Cyber Ware — Repository Playbook Purpose: one concise map of repository artifacts that improve developer + AI productivity, with implementation coverage and planned gaps.
Status: [x] implemented, [ ] planned, N/A out of scope
Phase: p1 foundation, p2 standardize, p3 harden, p4 scale, p5 optimize
ID format: rpb-<category>-<slug>
3) Repository, Structure & Naming 4) Coding Standards & Static Quality
Item
Status / Phase / ID
Implemented (where)
Planned
Coding standards
[x] p1
guidelines/README.md , CONTRIBUTING.md Add short one-page standards index
Style guide
[x] p1
clippy rules in clippy.toml and Cargo.toml , cargo fmt in Makefile , dylint rules in tools/dylint_lints/README.md
Expand language-agnostic style section
Lint rules
[x] p1
tools/dylint_lints/README.md , Makefile , tools/scripts/ci.py Add lint policy matrix by layer
Formatting rules
[x] p1
Makefile , tools/scripts/ci.py Add editor setup snippets
Documentation standards
[x] p1
docs/spec-templates/README.md , docs/checklists/README.md Add docs style/lint enforcement rules
Static analysis rules
[x] p2
docs/security/SECURITY.md , tools/dylint_lints/ , .github/workflows/codeql.yml Add local static-analysis quickstart
Code complexity rules
[x] p2
Clippy cognitive_complexity (threshold: 20) in workspace Cargo.toml , clippy.toml
Add per-module complexity budget
Commenting rules
[ ] p3
Partial conventions in existing guidelines
Add explicit comment policy document
README standards
[ ] p3
Implicit via module QUICKSTART guidance in docs/modkit_unified_system/
Add README template + required sections
5) Git Workflow & Reviews
Governance, roadmap, and maintainer processes are controlled in a separate global repository to cover cross-repo dependencies.
Item
Status / Phase / ID
Implemented (where)
Planned
Governance model
N/A
Managed in external global governance repository
Controlled externally for cross-repo dependencies
Decision authority
N/A
Managed in external global governance repository
Controlled externally for cross-repo dependencies
Ownership rules
N/A
Managed in external global governance repository
Controlled externally for cross-repo dependencies
Maintainer process
N/A
Managed in external global governance repository
Controlled externally for cross-repo dependencies
Maintenance procedures
N/A
Managed in external global governance repository
Controlled externally for cross-repo dependencies
Roadmap overview
N/A
Managed in external global governance repository
Controlled externally for cross-repo dependencies
7) Release, Versioning & Change Management
Item
Status / Phase / ID
Implemented (where)
Planned
Release workflow
[x] p1
docs/RELEASING.md , .github/workflows/release-plz.ymlAdd release rollback drills
Versioning policy
[x] p1
CONTRIBUTING.md , docs/RELEASING.md Add semver check gate per crate type
Changelog rules
[x] p1
docs/RELEASING.md , CHANGELOG.md Add changelog quality checklist
Backward compatibility policy
[x] p1
CONTRIBUTING.md (SemVer + breaking definitions)Add API compatibility test automation
Deprecation policy
[x] p2
CONTRIBUTING.md Add deprecation timeline template
8) Local Development & Tooling 10) Testing & Quality Gates 11) Debugging, Logging & Observability 12) Security, Access & Data Protection
Dedicated security coverage (phase-ordered) is tracked here. See docs/security/SECURITY.md for full implementation detail.
Item
Status / Phase / ID
Implemented (where)
Planned
Rust language safety baseline
[x] p1
docs/security/SECURITY.md , workspace Rust/clippy settingsKeep baseline aligned with toolchain policy
Authentication & authorization architecture
[x] p1
docs/security/SECURITY.md , docs/arch/authorization/ Add cross-module authz test matrix
Security practices
[x] p1
SECURITY.md , guidelines/SECURITY.md , docs/security/SECURITY.md Expand secure coding examples
Dependency security rules
[x] p1
docs/security/SECURITY.md , Makefile , cargo denyAdd allow/deny decision log
Vulnerability response
[x] p1
SECURITY.md Add incident severity matrix
Secure ORM tenant scoping
[x] p2
docs/security/SECURITY.md , docs/modkit_unified_system/06_authn_authz_secure_orm.md Add security-context propagation verification checks
Static security linting (Clippy + Dylint)
[x] p2
docs/security/SECURITY.md , tools/dylint_lints/README.md , clippy.toml Expand security-focused lint set
Secrets handling
[x] p2
docs/security/SECURITY.md , docs/pr-review/README.md token guidanceAdd repository-wide secrets policy doc
Data protection rules
[x] p2
docs/security/SECURITY.md , secure ORM docsAdd data classification policy
Access policies
[x] p2
docs/security/SECURITY.md , auth architecture docsAdd policy authoring guide
Security scanners in CI
[x] p2
docs/security/SECURITY.md , .github/workflows/ Add scanner findings triage runbook
Continuous fuzzing
[x] p2
docs/security/SECURITY.md , tools/fuzz/ Expand fuzz target coverage and schedules
Security in PRD/DESIGN SDLC templates
[x] p2
docs/security/SECURITY.md , docs/spec-templates/cyberware-sdlc/PRD/template.md , docs/spec-templates/cyberware-sdlc/DESIGN/template.md Add explicit security checklists in templates
13) Performance & Benchmarking
Basic performance requirements are part of the NFR (non-functional requirements) in every PRD and DESIGN.
Item
Status / Phase / ID
Implemented (where)
Planned
Basic performance requirements
[x] p1
docs/spec-templates/cyberware-sdlc/PRD/template.md , docs/spec-templates/cyberware-sdlc/DESIGN/template.md Keep NFR performance criteria mandatory in every feature spec
Optimization guidelines
[x] p2
Rust + clippy guidance in README.md , docs/security/SECURITY.md
Add hotspot optimization playbook
Caching strategies
[ ] p3
Scattered examples only
Add standard caching guidance
Performance standards
[ ] p3
Partially in architecture manifest/perf checks
Add explicit performance SLO policy
Performance budgets
[ ] p4
Not formalized
Add endpoint/module budgets
Benchmarking rules
[ ] p4
Not centralized
Add benchmark harness + reporting standard
Token / compute budgets
[ ] p4
Not formalized
Add GenAI token/compute governance
14) Agents, Prompts & AI Automation
Agents, prompts, and AI workflows are managed by Cypilot — see .cypilot/ (skills, scripts, templates, workflows) and .cypilot/config/ (project-specific configuration, artifacts.toml, AGENTS.md).
Item
Status / Phase / ID
Implemented (where)
Planned
Scripts usage
[x] p1
Makefile , tools/scripts/ci.py Add script catalog document
Automation rules
[x] p2
Makefile , tools/scripts/ci.py , workflow filesAdd automation safety policy
Task automation guidelines
[x] p2
tools/scripts/ci.py , Makefile Add “when to automate/not automate” guide
Bot behavior rules
[x] p2
docs/pr-review/README.md , workflow configsAdd standardized bot comment protocol
Agents overview
[x] p2
.cypilot/ , .cypilot/config/ , docs/pr-review/README.md Add central "AI operations" document
Prompt guidelines
[x] p2
.cypilot/ , docs/checklists/README.md Add universal prompt design guide
Prompt templates
[x] p2
.cypilot/ , docs/pr-review/ templatesAdd non-PR prompt template library
Agent responsibilities
[x] p2
.cypilot/config/AGENTS.md , docs/checklists/README.md Add explicit role split per bot/agent
Agent boundaries
[ ] p3
Implicit in review workflows
Add hard boundaries + escalation policy
Agent input/output contracts
[ ] p3
Templates exist for PR/status outputs
Add formal contract schema
Agent lifecycle
[ ] p3
Not formalized
Add lifecycle/run-states doc
Agent orchestration rules
[ ] p3
Partial through Cypilot workflows in .cypilot/
Add orchestration and precedence rules
Prompt patterns
[ ] p3
Not centralized
Add prompt pattern catalog
Prompt anti-patterns
[ ] p3
Not centralized
Add anti-pattern checklist
Prompt safety rules
[ ] p3
Partially implied in security/review process
Add explicit prompt safety controls
Prompt evaluation rules
[ ] p3
Not formalized
Add eval rubric and benchmark flow
15) Templates, Examples & Checklists 16) API, Data, Config & Error Contracts 17) Deployment & Operations
Cyber Ware is a collection of libraries and modules, not a standalone deployable component. Deployment, rollback, cost management, and resource limits are the responsibility of downstream applications that consume these libraries.
Item
Status / Phase / ID
Implemented (where)
Planned
Infrastructure overview
N/A
Out of scope for this library repository
Downstream responsibility
Deployment process
N/A
Out of scope for this library repository
Downstream responsibility
Migration guides
N/A
Out of scope for this library repository
Downstream responsibility
Rollback procedures
N/A
Out of scope for this library repository
Downstream responsibility
Deployment checklist
N/A
Out of scope for this library repository
Downstream responsibility
Cost management
N/A
Out of scope for this library repository
Downstream responsibility
Resource limits
N/A
Out of scope for this library repository
Downstream responsibility
18) Documentation IA, Onboarding, Knowledge Base
Item
Status / Phase / ID
Implemented (where)
Planned
Documentation structure
[x] p1
docs/ , docs/spec-templates/README.md , guidelines/README.md Add docs navigation index page
Onboarding guide
[x] p1
README.md , docs/QUICKSTART_GUIDE.md , CONTRIBUTING.md Add role-based onboarding tracks
First contribution guide
[x] p1
CONTRIBUTING.md Add “first good issue” process
Contribution guidelines
[x] p1
CONTRIBUTING.md Keep aligned with CI/review changes
Contributor expectations
[x] p1
CONTRIBUTING.md Add expected turnaround/SLA guidance
Decision records (ADR)
[x] p1
docs/spec-templates/cyberware-sdlc/ADR/template.md , docs/adrs/ Add ADR index by domain
Design documents
[x] p1
docs/spec-templates/cyberware-sdlc/DESIGN/template.md , module docsAdd quality gates for design docs
Common workflows
[x] p2
Makefile , tools/scripts/ci.py , docs/pr-review/README.md Add workflow cookbook
Anti-patterns
[x] p2
docs/checklists/ , tools/dylint_lints/README.md Add unified anti-pattern catalog
Common mistakes
[x] p2
tools/dylint_lints/AGENTS.md pitfalls, checklistsAdd “top mistakes” short guide
Support / escalation paths
[x] p2
SECURITY.md , CONTRIBUTING.md Add general (non-security) escalation flow
Proposal process
[x] p2
Spec-driven flow in docs/spec-templates/README.md
Add formal RFC/proposal workflow
Glossary
[ ] p3
Not centralized
Add glossary document
Terminology
[ ] p3
Partial in architecture/spec docs
Add terminology canon
Acronyms
[ ] p3
Scattered only
Add acronyms appendix
Known limitations
[ ] p3
Partially implied in architecture notes
Add limitations register
Known issues
[ ] p3
Not in docs (tracked externally)
Add known-issues doc or link policy
Maintainer responsibilities
[ ] p3
Partially implied in existing docs
Add explicit maintainer responsibilities
FAQ
[ ] p3
Not centralized
Add FAQ page
Implemented ([x]): strong coverage for architecture, standards, CI, testing, release, security, examples, Cypilot-managed AI automation.
Planned ([ ]): most gaps are performance benchmarking, AI prompt governance, glossary/FAQ.
Out of scope (N/A): deployment, rollback, cost/resource limits — downstream responsibility.
Highest-value next phase (p2/p3) additions:
Performance budgets + benchmark policy
AI prompt/agent boundary contracts
Central glossary/FAQ/known-issues pages