OpenELIS-Global-2 copilot-instructions.md

OpenELIS Global 2 — Copilot Code Review Instructions

Purpose

• Review changes for constitutional compliance, workflow impact, testing/validation quality, manageable scope, and AI-generated artifacts.
• This repository is a mission-critical healthcare LIMS. Prefer correctness, safety, and maintainability over speed.
• Inline rules here are the minimum bar. For details, see:
  • .specify/memory/constitution.md
  • .specify/guides/testing-roadmap.md
  • AGENTS.md
  • PULL_REQUEST_TIPS.md

Review priorities

• Blockers first: security, data integrity, broken workflows, and architecture violations.
• High-risk changes: authentication/authorization, analyzer interfaces, results reporting, database migrations, FHIR sync, and shared utility/service code.
• Prefer actionable feedback: point to the risky file/pattern, explain impact, suggest a concrete alternative.

---

Security critical issues

• Check for hardcoded secrets, API keys, or credentials.
• Verify RBAC / authorization checks exist for sensitive operations.
• Flag missing input validation or sanitization (XSS, SQL injection, path traversal).
• Review authentication and session-handling changes carefully.
• Ensure audit logging requirements are respected for data-changing operations.

---

Code quality essentials

• Functions should be focused and appropriately sized.
• Use clear, descriptive naming; avoid magic numbers/strings.
• Ensure proper error handling—no empty catch blocks or swallowed exceptions without explanation.
• Remove dead code, commented-out blocks, and unused imports.

---

Constitutional compliance (9 principles)

I. Configuration-driven variation (no country forks)

• Flag any country-specific branching in code paths.
• Prefer configuration-driven behavior via the existing configuration systems (e.g., SystemConfiguration, localization/config properties) rather than conditionals.

Examples

// BAD: country-specific branch in code
if ("MG".equals(countryCode)) {
    // Madagascar-only logic
}

// GOOD: read behavior from configuration (follow existing config patterns in the repo)
// String mode = configService.getValue("feature.mode");