# Debug Gateway

Load this before concluding a change did not land, and to read what the kirocrew-debug...

- Repository: https://github.com/kirodotdev/KiroCrew (4711 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add kirodotdev/KiroCrew --skill debug-gateway -g -a claude-code -y`
Codex: `npx skills add kirodotdev/KiroCrew --skill debug-gateway -g -a codex -y`
Cursor: `npx skills add kirodotdev/KiroCrew --skill debug-gateway -g -a cursor -y`
Gemini CLI: `npx skills add kirodotdev/KiroCrew --skill debug-gateway -g -a gemini-cli -y`

## Description

Load this before concluding a change did not land, and to read what the kirocrew-debug tools actually answered - which question to ask first, the fields that mean the opposite of how they look, and what a 400 / 403 / 404 / 501 from these tools means.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Reading the kirocrew-debug tools

Five read-only tools answer five questions about the live gateway. The tool
descriptions say what each one covers, and `docs/reference/debug/README.md` carries
the rest. This skill is the part neither of them has: which question to ask first,
and how to read an answer without drawing the opposite conclusion.

Where the surrounding material lives, all in one reference doc. An installed build
does not carry the repository's docs tree, so read it at
[Debugging a running gateway](https://github.com/kirodotdev/KiroCrew/blob/main/docs/reference/debug/README.md),
or at `docs/reference/debug/README.md` in a checkout:

- symptom table: section "Symptom to tool"
- the sandbox traps, including the empty placeholder mounts: section "Sandbox traps"
- who may take each reading: section "Authorization"
- why the server is opt-in, and how to grant it: the paragraph above the five questions

## Ask before you conclude

1. **Before reporting that a change did not work, call `debug_gateway`.** A gateway
   that started before your commit is executing the previous revision, and a daemon
   that outlived the change hands out backends built from the old checkout. Both look
   exactly like a broken fix.
2. **A refusal is `blocked-by-policy`'s job**; `debug_refusals` gives it the class.
3. **Before calling a refused path protected, read that class.** Only
   `sensitive_path_match` means the path is protected. `unverifiable_path` means the
   path was never judged, and the row's own `action` line says what to do.

## Fields that read as the opposite of what they mean

### debug_gateway

`gateway_predates_head` has three readings, not two. `null` is neither true nor
false: the start time comes from procfs, so it is absent off Linux, and HEAD's commit
time needs a git checkout, so it is absent on an installed wheel. Treat `null` as
unmeasured and say so, rather than concluding the gateway is current.

The rest: https://github.com/kirodotdev/KiroCrew/blob/HEAD/src/kiro_crew/builtin_skills/debug-gateway/SKILL.md