agentic-sdlc-scaffold

# GitHub Copilot — Acme Tracker

The operating manual for this repo is [`AGENTS.md`](../AGENTS.md) at the root — **not
duplicated here**. Copilot reads `AGENTS.md` natively as workspace instructions; this file
only records the Copilot-specific layout and routing. If this file and `AGENTS.md` ever
disagree, `AGENTS.md` wins — fix the divergence.

## Instruction files (`.github/instructions/`)

Thin twins of `.claude/rules/*.md`: each summarizes its rule and routes to the canonical doc.
The `applyTo:` glob in each file's frontmatter controls auto-loading; substance lives in the
routed-to canonical docs, never here.

| File | applyTo | Loads |
|---|---|---|
| [effort-discipline.instructions.md](instructions/effort-discipline.instructions.md) | `**` | always |
| [testing.instructions.md](instructions/testing.instructions.md) | test + spec paths | on matching files |
| [database.instructions.md](instructions/database.instructions.md) | `**/prisma/**` | on matching files |
| [backend.instructions.md](instructions/backend.instructions.md) | `apps/**` | on matching files |
| [frontend.instructions.md](instructions/frontend.instructions.md) | `frontend/**` | on matching files |
| [ux.instructions.md](instructions/ux.instructions.md) | frontend component paths | optional module |
| [windows-wsl2.instructions.md](instructions/windows-wsl2.instructions.md) | on demand | optional (Windows hosts) |
| [browser-verification.instructions.md](instructions/browser-verification.instructions.md) | on demand | optional (MCP browser tooling) |

## Agents (`.github/agents/`)

| Agent | Use for |
|---|---|
| [code-reviewer.agent.md](agents/code-reviewer.agent.md) | Findings-first branch review — read-only tools; drives SDLC gate 5.5 |
| [browser-verifier.agent.md](agents/browser-verifier.agent.md) | Capability-restricted browser verification (MCP + read only); optional module |

## Skills and prompts (`.github/skills/`, `.github/prompts/`)

| Entry | Use for |
|---|---|
| [skills/implement-spec/SKILL.md](skills/implement-spec/SKILL.md) | Gate-ordered execution of a SPEC-NNN end to end |
| [skills/create-spec/SKILL.md](skills/create-spec/SKILL.md) | Authoring a spec as a contract (required sections, verifiable ACs) |
| [skills/spec-review/SKILL.md](skills/spec-review/SKILL.md) | SDLC gate 2.5 — pre-implementation spec review |
| [skills/browser-verify/SKILL.md](skills/browser-verify/SKILL.md) | UI verification against `https://localhost:8443`; optional module |
| [prompts/browser-test.prompt.md](prompts/browser-test.prompt.md) | Routes a browser-test request to the browser-verifier agent |

Hooks: [hooks/enforce-repo-policy.json](hooks/enforce-repo-policy.json) mirrors the two
PreToolUse guards (`block-powershell.cjs`, `remind-selective-tests.cjs`) by invoking the same
`.claude/hooks/*.cjs` scripts Claude Code uses. Hook execution depends on the Copilot
environment supporting repository hooks — this varies by product/version, so verify yours
fires them. The implementation-log rule (AGENTS.md rule 2) is hook-enforced on the Claude
side only; on this side it is a convention backed by review.

## Handoff boundaries (the split SDLC)

- **Agents never merge to `main`.** Work stops at an open PR with all gates recorded
  (2.5, 5.5, and 5.6 where a PR-bot reviewer exists). See [`AGENTS.md`](../AGENTS.md) §3 and
  [docs/sdlc.md](../docs/sdlc.md).
- **Final browser sign-off is the operator's.** Agents may browser-verify when the tooling is
  connected, or record verification as pending operator review — either way, approval and
  merge remain human.
- The implementation log (AGENTS.md rule 2) is the shared audit trail across both tools and
  the handoff artifact the operator reviews alongside the diff.