Modernize agent instructions and prioritize security-first reviews

[Copilot]

Summary

• Consolidate repository-wide instructions and scoped C++ guidance, reducing duplication and clarifying task boundaries.
• Correct library error-handling guidance, changelog rules, test usage, and formatting prerequisites.
• Replace incident-specific examples with general security and safety review approaches, including pre-authentication memory safety and resource-exhaustion risks.
• Require ASCII-only committed code and agent instructions, including checks beyond automated script coverage.

Validation

• Existing formatting/lint checks passed during implementation; final ASCII, Prettier, diff, and secret checks passed.
• Full local checks remain incomplete: the CI test-bucket check could not configure because the checkout lacked a reachable ccf-* tag.
• Automated review completed. Its latest findings concerned unrelated partition-test code and were left unchanged.
• CodeQL was skipped by validation for documentation-only changes.

[Copilot]

🔵 Needs a closer look

Four documented guidance inaccuracies remain unresolved.

Pull request overview

Modernizes repository instructions with clearer validation workflows and security-first review guidance.

Changes:

• Refines testing, formatting, linting, and changelog guidance.
• Consolidates repository-wide agent instructions.
• Adds contract-driven security and error-handling guidance.

File summaries

File	Description	Review result
.github/skills/testing/SKILL.md	Updates test selection and execution guidance.	Two nits: narrow the build prerequisite scope and use direct ctest -N discovery.
.github/skills/formatting-and-linting/SKILL.md	Clarifies check scope and auto-fix safety.	Nit: document source-component dependency validation.
.github/instructions/reviewing.instructions.md	Establishes security-first review guidance.	No issues noted.
.github/instructions/changelog.instructions.md	Refines release and PR-reference rules.	No issues noted.
.github/copilot-instructions.md	Consolidates repository-wide agent instructions.	Nit: describe ci-checks.sh as the complete CI-check suite, not full local validation.

Review details

Suppressed comments (4)

.github/copilot-instructions.md:34

• scripts/ci-checks.sh does not perform the builds or relevant test execution required above; it runs the static/check inventory in scripts/ci-checks.sh:38-52. Calling its success "full local validation" can lead agents to report complete validation after only this check suite. Describe it as the complete CI-check suite instead.

- Run `scripts/ci-checks.sh` without auto-fix for full local validation when prerequisites are available. Targeted checks do not constitute a full-suite pass.

.github/skills/formatting-and-linting/SKILL.md:37

• includes-checks.sh also runs check-source-dependencies.py across C/C++ files under src/ (scripts/includes-checks.sh:45-49, scripts/check-source-dependencies.py:144-151). Describing this as public-header coverage means internal include/dependency changes may not be routed to the check; include source-component dependency validation in this row.

| `includes-checks.sh`      | Public C++ headers and their uses                            | Public/private include and exported-header checks  | No                |

.github/skills/testing/SKILL.md:11

• Scope this prerequisite to C++ and end-to-end tests. As written, it also covers the Python SDK tests below, but the SDK CI job runs the editable install and pytest without configuring or building CCF (.github/workflows/ci.yml:72-80). Following this instruction would unnecessarily block SDK-only validation on the full C++ build environment.

Follow the global validation policy for choosing relevant tests and reporting blockers. Before running tests, configure and build the affected targets using the documented development environment. The Copilot formatting/lint setup alone is not a full test environment.

.github/skills/testing/SKILL.md:17

• tests.sh always installs uv, the SDK, and test requirements before forwarding to ctest (tests/tests.sh:7-19,37), so this discovery command still requires Python/network setup and can fail before listing tests. This conflicts with the direct-discovery guidance on line 24; use ctest -N for inventory discovery.

./tests.sh -N                       # Discover registered tests; does not run them

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.