Set up GitHub Copilot coding agent instructions

[Copilot]

Adds .github/copilot-instructions.md to give Copilot's coding agent repository-specific context, reducing incorrect assumptions and drift from established patterns.

What's included

• Stack & commands — Hono/TypeScript/Cloudflare Workers, npm scripts for dev/test/deploy/migrations, wrangler secret put for secrets management
• Code conventions — Hono typed app pattern (Bindings: Env; Variables: AuthVariables), Drizzle ORM rules (cc_* table prefix, UUID PKs, withTimezone, monetary numeric(12,2)), Zod validator placement in src/lib/validators.ts, one-route-file-per-domain structure
• Auth patterns — Documents all three middleware layers (authMiddleware, bridgeAuthMiddleware, mcpAuthMiddleware), their paths, precedence, and how to access context via c.get('userId')/c.get('scopes')
• Security guardrails — No hardcoded secrets, CORS origin allowlist, X-Source-Service header on outbound calls, no error detail leakage in responses
• Environment bindings — All Cloudflare bindings (HYPERDRIVE, DOCUMENTS, COMMAND_KV, AI, service URLs) with types and purposes; guards for optional bindings
• PR policy — One concern per PR, required description fields, schema changes require a migration
• Ecosystem context — Tier 5 positioning, upstream service delegation boundaries

Original prompt

---

This section details on the original issue you should resolve

<issue_title>✨ Set up Copilot instructions</issue_title>
<issue_description>Configure instructions for this repository as documented in Best practices for Copilot coding agent in your repository.

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes ✨ Set up Copilot instructions #13

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

1. @coderabbitai review
2. @copilot review
3. @codex review
4. @claude review
   Adversarial review request: evaluate security, policy bypass paths, regression risk, and merge-gating bypass attempts.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

1. @coderabbitai review
2. @copilot review
3. @codex review
4. @claude review
   Adversarial review request: evaluate security, policy bypass paths, regression risk, and merge-gating bypass attempts.

[Copilot]

Pull request overview

Adds repository-specific GitHub Copilot coding-agent guidance to reduce incorrect assumptions and keep generated changes aligned with existing patterns and security requirements.

Changes:

• Introduces .github/copilot-instructions.md describing project stack, commands, and architecture touchpoints.
• Documents conventions for Hono/TypeScript, Drizzle schema expectations, auth middleware layering, and security guardrails.
• Lists environment bindings, cron schedules, testing approach, and PR/review policy for governance alignment.

[Copilot]

The Cron Schedule table also uses ||-prefixed rows, which will render with an extra blank column. Consider converting it to standard markdown table formatting.

Suggested change

	| Schedule | Purpose |
	|----------|---------|
	| `0 12 * * *` | Daily 6 AM CT: Plaid + ChittyFinance sync |
	| `0 13 * * *` | Daily 7 AM CT: Court docket check |
	| `0 14 * * 1` | Weekly Mon 8 AM CT: Utility scrapers |
	| `0 15 1 * *` | Monthly 1st 9 AM CT: Mortgage, property tax |
	| Schedule | Purpose |
	| -------------- | ------------------------------------------------ |
	| `0 12 * * *` | Daily 6 AM CT: Plaid + ChittyFinance sync |
	| `0 13 * * *` | Daily 7 AM CT: Court docket check |
	| `0 14 * * 1` | Weekly Mon 8 AM CT: Utility scrapers |
	| `0 15 1 * *` | Monthly 1st 9 AM CT: Mortgage, property tax |

[Copilot]

The Validation section says to use @hono/zod-validator with zValidator('json'|'query', ...), but the codebase currently validates with schema.safeParse(...) inside handlers (no zValidator usage found). Please update these instructions to match the established safeParse pattern (or, if you want to standardize on @hono/zod-validator, update the route handlers accordingly).

Suggested change

	- Use `@hono/zod-validator` with `zValidator('json', schema)` for request body validation.
	- Validate query params with `zValidator('query', schema)`.
	- In route handlers, validate request bodies with `schema.safeParse(await c.req.json())`.
	- Validate query params with `schema.safeParse(c.req.query())` (or an equivalent object).
	- On validation failure, return `c.json({ error: 'Invalid request', details: zodError.flatten() }, 400)` or a similarly safe, non-sensitive error shape.

[Copilot]

This states that all Hono apps/routes are typed with Variables: AuthVariables, but several route files are currently declared as new Hono<{ Bindings: Env }>() (e.g., accounts/obligations). Consider adjusting the instruction to reflect the actual pattern (app-level typing + add Variables: AuthVariables only where c.get('userId')/c.get('scopes') is used).

Suggested change

	- All Hono apps/routes are typed: `new Hono<{ Bindings: Env; Variables: AuthVariables }>()`.
	- Import `AuthVariables` from `src/middleware/auth.ts` for route-level context variables.
	- Use `c.set('userId', ...)` and `c.get('userId')` for auth context in middleware and handlers.
	- Default Hono apps/routes are typed: `new Hono<{ Bindings: Env }>()`.
	- When a route or app needs auth context via `c.get('userId')` / `c.get('scopes')`, type it as `new Hono<{ Bindings: Env; Variables: AuthVariables }>()`.
	- Import `AuthVariables` from `src/middleware/auth.ts` only in files that use these auth context variables.
	- Use `c.set('userId', ...)` and `c.get('userId')` (and similarly `scopes`) for auth context in middleware and handlers.

[Copilot]

Routing guidance says to always return c.json(...), but there is at least one streaming endpoint returning c.newResponse(...) (SSE). Suggest loosening this to “use c.json for standard API responses” while allowing c.newResponse/streams where required.

Suggested change

	- Always return `c.json(...)` — never return raw strings or untyped responses.
	- For standard API responses, return `c.json(...)`. Use `c.newResponse`/streaming APIs only when you intentionally need SSE, streaming, or non-JSON responses — avoid raw/untyped responses otherwise.

[Copilot]

CORS allowlist here is missing currently-configured origins (e.g., https://cmd.chitty.cc) and the existing list includes schemes like http://localhost:5173. Please update the documented allowlist to match src/index.ts so future edits don’t inadvertently “fix” CORS to the wrong set of origins.

Suggested change

	- CORS is restricted to approved origins: `app.command.chitty.cc`, `command.mychitty.com`, `chittycommand-ui.pages.dev`, `localhost:5173`.
	- CORS is restricted to approved origins: `https://app.command.chitty.cc`, `https://command.mychitty.com`, `https://chittycommand-ui.pages.dev`, `https://cmd.chitty.cc`, `http://localhost:5173`.

[Copilot]

Environment bindings table is incomplete vs the actual Env type / wrangler.toml (e.g., CHITTYCHARGE_URL, CHITTYBOOKS_URL, CHITTYASSETS_URL, CHITTYROUTER_URL, CHITTYREGISTER_URL, CHITTYCHAT_DATA_API, CHITTYSCHEMA_URL, CHITTYCERT_URL, CHITTY_CONNECT_TOKEN, PLAID_ENV, and optional DATABASE_URL). Consider either listing all current bindings or explicitly pointing readers to src/index.ts / wrangler.toml as the source of truth.

Suggested change

	| `PLAID_CLIENT_ID` | string (secret) | Plaid API key |
	| `PLAID_SECRET` | string (secret) | Plaid API secret |
	Always check if optional URL bindings are present before using them (e.g., `if (c.env.CHITTYAUTH_URL)`).
	| `CHITTYCHARGE_URL` | string | ChittyCharge service URL |
	| `CHITTYBOOKS_URL` | string | ChittyBooks service URL |
	| `CHITTYASSETS_URL` | string | ChittyAssets service URL |
	| `CHITTYROUTER_URL` | string | ChittyRouter service URL |
	| `CHITTYREGISTER_URL` | string | ChittyRegister service URL |
	| `CHITTYCHAT_DATA_API` | string | ChittyChat data API base URL |
	| `CHITTYSCHEMA_URL` | string | ChittySchema service URL |
	| `CHITTYCERT_URL` | string | ChittyCert service URL |
	| `CHITTY_CONNECT_TOKEN` | string (secret) | ChittyConnect service token |
	| `PLAID_CLIENT_ID` | string (secret) | Plaid API key |
	| `PLAID_SECRET` | string (secret) | Plaid API secret |
	| `PLAID_ENV` | string | Plaid environment (e.g. `sandbox`, `development`, `production`) |
	| `DATABASE_URL` | string (optional) | Direct PostgreSQL connection URL (optional, may be unused when using Hyperdrive) |
	Always check if optional URL bindings are present before using them (e.g., `if (c.env.CHITTYAUTH_URL)`), and refer to `Env` in `src/index.ts` and `wrangler.toml` as the source of truth for the full, up-to-date bindings list.

[Copilot]

Key Files list says migrations are 0001–0007, but the repo currently has migrations through 0009_*. Please update this to avoid future confusion (or change to something like “0001+”).

Suggested change

	- `migrations/` — SQL migration files (0001–0007)
	- `migrations/` — SQL migration files (0001+)

[Copilot]

The markdown tables use a leading double pipe (|| ...) which renders as an extra empty column in most markdown renderers. Switching these rows to single-pipe table syntax will render correctly.