Copilot shop-window: instructions, ignore, setup-steps

.copilotignore

@@ -0,0 +1,30 @@
+# Secrets and credentials — do not feed these to GitHub Copilot
+.env
+.env.*
+!.env.example
+**/.env
+**/.env.*
+secrets/
+**/secrets/
+credentials/
+**/credentials/
+**/*secret*
+**/*credential*
+
+# Deploy / build artifacts
+.vercel/
+dist/
+.output/
+.nitro/
+node_modules/
+
+# Large dumps and local leftovers
+*.dump
+*.sql.gz
+*.tar
+*.tar.gz
+*.zip
+artifacts/
+attachments/
+coverage/
+*.log

.github/copilot-instructions.md

@@ -1,8 +1,36 @@
-This repo is the web UI for the MCP OAuth checker at https://check.gfbytes.com/.
-
-- Same probe semantics as GFB2026/mcp-oauth-connect `diagnose.py`.
-- Free path reads discovery metadata only. Do not add DCR, token mint, or `tools/list`.
-- Do not commit `.vercel/`, `dist/`, or deploy artifacts.
-- Python tests: `cd diagnose && python -m pytest tests/`
-- Node tests: `npm test` (local / typecheck). CI covers the diagnose probe.
-- MIT. No secrets, no private company internals.
+# GitHub Copilot — mcp-gfbytes
+
+This repository is the **public web checker** for MCP OAuth Connect (TanStack Start). Live UI: https://check.gfbytes.com/. Same probe semantics as `GFB2026/mcp-oauth-connect` `diagnose.py`. MIT. Metadata-only free path.
+
+Shop-window pin: web UI companion to `mcp-oauth-connect`. Do not treat this repo as a fleet, ops, or private-product surface.
+
+## Safe lanes
+
+Stay here unless a human names a different **public shop-window** task:
+
+- Docs and comments (README, this file). No Volo/customer brand-hype vocabulary.
+- Diagnose unit tests: `cd diagnose && python -m pytest tests/`
+- Node local checks: `npm test`, `npm run typecheck` (Node ≥22)
+- GitHub Copilot config only: this file, `.copilotignore`, `.github/workflows/copilot-setup-steps.yml`
+
+CI already runs the diagnose probe in `.github/workflows/tests.yml`. Do not replace that workflow.
+
+Do not commit `.vercel/`, `dist/`, or deploy artifacts. Local dev needs no secrets: with `DATABASE_URL` unset the app uses embedded PGLite.
+
+## NEVER
+
+- Secrets: commit `.env`, `.env.*` with real values, credential files, or `DATABASE_URL` with real credentials
+- Vercel production deploy, or any live production ship from this repo
+- `COPILOT_MCP` or MCP config that can reach apps, ops, or `gc-mcp`
+- Fleet / `gc-mcp` work; greg-chat; gregops-plugins; gfb; private ILI / mail / money / client / intake
+- Handshake creep on the free check: DCR, token mint, or `tools/list`
+- Stripe live keys or checkout wiring beyond existing public product copy
+- Private company internals
+
+## Verify
+
+```bash
+npm test
+npm run typecheck
+cd diagnose && python -m pytest tests/
+```

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,39 @@
+# Preinstall Node + diagnose pytest deps so GitHub Copilot can run existing tests.
+# The job MUST be named copilot-setup-steps. Does not replace tests.yml.
+name: Copilot Setup Steps
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+  # The job MUST be called `copilot-setup-steps` or it will not be picked up.
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install Node dependencies
+        run: npm install
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install diagnose pytest
+        run: python -m pip install "pytest>=8"

README.md

@@ -64,6 +64,12 @@ server/        Nitro / PWA middleware
 
 Build output (`.vercel/`, `dist/`) is gitignored — do not commit deploy artifacts.
 
+## For AI assistants / contributors
+
+Safe work: docs, diagnose unit tests (`cd diagnose && python -m pytest tests/`), `npm test`, `npm run typecheck`, and the GitHub Copilot files under `.github/` plus `.copilotignore`. Do not replace `.github/workflows/tests.yml`.
+
+The free check is discovery metadata only — do not add DCR, token mint, or `tools/list`. Do not commit secrets, `.env*` with credentials, a real `DATABASE_URL`, `.vercel/`, or `dist/`.
+
 ## License
 
 MIT