docs: document system layers, layer rules, and standard flows

[lklimek]

Summary

• Replace flat "Core Module Structure" list with ordered system layers (top → bottom) with explicit responsibilities
• Add model rules (ideal target for new code): UI never calls SDK/DB directly, models are pure, DB is pure CRUD
• Document in-practice deviations: UI reads from DB via AppContext, Wallet mixes concerns intentionally, etc.
• Add three standard data flow patterns (user action → backend, UI read on construction, backend fetch + persist)
• List anti-patterns to avoid in new code
• Add AGENTS.md pointing to CLAUDE.md for Copilot/agent compatibility

Note: Copilot integration commits (sync script + assets) were added and reverted — will be done separately.

Test plan

• Review CLAUDE.md for accuracy against codebase
• Non-functional change (documentation only) — no manual testing needed

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch docs/architecture-layers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR enhances contributor-facing documentation and Copilot review tooling by documenting the codebase’s architectural layering and by vendoring “claudius” agent/skill assets (plus security reference material) into .github/ so they are visible to GitHub Copilot PR review.

Changes:

• Reworks CLAUDE.md architecture section into explicit system layers, layer rules, standard flows, and anti-patterns.
• Adds a sync script (scripts/sync-claudius.sh) to materialize claudius plugin assets into .github/skills/ and .github/agents/.
• Adds/updates Copilot/agent/skill markdown and includes security best-practices references plus an update script for OWASP cheat sheets.

Reviewed changes

Copilot reviewed 71 out of 144 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
scripts/sync-claudius.sh	Adds a repo-local sync script to copy claudius skills/agents into .github/ and strip claudius: prefixes.
CLAUDE.md	Documents system layers, layer rules, standard flows, and anti-patterns for new code.
AGENTS.md	Points contributors/agents to follow CLAUDE.md first.
.github/skills/severity/SKILL.md	Adds a “severity” skill definition for consistent review finding severity classification.
.github/skills/security-best-practices/scripts/update-cheatsheets.sh	Adds a helper script to sparse-clone OWASP CheatSheetSeries and refresh local references.
.github/skills/security-best-practices/references/cheatsheets/Web_Service_Security_Cheat_Sheet.md	Adds security reference material (web service security).
.github/skills/security-best-practices/references/cheatsheets/User_Privacy_Protection_Cheat_Sheet.md	Adds security reference material (privacy protection).
.github/skills/security-best-practices/references/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.md	Adds security reference material (open redirects/forwards).
.github/skills/security-best-practices/references/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.md	Adds deprecated-stub reference pointing to TLS cheat sheet.
.github/skills/security-best-practices/references/cheatsheets/Third_Party_Payment_Gateway_Integration.md	Adds security reference material (payment gateway integration).
.github/skills/security-best-practices/references/cheatsheets/TLS_Cipher_String_Cheat_Sheet.md	Adds deprecated-stub reference pointing to TLS cheat sheet.
.github/skills/security-best-practices/references/cheatsheets/Serverless_FaaS_Security_Cheat_Sheet.md	Adds security reference material (serverless/FaaS).
.github/skills/security-best-practices/references/cheatsheets/Securing_Cascading_Style_Sheets_Cheat_Sheet.md	Adds security reference material (CSS security).
.github/skills/security-best-practices/references/cheatsheets/Secure_Product_Design_Cheat_Sheet.md	Adds security reference material (secure product design).
.github/skills/security-best-practices/references/cheatsheets/Secure_AI_Model_Ops_Cheat_Sheet.md	Adds security reference material (AI/ML model operations).
.github/skills/security-best-practices/references/cheatsheets/REST_Assessment_Cheat_Sheet.md	Adds security reference material (REST assessment).
.github/skills/security-best-practices/references/cheatsheets/Query_Parameterization_Cheat_Sheet.md	Adds security reference material (query parameterization).
.github/skills/security-best-practices/references/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.md	Adds security reference material (prototype pollution).
.github/skills/security-best-practices/references/cheatsheets/PHP_Configuration_Cheat_Sheet.md	Adds security reference material (PHP hardening).
.github/skills/security-best-practices/references/cheatsheets/OAuth2_Cheat_Sheet.md	Adds security reference material (OAuth 2.0).
.github/skills/security-best-practices/references/cheatsheets/NoSQL_Security_Cheat_Sheet.md	Adds security reference material (NoSQL security).
.github/skills/security-best-practices/references/cheatsheets/Network_Segmentation_Cheat_Sheet.md	Adds security reference material (network segmentation).
.github/skills/security-best-practices/references/cheatsheets/Legacy_Application_Management_Cheat_Sheet.md	Adds security reference material (legacy app management).
.github/skills/security-best-practices/references/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.md	Adds security reference material (LDAP injection prevention).
.github/skills/security-best-practices/references/cheatsheets/JAAS_Cheat_Sheet.md	Adds security reference material (JAAS).
.github/skills/security-best-practices/references/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md	Adds security reference material (IDOR).
.github/skills/security-best-practices/references/cheatsheets/Injection_Prevention_in_Java_Cheat_Sheet.md	Adds reference stub redirecting to Java security cheat sheet section.
.github/skills/security-best-practices/references/cheatsheets/Infrastructure_as_Code_Security_Cheat_Sheet.md	Adds security reference material (IaC security).
.github/skills/security-best-practices/references/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.md	Adds security reference material (HSTS).
.github/skills/security-best-practices/references/cheatsheets/Forgot_Password_Cheat_Sheet.md	Adds security reference material (forgot password).
.github/skills/security-best-practices/references/cheatsheets/Dependency_Graph_SBOM_Cheat_Sheet.md	Adds security reference material (SBOM/dependency graph).
.github/skills/security-best-practices/references/cheatsheets/Database_Security_Cheat_Sheet.md	Adds security reference material (DB security).
.github/skills/security-best-practices/references/cheatsheets/Cookie_Theft_Mitigation_Cheat_Sheet.md	Adds security reference material (cookie theft mitigation).
.github/skills/security-best-practices/references/cheatsheets/Automotive_Security.md	Adds security reference material (automotive security overview).
.github/skills/security-best-practices/references/cheatsheets/Access_Control_Cheat_Sheet.md	Adds deprecated-stub reference pointing to authorization cheat sheet.
.github/skills/security-best-practices/references/cheatsheets/ATTRIBUTION.md	Adds attribution and licensing note for vendored OWASP cheat sheets.
.github/skills/security-best-practices/references/cheatsheets/AJAX_Security_Cheat_Sheet.md	Adds security reference material (AJAX security).
.github/skills/rust-best-practices/evals/evals.json	Adds Rust best-practices evaluation prompts/expectations JSON.
.github/skills/review/SKILL.md	Adds a comprehensive multi-agent review methodology skill doc.
.github/skills/review-pr/SKILL.md	Adds a PR audit workflow skill doc (incl. GitHub commenting flow).
.github/skills/review-loop/SKILL.md	Adds an automated peer review feedback loop skill doc.
.github/skills/review-dependency/SKILL.md	Adds a dependency security review workflow skill doc.
.github/skills/personality/SKILL.md	Adds a “personality” skill definition (claudius persona instructions).
.github/skills/ci-loop/SKILL.md	Adds an automated CI monitoring/fix loop skill doc.
.github/skills/check-pr-comments/SKILL.md	Adds a workflow skill doc for verifying/triaging PR review comments.
.github/copilot-instructions.md	Instructs Copilot to follow CLAUDE.md and apply the review skill methodology.
.github/agents/ux-designer.md	Adds an agent definition for UX/UI design + accessibility reviews/specs.
.github/agents/technical-writer.md	Adds an agent definition for documentation authoring/maintenance.
.github/agents/technical-researcher.md	Adds an agent definition for technology evaluation and research.
.github/agents/rust-developer.md	Adds an agent definition for Rust implementation and code review.
.github/agents/qa-engineer.md	Adds an agent definition for QA/test planning and validation.
.github/agents/python-developer.md	Adds an agent definition for Python implementation and review.
.github/agents/project-reviewer.md	Adds an agent definition for cross-artifact/project consistency reviews.
.github/agents/go-developer.md	Adds an agent definition for Go implementation and review.
.github/agents/frontend-developer.md	Adds an agent definition for frontend implementation and review.
.github/agents/devops-engineer.md	Adds an agent definition for CI/CD, Docker, and infra-related work.
.github/agents/claudius.md	Adds a general-purpose “claudius” coordinator agent definition.
.github/agents/architect.md	Adds an agent definition for architecture/module boundary reviews.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

cp -r "$skill_dir" "$dest" will create a nested directory if $dest already exists (e.g., it becomes .github/skills/<name>/<name>/...). Since clean_managed only deletes directories with the marker, any manually edited/unmarked skill dir would trigger this behavior. Consider removing $dest before copying, or using a copy mode that replaces the destination directory (e.g., rsync or an equivalent) to make the operation idempotent.

[Copilot]

sed -i is GNU-specific; on macOS/BSD sed it fails unless an extension is provided. If this script is intended to be run by contributors on macOS, consider using a portable in-place edit approach (or branching on uname for the correct sed -i syntax).

[Copilot]

Same portability issue here: sed -i is not compatible with macOS/BSD sed without an explicit backup suffix. Consider making the in-place replace portable so the script behaves consistently across contributor environments.

[Copilot]

The cleanup pipeline uses find ... | xargs rm, which is fragile if any filenames contain whitespace/newlines and can also match non-files. Consider using find with -type f and a NUL-delimited pipeline (-print0 + xargs -0) (or -exec rm -f {} +) to make deletions robust.

[Copilot]

The “In practice” exceptions list doesn’t mention that there is already direct app_context.db.* usage in UI code (both reads and writes), beyond wrapper methods and beyond display_task_result() (e.g., src/ui/dashpay/contact_details.rs writes via save_contact_private_info, and src/ui/identities/identities_screen.rs deletes identities directly). If the intent is “avoid introducing new direct DB calls from UI”, consider documenting this as an existing legacy pattern here (or clarifying the anti-pattern wording) so the guidance matches what contributors will find in the codebase.