From f621ea0f3dc2a8a37124f55294794ad5e5833228 Mon Sep 17 00:00:00 2001
From: Lloouujjiinn <281355774+fhwvtqdc2q-svg@users.noreply.github.com>
Date: Sun, 7 Jun 2026 10:32:28 +0200
Subject: [PATCH 1/2] feat(instructions): add Vue 3 development instructions +
 fix deps

Add instructions/vue.instructions.md covering the Vue 3 feature surface (Composition API, reactivity, compiler macros, built-in components, Pinia, Vue Router, TypeScript, testing, SSR, security) and regenerate the instructions README index.

Also apply non-breaking npm audit fix resolving the yaml advisory (GHSA-48c2-rrv3-qjmp) and a transitive high-severity issue.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docs/README.instructions.md      |   1 +
 instructions/vue.instructions.md | 174 +++++++++++++++++++++++++++++++
 package-lock.json                |  15 +--
 3 files changed, 184 insertions(+), 6 deletions(-)
 create mode 100644 instructions/vue.instructions.md

diff --git a/docs/README.instructions.md b/docs/README.instructions.md
index 0590fe1ff..b3c35d63d 100644
--- a/docs/README.instructions.md
+++ b/docs/README.instructions.md
@@ -202,5 +202,6 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-instructions) for guidelines on
 | [Use Cliche Data in Documentation](../instructions/use-cliche-data-in-docs.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fuse-cliche-data-in-docs.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fuse-cliche-data-in-docs.instructions.md) | Ensure documentation and examples use only generic, cliche placeholder data — never real or sensitive data sourced from local scripts, configuration, task files, or prompt context. |
 | [Use Code Components in Power Pages](../instructions/pcf-power-pages.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fpcf-power-pages.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fpcf-power-pages.instructions.md) | Using code components in Power Pages sites |
 | [Visual Studio Extension Development with Community.VisualStudio.Toolkit](../instructions/vsixtoolkit.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fvsixtoolkit.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fvsixtoolkit.instructions.md) | Guidelines for Visual Studio extension (VSIX) development using Community.VisualStudio.Toolkit |
+| [Vue 3 Development Instructions](../instructions/vue.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fvue.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fvue.instructions.md) | Comprehensive Vue 3 development standards and best practices: Composition API, `<script setup>`, the full reactivity system, compiler macros (defineModel/defineSlots/defineOptions), built-in components (Teleport/Suspense/Transition/KeepAlive), provide/inject, composables, Pinia, Vue Router, TypeScript, testing, performance, SSR, and security. |
 | [WinUI 3 / Windows App SDK](../instructions/winui3.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fwinui3.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fwinui3.instructions.md) | WinUI 3 and Windows App SDK coding guidelines. Prevents common UWP API misuse, enforces correct XAML namespaces, threading, windowing, and MVVM patterns for desktop Windows apps. |
 | [WordPress Development — Copilot Instructions](../instructions/wordpress.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fwordpress.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fwordpress.instructions.md) | Coding, security, and testing rules for WordPress plugins and themes |
diff --git a/instructions/vue.instructions.md b/instructions/vue.instructions.md
new file mode 100644
index 000000000..922bb421c
--- /dev/null
+++ b/instructions/vue.instructions.md
@@ -0,0 +1,174 @@
+---
+description: 'Comprehensive Vue 3 development standards and best practices: Composition API, `<script setup>`, the full reactivity system, compiler macros (defineModel/defineSlots/defineOptions), built-in components (Teleport/Suspense/Transition/KeepAlive), provide/inject, composables, Pinia, Vue Router, TypeScript, testing, performance, SSR, and security.'
+applyTo: '**/*.vue, **/*.ts, **/*.js, **/*.css, **/*.scss'
+---
+
+# Vue 3 Development Instructions
+
+Authoritative guidance for building production-grade Vue 3 applications. Default to the **Composition API** with `<script setup lang="ts">`, the modern reactivity system, and the official ecosystem (Pinia, Vue Router, Vite, Vitest). Prefer the idioms below over legacy Options API and Vue 2 patterns.
+
+## Project Context
+- Vue 3.4+ (use 3.5+ features such as `useTemplateRef`, `useId`, and reactive props destructuring where the project's version allows).
+- `<script setup lang="ts">` single-file components (SFCs) as the default authoring style.
+- TypeScript everywhere: components, composables, stores, and router.
+- Pinia for state management; Vue Router for routing; Vite for build/dev.
+- Vitest + Vue Test Utils (or Testing Library for Vue) for tests.
+
+## Authoring Style & Component Design
+- Use `<script setup>` — it is more concise, faster, and has better type inference than `setup()` or the Options API.
+- One responsibility per component; split large components into smaller focused ones plus composables.
+- Order an SFC as `<script setup>`, then `<template>`, then `<style scoped>`.
+- Name components in PascalCase; use multi-word names (e.g. `UserCard`, not `Card`) to avoid clashing with native elements.
+- Co-locate component-specific types, and lift shared types into a `types/` module.
+
+## Compiler Macros (no imports needed)
+- `defineProps<T>()` — declare typed props from a TypeScript interface/type for full inference.
+- `withDefaults(defineProps<T>(), { ... })` — provide prop defaults (or use reactive props destructuring with defaults in 3.5+).
+- `defineEmits<{ change: [id: number]; update: [value: string] }>()` — declare typed events.
+- `defineModel<T>()` (3.4+) — the canonical way to implement `v-model` on a component; supports multiple models, arguments, and modifiers.
+- `defineExpose({ ... })` — explicitly expose a public imperative API; expose nothing by default.
+- `defineSlots<{ default(props: { item: T }): any }>()` — type named/scoped slots.
+- `defineOptions({ name, inheritAttrs })` — set component options inside `<script setup>`.
+- Never mutate props directly — emit an event, use `defineModel`, or derive local state with `computed`/`ref`.
+
+## Reactivity System
+### Core primitives
+- `ref()` for primitives and single replaceable references; access via `.value` in script (auto-unwrapped in templates).
+- `reactive()` for deep-reactive objects/collections; never destructure it directly (breaks reactivity) — use `toRefs()`/`toRef()`.
+- `computed()` for derived values; keep getters pure and side-effect free. Use writable computed (`get`/`set`) for two-way derived state.
+- Prefer `computed` over `watch` whenever you are *deriving* a value rather than performing a side effect.
+
+### Watchers
+- `watch(source, cb, options)` for explicit dependencies; `watchEffect(cb)` for auto-tracked dependencies.
+- Use watch options deliberately: `{ immediate: true }`, `{ deep: true }`, `{ once: true }` (3.4+), and `flush: 'post'` when you need the DOM updated first.
+- Register cleanup with the `onCleanup`/`onWatcherCleanup` callback to cancel stale async work (debounce, fetch, listeners).
+- Stop manual watchers via their returned handle when they outlive their natural scope.
+
+### Advanced reactivity (use intentionally)
+- `shallowRef` / `shallowReactive` for large or externally-managed data to skip deep tracking.
+- `readonly()` to hand out immutable views of shared state.
+- `toRef` / `toRefs` to keep reactivity when destructuring; `toRaw`/`markRaw` to opt out for non-reactive objects (e.g. class instances, 3rd-party clients).
+- `effectScope()` to group and dispose related effects together (useful in composables/libraries).
+- `customRef` for debounced/throttled or storage-backed refs.
+
+## Composables (reusable logic)
+- Extract stateful, reusable logic into `useXxx()` functions under `composables/`.
+- Accept refs/getters as inputs and return refs/computed; use `toValue()`/`MaybeRefOrGetter` to normalize ref-or-plain inputs.
+- Set up and tear down inside the composable (`onMounted`/`onUnmounted` or `tryOnScopeDispose`) so callers don't leak.
+- Keep composables synchronous in their setup phase; expose async actions as returned functions.
+- Reach for VueUse for common needs instead of re-implementing (e.g. `useStorage`, `useEventListener`, `useDebounceFn`).
+
+## Lifecycle & Effects
+- Use `onMounted`, `onBeforeMount`, `onUpdated`, `onBeforeUnmount`, `onUnmounted`, `onActivated`/`onDeactivated` (with `<KeepAlive>`), and `onErrorCaptured`.
+- Always clean up timers, listeners, observers, and subscriptions in `onUnmounted`.
+- Guard browser-only APIs (`window`, `document`) for SSR; run them in `onMounted`.
+
+## Template Best Practices
+- Always set a stable, unique `:key` on `v-for`; never use the array index when items can reorder or mutate.
+- Never put `v-if` and `v-for` on the same element — filter via a `computed` instead.
+- `v-show` for frequently toggled elements; `v-if` for conditional mounting.
+- Use `v-memo` to skip re-rendering of expensive static subtrees, and `v-once` for content that renders a single time.
+- Use the `:` (v-bind) and `@` (v-on) shorthands consistently; group nodes with `<template>` to avoid wrapper elements.
+- Avoid heavy expressions in templates — move them to `computed` or methods.
+
+## Slots
+- Use named slots for layout extension and scoped slots (`<slot :item="item" />` + `#default="{ item }"`) to expose data to the parent.
+- Provide sensible fallback slot content.
+- Use the `v-slot` (`#`) shorthand and dynamic slot names where appropriate.
+
+## Built-in Components
+- `<Teleport to="body">` for modals, toasts, and tooltips that must escape overflow/stacking contexts.
+- `<Suspense>` with `#default`/`#fallback` for async setup and lazy components; pair with error handling.
+- `<Transition>` / `<TransitionGroup>` for enter/leave and list animations (set `:key` on grouped items).
+- `<KeepAlive>` (with `include`/`exclude`/`max`) to cache component state across toggles; handle `onActivated`/`onDeactivated`.
+- `<component :is="...">` for dynamic components; `defineAsyncComponent(() => import('...'))` for code-split/lazy loading with loading/error components.
+
+## Provide / Inject (dependency injection)
+- Type injections with an `InjectionKey<T>` (`Symbol`) for safety: `provide(key, value)` / `inject(key)`.
+- Provide a default or assert presence to avoid `undefined`.
+- Prefer `readonly()` when providing state that children should not mutate; expose explicit updater functions instead.
+- Use injection for cross-cutting concerns; use Pinia for app-wide shared state.
+
+## Custom Directives & Plugins
+- Author directives as objects with `mounted`/`updated` (etc.) hooks; keep them DOM-focused (e.g. `v-focus`, `v-click-outside`).
+- Encapsulate global setup (router, pinia, i18n, UI libs) as plugins via `app.use(...)`; register global config in `main.ts`.
+
+## State Management with Pinia
+- Use Pinia for shared/cross-component state; keep component-only state local with `ref`/`reactive`.
+- Prefer **setup stores**: `defineStore('user', () => { const user = ref(...); const isLoggedIn = computed(...); function login(){}; return { user, isLoggedIn, login } })`.
+- One store per domain; keep actions for async/side effects and getters pure & synchronous.
+- Destructure with `storeToRefs()` to preserve reactivity; use `$patch` for batched mutations, `$reset` to restore state, and `$subscribe`/`$onAction` for cross-cutting concerns.
+- Handle SSR hydration correctly and keep stores serializable.
+
+## Routing with Vue Router
+- Define routes with lazy `component: () => import('...')` for automatic code splitting.
+- Use navigation guards (`beforeEach`, `beforeEnter`, `beforeRouteLeave`) for auth and unsaved-changes checks; always resolve/`next()` exactly once.
+- Use `route.meta` (typed) for per-route config like `requiresAuth`.
+- Read params/query via `useRoute()` and navigate via `useRouter()`; treat `route.params` as reactive (watch it, don't cache).
+- Configure `scrollBehavior` for predictable scroll restoration; enable typed routes where available.
+
+## TypeScript Integration
+- Type props/emits/slots through generic compiler macros, not runtime object syntax.
+- Type refs explicitly when inference is too narrow: `ref<User | null>(null)`.
+- Type template refs with `useTemplateRef<HTMLInputElement>('input')` (3.5+) or `ref<HTMLInputElement | null>(null)`.
+- Build generic components with `<script setup lang="ts" generic="T">`.
+- Type provide/inject with `InjectionKey<T>`; type Pinia stores via their inferred return types.
+
+## Styling
+- Default to `<style scoped>`; use `:deep()`, `:slotted()`, and `:global()` selectors deliberately.
+- Use `v-bind()` in `<style>` to drive CSS from reactive state; prefer CSS custom properties for theming.
+- Consider CSS Modules (`<style module>`) for class-name isolation in larger teams.
+
+## Forms & Validation
+- Bind inputs with `v-model` (and `defineModel` for custom inputs); use modifiers `.lazy`, `.number`, `.trim`.
+- Validate with a schema library (Zod/Yup) plus a form library (VeeValidate or FormKit) for non-trivial forms.
+- Client validation is for UX only — always validate and sanitize on the server.
+
+## Error Handling
+- Use `onErrorCaptured` for component-tree boundaries and `app.config.errorHandler` for a global hook.
+- Wrap async/lazy boundaries with `<Suspense>` + an error fallback.
+- Surface user-friendly errors; log diagnostics to your monitoring pipeline.
+
+## Performance
+- Code-split routes and heavy components (`defineAsyncComponent`, dynamic `import()`).
+- Use `computed` for caching, `v-memo`/`v-once` for static subtrees, and `shallowRef`/`shallowReactive` for big datasets.
+- Virtualize long lists (e.g. `vue-virtual-scroller`); paginate or window large data.
+- Avoid unnecessary deep reactivity and avoid creating new object/array literals inline in templates.
+- In 3.5+, consider lazy hydration strategies for SSR to reduce time-to-interactive.
+
+## SSR / Meta-frameworks
+- Prefer Nuxt for SSR/SSG/hybrid rendering unless you have a reason to hand-roll SSR.
+- Keep code isomorphic: guard browser APIs, avoid module-level shared mutable state across requests, and ensure stores are request-scoped.
+- Match server and client output to prevent hydration mismatches.
+
+## Accessibility
+- Use semantic HTML first; add ARIA only to fill genuine gaps.
+- Ensure full keyboard operability and visible focus states.
+- Manage focus on route changes and when opening/closing dialogs (trap focus in modals).
+- Give icon-only controls accessible names (`aria-label`); associate labels with inputs.
+
+## Security
+- Never render untrusted input with `v-html`; sanitize (e.g. DOMPurify) if it is unavoidable.
+- Avoid dynamic `:is`/`:href`/`:src` from untrusted sources; validate URLs (block `javascript:` schemes).
+- Keep secrets server-side; only expose `VITE_`-prefixed env vars intentionally meant to be public.
+- Apply a Content Security Policy and standard CSRF/XSS protections at the app layer.
+
+## Testing
+- Unit-test composables as plain functions; component-test with Vue Test Utils / Testing Library.
+- Test observable behavior and rendered output, not internal implementation details.
+- Mock stores with `createTestingPinia`; stub router and async boundaries as needed.
+- Cover critical user journeys with end-to-end tests (Playwright or Cypress).
+
+## Tooling
+- Use Vite with the official Vue plugin; enable `vue-tsc` for type-checking in CI.
+- Use ESLint (`eslint-plugin-vue`) and Prettier; enable Volar/Vue official extension for the best DX.
+- Manage env via `import.meta.env` with `VITE_`-prefixed variables.
+
+## Anti-Patterns to Avoid
+- Mixing Options API and Composition API arbitrarily in the same codebase.
+- Mutating props directly, or destructuring `reactive()`/Pinia stores without `toRefs`/`storeToRefs`.
+- Using `watch` for values that should be `computed`.
+- `v-if` together with `v-for` on one element; using array index as `:key`.
+- Heavy logic inside templates; unbounded deep reactivity on large data.
+- Leaking timers/listeners by skipping `onUnmounted` cleanup.
+- Rendering untrusted HTML via `v-html`.
diff --git a/package-lock.json b/package-lock.json
index b5fd50b6e..e94a2d334 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -393,9 +393,9 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "dev": true,
       "license": "MIT"
     },
@@ -821,15 +821,18 @@
       "license": "ISC"
     },
     "node_modules/yaml": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz",
-      "integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==",
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
       },
       "engines": {
         "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
       }
     },
     "node_modules/yargs": {

From a05f8357a42f35ee44433af83d4afe7ecf9e8840 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 8 Jun 2026 14:57:58 +0000
Subject: [PATCH 2/2] Add instructions for GitHub Copilot Business/Enterprise
 administration

Adds a new instructions file guiding Copilot to help organization
admins diagnose and resolve Copilot Business/Enterprise provisioning,
licensing, and seat-management issues through supported channels.

Covers:
- Two-layer diagnosis (personal account vs. org provisioning)
- HTTP status-code interpretation (404 / 403 / 422)
- Common provisioning symptoms and first checks
- Relevant Copilot billing REST endpoints
- A structured GitHub Support escalation template

Explicitly scopes guidance to legitimate, documented administration and
never advises circumventing billing, risk, or compliance holds.

Regenerates docs/README.instructions.md via npm run build.

https://claude.ai/code/session_01KH7R8PXqz6e6tsRaaPAExK
---
 docs/README.instructions.md                   |  1 +
 ...ot-business-administration.instructions.md | 87 +++++++++++++++++++
 2 files changed, 88 insertions(+)
 create mode 100644 instructions/github-copilot-business-administration.instructions.md

diff --git a/docs/README.instructions.md b/docs/README.instructions.md
index b3c35d63d..599eace4e 100644
--- a/docs/README.instructions.md
+++ b/docs/README.instructions.md
@@ -105,6 +105,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-instructions) for guidelines on
 | [Get Tooling for Power Apps Component Framework](../instructions/pcf-tooling.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fpcf-tooling.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fpcf-tooling.instructions.md) | Get Microsoft Power Platform CLI tooling for Power Apps Component Framework |
 | [Gilfoyle Code Review Instructions](../instructions/gilfoyle-code-review.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fgilfoyle-code-review.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fgilfoyle-code-review.instructions.md) | Gilfoyle-style code review instructions that channel the sardonic technical supremacy of Silicon Valley's most arrogant systems architect. |
 | [GitHub Actions CI/CD Best Practices](../instructions/github-actions-ci-cd-best-practices.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fgithub-actions-ci-cd-best-practices.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fgithub-actions-ci-cd-best-practices.instructions.md) | Comprehensive guide for building robust, secure, and efficient CI/CD pipelines using GitHub Actions. Covers workflow structure, jobs, steps, environment variables, secret management, caching, matrix strategies, testing, and deployment strategies. |
+| [GitHub Copilot Business & Enterprise Administration](../instructions/github-copilot-business-administration.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fgithub-copilot-business-administration.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fgithub-copilot-business-administration.instructions.md) | Guidance for diagnosing and resolving GitHub Copilot Business and Enterprise provisioning, licensing, and seat-management issues through supported, legitimate channels — including API troubleshooting, common error patterns, and a structured support-escalation template for organization administrators. |
 | [GitHub Copilot SDK C# Instructions](../instructions/copilot-sdk-csharp.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fcopilot-sdk-csharp.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fcopilot-sdk-csharp.instructions.md) | This file provides guidance on building C# applications using GitHub Copilot SDK. |
 | [GitHub Copilot SDK Go Instructions](../instructions/copilot-sdk-go.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fcopilot-sdk-go.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fcopilot-sdk-go.instructions.md) | This file provides guidance on building Go applications using GitHub Copilot SDK. |
 | [GitHub Copilot SDK Java Instructions](../instructions/copilot-sdk-java.instructions.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fcopilot-sdk-java.instructions.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/instructions?url=vscode-insiders%3Achat-instructions%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Finstructions%2Fcopilot-sdk-java.instructions.md) | This file provides guidance on building Java applications using GitHub Copilot SDK for Java. |
diff --git a/instructions/github-copilot-business-administration.instructions.md b/instructions/github-copilot-business-administration.instructions.md
new file mode 100644
index 000000000..b511f04bc
--- /dev/null
+++ b/instructions/github-copilot-business-administration.instructions.md
@@ -0,0 +1,87 @@
+---
+applyTo: '**'
+description: 'Guidance for diagnosing and resolving GitHub Copilot Business and Enterprise provisioning, licensing, and seat-management issues through supported, legitimate channels — including API troubleshooting, common error patterns, and a structured support-escalation template for organization administrators.'
+---
+
+# GitHub Copilot Business & Enterprise Administration
+
+Guidance for helping **organization and enterprise administrators** provision, troubleshoot, and manage GitHub Copilot Business / Copilot Enterprise access. Use this when a user reports that Copilot is "not enabled", seats will not assign, provisioning appears stuck, or the API returns unexpected results for an org.
+
+> **Scope and boundaries**
+>
+> - This guidance covers **supported, documented** administration only.
+> - It never advises bypassing billing, risk, compliance, trust-and-safety, or verification controls. Those controls are operated by GitHub and can only be resolved by GitHub Support or the responsible internal team.
+> - If a restriction is a deliberate hold (for example a date-locked upgrade restriction, a payment hold, or a compliance/eligibility review), the **only** correct path is to escalate to GitHub Support with complete evidence — not to work around it.
+
+## Instructions
+
+- **Confirm the plan before debugging.** Copilot Business and Copilot Enterprise are billed at the organization or enterprise level. Verify which plan the org is actually on before assuming a bug. An org still reporting a free/unprovisioned plan via the API has not finished activation, regardless of what the UI attempted.
+- **Verify the requester's role.** Seat and policy management requires an **organization owner** (or an enterprise owner / billing manager for enterprise-level settings). Members and billing managers have different scopes.
+- **Separate the two layers.** Personal-account Copilot status and organization-level provisioning are independent. A restriction on a personal account does not provision an org, and an org seat does not lift a personal-account restriction. Diagnose each layer separately.
+- **Read the actual API/HTTP response.** Status codes are diagnostic:
+  - `404` on Copilot org endpoints usually means **Copilot Business is not enabled / not finished provisioning** for that org — not necessarily a permissions error.
+  - `403` typically means **insufficient scope or role** (token missing `manage_billing:copilot` / `admin:org`, or the caller is not an owner).
+  - `422` usually means the **request is well-formed but rejected** (e.g., seat assignment for a user who is not an org member, or a policy that conflicts with enterprise settings).
+- **Distinguish a misconfiguration from a hold.** If local configuration (roles, scopes, policies) checks out but the feature still will not enable, treat it as a backend/account state issue and escalate rather than continuing client-side troubleshooting.
+
+## Common provisioning issues and how to diagnose them
+
+| Symptom | Most likely cause | First check |
+|---------|-------------------|-------------|
+| `404` from Copilot org endpoints | Copilot Business never finished enabling for the org | Confirm the org's plan in **Settings → Billing**; re-run enablement as an owner |
+| Org "plan" still shows free/unprovisioned in API | Activation started in UI but backend did not complete | Compare UI state vs. billing API; if mismatched, escalate |
+| Seats will not assign (`422`) | Target users are not org members, or seat policy excludes them | Verify membership and the seat-assignment policy (selected teams/users vs. all members) |
+| `403` on management calls | Token scope or caller role insufficient | Confirm owner role + token scopes (`manage_billing:copilot`, `admin:org`) |
+| "Upgrade not available until \<date\>" | Automated billing / risk / eligibility hold | **Not self-service.** Escalate to Support — see below |
+| Enablement blocked despite valid admin + scopes | Account/org under automated review or hold | **Not self-service.** Escalate to Support — see below |
+
+### About automated holds, date-locks, and eligibility reviews
+
+Some restrictions are produced by automated billing, risk, trust-and-safety, or compliance systems rather than by normal admin settings:
+
+- A hard date-locked message (e.g., *"upgrade not available until \<date\>"*) is generated by an automated system and has **no self-service clear path** in account settings or the API.
+- Provisioning of advanced commercial features can be held pending account/eligibility verification.
+- These holds are intentional. Do **not** advise the user to rename an org, create a parallel org, switch accounts, or otherwise attempt to evade the control. Advise them to escalate and supply evidence so the responsible team can review and, if appropriate, lift the hold.
+
+## Useful API endpoints (read first, change carefully)
+
+Use the REST API to gather evidence before escalating. Calls require an organization owner and a token with `manage_billing:copilot` (and `admin:org` where noted).
+
+- **Copilot billing for an org**
+  `GET /orgs/{org}/copilot/billing`
+  Returns seat breakdown and the current Copilot plan. A `404` here is the key signal that Copilot Business is not enabled for the org.
+- **List Copilot seats**
+  `GET /orgs/{org}/copilot/billing/seats`
+- **Assign seats to selected users / teams**
+  `POST /orgs/{org}/copilot/billing/selected_users`
+  `POST /orgs/{org}/copilot/billing/selected_teams`
+- **Remove seats**
+  `DELETE /orgs/{org}/copilot/billing/selected_users`
+
+Always capture the **full request (endpoint + method), the response status code, and the response body** when documenting an issue — these are exactly what Support needs.
+
+## Escalating to GitHub Support
+
+When the issue is a backend/account state problem or an automated hold, open a Support ticket. Route it under: **Copilot → Billing / Provisioning → Organization access.**
+
+Include all of the following so the ticket can be actioned without back-and-forth:
+
+1. **Organization slug** (and enterprise slug, if applicable).
+2. **Confirmation of org-owner access** for the requester.
+3. **Screenshot of any hold or date-lock message** (e.g., the "upgrade not available until \<date\>" notice), with the date clearly visible.
+4. **The `404` / provisioning response** from `GET /orgs/{org}/copilot/billing`, including status code and body.
+5. **API output showing the org's current plan** (especially if it still reports free/unprovisioned).
+6. **A clear, explicit request**, for example: *"Please review Copilot Business provisioning for this organization and confirm whether an account/eligibility verification or compliance hold is blocking activation."*
+
+Also ask Support to confirm, explicitly:
+
+- Whether a **personal-account restriction** and the **organization restriction** are linked.
+- Whether the org is subject to an **automated eligibility/compliance review** (and what evidence, if any, would resolve it).
+- Whether **backend provisioning can be completed manually** once verification passes.
+
+## Additional Guidelines
+
+- Frame answers around the two-layer model (personal account vs. org provisioning) so the user does not chase the wrong layer.
+- Prefer pointing to **Settings → Billing** and the official Copilot billing API over speculative fixes.
+- When configuration is already correct, say so plainly and direct the user to escalation rather than inventing further client-side steps.
+- Never suggest circumventing a hold; suggest documenting it thoroughly and escalating through the supported channel.