Copilot Instructions

# Repository Instructions

This project uses a structured context system for AI-assisted development. Key project documentation lives in the `context/` directory.

## Before Making Changes

Always consult the relevant context files before making significant changes:
- `context/prd.md` for product requirements and user stories
- `context/infra.md` for coding standards and architecture conventions
- `context/security.md` for security rules and practices
- `context/sbom.md` for approved dependencies and versions

## Coding Standards

Follow the conventions defined in `context/infra.md`, including:
- Variable naming conventions
- File naming conventions
- Comment style and linting rules

## Security Rules

Always follow the baseline rules in `context/security.md`:
- Never hardcode secrets — use environment variables
- Maintain `.gitignore` entries for secret files (`.env`, `.pem`, etc.)
- Apply the principle of least privilege for all credentials

## Work Tracking

All work is tracked via **beads** (`bd`) CLI. Follow the workflow in `context/workflow.md`:
- Create issues with `bd create`
- Track status with `bd list`, `bd ready`
- Close completed work with `bd close`
- Reference beads IDs in commit messages

## Conflict Resolution

When context files conflict, follow this precedence (highest first):
`security.md` > `sbom.md` > `infra.md` > `prd.md` > `workflow.md`