migration-to-aws: flat-steering port with scripts shipped directly

[ayn-builds]

Summary

Ports the Kiro migration-to-aws power to parity with the upstream awslabs/startups/migrate/plugins/migration-to-aws plugin (Apache-2.0), using a flat-steering/ design that ships the plugin's deterministic scripts directly as uv run-able files.

Fork-only PR for review — nothing merged to kirodotdev/powers upstream.

Design

The plugin is a nested Claude/Cursor/Codex plugin; a Kiro power is flat. The bundled tooling/flatten_plugin_to_power.py projects the plugin into a flat steering/ deterministically, so a sync is a re-run rather than a manual merge. Verified byte-identical to a fresh projection of upstream HEAD 927def0.

What ships

• 214 flat steering files — 178 .md, 24 .json, 11 .py, 1 .template. No servers/ MCP dir.
• All 4 engines (gcp-to-aws, heroku-to-aws, llm-to-bedrock, agent-advisor) + shared tf-best-practices.
• Deterministic engines ship as scripts, not prose or an MCP server: agent-advisor scoring/build-diagram, the llm validators, and the tf policy checker are PEP 723 files run via uv run steering/<name>.py (only llm-validate-result.py needs a third-party dep — jsonschema — declared inline, so uv run resolves it with no setup).
• POWER.md defines $STEERING/$SCRIPTS/$HELPERS/<scriptsDir>/$GCP_BASE to resolve to the one flat directory, so the plugin's injected "Scripts directory" line is no longer load-bearing.
• INTERPRETER.md _exec dispatches to Kiro's generic general-task-execution sub-agent (with an inline fallback when no sub-agent tool exists), rather than the plugin-only worker-agent name.

Parity tooling (maintainers only, not loaded at runtime)

• flatten_plugin_to_power.py — projects plugin → flat steering, rewrites cross-references.
• validate_power.py — 0 unflattened paths / 0 dangling names / 0 plugin-layout tokens (scans fenced code blocks) / 0 broken POWER.md pointers.
• compare_to_published.py — drift vs the published Kiro power.

Verification

• Re-projection from upstream HEAD → byte-identical to shipped steering/.
• validate_power.py → clean (0/0/0/0).
• Ran agent-advisor-scoring.py and llm-validate-result.py under the flat uv run invocations — both produce correct output and contract tokens.

Not done here / caveats

• Upstream's script test suites are not re-run in this PR (logic is byte-identical to upstream CI).
• The three MCP servers in mcp.json (awsknowledge, awspricing, temporal-docs) are declared identically to upstream and are not live-tested; POWER.md has a cached-pricing fallback for awspricing.
• _exec assumes general-task-execution is the registered generic sub-agent in the target Kiro runtime — worth a one-time confirmation.

[leon1418]

The reference here still points to awslabs/startups

[ayn-builds]

Deliberate - test_*.py isn't shipped. Those tests assert on the plugin's nested layout (references/phases//.md, and one case walking up four parents to CONTRIBUTING.md), so they can't pass against a flat power and can't be mechanically repaired. Rather than leave five dangling basenames that validate_power.py would flag, they're repo-qualified upstream so the pointer stays resolvable. That said, they sit under a bare ## Files heading which reads as local-only — happy to move them under a "content locks — not shipped with this power" sub-heading, or collapse the five rows into one.

[leon1418]

The directory structure here has changed.

[ayn-builds]

Already fixed in 8395103 — that landed ~30 min before your review, so the hunk you're seeing is from 645c663. The tree is now single-level under steering/, done in the projection via flatten_layout_tree() rather than by hand: directory rows dropped, leaves re-anchored, comments realigned, upstream ordering kept so the phase grouping stays readable.

[leon1418]

The directory structure has changed and needs to be updated.

[ayn-builds]

Same commit as the gcp one. Heroku also had two extras the rewrite cleaned up: a dangling
README.md row and the heroku-to-aws/ tree root, both gone since rows naming an unshipped file get dropped. validate_power.py missed both trees originally — LAYOUT_TOKENS held references/ as a backtick-wrapped literal, so it matched neither the un-backticked tree rows nor the deeper references/phases/workshop/ form. That's now a markup-independent LAYOUT_DIRS regex.

[leon1418]

In the original Claude Code plugin, we defined some subagents, but in Kiro Power these have all been converted to flat reference files. The original purpose of the subagent design was context isolation, but that benefit is lost once they're turned into reference files.

I'd suggest checking whether Kiro Power supports subagents. If it doesn't, we should run through the tests to confirm there are no context issues.

[ayn-builds]

Kiro does have sub-agents and the port uses them — isolation is preserved. What's missing is a power-level agent registry: a power bundles steering + MCP, so it can't register migration-to-aws:llm2bedrock-code-analyzer as an addressable type. So the two jobs got split — the agent file ships as a steering file and serves as the contract, and the isolation comes from dispatching Kiro's generic general-task-execution sub-agent with that file handed over (INTERPRETER.md L294-311, POWER.md L192-203; llm Phase C does the same with the five llm-*.md files). Artifacts pass as file paths, never inlined. The tier becomes advisory, which INTERPRETER.md's platform-asymmetry note already permits.