Add agent skills and enhance Copilot instructions with best practices

[Copilot]

Standardizes repository documentation following always-on-instructions best practices to improve AI-assisted development quality and consistency.

Changes

Enhanced .github/copilot-instructions.md (126→375 lines, 1690 words)

• Rationale sections for key architectural decisions (H2 as primary, React Query over Redux, circuit breaker pattern)
• Good/Bad code examples for critical patterns:
  • Circuit breaker implementation with Resilience4j fallback
  • React Query hooks vs manual useEffect state management
  • Backend testing with WireMock mocking
  • Playwright E2E with data-testid selectors
  • Bean Validation for input sanitization
• Security guidelines: Input validation, CORS configuration, dependency scanning
• Expanded tech stack: Explicit versions and testing frameworks

Added .github/skills/create-agent-skill/SKILL.md

Agent skill following agentskills.io spec for creating new skills. Includes frontmatter validation, naming rules, and progressive disclosure patterns.

Added .github/agents/feature-builder.md

Custom agent for orchestrating full-stack features with handoffs to specialized sub-agents (security review, test writer, PR creator). Encodes project-specific patterns:

• H2 as authoritative source, BIAN for enrichment only
• Mandatory circuit breakers on external API calls
• React Query for all server state
• Material-UI theme consistency
• Uses Claude Sonnet 4.5 model
• Handoffs correctly reference: 'SE: Security', 'test-writer', and 'pr-creator' agents

Added custom agent definitions

• .github/agents/security-reviewer.md ('SE: Security'): Security-focused code review with OWASP Top 10 and enterprise security standards
• .github/agents/test-writer.md ('Test Writer'): Comprehensive testing for Playwright E2E, JUnit backend, and React Testing Library
• .github/agents/pr-creator.md ('PR Creator'): Creates GitHub Pull Requests with detailed descriptions, prioritizing GitHub MCP tools over gh CLI

All custom agents configured with Claude Sonnet 4.5 model.

Example usage:

## What You Always Do

### Backend (Spring Boot)
- ✅ Add repository methods in `com.threeriversbank.repository`
- ✅ Implement service logic with `@CircuitBreaker` for BIAN calls
- ✅ Use `@Valid` for request validation

### Frontend (React)
- ✅ Create React Query hooks for API calls
- ✅ Use `data-testid` attributes for E2E testing

Impact

• AI agents now have explicit context about architecture trade-offs
• Code examples prevent common anti-patterns (bypassing circuit breakers, using Redux, skipping validation)
• Feature Builder agent provides consistent implementation workflow across the team with proper handoffs to specialized sub-agents
• PR Creator prioritizes GitHub MCP tools for programmatic GitHub API access

Original prompt

Requirement

Create, update, and refine the best instructions for this repository, explicitly using the recommendations from the always-on-instructions file as the authoritative source for foundational Copilot configuration. This will:

• Centralize and standardize project management knowledge
• Clarify onboarding workflows and best practices
• Make improvements easier to validate, document, and maintain

Tasks

1. Identify current documentation and instructions used in this repo

Analyze the existing .github/copilot-instructions.md file and other documentation in the repository to understand current state.

2. Compare and integrate guidance from always-on-instructions

Use the guidance from docs/part-2-1-always-on-instructions.md from the Norman-Norman-Norman/customize-your-repo repository as the baseline reference. The current instructions are project-specific but should be enhanced with:

Structure improvements:

• Add rationale sections explaining "why" for key decisions
• Include "Good vs Bad" examples for critical patterns
• Add sections on what NOT to do with explanations
• Organize content following the recommended structure from the guide

Content additions:

• Tech stack section (already present but could be enhanced)
• Code style conventions with examples
• File organization patterns
• Security guidelines
• Testing requirements with examples
• Error handling approaches
• Dependencies section (approved/deprecated libraries)
• Git conventions if applicable

3. Draft improved instructions

Update the .github/copilot-instructions.md file to:

• Maintain all existing Three Rivers Bank project-specific information
• Enhance structure and formatting following always-on-instructions best practices
• Add rationale for key architectural decisions (e.g., why React Query over Redux, why H2 as primary source)
• Include "Good vs Bad" code examples for critical patterns
• Add security guidelines specific to this project
• Document testing patterns with examples
• Keep the content focused (500-2000 words as recommended)

4. Include the create-agent-skill skill

Copy the create-agent-skill skill from Norman-Norman-Norman/customize-your-repo to this repository:

• Create directory: .github/skills/create-agent-skill/
• Copy the SKILL.md file with all content from: https://github.com/Norman-Norman-Norman/customize-your-repo/blob/main/.github/skills/create-agent-skill/SKILL.md
• Ensure the directory structure and frontmatter follow agentskills.io specification

5. Create and include the Feature Builder custom agent

Create a Feature Builder custom agent based on the example from Norman-Norman-Norman/customize-your-repo:

• Create file: .github/agents/feature-builder.md
• Base the content on the Feature Builder agent documented in the customize-your-repo repository
• Adapt the agent to be specific to this Three Rivers Bank project (Spring Boot backend, React frontend)
• Include handoffs for security review, testing, and PR creation
• Follow the custom agent format with proper frontmatter (name, description, tools, model, handoffs)
• Use the "Agent Formula" structure: Who You Are, How You Think, How You Respond, What You Always Do, What You Never Do

Feature Builder requirements:

---
name: 'Feature Builder'
description: 'End-to-end feature implementation with specialized sub-agents'
tools: ['search', 'readFile', 'editFile', 'runInTerminal']
model: 'Claude Opus 4.5'
handoffs:
  - label: 'Security Review'
    agent: 'security-reviewer'
    prompt: 'Review the implemented code for security vulnerabilities.'
  - label: 'Write Tests'
    agent: 'test-writer'
    prompt: 'Write comprehensive tests for the new feature code.'
  - label: 'Create PR'
    agent: 'pr-creator'
    prompt: 'Create a pull request with all changes and a detailed description.'
---

The agent should be an orchestrator that:

• Understands requirements before coding
• Plans feature implementation
• Implements core features following project conventions
• Delegates to specialized sub-agents for review, testing, and PRs
• Works with both Spring Boot backend and React frontend code

Reference Files

Source for always-on-instructions guidance:

• https://github.com/Norman-Norman-Norman/customize-your-repo/blob/main/docs/part-2-1-always-on-instructions.md

Source for create-agent-skill:

• https://github.com/Norman-Norman-Norman/customize-your-repo/blob/main/.github/skills/create-agent-skill/SKILL.md

Source for Feature Builder agent:

• https://github.com/Norman-Norman-Norman/customize-your-repo/blob/main/docs/part-2-5-custom-agents.md (see Feature Builder example)

Current instructions file to update:

• .github/copilot-instructions.md

Success Criteria

1. Updated .github/copilot-instructions.md maintains all Three Rivers Bank project details while following always-on-instructions best practices
2. Instructions include rationale sections explaining key decisions
3. Instruc...

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[yortch]

@claude[agent]
Ensure the referenced custom agents definitions are included:

• security-reviewer use: https://github.com/github/awesome-copilot/blob/main/agents/se-security-reviewer.agent.md
• test-writer, use https://github.com/github/awesome-copilot/blob/main/agents/playwright-tester.agent.md but also include guidance for junit
  https://github.com/github/awesome-copilot/blob/main/prompts/java-junit.prompt.md and for react tests: https://github.com/github/awesome-copilot/blob/main/agents/expert-react-frontend-engineer.agent.md
• pr-creator use guidance from: https://github.com/github/awesome-copilot/blob/main/prompts/create-github-pull-request-from-specification.prompt.md

[Claude]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh pr view --json number,comments --jq .number /usr/bin/base64 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Claude]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh pr view --json number,comments --jq .number /usr/bin/base64 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Claude]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh pr view --json number,comments --jq .number /usr/bin/base64 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Claude]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh pr view --json number,comments --jq .number /usr/bin/base64 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Claude]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh pr view --json number,comments --jq .number /usr/bin/base64 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Claude]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh pr view --json number,comments --jq .number /usr/bin/base64 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[yortch]

@copilot for the custom agents:

• ensure the names used in feature builder agent match the corresponding custom agent definitions so that it works for agent handoff
• change the default model to Claude Sonnet 4.5
• for the pr-creator agent change to try to favor using github mcp tools instead of gh CLI when possible

[Copilot]

@copilot for the custom agents:

• ensure the names used in feature builder agent match the corresponding custom agent definitions so that it works for agent handoff
• change the default model to Cla...

Updated in commit e8abaf9:

• Fixed feature-builder handoff to use 'SE: Security' (matching security-reviewer agent name)
• Changed all agent models from Claude Opus 4.5 to Claude Sonnet 4.5
• Updated pr-creator to prioritize GitHub MCP tools (github-mcp-server) over gh CLI, with gh CLI as fallback