access-to copilot-instructions.md

A repository-specific instruction file for GitHub Copilot, an AI coding assistant, in the Access To project.

In plain words
What is it for?
It is for working consistently with the project's static site, admin system, configuration files, scripts, workflows, and child repositories.
Why use it?
It gives the assistant the project's architecture, file locations, and coding conventions so its changes fit the repository.

Instructions file for GitHub Copilot

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/dougdevitre/access-to/copilot-instructions
Clone the repo
git clone --depth 1 https://github.com/dougdevitre/access-to

Made for: GitHub Copilot.

Per session 692 This file is loaded in full into every session.
When invoked 692 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00692 $0.00692
Opus 5 $0.00346 $0.00346
Sonnet 5 $0.00138 $0.00138
Haiku 4.5 $0.00069 $0.00069

Measured yesterday against content hash edc5c4cfe79d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

access-to copilot-instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/copilot-instructions.md · 54 lines

How it starts

The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Copilot Instructions for Access To

You are working in the Access To ecosystem — a collection of open-source Claude Skills that close access gaps in housing, jobs, health, education, services, safety, and business.

Architecture

This is the hub repository. It contains:

  • A static landing site (HTML/CSS, no frameworks)
  • An admin system that manages 8 interconnected repos
  • Config-driven automation (.github/config/, .github/scripts/, .github/workflows/)

Child repos each contain a SKILL.md file — a structured prompt system designed to run inside Claude.ai Projects with no code.

Key conventions

File structure

  • Config files live in .github/config/ (JSON, validated by schemas in .github/schemas/)
  • Admin scripts live in .github/scripts/ (bash, all source lib-log.sh for structured logging)
  • Workflows live in .github/workflows/ (thin orchestration that calls scripts)
  • Static site files are in the repo root (HTML, CSS, no build step)

Code style

  • HTML: Semantic elements, ARIA labels, no inline styles
  • CSS: Use existing CSS variables defined in styles.css. No frameworks.
  • JavaScript: Vanilla JS only. No frameworks, no npm, no dependencies.
  • Bash scripts: Use set -euo pipefail. Source lib-log.sh. Use log_info, log_warn, log_error, log_action instead of raw echo.
  • JSON configs: Follow the schemas in .github/schemas/. Run validate-config.sh after changes.

Cross-repo awareness

  • The repo registry is .github/config/repos.json — always check it for repo names, pillars, and connections.
  • Labels are defined in .github/config/labels.json — use the namespace:value convention (e.g., pillar:housing, type:bug, status:triage).
  • When a change affects multiple repos, use the cross-repo label and reference the hub coordination issue.

What NOT to do

  • Do not add npm, bundlers, or build tools to the hub site
  • Do not hardcode repo lists — read from repos.json
  • Do not use echo for logging in scripts — use lib-log.sh functions
  • Do not suppress errors with 2>/dev/null without capturing the output first
  • Do not add inline styles to HTML — use CSS variables

Read the full file on GitHub · 54 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 54 lines · 692 tokens per session scan A edc5c4cfe79d

Subscribe to this mod's changes

access-to copilot-instructions.md is an instructions file published in the GitHub repository dougdevitre/access-to (1 stars, last pushed 2mo ago), licensed MIT. It adds 692 tokens to every session, about $0.0035 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.