Update:
I attached my collections for your reference. Up to now, I can only find datasheet for RT3070L and RTL8187, instead of popular RTL8188CUS. It is really stranger since they still consider them as confidential. Even these PDF files have not reveal enough information. so we have to check driver source code and cross checking. If someone really wants to do it. he should contact supplier to sign an NDA to access enough information, including but not limited to EEPROM programmer, STA/AP switching......
I usually probe USB devices in user mode with PyUSB or libUSB to interactive with their EPs.
As I mentioned, this project maybe bigger than our though. So collect more and survey in detail may help us to find out how big it is.
I have read GS embedded WiFi module used by Freescale TWR. It has simple strucuture, one link manager, one TX callback, one RX callback. The host communicates with it via AT command over UART, like MODEM.
To keep it as simple and small as possible. We can borrow the structure, and leave callbacks as API. The link manager is useful and must be implemented in first stage. That brings up requirements for console, timer for timeout, NVM storage for SSID. Of course, an open source TCP/IP stack is necessary to offer basic socket communication.
Just simple socket programming interfaces are enough for IoT applications.
Leave WEP/WPA and any advanced features to future release.
Regarding development tool, personally I prefer IAR + KL25Z. However, as an open source, GCC + gdbserver is better.