Language Governance Packs

Every language pack installs three independent assets into one standards:<language> scope:

Install all three for a complete baseline. Teams can install only the skill and reference knowledge when repository-owned standards are already stricter.

Available packs

These are broad source-aware baselines, not universal style decrees. Repository policy controls supported versions, selected tools, naming, architecture, risk tolerance, and exact commands.

C++ example

Install the complete C++ pack:

curl --fail-with-body \
  --request POST \
  "$NEUTRON_API_URL/v1/platform/industry-library/plugins/cpp-engineering-governance/install" \
  --header "Authorization: Bearer $NEUTRON_WORKSPACE_API_KEY" \
  --header "Content-Type: application/json" \
  --data "{\"nucleusId\":\"$NEUTRON_NUCLEUS_ID\"}"

The installed standards cover:

• supported C++ standard and compiler matrix
• RAII, ownership, lifetime, value semantics, and non-owning views
• explicit conversion, const correctness, headers, dependencies, and ABI policy
• exception/error strategy and concurrency contracts
• undefined behavior, size conversions, FFI, sanitizers, fuzzing, and dependency provenance
• CMake presets, clang-format, clang-tidy, CTest, compiler warnings, and release validation

The knowledge base is anchored in the C++ Core Guidelines, clang-tidy, CMake presets, and GoogleTest.

Request it for a task:

{
  "nucleusId": "native-engine",
  "scopeIds": [
    "governance:team-code",
    "standards:cpp",
    "repo:root",
    "package:render-engine",
    "tests:render-engine",
    "agent:codex"
  ],
  "agentId": "agent:codex",
  "task": "Replace owning raw pointers in the texture cache without changing its public ABI.",
  "tokenBudget": 1600
}

Rust example

The Rust pack installs:

• rust-coding-standards
• rust-coding-skill
• rust-knowledge-base

It covers editions and MSRV, ownership and borrowing, error and panic policy, isolated unsafe invariants, Cargo features, SemVer, asynchronous cancellation, Clippy, rustfmt, rustdoc, supply-chain review, Miri, fuzzing, and supported-feature testing.

Its source anchors include the Rust documentation, Rust Style Guide, Rust API Guidelines, Clippy, and Cargo reference.

An agent using standards:rust should not automatically enable every Clippy restriction lint. It should use the repository's configured lint policy and propose individual restrictions with a reason and migration plan.

TypeScript and JavaScript

This pack emphasizes strict typing, runtime validation at untrusted boundaries, explicit async behavior, immutable state flow, SSR/client separation, stable exports, dependency review, browser accessibility, and layered tests.

The reference knowledge draws from the TypeScript Handbook, TSConfig reference, MDN JavaScript Guide, ESLint, and Node.js security guidance.

Python

The Python pack covers supported versions, pyproject.toml, PEP 8, formatter/linter authority, public typing, specific exception handling, import-time side effects, sync/async boundaries, packaging, dependency provenance, safe subprocess and serialization behavior, pytest, and deterministic fixtures.

Source anchors include PEP 8, Python typing, the Python Packaging User Guide, and pytest.

Go

The Go pack covers package design, gofmt, error identity, small consumer-owned interfaces, context propagation, goroutine lifecycle, cancellation, race detection, fuzzing, module changes, and govulncheck.

It uses Effective Go, Go Code Review Comments, Go security best practices, and How to Write Go Code as source anchors.

Java and Kotlin

Install separate standards:java and standards:kotlin scopes when the repository uses both. Shared JVM facts do not remove language-specific differences:

• Java policy covers release/JDK matrices, resource handling, exceptions, records and sealed types, serialization, JVM concurrency, Maven/Gradle, JUnit, and Java security.
• Kotlin policy covers null safety, expression-oriented design, sealed variants, Java interoperability, coroutines, flows, structured concurrency, Android and multiplatform boundaries.

The packs reference current Java learning and specification material, Java security guidance, Kotlin coding conventions, Kotlin coroutines, and Gradle.

C# and .NET

The .NET pack covers SDK pinning, EditorConfig, analyzers, nullable reference types, disposal, async/cancellation, records and immutable state, ASP.NET boundaries, NuGet provenance, testing, publishing, trimming, and AOT.

It is anchored in Microsoft's C# coding conventions, .NET design guidelines, code analysis, security, and testing documentation.

Swift

The Swift pack covers API clarity, value semantics, optionals and failure, strict concurrency, actor isolation, sendability, package manifests, application boundaries, privacy, testing, and distribution.

Its sources include the Swift API Design Guidelines, Swift language documentation, Swift Package Manager, and Swift Testing.

PHP and Ruby

Both packs emphasize typed or explicit domain boundaries, thin framework entry points, dependency locks, injection prevention, safe serialization, controlled shell/file behavior, authorization, deterministic tests, and secret-safe diagnostics.

• PHP sources: PHP language reference, PSR-12, Composer, and PHPUnit.
• Ruby sources: Ruby documentation, Bundler, RuboCop, RSpec, and the Rails Security Guide.

Shell

The Shell pack is intentionally strict around quoting, interpreter portability, destructive targets, temporary files, cleanup, idempotency, command construction, and secret leakage. It also teaches when a script has become complex enough to move into a typed language.

Sources include the Bash manual, POSIX Shell Command Language, ShellCheck, Google Shell Style Guide, and Bats.

SQL and Database

The database pack covers dialect and version policy, parameterized queries, constraints, migrations, expand-contract rollouts, transactions, locking, idempotency, tenant isolation, least privilege, query plans, backups, retention, and recovery.

Its knowledge base distinguishes database-engine guarantees from generic SQL advice and references PostgreSQL, SQLite, MySQL, and OWASP SQL injection prevention.

Customize a baseline

Do not edit a built-in pack to encode one repository's temporary preference. Add the team's durable differences to AGENTS.md and repository tool configuration, or upload a workspace-owned standards knowledge base with explicit scope, owner, version, source, and review date.

When the team changes a standard:

1. Review and approve the new rule.
2. Update deterministic tooling where enforcement is possible.
3. Upload or refresh the scoped policy asset.
4. Tombstone the obsolete memory.
5. Invalidate affected context caches.
6. Prove the new behavior in a fresh coding-agent session and CI run.