Use when porting a C++ implementation to Rust and you need confidence the port is behavior-equivalent. Guides the full workflow — establish a C++ baseline, inventory every external or semantically observable value selected as in-scope by the port-equivalence contract, define that fail-closed contract and a state machine, instrument both sides, port to Rust, then check contract/state-machine conformance and trace/outcome/side-effect equivalence with field-specific numeric policies, complete contract coverage, comparator mutation audit, failure triage, and regression tests.
Use whenever writing, reviewing, or generating Rust code — hardening is the default for all Rust, not just production. Enforces a zero-warning / zero-clippy-finding build, bans panicking constructs (unwrap/expect/panic/indexing/slicing) in non-test code, forbids silently-overflowing arithmetic and lossy `as` casts, and requires runtime failures from arithmetic, indexing, conversion, and other fallible operations to propagate as Result unless local recovery completes the documented contract. Also bans erasing failures through underscore bindings, default substitution, Result-to-Option conversion, or ignored overflow flags, and requires rustfmt. Lint suppression is the rare, self-cleaning exception: `#[expect(reason=…)]` over `#[allow]`, at the narrowest scope, only from an explicit production allowlist — while generated code and test code (#[cfg(test)], tests/, benches/, examples/) may relax freely.
Use when implementing or writing Rust code for real-time systems where predictable WCET matters. Apply to RT-critical paths such as ISRs, schedulers, drivers, packet fast paths, async poll loops, control loops, allocators, and synchronization code. Prefer bounded, allocation-free, panic-free, blocking-free designs over fast average-case code. For reviewing existing patches or PRs, use rust-realtime-review instead.
Use when reviewing Rust patches, PRs, or files for real-time safety, WCET predictability, bounded execution, allocation-free RT paths, panic-free RT paths, synchronization risks, async poll bounds, data-structure predictability, and residual timing risks. Use quick review for normal patches and WCET audit mode for deeper timing-bound analysis.
Use when measuring or improving test coverage for a Rust crate. Focus on behavior, invariants, edge cases, unsafe contracts, and regression protection. Do not add shallow tests whose only purpose is to execute lines.
Use when writing, reviewing, or generating Rust code that calls C (or C that is called from Rust) over FFI — extern "C" declarations, unsafe wrappers, pointer/struct marshaling, or the C side of a Rust binding. Enforces the 26 FFI soundness rules so foreign data and pointers are validated against Rust's safety invariants.