Copilot instructions

1# Copilot instructions for EGC
2 
3EGC is a local-first MCP runtime that gives every AI coding agent a shared
4persistent memory (egc-memory), a safety layer that validates commands and
5writes before they run (egc-guardian), and shell-output compression (Token
6Crusher). It installs into 23 AI coding tools from one npm package
7(@egchq/egc). Memory lives encrypted in ~/.egc on the user's machine and must
8never reach the repository.
9 
10## Repository conventions
11 
12- All repository content is written in English, except the files under
13  translations/.
14- Flag any populated memory content in AGENTS.md, GEMINI.md,
15  .cursor/rules/egc-context.mdc or .trae/rules/egc-context.md: those
16  propagation files must ship with an empty structure only, and CI enforces
17  it.
18 
19## README and translations
20 
21- README.md must keep the exact catalog sentence matching "access to N
22  agents, N skills, and N commands" and the "Works natively with ..."
23  provider sentence: CI validates both.
24- The 7 translations (ar, es, hi, ja, ko, pt, ru) must mirror the heading
25  levels of README.md in the same order; adding or removing a section in one
26  language only is a defect.
27- The Support EGC section and everything below it (sponsors, backers,
28  OpenSSF footer) changes only when the maintainer edits it deliberately.
29 
30## Code review priorities
31 
32- Commits need a DCO Signed-off-by line and follow conventional commits.
33- New code never uses Math.random for anything security-adjacent: use
34  crypto.randomInt (SonarCloud S2245 gates the merge).
35- Binaries invoked from scripts are resolved from fixed paths with a PATH
36  fallback, not bare names (S4036 pattern used across scripts/).
37- Any change touching files shared across concurrent EGC processes
38  (~/.egc state, encryption key, install-state, lockfiles) requires a
39  concurrent-access regression test; check for read-merge-write races and
40  lock steal in upserts.
41- Shell-facing features must be fail-open: a broken hook or missing binary
42  must never block the user's command.
43- Version bumps happen only in dedicated release PRs that update the whole
44  release surface (11 files); flag any stray version change elsewhere.
45 
46<!-- egc:start -->
47## EGC Project Memory
48 
49<!-- egc:end -->
50