The Copilot Edition

The file GitHub Copilot reads

GitHub spent 2025 consolidating. Copilot Extensions and the GitHub-App path were sunset. What survived: two surfaces — MCP servers and instruction files. There is no "instruction provider API." GitHub's supported model is literally write the file into the repo. So the tool that generates the file is first-class.

.github/copilot-instructions.md is the widest of those files — honored by default across web chat, code review, VS Code, JetBrains, the Copilot CLI, and the coding agent. Broader reach than AGENTS.md, which only the agentic surfaces read.

FAF already emitted CLAUDE.md, AGENTS.md, .cursorrules, and GEMINI.md. Now it emits the Copilot file too — from the same scored source:

Non-destructive faf-block injection, idempotent, auto-creates .github/. It's in the default export and in --all, so you don't have to think about it:

Five instruction files. One .faf. AGENTS.md and copilot-instructions.md coexist — no override, both honored — so emitting both is the maximum-surface move. FAF defines; the files instruct.

Hardened on the way in

faf git takes a GitHub URL and turns it into a scored .faf. It used to build git clone … ${url} and run it through a shell — a crafted URL could execute arbitrary commands.

Fixed at the structure level: a strict normalizeGitUrl (allowlist, rejects shell metacharacters) plus a no-shell execFileSync clone. Injection isn't blocked by a filter you can outwit — it's structurally impossible.

All five WJTTC tiers

The audit was running blind in one lane. faf wjttc now recognizes all five tiers — TYRE (live, the real road) was missing, so live tests were mislabeled untiered.

The new Git suite exercises every tier on the real path: a real git clone → a real .faf → a real score.

Try It

The Numbers

• v6.15.0 — released June 24, 2026
• 5 instruction files — CLAUDE.md, AGENTS.md, .cursorrules, GEMINI.md, copilot-instructions.md — from one .faf
• 6 Copilot surfaces — web chat, code review, VS Code, JetBrains, CLI, coding agent — all read the one file
• 5 WJTTC tiers — BRAKE · ENGINE · AERO · TYRE · PIT
• URL injection — structurally impossible
• IANA-registered — .faf is a registered media type

Next: 7.0, The Git Edition

This edition ships the Copilot file and hardens the door. The full story — faf git as the GitHub-native engine (URL → scored .faf, no clone), a reusable Action, PR checks and a README badge — is the run-up to 7.0, The Git Edition. The name is reserved. The work is underway.