<!--
  ─────────────────────────────────────────────────────────────────────────────
  TRIO FILE 3 of 3 — .github/copilot-instructions.md (THIN ADAPTER)
  QRefAI AI Coding Field Guide, Part 5 (Q5.x)

  Copilot has no @import, and Copilot CODE REVIEW reads only the FIRST ~4,000
  characters of this file. So this adapter can't just point at AGENTS.md — it must
  RESTATE the must-enforce-in-review rules densely, up top, then defer the rest.

  Pattern:
    • Top of file (within 4K): the hard rules, rule-first, no preamble. These are
      copied from AGENTS.md's Security Considerations + Code Style — the subset that
      must influence review.
    • Below: a one-line pointer to AGENTS.md for full context (used by the coding
      agent and Chat, which have no 4K limit).
  When AGENTS.md's hard rules change, sync the top block here. That's the only
  maintenance this file needs.
  ─────────────────────────────────────────────────────────────────────────────
-->

# Acme Payments — Copilot Instructions

## Hard rules (enforced in review — keep within first ~4,000 chars)
- All money is int64 minor units; never floats.
- No secrets, tokens, or credentials in source — ever.
- Never write code that deletes from `audit_events` or the ledger tables.
- External calls go through `internal/clients/`; never inline an http.Client.
- Errors are wrapped with context: `fmt.Errorf("charge %s: %w", id, err)`.
- New public endpoints require an entry in `docs/api-changelog.md`.

## Stack & commands
- Go 1.23 · PostgreSQL 16 · gRPC 1.62 · EKS
- Build `make build` · Test `make test` (must pass before PR) · Lint `make lint`

## Testing
- Table-driven tests; new behavior requires a test (PRs without tests are rejected).

<!-- Full canonical context (architecture, PR rules, rationale) lives in AGENTS.md.
     The coding agent and Chat read it; only code review is limited to the 4K above. -->