Quarkus security (deny-unannotated-endpoints defaulting to false, CORS config, the quarkus-rest-csrf extension, Panache active-record mass assignment, and the path-normalization authorization-bypass advisories against quarkus.http.auth.permission policies). Chains: mir-backend -> mir-backend-jvm -> this, which adds only Quarkus library mechanics. TRIGGER only when the JVM backend stack is Quarkus — building, reviewing, or debugging a Quarkus R
mir-backend-jvm-spring
Make It Right (Spring Boot module). Spring Boot 4.x / Framework 7 + Spring Data JPA/Hibernate + Spring Security 7 + MVC/WebFlux footguns. Covers: @Transactional self-invocation (a same-bean call bypasses the proxy, so no transaction), checked exceptions not rolling back by default, JPA/Hibernate N+1 and LazyInitializationException plus the open-in-view default, @Async on Boot's auto-configured applicationTaskExecutor (unbounded queue, swallowed exceptions, spring.threads.virtual.enabled), the Jackson 3 and Boot 3.x-to-4 migration cliff, @Valid + DTOs against overposting, and Spring Security object-level authorization plus the current authorization-bypass advisories (NimbusJwtDecoder issuer validation, method security on parameterized types, Actuator health-group paths, versioned static-resource path traversal). Chains: mir-backend (gates) -> mir-backend-jvm (JVM runtime) -> this, which adds only Spring library mechanics. TRIGGER only when the JVM backend stack is Spring Boot — building, reviewing, or debuggin
mir-backend-jvm
Make It Right (JVM runtime tier). Java 25/21 LTS and Kotlin runtime reliability footguns shared across every JVM backend framework — distinct from the generic backend gates and from any one framework's mechanics. Covers: thread-pool sizing and pool-exhaustion deadlock, blocking I/O on platform threads, virtual threads after JEP 491 (synchronized no longer pins on Java 24+, jdk.VirtualThreadPinned JFR event) and virtual threads not bounding concurrency, GC choice (G1, ZGC, Generational Shenandoah) and container-aware heap sizing (-XX:MaxRAMPercentage), cold start (Leyden AOT cache, AppCDS, GraalVM native image, CRaC), JMM visibility and data races, ThreadLocal leaks in pooled threads, and JVM-level security (untrusted deserialization and ObjectInputFilter, XXE defaults, SSRF to the cloud metadata IP, Security Manager disabled since JDK 24, Maven/Gradle dependency verification). Chains: mir-backend -> this -> framework module. TRIGGER when the backend runtime is Java or Kotlin on the JVM. SKIP for Python, Node,
mir-backend-node-express
Make It Right (Express module). Express 5 (now the npm default) + Express 4 maintenance-line reliability augmentation. Use alongside mir-backend and mir-backend-node when the target stack is Express — it carries the mechanical footguns that the framework-agnostic tiers deliberately omit: what Express 5 does and does not auto-catch for async handlers, the path-to-regexp route-syntax break that makes `app.get('*')` throw at boot, req.body being undefined rather than {}, the simple-vs-extended query parser change, middleware ordering as a hard contract, error-handler arity, the absence of built-in validation and what fills the gap, CORS/helmet/rate-limit being off by default, trust-proxy spoofing, and object-level authorization gaps that structural frameworks catch but Express doesn't. TRIGGER only when the Node backend stack is Express used directly — building, reviewing, or debugging an Express route, middleware, or error handler. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-node (V8 even
mir-backend-node-fastify
Make It Right (Fastify module). Fastify 5 + Node.js specific reliability augmentation. Use alongside mir-backend and mir-backend-node when the target stack is Fastify — it carries the mechanical footguns that the framework-agnostic tiers deliberately omit: schema-first validation and response serialization (and the data-leak risk of skipping the response schema), the fact that additionalProperties:false STRIPS rather than rejects under Fastify's default Ajv settings, the v5 full-JSON-schema requirement, server defaults that ship wide open (requestTimeout 0, connectionTimeout 0, maxParamLength 100, trustProxy false), the reply lifecycle and double-send traps, plugin encapsulation and decorator scoping, hook ordering for authentication, and the Content-Type validation-bypass CVE chain. TRIGGER only when the Node backend stack is Fastify used directly — building, reviewing, or debugging a Fastify route, plugin, hook, schema, or error handler. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-nod
mir-backend-node-nestjs
Make It Right (NestJS module). NestJS 11 + TypeScript specific reliability augmentation. Use alongside mir-backend and mir-backend-node when the target stack is NestJS — it carries the mechanical footguns that the framework-agnostic tiers deliberately omit: singleton DI scope bleeding request state across users, the full execution-order pipeline (middleware → guards → interceptors → pipes → handler → interceptors → exception filters) and why middleware is not a security boundary on the Fastify adapter, ValidationPipe with whitelist and forbidNonWhitelisted to stop mass assignment, ClassSerializerInterceptor as the outbound allow-list, the Express 5 route-syntax break that NestJS 11 inherits, the TypeScript 7 compiler-API break that stops nest build, and offloading durable work to BullMQ rather than running it in a request. TRIGGER only when the Node backend stack is NestJS — building, reviewing, or debugging a NestJS controller, provider, module, guard, pipe, interceptor, or exception filter, on either the Ex
mir-backend-node
Make It Right (Node.js runtime tier). V8/Node 22–26 runtime reliability footguns that are shared across EVERY Node backend framework (Express, Fastify, NestJS, Hapi, Koa) — distinct from the generic backend gates and from any one framework's mechanics. Covers: the single-threaded event loop and what blocks it (sync I/O, huge JSON, synchronous crypto/zlib, long CPU loops, pathological regex), the absence of CPU parallelism on one process and how to get it (worker_threads / cluster), unhandled promise rejection crashes, serializing awaits in a loop vs. bounded Promise.all concurrency, stream backpressure, AbortSignal.timeout on every outbound call, uncaughtException semantics, heap limits under container memory, graceful shutdown with keep-alive sockets, async-context loss across callbacks and timers, require(esm) and native TypeScript type stripping, and npm supply-chain defaults after the 2025–2026 registry compromises. TRIGGER when the backend runtime is Node.js / V8 — sits between mir-backend (generic gates
mir-backend-php-laravel
Make It Right (Laravel module). Laravel 13 / 12 + Eloquent ORM + MySQL/PostgreSQL + Redis + Laravel Queues + Octane + the Laravel AI SDK — mechanical reliability augmentation. Use alongside mir-backend and mir-backend-php when the target stack is Laravel; it carries the footguns the framework-agnostic tiers deliberately omit: Eloquent N+1 and automatic eager loading, mass assignment via $fillable/$guarded and the forceFill bypass, queued vs. inline work with the Laravel 13 job attributes, DB::transaction() boundaries and afterCommit semantics, migrations that are NOT transactional on MySQL, Octane container/request/config injection bleed, and prompt injection plus tool authorization in the Laravel AI SDK. TRIGGER only when the PHP backend stack is Laravel — building, reviewing, or debugging a Laravel controller, Eloquent model, Job, migration, policy, middleware, or AI agent/tool. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-php (Zend Engine runtime concerns: shared-nothing lifecycle, FP
mir-backend-php-symfony
Make It Right (Symfony module). Symfony 8.1 / 7.4 LTS + Doctrine ORM 3 + PostgreSQL/MySQL + Messenger + API Platform — mechanical reliability augmentation. Use alongside mir-backend and mir-backend-php when the target stack is Symfony; it carries the footguns the framework-agnostic tiers deliberately omit: Doctrine N+1 via lazy proxies, Unit of Work memory exhaustion in batch loops, the EntityManager closing after a failed flush, service-container singletons and ResetInterface under worker runtimes, Serializer normalization AND denormalization groups, Messenger with #[AsMessageHandler] and idempotent handlers, request-to-DTO mapping with #[MapRequestPayload]/#[MapQueryString]/#[MapUploadedFile], and the removal of Request::get() in Symfony 8. TRIGGER only when the PHP backend stack is Symfony — building, reviewing, or debugging a Symfony controller, Doctrine entity/repository, Messenger handler, Voter, migration, or DI service. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-php (Zend Engin
mir-backend-php
Make It Right (PHP runtime tier). Zend Engine / PHP 8.4–8.5 runtime reliability footguns that are shared across EVERY PHP backend framework (Laravel, Symfony, WordPress, Slim, Lumen) — distinct from the generic backend gates and from any one framework's mechanics. Covers: shared-nothing request lifecycle under PHP-FPM and why static/global state does not persist, concurrency = pm.max_children (not threads), long-running worker runtimes (FrankenPHP, Swoole, RoadRunner, Laravel Octane) and the state-bleed/memory-leak inversion they introduce, max_execution_time not counting blocked I/O, memory_limit, opcache plus the PHP 8.4 opcache.jit default flip, persistent PDO connection state, SIGTERM handling in queue workers, PHP's error/exception model in production, and runtime-level security settings (register_argc_argv, session.use_strict_mode, unserialize, parse_url/SSRF, Composer supply chain). TRIGGER when the backend runtime is PHP and the concern is the engine, the php.ini, or the process model — sits between m
mir-backend-python-django
Make It Right (Django module). Django 6.1 / 5.2 LTS + Django REST Framework specific reliability augmentation. Use alongside the mir-backend skill when the target stack is Django — it carries the mechanical footguns that the framework-agnostic skill deliberately omits: ORM N+1 with select_related/prefetch_related and the new QuerySet.fetch_mode() (FETCH_PEERS / FETCH_RAISE), queryset laziness and result caching, migration safety on populated tables (lock_timeout, AddIndexConcurrently, db_default), transaction.atomic() and on_commit() boundaries, mass assignment through ModelForm and DRF serializers, async views and the async ORM (transactions do NOT work in async; CONN_MAX_AGE must be off), the built-in django.tasks background framework added in 6.0, signal side-effect traps, and Django's own 2026 security advisories. TRIGGER only when the Python backend stack is Django — building, reviewing, or debugging a Django view, model, serializer, migration, task, or admin. Always loads TOGETHER WITH mir-backend (the
mir-backend-python-fastapi
Make It Right (FastAPI module). FastAPI + Starlette + Async SQLAlchemy 2.0 + Postgres + Alembic + Redis specific reliability augmentation. Use alongside the mir-backend skill when the target stack is FastAPI — it carries the mechanical footguns that the framework-agnostic skill deliberately omits: async session lifecycle and scope, engine creation in lifespan (on_event is deprecated), Pydantic v2 validation boundaries, Annotated[...]-based Depends() auth and object-level authorization, BackgroundTasks vs a real queue, async N+1 with selectinload, greenlet/sync-driver-in-async traps, Starlette threadpool saturation, Alembic migration safety on populated tables, Redis idempotency/locking patterns, and the 2026 Starlette advisory set (Host-header path poisoning, form-limit bypass, StaticFiles UNC). TRIGGER only when the Python backend stack is FastAPI — building, reviewing, or debugging a FastAPI endpoint, dependency, Starlette middleware, SQLAlchemy session, or Alembic migration. Always loads TOGETHER WITH mir-
mir-backend-python-flask
Make It Right (Flask module). Flask 3.1 + Werkzeug 3.1 specific reliability augmentation. Use alongside the mir-backend skill when the target stack is Flask — it carries the mechanical footguns that the framework-agnostic skill deliberately omits: app/request context misuse (current_app/request/g outside a context, background threads, Celery tasks), missing input validation and object-level authorization, SQLAlchemy session scoping and teardown, the app-factory pattern and circular imports, offloading heavy work to Celery/RQ, Flask 3.1 config safety (SECRET_KEY_FALLBACKS key rotation, TRUSTED_HOSTS after the SERVER_NAME behaviour change, MAX_CONTENT_LENGTH / MAX_FORM_MEMORY_SIZE / MAX_FORM_PARTS, debug-mode RCE), Alembic migration safety via Flask-Migrate, and Flask's own 2026 advisories. TRIGGER only when the Python backend stack is Flask — building, reviewing, or debugging a Flask route, blueprint, extension, SQLAlchemy session, or Flask-Migrate revision. Always loads TOGETHER WITH mir-backend (the gates) a
mir-backend-python
Make It Right (Python runtime tier). CPython runtime reliability footguns that are shared across EVERY Python backend framework (FastAPI, Django, Flask, Celery) — distinct from the generic backend gates and from any one framework's mechanics. Covers: the GIL and the free-threaded build (PEP 703/779, officially supported since 3.14 but not the default), async-vs-sync 'coloring', blocking the event loop, choosing asyncio vs threads vs multiprocessing vs subinterpreters vs a worker queue, fork-safety of connection pools and the 3.14 forkserver default change, lazy annotations (PEP 649/749), serverless cold starts, dropped-task exceptions, and runtime-level security (unsafe deserialization, archive extraction, shell arguments, SSRF, packaging supply chain). TRIGGER when the backend runtime is Python — sits between mir-backend (generic) and the framework module (e.g. mir-backend-python-fastapi). SKIP for Node/JVM/Go/Rust/.NET/Ruby/PHP/BEAM runtimes (each has its own mir-backend-<runtime> tier), and for framework-l
mir-backend-ruby-rails
Make It Right (Rails module). Ruby on Rails 8.1 specific reliability augmentation. Use alongside mir-backend and mir-backend-ruby when the target stack is Rails — carries the mechanical footguns the framework-agnostic skills deliberately omit: ActiveRecord N+1 and eager-loading strategies, params.expect / strong parameters and mass-assignment safety, callback side-effect timing (after_commit vs after_save) and jobs enqueued inside transactions, transaction semantics and nested transactions, migration safety on populated tables (the #1 Rails production incident class), connection pool sizing across the Rails 8 primary/cache/queue/cable databases, and the Rails security defaults and Active Storage advisories. TRIGGER only when the Ruby backend is Rails — building, reviewing, or debugging a Rails controller, model, concern, migration, Active Storage attachment, or background job that uses ActiveRecord. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-ruby (YARV runtime: GVL, Ractors, YJIT, Puma
mir-backend-ruby
Make It Right (Ruby runtime tier). YARV/MRI Ruby 4.0 runtime reliability footguns shared across EVERY Ruby backend framework (Rails, Sinatra, Hanami, Sidekiq/Solid Queue workers) — distinct from the generic backend gates and from any one framework's mechanics. Covers: the GVL (threads give no CPU parallelism, like Python's GIL), the reworked Ractor API in Ruby 4.0, YJIT/ZJIT enablement, Puma's forked-worker + thread model, fork-safety of DB/Redis connections, copy-on-write memory and per-worker bloat, background job hygiene (idempotency, retries), GC/string-literal pressure, and the Rack/Puma/Bundler security layer every Ruby web app inherits. TRIGGER when the backend runtime is Ruby — sits between mir-backend (generic) and the framework module (e.g. mir-backend-ruby-rails). SKIP for Node/JVM/Go/Rust/.NET/Python/PHP/BEAM runtimes (each has its own mir-backend-<runtime> tier), and for Rails/ActiveRecord library mechanics — N+1, strong parameters, callbacks, migrations, Active Storage — which belong to mir-back
mir-backend-rust-actix
Make It Right (Actix-web module). Actix-web 4.x + async Rust specific reliability augmentation. Use alongside mir-backend and mir-backend-rust when the target stack is Actix-web — it carries the mechanical footguns that the framework-agnostic tiers deliberately omit: the multi-worker app data trap (state constructed inside the App factory closure yields N independent copies, not one shared instance), web::Data<T> Arc semantics versus web::ThinData, the removed .data() method, worker-local single-threaded actix-rt execution (!Send types allowed, guard-across-await compiles and deadlocks, blocking starves the whole worker), web::block for blocking work, the real default body limits behind JsonConfig and PayloadConfig, Route::wrap ordering that used to silently drop route middleware, and error handling via the ResponseError trait. TRIGGER only when the Rust backend framework is Actix-web — building, reviewing, or debugging an Actix-web handler, middleware, extractor, or App factory. Always loads TOGETHER WITH mi
mir-backend-rust-axum
Make It Right (Axum module). Axum 0.8 + Tower + async Rust specific reliability augmentation. Use alongside mir-backend and mir-backend-rust when the target stack is Axum — it carries the mechanical footguns that the framework-agnostic tiers deliberately omit: the 0.8 route syntax change (/:id now panics, use /{id}), extractor ordering (body-consuming extractors must be last), custom extractors after the #[async_trait] removal in axum-core 0.5, typed State<T> vs Extension<T> and the FromRef sub-state pattern, implementing IntoResponse for error types without leaking internals, DefaultBodyLimit, and Tower middleware layer ordering (outermost wraps first). TRIGGER only when the Rust backend framework is Axum — building, reviewing, or debugging an Axum handler, router, extractor, or Tower middleware. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-rust (Tokio runtime concerns: blocking, guard-across-await, cancellation safety, async traits, Arc/'static, backpressure, timeouts); this module onl
mir-backend-rust
Make It Right (Rust runtime tier). Async Rust on Tokio runtime reliability footguns that are shared across EVERY Rust backend framework (Axum, Actix-web, Warp, Poem) — distinct from the generic backend gates and from any one framework's mechanics. Covers: blocking the async runtime (std::thread::sleep / blocking I/O inside async tasks starves Tokio worker threads), holding a std::sync::MutexGuard across an .await point (Send error on a multi-thread runtime, silent deadlock on a current-thread one), cancellation safety (futures dropped at any .await under timeout/select!/disconnect leaving partial state), panic-poisoned Mutexes, Arc-based shared state with 'static bounds on spawned tasks, async fn in traits and the still-unsolved Send-bound problem, spawn_blocking thread-pool exhaustion, bounded vs unbounded channels for backpressure, and timeout discipline on every outbound call. TRIGGER when the backend runtime is Rust — sits between mir-backend (generic) and the framework module. SKIP for Python/Node/JVM/Go
mir-backend
Make It Right (backend pillar). Constraint-first backend planning protocol for AI coding agents — AI makes code that WORKS on the happy path; this makes it RIGHT under concurrency, failure, and load. Forces the model OUT of pattern-completion ('autocomplete from latent space') and INTO explicit constraint discovery before any code is written. Use whenever a task involves backend logic that changes state, touches money/inventory/auth, spans multiple tables or services, runs under concurrency, or persists data beyond a single request. Runs a hard-gated pipeline: Intent → Constraint Interrogation → Assumption Ledger → Invariants & Failure Modes → Risk Register → Design Review → Implementation → Production-Readiness Review. Spawns specialized reviewer sub-agents. Chains into a runtime tier (e.g. mir-backend-python for CPython concerns) and a framework module (e.g. mir-backend-python-fastapi for FastAPI/SQLAlchemy/Alembic). TRIGGER for backend work in ANY language (Python, Node, TypeScript, Go, Rust, Java, Kotlin,
mir-cloud
Make It Right (cloud pillar). Constraint-first infrastructure selection across AWS, GCP, Azure and Cloudflare - AI names whichever provider its training data mentions most; this ranks them from the workload's own numbers. Characterizes the workload first (egress GB/month, latency target and user geography, execution duration, GPU need, compliance and data residency), then runs a two-stage decision table: HARD CONSTRAINTS that eliminate providers outright (no region in the required country, FedRAMP/IRAP-class authorization, a runtime-duration ceiling the workload exceeds, a GPU family the provider does not sell), then SCORED TRADEOFFS across the survivors keyed on workload class. Costs AI under-models: egress (R2 zero-egress vs. hyperscaler per-GB tiers, NAT Gateway processing, cross-AZ transfer), cold-start behaviour, and managed-service exit cost. TRIGGER only while the provider or compute model is still open - comparing two or more providers, choosing serverless vs. container vs. VM, modelling cloud cost, p
mir-database-mongo
Make It Right (MongoDB module). MongoDB 8.x mechanics the engine-independent pillar omits: embed vs reference decided per relationship by access pattern, cardinality, update frequency; the 16 MB BSON limit and unbounded arrays; $jsonSchema validators — a collection accepts any shape until you add one; write concern w:1 losing acknowledged writes on failover; read concern, stale secondary reads, retryable writes — updateMany/deleteMany are NOT retryable; the 60-second transaction lifetime limit vs a single-document atomic update; compound-index prefix rules, ESR ordering, covered queries; aggregation stage ordering and the 100 MB stage limit; shard-key selection — a monotonic key creates a hot shard; NoSQL operator injection. Chains: mir-database (the gates) → this. TRIGGER only when the datastore is MongoDB itself (Community, Enterprise, Atlas) — designing a collection or document schema, picking a shard key, writing an aggregation pipeline or index, or debugging a Mongo consistency, concurrency, or query-pla
mir-database-postgres
Make It Right (PostgreSQL module). Postgres mechanics the engine-agnostic pillar omits: which ALTER TABLE subforms take ACCESS EXCLUSIVE and the lock queue where a blocked DDL stalls every read behind it; lock_timeout/statement_timeout migration discipline; NOT VALID then VALIDATE; CREATE INDEX CONCURRENTLY and invalid-index cleanup; MVCC bloat, autovacuum, XID wraparound; isolation levels and 40001/40P01 retry; SELECT FOR UPDATE vs FOR NO KEY UPDATE, SKIP LOCKED queues, advisory locks; b-tree/GIN/GiST/BRIN choice, partial and covering indexes, why an index is unused; PgBouncer pooling modes and transaction-pooling breakage; RLS multi-tenancy and its bypass paths. Chains: mir-database (the gates) → this. TRIGGER when the engine is PostgreSQL or Postgres-compatible (RDS/Aurora, Cloud SQL, Neon, Supabase) and the task writes DDL, a migration, an index, a locking or isolation decision, a partitioning or RLS layout, or diagnoses a slow query, EXPLAIN plan, missing index, bloat, vacuum, deadlock, or connection poo
mir-database
Make It Right (database pillar). Constraint-first schema and data-modeling protocol. Decides what is TRUE of the data before the first CREATE TABLE. Forces explicit decisions on cardinality and ownership, natural vs surrogate keys, what the database enforces vs what the application enforces, deliberate denormalization, nullability as a domain statement, soft delete's effect on uniqueness and foreign keys, tenancy model (shared-schema tenant column, schema-per-tenant, database-per-tenant), index design driven by the actual query set, and migration safety on populated tables. Runs the hard-gated pipeline: Intent → Constraint Interrogation → Assumption Ledger → Invariants & Enforcement Boundary → Risk Register → Design Review → DDL/Migration → Production-Readiness. Engine-independent. Chains: this → an engine module. TRIGGER when the task designs or changes a schema, data model, keys, constraints, indexes, tenancy layout, or a migration against populated tables. SKIP for application business logic, transaction/i
mir-devsecops
Make It Right (DevSecOps pillar). Constraint-first protocol for the path from commit to production - AI writes pipelines that go green, not pipelines safe to trust. Covers: supply chain (dependency pinning and lockfile integrity, install-script execution, typosquatting and slopsquatting of AI-hallucinated package names, SBOM, Sigstore/SLSA provenance); CI identity (the pull_request_target class of GitHub Actions bug, actions pinned by commit SHA not tag, secrets in forked-PR runs, OIDC federation, not long-lived cloud keys); secret storage, rotation, and detection; IaC (Terraform state as a credential store, drift, plan-vs-apply review, policy-as-code); containers (base-image provenance, non-root, scanning, registry trust); runtime IAM least privilege and egress restriction. Records per control WHERE it is enforced and whether it BLOCKS or WARNS. TRIGGER for CI/CD workflow files, release pipelines, Dockerfiles, Terraform/OpenTofu/Pulumi/Helm/Kubernetes manifests, dependency and lockfile changes, secret handli
mir-frontend-react-next
Make It Right (Next.js module). Next.js 16 App Router mechanics — the footguns that exist only in this meta-framework, not in React generally. Carries the Server/Client Component boundary and how one 'use client' pulls its entire import graph into the browser bundle; Server Actions as public POST endpoints that must re-authenticate and re-authorize on every call (hiding the button is not access control); proxy.ts as an optimistic redirect and never the sole auth gate — this framework has a repeating middleware-bypass advisory class (CVE-2025-29927, CVE-2026-45109); the opt-in caching layers after Next 16 ('use cache', cacheComponents, cacheTag, revalidateTag vs updateTag vs revalidatePath); request waterfalls from sequential awaits in nested layouts; and NEXT_PUBLIC_ vars inlined at build time. Chains: mir-frontend → mir-frontend-react → this. TRIGGER only when the React meta-framework is Next.js — work in app/, page.tsx, layout.tsx, route.ts, proxy.ts or middleware.ts, any 'use server' file, next.config.ts,
mir-frontend-react
Make It Right (React reactivity tier). React 19 + React Compiler reactivity footguns shared across EVERY React meta-framework (Next.js, React Router 7/Remix, TanStack Start, Vite SPA) — distinct from the generic frontend gates and from any one framework's mechanics. Covers the Rules of Hooks, effect-dependency discipline (derive in render; effects are for external sync only), stale closures, list-key correctness, use() and promise identity, granular Suspense + Error Boundary placement, useTransition/useDeferredValue for INP, React Compiler 1.0 interop (blind useMemo/useCallback is now a liability; the 'use no memo' opt-out), the server-state-vs-client-state boundary (TanStack Query, not useState mirrors), and React-layer security (raw-HTML props, LLM-output rendering, secrets in the bundle). Chains: mir-frontend → this → mir-frontend-react-next. TRIGGER when the reactivity library is React, including React Server Components — render purity, promise identity and Suspense placement apply on the server too. SKIP
mir-frontend-vanilla
Make It Right (vanilla JS / no-framework reactivity tier). Plain-DOM footguns that no reactive library is present to hide. Covers event listeners never removed (the #1 leak) and AbortController as the removal mechanism; detached DOM nodes retained by a closure or a module-scope map; Intersection/Mutation/ResizeObservers never disconnected and timers that outlive their element; innerHTML as an XSS sink and the current alternatives (textContent, Element.setHTML + Sanitizer, Trusted Types CSP); manual state/DOM divergence and the idempotent render-from-state discipline; custom-element lifecycle and upgrade timing, shadow DOM style/focus/ARIA consequences; stale-response-overwrites-fresh-response fetch races; and manual focus management (focus after route change, dialog focus traps, aria-live). Chains: mir-frontend → this. TRIGGER when the UI is built with plain DOM APIs and no reactive library — vanilla JS/TypeScript, jQuery-era code, hand-written Web Components, a static site with its own script, a browser-exte
mir-frontend-vue-nuxt
Make It Right (Nuxt module). Nuxt 4.5 universal-rendering mechanics layered on the Vue tier — the failures that exist only because the same component code runs once in Nitro and again in the browser: bare $fetch in setup causing a double fetch; useAsyncData vs useFetch and the key/payload deduplication rules; module-scope state as a CROSS-REQUEST USER-DATA LEAK on the server (and CVE-2026-71316, where cached-route payload extraction served one user's SSR data to the next visitor); server-only vs client-only values and the hydration mismatch they produce; payload bloat from over-fetching in asyncData (pick/transform); Nitro server routes; runtimeConfig public vs private and what ships in the client payload; route middleware for auth and why client-side route middleware is never a security control (CVE-2026-53721 route-rule case bypass). Chains: mir-frontend → mir-frontend-vue → this. TRIGGER only when the Vue stack is Nuxt — a Nuxt page, layout, composable, server/api route, route middleware, plugin, Nuxt modu
mir-frontend-vue
Make It Right (Vue reactivity tier). Vue 3.5 reactivity footguns shared across EVERY Vue meta-framework (Nuxt, Vite SPA, Quasar, legacy Vue CLI) — distinct from the generic frontend gates and from any one framework's mechanics. Covers where reactivity is silently lost (destructuring a reactive object, reassigning an array or object wholesale) and toRef/toRefs/toValue; computed purity — a side effect or fetch in a getter is a bug, because the getter is cached and may never re-run; watch vs watchEffect and pre/post/sync flush timing, deep-watch cost, and cleanup via onWatcherCleanup/effectScope plus the post-await registration trap; provide/inject typing and the non-reactive snapshot trap; v-for key correctness (index keys attach row state to the wrong row); defineModel; KeepAlive deactivation (onUnmounted never fires). Also carries Vue-runtime security: v-html, SSR cross-request state pollution from module-scope singletons, and VITE_-prefixed secrets in the client bundle. Chains: mir-frontend → this → mir-fron
mir-frontend
Make It Right (frontend pillar). Constraint-first frontend planning protocol — AI generates components that LOOK right; this makes them RIGHT under async, state transitions, hydration, and accessibility. Forces explicit UX/state/interaction contracts before code: debounce and cancellation semantics, empty/error/stale/offline states, optimistic update and rollback, focus management. Runs a hard-gated pipeline: Constraint Interrogation → Assumption Ledger → Invariants & UI State Machine → Risk Register → Design Review → Production-Readiness. Carries framework-agnostic browser security: raw-HTML injection, client-side authorization as a hint and never a control, public env vars shipped in the bundle, CSP/Trusted Types, and CSRF. Chains: this → reactivity tier (mir-frontend-react, mir-frontend-vue, or mir-frontend-vanilla for plain-DOM work) → framework module (mir-frontend-react-next, mir-frontend-vue-nuxt). TRIGGER for browser UI work in any reactive library or none — components, hooks, composables, forms, data
mir-init
Make It Right (project init). Prepares a repository's Make It Right harness before feature work starts: detects the stack from lockfiles, confirms it through a deterministic picker (never guesses), resolves the matching mir-* skills, and generates the per-project artifacts — a thin AGENTS.md that names the applicable pillars, a CLAUDE.md that imports it, a .mir/manifest.json write policy, and a .claude/settings.json PreToolUse hook that enforces it — then runs a manifest-derived probe to prove the hook actually blocks the denied paths. It is a thin wrapper over the CLI at init/cli.py; it installs no software and generates no code. TRIGGER when a user is setting up a new or existing repo for AI coding agents, asks to 'prepare/scaffold/bootstrap the harness', to generate AGENTS.md/CLAUDE.md/hooks, or to choose and lock a stack. SKIP for writing feature code (that is the backend/frontend/mobile pillars and their gated pipeline), for one-off task constraints (the constraint-interrogator handles those at Gate 1),
mir-mobile-android
Make It Right (Android module). Kotlin + Jetpack Compose + coroutines mechanics for the mir-mobile pillar — the Android-specific footguns the platform-agnostic skill omits: what SavedStateHandle and rememberSaveable actually survive (process death) versus rotation only, repeatOnLifecycle and collectAsStateWithLifecycle, viewModelScope vs lifecycleScope, Compose recomposition storms and the LaunchedEffect wrong-key bug, WorkManager plus the mandatory android:foregroundServiceType and the dataSync 6h/24h cap, permanently-denied runtime permissions, predictive back under targetSdk 36, and Android security (Keystore, SharedPreferences is not secure storage, android:exported, intent redirection, PendingIntent FLAG_IMMUTABLE, App Links assetlinks.json, WebView JS interfaces). Chains: mir-mobile → this. TRIGGER when the mobile target is native Android — Kotlin, Jetpack Compose, ViewModel, Room, DataStore, WorkManager, Gradle/R8, AndroidManifest, Play Console. In React Native or Flutter apps, TRIGGER for the native A
mir-mobile-ios
Make It Right (iOS module). Swift 6 + SwiftUI + Swift Concurrency mechanical footguns on Apple platforms — the ones the platform-agnostic mobile gates omit: what Swift 6 language mode rejects that Swift 5 allowed (global mutable state, non-Sendable values crossing isolation boundaries), Xcode 26's MainActor-by-default plus nonisolated(nonsending)/@concurrent silently keeping async work ON the main actor, Task lifetime (a Task {} in a view is NOT cancelled on disappear — only .task is), the SwiftUI ForEach(id: \.self) bug that reuses @State across rows, @State vs @StateObject vs @ObservedObject, BGTaskScheduler's non-guarantee, and iOS security (Keychain accessibility classes, PrivacyInfo.xcprivacy required-reason APIs, App Groups, universal links vs URL-scheme hijacking). Chains: mir-mobile → this. TRIGGER for an Apple-platform app in Swift/SwiftUI/UIKit — iOS, iPadOS, watchOS, tvOS, visionOS — views, view models, concurrency, background work, Keychain, push, deep links, App Store submission. In React Native
mir-mobile
Make It Right (mobile pillar). Constraint-first NATIVE MOBILE planning protocol — AI writes screens that run in the simulator; this makes them RIGHT under process death, permission denial, flaky cellular, OS background limits, and app-store review. Runs the hard-gated pipeline (Intent → Constraint Interrogation → Assumption Ledger → Invariants & App State Machine → Risk Register → Design Review → Implementation → Production-Readiness + store submission). Carries the release gates AI ignores: Google Play targetSdk and Play Billing deadlines, restricted-permission declarations, Apple's Xcode/SDK minimum, PrivacyInfo.xcprivacy required-reason APIs. TRIGGER for app work that ships to the App Store or Google Play in ANY mobile stack — Swift/SwiftUI, Kotlin/Jetpack Compose, Kotlin Multiplatform, React Native, Flutter — including background work, offline sync, runtime permissions, keychain/keystore, push, deep links, in-app purchase, and store submission; also enterprise/MDM, OEM-preload and sideloaded builds. Chain
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.