A production-grade engineering gate for AI coding agents.
One discipline that produces and protects production-grade code — security, resource safety, backend cost, defensive edges, and evidence that the work is actually done.
AI agents write plausible code fast — and skip the same checks humans skip
under time pressure: the undisposed stream, the query in a loop, the catch {},
the "should work now" with nothing actually run.
ironcode is not a style guide. It is a gate. It forces the checks that get skipped, and it forbids claiming "done" without observable proof.
| # | Law | Meaning |
|---|---|---|
| 1 | Evidence before claims | Never say "done / fixed / works" without fresh test, build, or run output. |
| 2 | Spec before style | First prove it solves the right problem; only then critique quality. |
| 3 | Root cause before fix | Reproduce and trace before patching. Symptom-patching is failure. |
| 4 | Own analysis before external input | Verify every linter/tool/agent finding against the actual code. |
| 5 | Cost is a correctness property | N+1 queries and unbounded fetches are defects, not "optimizations for later". |
Reference files load on demand — a one-line change never pulls in a thousand lines of checklist.
| Dimension | Reference | Catches |
|---|---|---|
| 🔐 Security | references/security.md |
Secrets, injection, authz/RLS, SSRF, OWASP Top 10 |
| 🧹 Resource safety | references/resource-safety.md |
Leaked listeners, streams, timers, controllers, unbounded caches |
| 💸 Data access & cost | references/data-access.md |
N+1, missing pagination, over-fetching, schema drift, missing indexes |
| 🛡️ Defensive coding | references/defensive.md |
Null/edge cases, swallowed errors, races, idempotency |
| 🧭 Maintainability | references/checklist.md |
Naming, size, duplication, dead code — plus the full gate checklist |
| 🚀 Ship-readiness | references/ship-readiness.md |
Release scope: testing strategy, observability, deploy compatibility, supply chain, privacy |
The skill is adaptive — it detects which mode the agent is in:
PLAN → design the checks in before writing
BUILD → apply the patterns while writing (teardown written with every resource)
GATE → spec → diagnostics → five dimensions → verify → report with evidence
Every finding is concrete and actionable:
🔴 home_controller.dart:120 — fetches all rows (no limit), re-runs every rebuild.
Fix: keyset pagination + in-flight guard + cache.
Verification: flutter analyze → 0 issues · make test → 250 passed
Verdict: CHANGES NEEDED
git clone https://github.com/djfksjd/ironcode.git ~/.claude/skills/ironcodeThen invoke with /ironcode, or just ask for a production-grade / rigorous /
leak-free implementation or review — the skill self-triggers on its
description.
Codex CLI reads the same open SKILL.md skill format (the old
~/.codex/prompts custom prompts are deprecated). Depending on your Codex
version, the user skill directory is ~/.codex/skills or ~/.agents/skills:
git clone https://github.com/djfksjd/ironcode.git ~/.codex/skills/ironcode
# or
git clone https://github.com/djfksjd/ironcode.git ~/.agents/skills/ironcodeInvoke via the skill selector (/skills) or $ironcode.
Language- and stack-agnostic by design: patterns are given for Flutter/Dart, JS/TS, C#/Java/Kotlin, Go, Rust, and SQL/Postgres (incl. Supabase RLS). Examples lean on real production incidents; adapt the specifics to your stack.
| Severity | Disposition | |
|---|---|---|
| 🔴 | Security hole, data loss, crash, leak, unbounded cost | Fix before merge |
| 🟠 | Real bug, strong smell, missing edge handling | Fix before merge |
| 🟡 | Style, minor naming, optional cleanup | When convenient |
| 🔵 | Optional improvement | Author's call |
Findings are ranked by severity × exploitability × blast radius — never inflated, never flattened.