docs: September 2026 Copilot coding standards

.github/copilot-instructions.md

@@ -20,3 +20,7 @@ not a production SaaS.
 - Do not introduce Express or `better-sqlite3`.
 
 Read [`docs/DESIGN-PIVOT.md`](../docs/DESIGN-PIVOT.md) and [`AGENTS.md`](../AGENTS.md) before expanding scope.
+
+## Coding standards
+
+Follow path-specific files in [`.github/instructions/`](instructions/). Copilot code review loads [`.github/skills/code-review/`](skills/code-review/).

.github/instructions/tests.instructions.md

@@ -0,0 +1,15 @@
+---
+applyTo: "**/*.{test,spec}.ts,**/*.{test,spec}.tsx,**/tests/**/*.ts,**/tests/**/*.tsx"
+---
+
+# Test standards (September 2026)
+
+- Ship behavior with a test in the existing layout (co-located `*.test.ts` or `tests/`).
+- Do not skip, delete, or weaken verify, lint, typecheck, or adversarial gates to land a change.
+- Do not invent a passing gate from prose. Run the documented verify command.
+- Fixtures are synthetic. Never commit real PII, PHI, payroll, or credentials.
+
+## This repository
+
+- Definition of Done: `./scripts/harness/verify.sh`.
+- `npm run scenario` is HITL default-off; it is non-zero unless the exception auto-settles in a test flag path.

.github/instructions/typescript.instructions.md

@@ -0,0 +1,22 @@
+---
+applyTo: "**/*.ts,**/*.tsx"
+---
+
+# TypeScript coding standards (September 2026)
+
+- Write TypeScript, not new application JavaScript. Leave existing tooling `.js` / `.mjs` / `.cjs` files alone.
+- Place imports at the top of the module. Do not use inline `import()` in function bodies except for a documented circular-dependency or optional-runtime case.
+- Prefer early returns over nested conditionals.
+- On `switch` over a discriminated union or enum, handle every variant. Use a `never` check in `default` so newly added variants fail at compile time.
+- Do not introduce `any` in new production code. Prefer `unknown` plus narrowing. Do not use non-null assertions to silence `strict` or `noUncheckedIndexedAccess`.
+- Match this repository's existing formatter and linter. Do not add a second style system.
+- Keep public unions narrow. Do not widen a literal union to `string` without a spec change.
+- Do not weaken fail-closed, human-in-the-loop, tenancy, or verify gates to make types compile.
+
+## This repository
+
+- Firm logic in `packages/core`, HTTP in `apps/api` (Hono), UI in `apps/console` (Vite + Preact).
+- Do not introduce Express or `better-sqlite3`.
+- Do not add LangGraph, CrewAI, or other graph/crew runtimes.
+- Exception HITL stays default-off. Only tests/CI may pass `autoApproveException: true`.
+- Never set `CORPOS_ALLOW_LIVE` in CI. Default provider is `SimulationProvider`.

.github/skills/code-review/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: code-review
+description: "Review CorpOS PRs for company-day simulation rules: PDP/PEP, HITL exceptions, and no live LLM in CI. Use on pull requests that touch packages/core, apps/api, apps/console, or verify scripts. Flag LangGraph/CrewAI additions and auto-approve in product paths."
+---
+
+# Copilot code review — CorpOS
+
+Use this skill when reviewing a pull request in this repository.
+
+CorpOS is a **company-day simulation**, not an orchestration framework.
+
+- Reject auto-approve in product/demo paths.
+- Reject live LLM in CI (`CORPOS_ALLOW_LIVE`, `OPENROUTER_API_KEY`).
+- Reject Express, `better-sqlite3`, LangGraph, or CrewAI.
+- Verify with `./scripts/harness/verify.sh`.
+
+## Always flag
+
+- Secrets, `.env` values, private keys, or real personal data in the diff
+- Weakened or skipped verify / lint / typecheck / adversarial gates
+- Invented success (prose claiming a gate passed with no command output)
+- Fail-open authorization, skipped human approval, or agents recording `--actor user`
+
+## Never request
+
+- Drive-by major upgrades, formatter churn, or unrelated refactors
+- Softening honesty disclaimers or certification claims

.github/skills/company-day-simulation/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: company-day-simulation
+description: "Change CorpOS company-day simulation behavior (firm model, work contracts, PDP/PEP, Approve/Reject/Kill). Use when editing packages/core, exception HITL, or SimulationProvider. Do not add LangGraph/CrewAI or auto-approve exceptions in product paths."
+---
+
+# Company-day simulation
+
+CorpOS simulates a company day: firm model, work contracts, PDP/PEP, humans Approve / Reject / Kill.
+
+## Do
+
+- Put firm logic in `packages/core`, HTTP in `apps/api`, UI in `apps/console`.
+- Keep exception HITL default-off.
+- Keep CI on `SimulationProvider`.
+
+## Do not
+
+- Auto-approve exceptions unless a test passes `autoApproveException: true`.
+- Set `CORPOS_ALLOW_LIVE` in CI.
+- Add LangGraph, CrewAI, Express, or `better-sqlite3`.
+
+Verify: `./scripts/harness/verify.sh`.

AGENTS.md

@@ -40,3 +40,9 @@ A change is not done until `./scripts/harness/verify.sh` is green.
   See [`docs/DESIGN-PIVOT.md`](docs/DESIGN-PIVOT.md).
 - Do not introduce Express or `better-sqlite3`.
 - Never commit secrets, `*.db`, `.env`, or `dist/`.
+
+## Coding standards (September 2026)
+
+Path-specific Copilot instructions: [`.github/instructions/`](.github/instructions/).
+Repository-wide Copilot file: [`.github/copilot-instructions.md`](.github/copilot-instructions.md).
+Copilot code review skill: [`.github/skills/code-review/SKILL.md`](.github/skills/code-review/SKILL.md).

llms.txt

@@ -17,3 +17,6 @@
 `./scripts/harness/verify.sh`
 
 Default provider is simulation. Live LLM (`CORPOS_ALLOW_LIVE`) is optional and never used in CI.
+- [.github/copilot-instructions.md](.github/copilot-instructions.md): repository-wide Copilot coding standards
+- [.github/instructions/](.github/instructions/): path-specific Copilot coding standards (September 2026)
+- [.github/skills/code-review/SKILL.md](.github/skills/code-review/SKILL.md): Copilot code review skill