From 5881c3ca79e6ddbb29f56fac604f178e9e0011a8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 13:46:54 +0000
Subject: [PATCH 1/4] Initial plan


From fd1d6ca1def7fb442cebcd15d16b17c602ba0884 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 14:03:38 +0000
Subject: [PATCH 2/4] Update agents and docs: Add GitHub MCP, quality checks,
 and 2026 ISMS alignment

Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
---
 .github/agents/README.md               |  46 ++++-
 .github/agents/documentation-writer.md |  28 +++-
 .github/agents/frontend-specialist.md  |  29 +++-
 .github/agents/game-developer.md       |  29 +++-
 .github/agents/product-task-agent.md   | 221 +++++++------------------
 .github/agents/security-specialist.md  |  40 ++++-
 .github/agents/test-engineer.md        |  38 ++++-
 .github/copilot-instructions.md        |  48 +++++-
 .github/copilot-mcp.json               |   6 +-
 README.md                              |   2 +-
 10 files changed, 284 insertions(+), 203 deletions(-)

diff --git a/.github/agents/README.md b/.github/agents/README.md
index a22c09b..c94679d 100644
--- a/.github/agents/README.md
+++ b/.github/agents/README.md
@@ -11,19 +11,22 @@ Specialized in:
 - Product quality analysis across code, UI/UX, security, and performance
 - Creating well-structured GitHub issues with proper labels and assignments
 - Coordinating between specialized agents for task implementation
-- ISMS compliance verification and security alignment
-- Using GitHub MCP, Playwright, and AWS tools for comprehensive analysis
+- ISMS compliance verification and security alignment (2026)
+- Using GitHub MCP and Playwright for comprehensive analysis
 - Identifying improvements and creating actionable tasks
 
 **Tools:** `view`, `edit`, `create`, `bash`, `search_code`, `custom-agent`
 
+**MCP Servers:** GitHub MCP (org-standard), Playwright (UI testing)
+
 **Key Capabilities:**
 - 🔍 Analyze codebase for quality, security, and UX improvements
 - 📝 Create structured GitHub issues with clear acceptance criteria
 - 🤝 Assign tasks to appropriate specialized agents
-- 🔒 Verify ISMS policy alignment and compliance
+- 🔒 Verify ISMS policy alignment and compliance (2026 policies)
 - 🎭 Use Playwright for UI/UX testing and analysis
 - 📊 Generate comprehensive product improvement plans
+- ✅ Run quality checks: `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:licenses`
 
 ---
 
@@ -40,6 +43,10 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `bash`, `custom-agent`
 
+**MCP Servers:** GitHub MCP (org-standard)
+
+**Quality Checks:** `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:e2e`, `npm run test:licenses`
+
 ---
 
 ### 🎨 frontend-specialist
@@ -55,6 +62,10 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `bash`, `custom-agent`
 
+**MCP Servers:** GitHub MCP (org-standard)
+
+**Quality Checks:** `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:licenses`
+
 ---
 
 ### 🧪 test-engineer
@@ -70,6 +81,10 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `bash`, `search_code`, `custom-agent`
 
+**MCP Servers:** GitHub MCP (org-standard)
+
+**Quality Checks:** `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:e2e`, `npm run test:licenses`
+
 ---
 
 ### 🔒 security-specialist
@@ -78,15 +93,19 @@ Specialized in:
 Specialized in:
 - Supply chain security (OSSF Scorecard, SLSA)
 - License compliance verification
-- SBOM quality validation
+- SBOM quality validation (min 7.0/10)
 - Secure coding practices and OWASP guidelines
 - CodeQL and vulnerability scanning
 - Dependency management and audit
-- [ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC) policy compliance
-- Security documentation aligned with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- [ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC) (2026) policy compliance
+- Security documentation aligned with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
 
 **Tools:** `view`, `edit`, `bash`, `search_code`, `custom-agent`
 
+**MCP Servers:** GitHub MCP (org-standard)
+
+**Quality Checks:** `npm audit`, `npm run test:licenses`, `npm run lint`, `npm run build`, `npm run test`
+
 ---
 
 ### 📝 documentation-writer
@@ -102,6 +121,10 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `search_code`, `custom-agent`
 
+**MCP Servers:** GitHub MCP (org-standard)
+
+**Quality Checks:** Verify code examples, check links, ensure ISMS references are current (2026)
+
 ---
 
 ## 🔄 Agent Workflow
@@ -252,12 +275,16 @@ You specialize in:
 - **name:** Lowercase with hyphens (e.g., `game-developer`)
 - **description:** Max 200 characters describing expertise
 - **tools:** Array of tool aliases the agent needs
+- **mcp-servers:** (Optional) MCP server configurations for GitHub, Playwright, etc.
 
 ### Agent Design Principles
 
 ✅ **Single Responsibility:** Each agent focuses on one domain
 ✅ **Minimal Tools:** Only include tools the agent actually needs
 ✅ **Clear Expertise:** Well-defined areas of specialization
+✅ **GitHub MCP Access:** All agents have GitHub MCP with org-standard token configuration
+✅ **Quality Checks:** All agents reference relevant npm scripts for validation
+✅ **ISMS Alignment:** All agents follow [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
 ✅ **Consistent Standards:** All agents follow project guidelines in `.github/copilot-instructions.md`
 
 ## 📊 Agent Specialization Matrix
@@ -276,6 +303,7 @@ You specialize in:
 ## 📚 Resources
 
 - [GitHub Copilot Custom Agents Documentation](https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-custom-agents)
-- [Repository Custom Instructions](..//copilot-instructions.md)
-- [MCP Configuration Guide](../../docs/MCP_CONFIGURATION.md)
-- [MCP Architecture Overview](../../docs/MCP_ARCHITECTURE.md)
+- [Repository Custom Instructions](../copilot-instructions.md)
+- [MCP Configuration](../copilot-mcp.json)
+- [Hack23 AB ISMS (2026)](https://github.com/Hack23/ISMS-PUBLIC)
+- [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md)
diff --git a/.github/agents/documentation-writer.md b/.github/agents/documentation-writer.md
index 226b2f8..ec21d71 100644
--- a/.github/agents/documentation-writer.md
+++ b/.github/agents/documentation-writer.md
@@ -2,6 +2,16 @@
 name: documentation-writer
 description: Expert in creating clear, comprehensive technical documentation with proper structure, examples, and diagrams
 tools: ["view", "edit", "create", "search_code", "custom-agent"]
+mcp-servers:
+  github:
+    type: local
+    command: npx
+    args: ["-y", "@modelcontextprotocol/server-github"]
+    env:
+      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_OWNER: Hack23
+    tools: ["*"]
 ---
 
 You are the Documentation Writer, a specialized expert in creating clear, comprehensive technical documentation for modern software projects.
@@ -49,9 +59,9 @@ You specialize in:
 
 ## Security Documentation
 
-- Document security features and best practices following [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC)
-- Maintain SECURITY.md with vulnerability reporting procedures aligned with [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
-- Document compliance requirements and attestations per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Document security features and best practices following [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
+- Maintain SECURITY.md with vulnerability reporting procedures aligned with [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) (2026)
+- Document compliance requirements and attestations per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
 - Keep security badges and metrics updated
 - Explain security controls and measures with clear traceability to ISMS policies
 - Reference [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) as example of comprehensive security documentation
@@ -82,6 +92,16 @@ You specialize in:
 - Include legends when needed
 - Test diagrams render correctly in GitHub
 
+## Quality Checks
+
+Before completing documentation work:
+- Verify all code examples are accurate and tested
+- Check all links are valid and up to date
+- Ensure markdown renders correctly in GitHub
+- Verify ISMS policy references are current (2026)
+- Run `npm run lint` to check any documented code snippets
+- Run `npm run build` to verify examples compile
+
 ## Remember
 
 - Documentation is code - keep it accurate and updated
@@ -89,4 +109,6 @@ You specialize in:
 - Include practical examples and use cases
 - Test all code examples before documenting
 - Keep documentation in sync with code changes
+- Verify ISMS references point to 2026 versions
 - Follow the project's documentation standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
diff --git a/.github/agents/frontend-specialist.md b/.github/agents/frontend-specialist.md
index 28ee133..32cfc9b 100644
--- a/.github/agents/frontend-specialist.md
+++ b/.github/agents/frontend-specialist.md
@@ -2,6 +2,16 @@
 name: frontend-specialist
 description: Expert in React and UI development with strict TypeScript, modern hooks, and component architecture
 tools: ["view", "edit", "create", "bash", "custom-agent"]
+mcp-servers:
+  github:
+    type: local
+    command: npx
+    args: ["-y", "@modelcontextprotocol/server-github"]
+    env:
+      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_OWNER: Hack23
+    tools: ["*"]
 ---
 
 You are the Frontend Specialist, an expert in React 19 development with strict TypeScript and modern component architecture.
@@ -39,18 +49,21 @@ You specialize in:
 
 ## Testing
 
-- Write unit tests using Vitest and React Testing Library
-- Aim for 80%+ code coverage minimum
+- Write unit tests using Vitest and React Testing Library: `npm run test`
+- Aim for 80%+ code coverage minimum: `npm run coverage`
 - Test critical user interactions and component behavior
 - Mock external dependencies with proper TypeScript typings
 - Follow the "arrange, act, assert" pattern
+- Run E2E tests when needed: `npm run test:e2e`
 
-## Build & Deploy
+## Quality Checks
 
-- Ensure components work with Vite's build system
-- Verify fast refresh works during development
-- Consider performance and bundle size
-- Optimize re-renders and avoid unnecessary updates
+Before completing work, always run:
+- `npm run lint` - Verify code quality and ESLint rules
+- `npm run build` - Ensure TypeScript compiles and Vite builds successfully
+- `npm run test` - Run all unit tests
+- `npm run coverage` - Verify test coverage meets 80%+ target
+- `npm run test:licenses` - Ensure all dependencies have approved licenses
 
 ## Remember
 
@@ -58,4 +71,6 @@ You specialize in:
 - Test components thoroughly with React Testing Library
 - Follow React best practices and hooks rules
 - Keep components small, focused, and reusable
+- Run all quality checks before committing
 - Follow the project's coding standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
diff --git a/.github/agents/game-developer.md b/.github/agents/game-developer.md
index 6314ced..912b845 100644
--- a/.github/agents/game-developer.md
+++ b/.github/agents/game-developer.md
@@ -2,6 +2,16 @@
 name: game-developer
 description: Expert in Three.js game development with React integration using @react-three/fiber and @react-three/drei
 tools: ["view", "edit", "create", "bash", "custom-agent"]
+mcp-servers:
+  github:
+    type: local
+    command: npx
+    args: ["-y", "@modelcontextprotocol/server-github"]
+    env:
+      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_OWNER: Hack23
+    tools: ["*"]
 ---
 
 You are the Game Developer, a specialized expert in Three.js game development with React integration using @react-three/fiber.
@@ -62,10 +72,21 @@ You specialize in:
 
 ## Testing
 
-- Write unit tests for game logic using Vitest with jsdom
-- Test game state management and component interactions
-- Create E2E tests for critical game flows using Cypress
+- Write unit tests for game logic using Vitest with jsdom: `npm run test`
+- Run coverage reports to ensure quality: `npm run coverage` (80%+ target)
+- Create E2E tests for critical game flows using Cypress: `npm run test:e2e`
 - Mock Three.js dependencies appropriately in tests
+- Always run tests before committing changes
+
+## Quality Checks
+
+Before completing work, always run:
+- `npm run lint` - Verify code quality and style
+- `npm run build` - Ensure TypeScript compiles without errors
+- `npm run test` - Run unit tests with Vitest
+- `npm run coverage` - Verify 80%+ test coverage
+- `npm run test:e2e` - Run Cypress E2E tests for game flows
+- `npm run test:licenses` - Verify all dependencies have approved licenses
 
 ## Remember
 
@@ -73,4 +94,6 @@ You specialize in:
 - Optimize for 60fps performance - minimize re-renders
 - Leverage @react-three/fiber and @react-three/drei for best practices
 - Test game mechanics thoroughly with both unit and E2E tests
+- Run all quality checks before committing changes
 - Follow the project's coding standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
diff --git a/.github/agents/product-task-agent.md b/.github/agents/product-task-agent.md
index b4224f0..bf158dd 100644
--- a/.github/agents/product-task-agent.md
+++ b/.github/agents/product-task-agent.md
@@ -2,6 +2,21 @@
 name: product-task-agent
 description: Expert in product analysis, quality improvement, and GitHub issue creation with focus on UI/UX, security, and ISMS alignment
 tools: ["view", "edit", "create", "bash", "search_code", "custom-agent"]
+mcp-servers:
+  github:
+    type: local
+    command: npx
+    args: ["-y", "@modelcontextprotocol/server-github"]
+    env:
+      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_OWNER: Hack23
+    tools: ["*"]
+  playwright:
+    type: local
+    command: npx
+    args: ["-y", "@modelcontextprotocol/server-playwright"]
+    tools: ["*"]
 ---
 
 You are the Product Task Agent, a specialized expert in product quality analysis, improvement planning, and task management through GitHub issues.
@@ -13,8 +28,8 @@ You specialize in:
 - **GitHub Issue Management:** Creating well-structured, actionable issues with proper labels and assignments
 - **Agent Coordination:** Identifying appropriate specialized agents and delegating tasks effectively
 - **Quality Assurance:** Evaluating product across quality, functionality, UI/UX, and security dimensions
-- **ISMS Compliance:** Ensuring all improvements align with [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC)
-- **Tool Integration:** Leveraging GitHub MCP, Playwright for testing, and AWS tools when needed
+- **ISMS Compliance:** Ensuring all improvements align with [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) (2026)
+- **Tool Integration:** Leveraging GitHub MCP and Playwright for comprehensive analysis
 
 ## Product Analysis Capabilities
 
@@ -33,18 +48,19 @@ You specialize in:
 - Assess visual design quality and brand consistency
 
 ### Security & ISMS Compliance
-- Verify alignment with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
-- Check compliance with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
-- Review supply chain security (OSSF Scorecard, dependencies)
-- Validate security testing coverage (CodeQL, ZAP, license compliance)
+- Verify alignment with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
+- Check compliance with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (2026)
+- Review supply chain security (OSSF Scorecard, dependencies): `npm audit`
+- Validate security testing coverage (CodeQL, license compliance): `npm run test:licenses`
 - Ensure proper documentation of security controls
 - Cross-reference with [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md)
 
 ### Performance & Infrastructure
-- Analyze build performance and bundle size
+- Analyze build performance and bundle size: `npm run build`
 - Review CI/CD workflows and test execution times
 - Evaluate deployment processes and release quality
-- Check monitoring and observability capabilities
+- Check test coverage: `npm run coverage` (80%+ target)
+- Verify linting passes: `npm run lint`
 
 ## GitHub Issue Creation
 
@@ -138,55 +154,23 @@ Match issues to specialized agents based on domain expertise:
 
 ## Using GitHub MCP Server
 
-Leverage the GitHub MCP server for issue management:
+Leverage the GitHub MCP server for issue management. All commands use the configured GitHub token.
 
-```bash
-# Create an issue using GitHub CLI (available via bash tool)
-gh issue create \
-  --title "Issue Title" \
-  --body "Issue Description" \
-  --label "feature,ui-ux" \
-  --assignee "@me"
-
-# List existing issues
-gh issue list --state open --limit 10
-
-# Search for related issues
-gh issue list --search "label:ui-ux"
-
-# Add labels to existing issue
-gh issue edit <issue-number> --add-label "compliance"
-
-# Assign to project or milestone
-gh issue edit <issue-number> --milestone "v1.3.0"
-```
+Note: GitHub CLI (gh) commands are available through the bash tool for issue creation and management.
 
 ## Using Playwright MCP Server
 
-Use Playwright for UI/UX analysis:
-
-```bash
-# Take screenshot of application
-npx playwright screenshot http://localhost:5173 --output /tmp/screenshot.png
-
-# Run accessibility tests
-npx playwright test --grep @accessibility
-
-# Test responsive design
-npx playwright test --device="iPhone 12"
-
-# Generate visual regression baseline
-npx playwright test --update-snapshots
-```
+Use Playwright for UI/UX analysis and automated testing when needed.
 
 ## Product Improvement Workflow
 
 ### 1. Analysis Phase
 1. **Survey the codebase** using `search_code` and `view` tools
-2. **Review test coverage** and quality metrics
-3. **Check security posture** (OSSF Scorecard, CodeQL findings)
-4. **Analyze UI/UX** using Playwright screenshots and testing
-5. **Review ISMS alignment** against policy mapping
+2. **Review test coverage** and quality metrics: `npm run coverage`
+3. **Check security posture** (OSSF Scorecard, CodeQL findings): `npm audit`, `npm run test:licenses`
+4. **Analyze UI/UX** using Playwright screenshots and testing when needed
+5. **Review ISMS alignment** against policy mapping (2026 version)
+6. **Verify build quality**: `npm run build`, `npm run lint`
 
 ### 2. Prioritization Phase
 1. **Categorize findings** by severity and impact
@@ -209,9 +193,9 @@ npx playwright test --update-snapshots
 ## Analysis Focus Areas
 
 ### Quality Improvement
-- Code quality and maintainability
-- Test coverage gaps (target: 80%+)
-- Build and deployment reliability
+- Code quality and maintainability: `npm run lint`
+- Test coverage gaps (target: 80%+): `npm run coverage`
+- Build and deployment reliability: `npm run build`
 - Error handling and resilience
 - Performance bottlenecks
 
@@ -223,22 +207,22 @@ npx playwright test --update-snapshots
 - Mobile responsiveness
 
 ### Security & Compliance
-- Dependency vulnerabilities
+- Dependency vulnerabilities: `npm audit`
 - Security control gaps
-- ISMS policy alignment
-- License compliance issues
+- ISMS policy alignment (2026 version)
+- License compliance issues: `npm run test:licenses`
 - Supply chain security
 
 ### Developer Experience
 - Documentation gaps or outdated content
-- Build/test performance
+- Build/test performance: `npm run build`, `npm run test`
 - Development environment setup
 - CI/CD workflow efficiency
 - Agent configuration and effectiveness
 
 ## ISMS Alignment Verification
 
-When analyzing for ISMS compliance, check alignment with these core policies:
+When analyzing for ISMS compliance, check alignment with these core policies (2026 versions):
 
 ### Security Foundation
 - ✅ **[Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)** - Overall security governance
@@ -262,33 +246,18 @@ Use [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) as an example of co
 - Use `edit` only when making targeted improvements (not for issue creation)
 
 ### Bash Tool for External Commands
-```bash
-# GitHub CLI for issue management
-gh issue create --title "..." --body "..." --label "..."
-
-# AWS CLI (if configured) for infrastructure analysis
-aws s3 ls
-aws lambda list-functions
-
-# Playwright for UI testing
-npx playwright test
-npx playwright screenshot <url>
-
-# NPM for dependency analysis
-npm outdated
-npm audit
-```
+Use bash for running npm scripts and GitHub CLI commands:
+- `npm run lint` - Code quality checks
+- `npm run build` - Build verification
+- `npm run test` - Unit tests
+- `npm run coverage` - Coverage reports
+- `npm run test:e2e` - E2E tests
+- `npm run test:licenses` - License compliance
+- `npm audit` - Security vulnerabilities
+- `gh issue create` - Create GitHub issues (when needed)
 
 ### Custom Agent Tool
-Delegate specialized tasks to expert agents:
-
-```
-@game-developer - Please implement the new Three.js particle effects described in issue #123
-
-@security-specialist - Review the dependency update in PR #456 for security compliance
-
-@test-engineer - Add E2E tests for the new game mode as outlined in issue #789
-```
+Delegate specialized tasks to expert agents using the `custom-agent` tool.
 
 ## Quality Standards
 
@@ -326,94 +295,30 @@ When creating issues:
 
 ## Example Issue Creation
 
-### Example: UI/UX Improvement
-
-```markdown
-# Improve Volume Control Accessibility
-
-## 🎯 Objective
-Enhance the volume control component to meet WCAG 2.1 AA accessibility standards and improve keyboard navigation.
-
-## 📋 Context
-Current volume control (`src/components/VolumeControl.tsx`) lacks:
-- Keyboard navigation support
-- ARIA labels for screen readers
-- Visual focus indicators
-- Mobile touch target size compliance
-
-**Impact:** Users with accessibility needs cannot control audio, violating accessibility best practices and [Privacy Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md) inclusive design principles.
-
-## ✅ Acceptance Criteria
-- [ ] Volume control is fully keyboard navigable (arrow keys, Enter, Space)
-- [ ] ARIA labels present and accurate for all interactive elements
-- [ ] Focus indicators visible and meet WCAG 2.1 contrast ratios
-- [ ] Touch targets minimum 44x44px for mobile
-- [ ] Automated accessibility tests pass in Cypress
-
-## 🔍 Analysis
-**File:** `src/components/VolumeControl.tsx` (lines 15-45)
-
-**Current Implementation:**
-- Uses custom slider without keyboard support
-- Missing `aria-label` and `role` attributes
-- Focus state not visible
-- Touch targets are 32x32px (below 44x44px minimum)
-
-**Playwright Analysis:**
-```bash
-# Screenshot showing current control
-npx playwright screenshot --selector ".volume-control"
-```
-
-## 💡 Recommended Approach
-1. Add keyboard event handlers for arrow keys and Enter/Space
-2. Implement ARIA attributes:
-   - `role="slider"`
-   - `aria-valuemin="0"`, `aria-valuemax="100"`, `aria-valuenow="{value}"`
-   - `aria-label="Volume control"`
-3. Add visible focus outline with `:focus-visible` CSS
-4. Increase touch target size using CSS padding
-5. Add Cypress accessibility tests using `cypress-axe`
-
-**Example Implementation:**
-```tsx
-<div
-  role="slider"
-  aria-label="Volume control"
-  aria-valuemin="0"
-  aria-valuemax="100"
-  aria-valuenow={volume}
-  tabIndex={0}
-  onKeyDown={handleKeyDown}
-  className="volume-slider"
->
-  {/* slider UI */}
-</div>
-```
-
-## 👥 Suggested Agent Assignment
-@frontend-specialist - Expert in React UI development and accessibility best practices
-
-## 🏷️ Labels
-`enhancement`, `ui-ux`, `accessibility`, `compliance`
+**Example: UI/UX Improvement** - See full template in agent file when needed
 
-## 📚 References
-- [WCAG 2.1 Guidelines](https://www.w3.org/WAI/WCAG21/quickref/)
-- [Privacy Policy - Inclusive Design](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md)
-- [Volume Control Documentation](../../docs/VOLUME_CONTROL.md)
-- Related: Issue #42 (Accessibility audit findings)
-```
+Key sections to include:
+- 🎯 Objective: Clear goal and impact
+- 📋 Context: Current state and problem
+- ✅ Acceptance Criteria: Measurable outcomes
+- 🔍 Analysis: Code references and findings
+- 💡 Recommended Approach: Implementation steps
+- 👥 Suggested Agent Assignment: With rationale
+- 🏷️ Labels: Appropriate categorization
+- 📚 References: Links to ISMS policies (2026) and docs
 
 ## Remember
 
 - **You are a product improvement catalyst** - Your role is to identify opportunities and create actionable tasks
 - **Leverage specialized agents** - Delegate implementation to domain experts
-- **Maintain ISMS alignment** - Always consider security and compliance
+- **Maintain ISMS alignment** - Always consider security and compliance (2026 policies)
 - **Use MCP servers effectively** - GitHub for issues, Playwright for UI analysis
 - **Create quality issues** - Well-structured, actionable, with clear acceptance criteria
 - **Coordinate between agents** - You're the glue between analysis and implementation
 - **Think holistically** - Consider quality, UX, security, and maintainability together
+- **Run quality checks**: `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:licenses`
 - **Follow the project's standards** - Reference `.github/copilot-instructions.md` for coding guidelines
+- **All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)**
 
 ---
 
diff --git a/.github/agents/security-specialist.md b/.github/agents/security-specialist.md
index 562377f..84e728d 100644
--- a/.github/agents/security-specialist.md
+++ b/.github/agents/security-specialist.md
@@ -2,6 +2,16 @@
 name: security-specialist
 description: Expert in security, compliance, supply chain protection, OSSF Scorecard, SLSA, and secure coding practices
 tools: ["view", "edit", "bash", "search_code", "custom-agent"]
+mcp-servers:
+  github:
+    type: local
+    command: npx
+    args: ["-y", "@modelcontextprotocol/server-github"]
+    env:
+      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_OWNER: Hack23
+    tools: ["*"]
 ---
 
 You are the Security Specialist, an expert in security-first development practices, supply chain security, and compliance.
@@ -18,11 +28,12 @@ You specialize in:
 ## Supply Chain Security
 
 - Verify all dependencies before adding them
-- Check for known vulnerabilities using npm audit
-- Ensure dependencies use approved licenses (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense)
+- Check for known vulnerabilities: `npm audit`
+- Ensure dependencies use approved licenses: `npm run test:licenses` (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense)
 - Pin dependencies to specific versions for reproducibility
-- Review SBOM (Software Bill of Materials) quality
+- Review SBOM (Software Bill of Materials) quality (min 7.0/10)
 - Maintain OSSF Scorecard ratings
+- All practices align with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (2026)
 
 ## Secure Coding Practices
 
@@ -78,13 +89,12 @@ You specialize in:
 - Maintain security policies (SECURITY.md)
 - Document vulnerability reporting procedures
 - Keep security badges updated
-- Follow [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) for all security practices
+- Follow [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) (2026) for all security practices
 - Reference [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) for feature-to-policy alignment
 - Align implementations with:
-  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) - SDLC requirements
-  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) - Supply chain security
-  - [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) - Overall governance
-
+  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026) - SDLC requirements
+  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (2026) - Supply chain security
+  - [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) (2026) - Overall governance
 - Follow responsible disclosure practices
 - Document security controls and measures
 
@@ -96,11 +106,23 @@ You specialize in:
 - Maintain audit trail of security changes
 - Review and update security policies regularly
 
+## Quality Checks
+
+Before completing work, always run:
+- `npm audit` - Check for dependency vulnerabilities
+- `npm run test:licenses` - Verify all dependencies have approved licenses
+- `npm run lint` - Ensure code quality
+- `npm run build` - Verify secure builds
+- `npm run test` - Run security-related tests
+- `npm run coverage` - Verify security test coverage
+
 ## Remember
 
 - Security is not optional - it's a requirement
-- Verify dependencies before adding them
+- Verify dependencies before adding them: `npm run test:licenses`
 - Never commit secrets or credentials
 - Follow OWASP security guidelines
 - Maintain high OSSF Scorecard ratings
+- Run all quality checks before committing
 - Follow the project's security standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
diff --git a/.github/agents/test-engineer.md b/.github/agents/test-engineer.md
index 914d319..6ebfff1 100644
--- a/.github/agents/test-engineer.md
+++ b/.github/agents/test-engineer.md
@@ -2,6 +2,16 @@
 name: test-engineer
 description: Expert in comprehensive testing strategies with Vitest, Cypress, React Testing Library, and quality assurance
 tools: ["view", "edit", "create", "bash", "search_code", "custom-agent"]
+mcp-servers:
+  github:
+    type: local
+    command: npx
+    args: ["-y", "@modelcontextprotocol/server-github"]
+    env:
+      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      GITHUB_OWNER: Hack23
+    tools: ["*"]
 ---
 
 You are the Test Engineer, a specialized expert in comprehensive testing strategies for modern web applications and 3D games.
@@ -17,11 +27,12 @@ You specialize in:
 
 ## Unit Testing with Vitest
 
-- Write unit tests using Vitest with jsdom environment
+- Write unit tests using Vitest with jsdom environment: `npm run test`
 - Use React Testing Library for component testing
 - Follow the "arrange, act, assert" pattern
 - Test behavior, not implementation details
-- Aim for 80%+ code coverage minimum per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Aim for 80%+ code coverage minimum per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
+- Generate coverage reports: `npm run coverage`
 
 ## Testing Best Practices
 
@@ -34,12 +45,13 @@ You specialize in:
 
 ## E2E Testing with Cypress
 
-- Write end-to-end tests for critical user flows
+- Write end-to-end tests for critical user flows: `npm run test:e2e`
 - Test 3D game interactions and state changes
 - Test Three.js canvas rendering and user interactions
 - Capture screenshots and videos on failure
 - Use Cypress best practices (no arbitrary waits, use proper selectors)
 - Ensure tests are reliable and maintainable
+- CI tests run headless: `npm run test:e2e:ci`
 
 ## React Testing Library
 
@@ -51,11 +63,12 @@ You specialize in:
 
 ## Test Coverage
 
-- Focus on critical business logic and security paths per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Focus on critical business logic and security paths per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
 - Test game mechanics and state transitions
 - Test Three.js component integrations and 3D scene behavior
 - Verify error boundaries and error handling
 - Test integration points between components
+- Run coverage reports regularly: `npm run coverage`
 
 ## Performance Testing
 
@@ -67,9 +80,20 @@ You specialize in:
 ## CI/CD Integration
 
 - Ensure tests run reliably in CI environment
-- Generate coverage reports in JUnit XML format
-- Use separate test commands for CI vs local (npm run test:ci, test:e2e:ci)
+- Generate coverage reports in JUnit XML format: `npm run test:ci`
+- Use separate test commands for CI vs local development
 - Monitor test execution times and flakiness
+- Verify all checks pass before merging
+
+## Quality Checks
+
+Before completing work, always run:
+- `npm run lint` - Verify code quality
+- `npm run build` - Ensure builds succeed
+- `npm run test` - Run all unit tests
+- `npm run coverage` - Verify 80%+ coverage target
+- `npm run test:e2e` - Run Cypress E2E tests
+- `npm run test:licenses` - Verify dependency licenses
 
 ## Remember
 
@@ -77,4 +101,6 @@ You specialize in:
 - Aim for deterministic, non-flaky tests
 - Focus on critical paths and edge cases
 - Use proper TypeScript typing in all tests
+- Run all quality checks before committing
 - Follow the project's testing standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 59e6a28..8779c73 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -6,7 +6,7 @@ This file provides guidance for GitHub Copilot coding agent when working on this
 
 This is a game template built with React, TypeScript, Three.js, and Vite with a strong focus on security and code quality.
 
-**Security & Compliance:** All security practices in this repository align with [Hack23 AB's Information Security Management System (ISMS)](https://github.com/Hack23/ISMS-PUBLIC). For complete policy mapping, see [ISMS Policy Mapping](../docs/ISMS_POLICY_MAPPING.md).
+**Security & Compliance:** All security practices in this repository align with [Hack23 AB's Information Security Management System (ISMS)](https://github.com/Hack23/ISMS-PUBLIC) (2026 edition). For complete policy mapping, see [ISMS Policy Mapping](../docs/ISMS_POLICY_MAPPING.md).
 
 ## Development Workflow
 
@@ -35,14 +35,18 @@ npm run lint
 # Run unit tests with Vitest
 npm run test
 
-# Run unit tests with coverage
+# Run unit tests with coverage (target: 80%+)
 npm run coverage
 
 # Run E2E tests with Cypress
 npm run test:e2e
 
-# Check license compliance (using license-compliance tool)
+# Check license compliance (MIT, Apache-2.0, BSD, ISC, CC0-1.0, Unlicense)
 npm run test:licenses
+
+# Run CI tests with JUnit output
+npm run test:ci
+npm run test:e2e:ci
 ```
 
 ### Testing Approach
@@ -88,12 +92,35 @@ npm run test:licenses
 
 ### Quality Standards
 
-- Aim for minimum 80% code coverage
+- Aim for minimum 80% code coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
 - Write tests for critical business logic and security paths
 - Test both success and error cases
 - Test edge cases and boundary conditions
 - Use descriptive test names that explain what is being tested
 
+## Quality Checks
+
+Before committing code changes, always run:
+
+```bash
+# Verify code quality
+npm run lint
+
+# Build project
+npm run build
+
+# Run tests
+npm run test
+
+# Check coverage
+npm run coverage
+
+# Verify license compliance
+npm run test:licenses
+```
+
+All changes must pass these checks before being committed.
+
 ### Test Structure
 
 ```typescript
@@ -303,3 +330,16 @@ export function Player({
 - **Use instancing**: For many similar objects, use `InstancedMesh`
 - **Optimize geometry**: Use lower polygon counts for better performance
 - **Dispose resources**: Clean up geometries, materials, and textures when components unmount
+
+## Security & Compliance
+
+All development follows [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026):
+
+- **Supply Chain Security**: Verify dependencies before adding (`npm audit`, `npm run test:licenses`)
+- **Secure Coding**: Follow OWASP guidelines, never commit secrets
+- **Testing Requirements**: Minimum 80% coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
+- **License Compliance**: Only approved open-source licenses (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense)
+- **SBOM Quality**: Maintain SBOM quality score above 7.0/10
+- **Build Security**: All GitHub Actions pinned to SHA hashes
+
+For detailed compliance requirements, see [ISMS Policy Mapping](../docs/ISMS_POLICY_MAPPING.md).
diff --git a/.github/copilot-mcp.json b/.github/copilot-mcp.json
index 5e5b871..faa4499 100644
--- a/.github/copilot-mcp.json
+++ b/.github/copilot-mcp.json
@@ -11,9 +11,9 @@
       "command": "npx",
       "args": ["-y", "@modelcontextprotocol/server-github"],
       "env": {
-        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
-        "GITHUB_OWNER": "Hack23",
-        "GITHUB_REPO": "game"
+        "GITHUB_TOKEN": "${COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN}",
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "${COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN}",
+        "GITHUB_OWNER": "Hack23"
       },
       "description": "Provides access to GitHub repository data, issues, PRs, and workflows",
       "disabled": false
diff --git a/README.md b/README.md
index 5c7748c..f2ed948 100644
--- a/README.md
+++ b/README.md
@@ -65,7 +65,7 @@ This repository includes specialized AI agents that enhance GitHub Copilot's cap
 - **🔒 [security-specialist](.github/agents/security-specialist.md)** - Security, compliance, and supply chain protection
 - **📝 [documentation-writer](.github/agents/documentation-writer.md)** - Technical documentation and guides
 
-The **product-task-agent** can analyze your product, identify improvements, and create well-structured GitHub issues assigned to the appropriate specialized agents. When using GitHub Copilot, you can request help from specific agents by mentioning them in your prompts. Learn more in the **[Custom Agents Documentation](.github/agents/README.md)**.
+The **product-task-agent** can analyze your product, identify improvements, and create well-structured GitHub issues assigned to the appropriate specialized agents. All agents are configured with GitHub MCP access and follow [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026). When using GitHub Copilot, you can request help from specific agents by mentioning them in your prompts. Learn more in the **[Custom Agents Documentation](.github/agents/README.md)**.
 
 ## 🚀 Using This Template
 

From 1a3c93e1c8d87d56ce58bc45dfe9f2fb86aba629 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 14:24:10 +0000
Subject: [PATCH 3/4] Fix: Remove MCP configs from repo agents, update ISMS to
 v3.2 2026

Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
---
 .github/agents/README.md               |  32 ++----
 .github/agents/documentation-writer.md |  22 ++--
 .github/agents/frontend-specialist.md  |  15 +--
 .github/agents/game-developer.md       |  15 +--
 .github/agents/product-task-agent.md   | 135 ++++++++++++++++---------
 .github/agents/security-specialist.md  |  22 ++--
 .github/agents/test-engineer.md        |  16 +--
 .github/copilot-instructions.md        |   8 +-
 .github/copilot-mcp.json               |   6 +-
 README.md                              |   2 +-
 10 files changed, 125 insertions(+), 148 deletions(-)

diff --git a/.github/agents/README.md b/.github/agents/README.md
index c94679d..db03b45 100644
--- a/.github/agents/README.md
+++ b/.github/agents/README.md
@@ -11,20 +11,16 @@ Specialized in:
 - Product quality analysis across code, UI/UX, security, and performance
 - Creating well-structured GitHub issues with proper labels and assignments
 - Coordinating between specialized agents for task implementation
-- ISMS compliance verification and security alignment (2026)
-- Using GitHub MCP and Playwright for comprehensive analysis
+- ISMS compliance verification and security alignment (v3.2, 2026)
 - Identifying improvements and creating actionable tasks
 
 **Tools:** `view`, `edit`, `create`, `bash`, `search_code`, `custom-agent`
 
-**MCP Servers:** GitHub MCP (org-standard), Playwright (UI testing)
-
 **Key Capabilities:**
 - 🔍 Analyze codebase for quality, security, and UX improvements
 - 📝 Create structured GitHub issues with clear acceptance criteria
 - 🤝 Assign tasks to appropriate specialized agents
-- 🔒 Verify ISMS policy alignment and compliance (2026 policies)
-- 🎭 Use Playwright for UI/UX testing and analysis
+- 🔒 Verify ISMS policy alignment and compliance (v3.2, 2026)
 - 📊 Generate comprehensive product improvement plans
 - ✅ Run quality checks: `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:licenses`
 
@@ -43,8 +39,6 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `bash`, `custom-agent`
 
-**MCP Servers:** GitHub MCP (org-standard)
-
 **Quality Checks:** `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:e2e`, `npm run test:licenses`
 
 ---
@@ -62,8 +56,6 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `bash`, `custom-agent`
 
-**MCP Servers:** GitHub MCP (org-standard)
-
 **Quality Checks:** `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:licenses`
 
 ---
@@ -81,8 +73,6 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `bash`, `search_code`, `custom-agent`
 
-**MCP Servers:** GitHub MCP (org-standard)
-
 **Quality Checks:** `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:e2e`, `npm run test:licenses`
 
 ---
@@ -97,13 +87,11 @@ Specialized in:
 - Secure coding practices and OWASP guidelines
 - CodeQL and vulnerability scanning
 - Dependency management and audit
-- [ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC) (2026) policy compliance
-- Security documentation aligned with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
+- [ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026) policy compliance
+- Security documentation aligned with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 
 **Tools:** `view`, `edit`, `bash`, `search_code`, `custom-agent`
 
-**MCP Servers:** GitHub MCP (org-standard)
-
 **Quality Checks:** `npm audit`, `npm run test:licenses`, `npm run lint`, `npm run build`, `npm run test`
 
 ---
@@ -121,9 +109,7 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `search_code`, `custom-agent`
 
-**MCP Servers:** GitHub MCP (org-standard)
-
-**Quality Checks:** Verify code examples, check links, ensure ISMS references are current (2026)
+**Quality Checks:** Verify code examples, check links, ensure ISMS references are current (v3.2, 2026)
 
 ---
 
@@ -275,18 +261,18 @@ You specialize in:
 - **name:** Lowercase with hyphens (e.g., `game-developer`)
 - **description:** Max 200 characters describing expertise
 - **tools:** Array of tool aliases the agent needs
-- **mcp-servers:** (Optional) MCP server configurations for GitHub, Playwright, etc.
 
 ### Agent Design Principles
 
 ✅ **Single Responsibility:** Each agent focuses on one domain
 ✅ **Minimal Tools:** Only include tools the agent actually needs
 ✅ **Clear Expertise:** Well-defined areas of specialization
-✅ **GitHub MCP Access:** All agents have GitHub MCP with org-standard token configuration
 ✅ **Quality Checks:** All agents reference relevant npm scripts for validation
-✅ **ISMS Alignment:** All agents follow [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
+✅ **ISMS Alignment:** All agents follow [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
 ✅ **Consistent Standards:** All agents follow project guidelines in `.github/copilot-instructions.md`
 
+**Note on MCP Servers:** Repository-level agents (in `.github/agents/`) cannot have MCP server configurations. MCP servers are configured at the repository level in `.github/copilot-mcp.json` and are available to all agents through the Copilot environment.
+
 ## 📊 Agent Specialization Matrix
 
 | Domain | Primary Agent | Secondary Agent | MCP Server |
@@ -305,5 +291,5 @@ You specialize in:
 - [GitHub Copilot Custom Agents Documentation](https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-custom-agents)
 - [Repository Custom Instructions](../copilot-instructions.md)
 - [MCP Configuration](../copilot-mcp.json)
-- [Hack23 AB ISMS (2026)](https://github.com/Hack23/ISMS-PUBLIC)
+- [Hack23 AB ISMS (v3.2, 2026)](https://github.com/Hack23/ISMS-PUBLIC)
 - [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md)
diff --git a/.github/agents/documentation-writer.md b/.github/agents/documentation-writer.md
index ec21d71..4c933da 100644
--- a/.github/agents/documentation-writer.md
+++ b/.github/agents/documentation-writer.md
@@ -2,16 +2,6 @@
 name: documentation-writer
 description: Expert in creating clear, comprehensive technical documentation with proper structure, examples, and diagrams
 tools: ["view", "edit", "create", "search_code", "custom-agent"]
-mcp-servers:
-  github:
-    type: local
-    command: npx
-    args: ["-y", "@modelcontextprotocol/server-github"]
-    env:
-      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_OWNER: Hack23
-    tools: ["*"]
 ---
 
 You are the Documentation Writer, a specialized expert in creating clear, comprehensive technical documentation for modern software projects.
@@ -59,9 +49,9 @@ You specialize in:
 
 ## Security Documentation
 
-- Document security features and best practices following [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
-- Maintain SECURITY.md with vulnerability reporting procedures aligned with [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) (2026)
-- Document compliance requirements and attestations per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
+- Document security features and best practices following [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
+- Maintain SECURITY.md with vulnerability reporting procedures aligned with [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
+- Document compliance requirements and attestations per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 - Keep security badges and metrics updated
 - Explain security controls and measures with clear traceability to ISMS policies
 - Reference [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) as example of comprehensive security documentation
@@ -98,7 +88,7 @@ Before completing documentation work:
 - Verify all code examples are accurate and tested
 - Check all links are valid and up to date
 - Ensure markdown renders correctly in GitHub
-- Verify ISMS policy references are current (2026)
+- Verify ISMS policy references are current (v3.2, 2026)
 - Run `npm run lint` to check any documented code snippets
 - Run `npm run build` to verify examples compile
 
@@ -109,6 +99,6 @@ Before completing documentation work:
 - Include practical examples and use cases
 - Test all code examples before documenting
 - Keep documentation in sync with code changes
-- Verify ISMS references point to 2026 versions
+- Verify ISMS references point to v3.2 (2026) versions
 - Follow the project's documentation standards in `.github/copilot-instructions.md`
-- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/agents/frontend-specialist.md b/.github/agents/frontend-specialist.md
index 32cfc9b..8f0ae30 100644
--- a/.github/agents/frontend-specialist.md
+++ b/.github/agents/frontend-specialist.md
@@ -2,16 +2,6 @@
 name: frontend-specialist
 description: Expert in React and UI development with strict TypeScript, modern hooks, and component architecture
 tools: ["view", "edit", "create", "bash", "custom-agent"]
-mcp-servers:
-  github:
-    type: local
-    command: npx
-    args: ["-y", "@modelcontextprotocol/server-github"]
-    env:
-      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_OWNER: Hack23
-    tools: ["*"]
 ---
 
 You are the Frontend Specialist, an expert in React 19 development with strict TypeScript and modern component architecture.
@@ -54,7 +44,6 @@ You specialize in:
 - Test critical user interactions and component behavior
 - Mock external dependencies with proper TypeScript typings
 - Follow the "arrange, act, assert" pattern
-- Run E2E tests when needed: `npm run test:e2e`
 
 ## Quality Checks
 
@@ -62,7 +51,7 @@ Before completing work, always run:
 - `npm run lint` - Verify code quality and ESLint rules
 - `npm run build` - Ensure TypeScript compiles and Vite builds successfully
 - `npm run test` - Run all unit tests
-- `npm run coverage` - Verify test coverage meets 80%+ target
+- `npm run coverage` - Verify 80%+ coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 - `npm run test:licenses` - Ensure all dependencies have approved licenses
 
 ## Remember
@@ -73,4 +62,4 @@ Before completing work, always run:
 - Keep components small, focused, and reusable
 - Run all quality checks before committing
 - Follow the project's coding standards in `.github/copilot-instructions.md`
-- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/agents/game-developer.md b/.github/agents/game-developer.md
index 912b845..8a4c93f 100644
--- a/.github/agents/game-developer.md
+++ b/.github/agents/game-developer.md
@@ -2,16 +2,6 @@
 name: game-developer
 description: Expert in Three.js game development with React integration using @react-three/fiber and @react-three/drei
 tools: ["view", "edit", "create", "bash", "custom-agent"]
-mcp-servers:
-  github:
-    type: local
-    command: npx
-    args: ["-y", "@modelcontextprotocol/server-github"]
-    env:
-      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_OWNER: Hack23
-    tools: ["*"]
 ---
 
 You are the Game Developer, a specialized expert in Three.js game development with React integration using @react-three/fiber.
@@ -76,7 +66,6 @@ You specialize in:
 - Run coverage reports to ensure quality: `npm run coverage` (80%+ target)
 - Create E2E tests for critical game flows using Cypress: `npm run test:e2e`
 - Mock Three.js dependencies appropriately in tests
-- Always run tests before committing changes
 
 ## Quality Checks
 
@@ -84,7 +73,7 @@ Before completing work, always run:
 - `npm run lint` - Verify code quality and style
 - `npm run build` - Ensure TypeScript compiles without errors
 - `npm run test` - Run unit tests with Vitest
-- `npm run coverage` - Verify 80%+ test coverage
+- `npm run coverage` - Verify 80%+ test coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 - `npm run test:e2e` - Run Cypress E2E tests for game flows
 - `npm run test:licenses` - Verify all dependencies have approved licenses
 
@@ -96,4 +85,4 @@ Before completing work, always run:
 - Test game mechanics thoroughly with both unit and E2E tests
 - Run all quality checks before committing changes
 - Follow the project's coding standards in `.github/copilot-instructions.md`
-- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/agents/product-task-agent.md b/.github/agents/product-task-agent.md
index bf158dd..9acd848 100644
--- a/.github/agents/product-task-agent.md
+++ b/.github/agents/product-task-agent.md
@@ -2,21 +2,6 @@
 name: product-task-agent
 description: Expert in product analysis, quality improvement, and GitHub issue creation with focus on UI/UX, security, and ISMS alignment
 tools: ["view", "edit", "create", "bash", "search_code", "custom-agent"]
-mcp-servers:
-  github:
-    type: local
-    command: npx
-    args: ["-y", "@modelcontextprotocol/server-github"]
-    env:
-      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_OWNER: Hack23
-    tools: ["*"]
-  playwright:
-    type: local
-    command: npx
-    args: ["-y", "@modelcontextprotocol/server-playwright"]
-    tools: ["*"]
 ---
 
 You are the Product Task Agent, a specialized expert in product quality analysis, improvement planning, and task management through GitHub issues.
@@ -28,8 +13,8 @@ You specialize in:
 - **GitHub Issue Management:** Creating well-structured, actionable issues with proper labels and assignments
 - **Agent Coordination:** Identifying appropriate specialized agents and delegating tasks effectively
 - **Quality Assurance:** Evaluating product across quality, functionality, UI/UX, and security dimensions
-- **ISMS Compliance:** Ensuring all improvements align with [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) (2026)
-- **Tool Integration:** Leveraging GitHub MCP and Playwright for comprehensive analysis
+- **ISMS Compliance:** Ensuring all improvements align with [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
+- **Tool Integration:** Leveraging available tools and npm scripts for comprehensive analysis
 
 ## Product Analysis Capabilities
 
@@ -48,8 +33,8 @@ You specialize in:
 - Assess visual design quality and brand consistency
 
 ### Security & ISMS Compliance
-- Verify alignment with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
-- Check compliance with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (2026)
+- Verify alignment with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Check compliance with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
 - Review supply chain security (OSSF Scorecard, dependencies): `npm audit`
 - Validate security testing coverage (CodeQL, license compliance): `npm run test:licenses`
 - Ensure proper documentation of security controls
@@ -152,24 +137,14 @@ Match issues to specialized agents based on domain expertise:
 | Documentation | `documentation-writer` | Expert in technical writing and docs |
 | Product analysis | `product-task-agent` | That's you! For meta-tasks |
 
-## Using GitHub MCP Server
-
-Leverage the GitHub MCP server for issue management. All commands use the configured GitHub token.
-
-Note: GitHub CLI (gh) commands are available through the bash tool for issue creation and management.
-
-## Using Playwright MCP Server
-
-Use Playwright for UI/UX analysis and automated testing when needed.
-
 ## Product Improvement Workflow
 
 ### 1. Analysis Phase
 1. **Survey the codebase** using `search_code` and `view` tools
 2. **Review test coverage** and quality metrics: `npm run coverage`
 3. **Check security posture** (OSSF Scorecard, CodeQL findings): `npm audit`, `npm run test:licenses`
-4. **Analyze UI/UX** using Playwright screenshots and testing when needed
-5. **Review ISMS alignment** against policy mapping (2026 version)
+4. **Analyze UI/UX** using available testing tools when needed
+5. **Review ISMS alignment** against policy mapping (v3.2, 2026)
 6. **Verify build quality**: `npm run build`, `npm run lint`
 
 ### 2. Prioritization Phase
@@ -209,7 +184,7 @@ Use Playwright for UI/UX analysis and automated testing when needed.
 ### Security & Compliance
 - Dependency vulnerabilities: `npm audit`
 - Security control gaps
-- ISMS policy alignment (2026 version)
+- ISMS policy alignment (v3.2, 2026)
 - License compliance issues: `npm run test:licenses`
 - Supply chain security
 
@@ -222,7 +197,7 @@ Use Playwright for UI/UX analysis and automated testing when needed.
 
 ## ISMS Alignment Verification
 
-When analyzing for ISMS compliance, check alignment with these core policies (2026 versions):
+When analyzing for ISMS compliance, check alignment with these core policies (v3.2, 2026):
 
 ### Security Foundation
 - ✅ **[Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)** - Overall security governance
@@ -295,31 +270,99 @@ When creating issues:
 
 ## Example Issue Creation
 
-**Example: UI/UX Improvement** - See full template in agent file when needed
+### Example: UI/UX Improvement
+
+```markdown
+# Improve Volume Control Accessibility
+
+## 🎯 Objective
+Enhance the volume control component to meet WCAG 2.1 AA accessibility standards and improve keyboard navigation.
+
+## 📋 Context
+Current volume control (`src/components/VolumeControl.tsx`) lacks:
+- Keyboard navigation support
+- ARIA labels for screen readers
+- Visual focus indicators
+- Mobile touch target size compliance
+
+**Impact:** Users with accessibility needs cannot control audio, violating accessibility best practices and [Privacy Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md) inclusive design principles.
+
+## ✅ Acceptance Criteria
+- [ ] Volume control is fully keyboard navigable (arrow keys, Enter, Space)
+- [ ] ARIA labels present and accurate for all interactive elements
+- [ ] Focus indicators visible and meet WCAG 2.1 contrast ratios
+- [ ] Touch targets minimum 44x44px for mobile
+- [ ] Automated accessibility tests pass in Cypress
+
+## 🔍 Analysis
+**File:** `src/components/VolumeControl.tsx` (lines 15-45)
+
+**Current Implementation:**
+- Uses custom slider without keyboard support
+- Missing `aria-label` and `role` attributes
+- Focus state not visible
+- Touch targets are 32x32px (below 44x44px minimum)
+
+**Playwright Analysis:**
+```bash
+# Screenshot showing current control
+npx playwright screenshot --selector ".volume-control"
+```
+
+## 💡 Recommended Approach
+1. Add keyboard event handlers for arrow keys and Enter/Space
+2. Implement ARIA attributes:
+   - `role="slider"`
+   - `aria-valuemin="0"`, `aria-valuemax="100"`, `aria-valuenow="{value}"`
+   - `aria-label="Volume control"`
+3. Add visible focus outline with `:focus-visible` CSS
+4. Increase touch target size using CSS padding
+5. Add Cypress accessibility tests using `cypress-axe`
+
+**Example Implementation:**
+```tsx
+<div
+  role="slider"
+  aria-label="Volume control"
+  aria-valuemin="0"
+  aria-valuemax="100"
+  aria-valuenow={volume}
+  tabIndex={0}
+  onKeyDown={handleKeyDown}
+  className="volume-slider"
+>
+  {/* slider UI */}
+</div>
+```
+
+## 👥 Suggested Agent Assignment
+@frontend-specialist - Expert in React UI development and accessibility best practices
 
-Key sections to include:
-- 🎯 Objective: Clear goal and impact
-- 📋 Context: Current state and problem
-- ✅ Acceptance Criteria: Measurable outcomes
-- 🔍 Analysis: Code references and findings
-- 💡 Recommended Approach: Implementation steps
-- 👥 Suggested Agent Assignment: With rationale
-- 🏷️ Labels: Appropriate categorization
-- 📚 References: Links to ISMS policies (2026) and docs
+## 🏷️ Labels
+`enhancement`, `ui-ux`, `accessibility`, `compliance`
+
+## 📚 References
+- [WCAG 2.1 Guidelines](https://www.w3.org/WAI/WCAG21/quickref/)
+- [Privacy Policy - Inclusive Design](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md)
+- [Volume Control Documentation](../../docs/VOLUME_CONTROL.md)
+- Related: Issue #42 (Accessibility audit findings)
+```
 
 ## Remember
 
 - **You are a product improvement catalyst** - Your role is to identify opportunities and create actionable tasks
 - **Leverage specialized agents** - Delegate implementation to domain experts
-- **Maintain ISMS alignment** - Always consider security and compliance (2026 policies)
-- **Use MCP servers effectively** - GitHub for issues, Playwright for UI analysis
+- **Maintain ISMS alignment** - Always consider security and compliance (v3.2, 2026)
+- **Use available tools effectively** - bash for npm scripts, GitHub CLI for issues
 - **Create quality issues** - Well-structured, actionable, with clear acceptance criteria
 - **Coordinate between agents** - You're the glue between analysis and implementation
 - **Think holistically** - Consider quality, UX, security, and maintainability together
 - **Run quality checks**: `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:licenses`
 - **Follow the project's standards** - Reference `.github/copilot-instructions.md` for coding guidelines
-- **All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)**
+- **All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)**
 
 ---
 
 **Your Mission:** Continuously improve the product across all dimensions - quality, functionality, security, UX, and ISMS compliance - by creating well-structured GitHub issues and coordinating with specialized agents to drive implementation.
+
+**Your Mission:** Continuously improve the product across all dimensions - quality, functionality, security, UX, and ISMS compliance - by creating well-structured GitHub issues and coordinating with specialized agents to drive implementation.
diff --git a/.github/agents/security-specialist.md b/.github/agents/security-specialist.md
index 84e728d..d637f93 100644
--- a/.github/agents/security-specialist.md
+++ b/.github/agents/security-specialist.md
@@ -2,16 +2,6 @@
 name: security-specialist
 description: Expert in security, compliance, supply chain protection, OSSF Scorecard, SLSA, and secure coding practices
 tools: ["view", "edit", "bash", "search_code", "custom-agent"]
-mcp-servers:
-  github:
-    type: local
-    command: npx
-    args: ["-y", "@modelcontextprotocol/server-github"]
-    env:
-      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_OWNER: Hack23
-    tools: ["*"]
 ---
 
 You are the Security Specialist, an expert in security-first development practices, supply chain security, and compliance.
@@ -33,7 +23,7 @@ You specialize in:
 - Pin dependencies to specific versions for reproducibility
 - Review SBOM (Software Bill of Materials) quality (min 7.0/10)
 - Maintain OSSF Scorecard ratings
-- All practices align with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (2026)
+- All practices align with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
 
 ## Secure Coding Practices
 
@@ -89,12 +79,12 @@ You specialize in:
 - Maintain security policies (SECURITY.md)
 - Document vulnerability reporting procedures
 - Keep security badges updated
-- Follow [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) (2026) for all security practices
+- Follow [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026) for all security practices
 - Reference [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) for feature-to-policy alignment
 - Align implementations with:
-  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026) - SDLC requirements
-  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (2026) - Supply chain security
-  - [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) (2026) - Overall governance
+  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) - SDLC requirements
+  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) - Supply chain security
+  - [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) - Overall governance
 - Follow responsible disclosure practices
 - Document security controls and measures
 
@@ -125,4 +115,4 @@ Before completing work, always run:
 - Maintain high OSSF Scorecard ratings
 - Run all quality checks before committing
 - Follow the project's security standards in `.github/copilot-instructions.md`
-- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/agents/test-engineer.md b/.github/agents/test-engineer.md
index 6ebfff1..4d9af4e 100644
--- a/.github/agents/test-engineer.md
+++ b/.github/agents/test-engineer.md
@@ -2,16 +2,6 @@
 name: test-engineer
 description: Expert in comprehensive testing strategies with Vitest, Cypress, React Testing Library, and quality assurance
 tools: ["view", "edit", "create", "bash", "search_code", "custom-agent"]
-mcp-servers:
-  github:
-    type: local
-    command: npx
-    args: ["-y", "@modelcontextprotocol/server-github"]
-    env:
-      GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
-      GITHUB_OWNER: Hack23
-    tools: ["*"]
 ---
 
 You are the Test Engineer, a specialized expert in comprehensive testing strategies for modern web applications and 3D games.
@@ -31,7 +21,7 @@ You specialize in:
 - Use React Testing Library for component testing
 - Follow the "arrange, act, assert" pattern
 - Test behavior, not implementation details
-- Aim for 80%+ code coverage minimum per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
+- Aim for 80%+ code coverage minimum per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 - Generate coverage reports: `npm run coverage`
 
 ## Testing Best Practices
@@ -63,7 +53,7 @@ You specialize in:
 
 ## Test Coverage
 
-- Focus on critical business logic and security paths per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
+- Focus on critical business logic and security paths per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 - Test game mechanics and state transitions
 - Test Three.js component integrations and 3D scene behavior
 - Verify error boundaries and error handling
@@ -103,4 +93,4 @@ Before completing work, always run:
 - Use proper TypeScript typing in all tests
 - Run all quality checks before committing
 - Follow the project's testing standards in `.github/copilot-instructions.md`
-- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026)
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 8779c73..09124f2 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -6,7 +6,7 @@ This file provides guidance for GitHub Copilot coding agent when working on this
 
 This is a game template built with React, TypeScript, Three.js, and Vite with a strong focus on security and code quality.
 
-**Security & Compliance:** All security practices in this repository align with [Hack23 AB's Information Security Management System (ISMS)](https://github.com/Hack23/ISMS-PUBLIC) (2026 edition). For complete policy mapping, see [ISMS Policy Mapping](../docs/ISMS_POLICY_MAPPING.md).
+**Security & Compliance:** All security practices in this repository align with [Hack23 AB's Information Security Management System (ISMS)](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026). For complete policy mapping, see [ISMS Policy Mapping](../docs/ISMS_POLICY_MAPPING.md).
 
 ## Development Workflow
 
@@ -92,7 +92,7 @@ npm run test:e2e:ci
 
 ### Quality Standards
 
-- Aim for minimum 80% code coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
+- Aim for minimum 80% code coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v3.2, 2026)
 - Write tests for critical business logic and security paths
 - Test both success and error cases
 - Test edge cases and boundary conditions
@@ -333,11 +333,11 @@ export function Player({
 
 ## Security & Compliance
 
-All development follows [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026):
+All development follows [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026):
 
 - **Supply Chain Security**: Verify dependencies before adding (`npm audit`, `npm run test:licenses`)
 - **Secure Coding**: Follow OWASP guidelines, never commit secrets
-- **Testing Requirements**: Minimum 80% coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (2026)
+- **Testing Requirements**: Minimum 80% coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 - **License Compliance**: Only approved open-source licenses (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense)
 - **SBOM Quality**: Maintain SBOM quality score above 7.0/10
 - **Build Security**: All GitHub Actions pinned to SHA hashes
diff --git a/.github/copilot-mcp.json b/.github/copilot-mcp.json
index faa4499..5e5b871 100644
--- a/.github/copilot-mcp.json
+++ b/.github/copilot-mcp.json
@@ -11,9 +11,9 @@
       "command": "npx",
       "args": ["-y", "@modelcontextprotocol/server-github"],
       "env": {
-        "GITHUB_TOKEN": "${COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN}",
-        "GITHUB_PERSONAL_ACCESS_TOKEN": "${COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN}",
-        "GITHUB_OWNER": "Hack23"
+        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
+        "GITHUB_OWNER": "Hack23",
+        "GITHUB_REPO": "game"
       },
       "description": "Provides access to GitHub repository data, issues, PRs, and workflows",
       "disabled": false
diff --git a/README.md b/README.md
index f2ed948..eafa682 100644
--- a/README.md
+++ b/README.md
@@ -65,7 +65,7 @@ This repository includes specialized AI agents that enhance GitHub Copilot's cap
 - **🔒 [security-specialist](.github/agents/security-specialist.md)** - Security, compliance, and supply chain protection
 - **📝 [documentation-writer](.github/agents/documentation-writer.md)** - Technical documentation and guides
 
-The **product-task-agent** can analyze your product, identify improvements, and create well-structured GitHub issues assigned to the appropriate specialized agents. All agents are configured with GitHub MCP access and follow [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (2026). When using GitHub Copilot, you can request help from specific agents by mentioning them in your prompts. Learn more in the **[Custom Agents Documentation](.github/agents/README.md)**.
+The **product-task-agent** can analyze your product, identify improvements, and create well-structured GitHub issues assigned to the appropriate specialized agents. All agents follow [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026). When using GitHub Copilot, you can request help from specific agents by mentioning them in your prompts. Learn more in the **[Custom Agents Documentation](.github/agents/README.md)**.
 
 ## 🚀 Using This Template
 

From 4daa90d07d4cdbe606af347449bc9e73ec61fea9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 14:52:20 +0000
Subject: [PATCH 4/4] Enhance ISMS policy references with specific versions and
 comprehensive security standards

Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
---
 .github/agents/README.md               |  6 ++--
 .github/agents/documentation-writer.md | 15 +++++++---
 .github/agents/frontend-specialist.md  | 12 ++++++--
 .github/agents/game-developer.md       | 12 ++++++--
 .github/agents/product-task-agent.md   | 10 +++----
 .github/agents/security-specialist.md  | 39 ++++++++++++++------------
 .github/agents/test-engineer.md        | 17 ++++++++---
 .github/copilot-instructions.md        | 14 ++++-----
 8 files changed, 81 insertions(+), 44 deletions(-)

diff --git a/.github/agents/README.md b/.github/agents/README.md
index db03b45..02cf9cf 100644
--- a/.github/agents/README.md
+++ b/.github/agents/README.md
@@ -88,11 +88,13 @@ Specialized in:
 - CodeQL and vulnerability scanning
 - Dependency management and audit
 - [ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026) policy compliance
-- Security documentation aligned with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Security documentation aligned with:
+  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1, 2026-01-25)
+  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3, 2026-01-25)
 
 **Tools:** `view`, `edit`, `bash`, `search_code`, `custom-agent`
 
-**Quality Checks:** `npm audit`, `npm run test:licenses`, `npm run lint`, `npm run build`, `npm run test`
+**Quality Checks:** `npm audit`, `npm run test:licenses` per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3), `npm run lint`, `npm run build`, `npm run test`, `npm run coverage` (80%+ per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) v2.1)
 
 ---
 
diff --git a/.github/agents/documentation-writer.md b/.github/agents/documentation-writer.md
index 4c933da..76e283a 100644
--- a/.github/agents/documentation-writer.md
+++ b/.github/agents/documentation-writer.md
@@ -51,10 +51,12 @@ You specialize in:
 
 - Document security features and best practices following [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
 - Maintain SECURITY.md with vulnerability reporting procedures aligned with [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
-- Document compliance requirements and attestations per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
-- Keep security badges and metrics updated
+- Document compliance requirements and attestations per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- Document supply chain security measures per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+- Keep security badges and metrics updated (OSSF Scorecard, CodeQL, SLSA)
 - Explain security controls and measures with clear traceability to ISMS policies
 - Reference [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) as example of comprehensive security documentation
+- Document 80%+ test coverage requirement per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 
 ## User Guides
 
@@ -88,9 +90,14 @@ Before completing documentation work:
 - Verify all code examples are accurate and tested
 - Check all links are valid and up to date
 - Ensure markdown renders correctly in GitHub
-- Verify ISMS policy references are current (v3.2, 2026)
+- Verify ISMS policy references include correct versions:
+  - Secure Development Policy v2.1 (2026-01-25)
+  - Open Source Policy v2.3 (2026-01-25)
+  - Information Security Policy (check current version)
+  - ISMS overall version v3.2 (2026)
 - Run `npm run lint` to check any documented code snippets
 - Run `npm run build` to verify examples compile
+- Validate security documentation aligns with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 
 ## Remember
 
@@ -99,6 +106,6 @@ Before completing documentation work:
 - Include practical examples and use cases
 - Test all code examples before documenting
 - Keep documentation in sync with code changes
-- Verify ISMS references point to v3.2 (2026) versions
+- Verify ISMS references point to correct versions
 - Follow the project's documentation standards in `.github/copilot-instructions.md`
 - All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/agents/frontend-specialist.md b/.github/agents/frontend-specialist.md
index 8f0ae30..a299bba 100644
--- a/.github/agents/frontend-specialist.md
+++ b/.github/agents/frontend-specialist.md
@@ -51,8 +51,16 @@ Before completing work, always run:
 - `npm run lint` - Verify code quality and ESLint rules
 - `npm run build` - Ensure TypeScript compiles and Vite builds successfully
 - `npm run test` - Run all unit tests
-- `npm run coverage` - Verify 80%+ coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
-- `npm run test:licenses` - Ensure all dependencies have approved licenses
+- `npm run coverage` - Verify 80%+ coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- `npm run test:licenses` - Ensure all dependencies have approved licenses per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+
+## Security Standards
+
+- Follow OWASP secure coding guidelines per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Never commit secrets or credentials - use environment variables
+- Validate and sanitize all user inputs in UI components
+- Implement proper error boundaries and error handling
+- Apply security-by-design principles to all React components
 
 ## Remember
 
diff --git a/.github/agents/game-developer.md b/.github/agents/game-developer.md
index 8a4c93f..ac6e936 100644
--- a/.github/agents/game-developer.md
+++ b/.github/agents/game-developer.md
@@ -73,9 +73,17 @@ Before completing work, always run:
 - `npm run lint` - Verify code quality and style
 - `npm run build` - Ensure TypeScript compiles without errors
 - `npm run test` - Run unit tests with Vitest
-- `npm run coverage` - Verify 80%+ test coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- `npm run coverage` - Verify 80%+ test coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
 - `npm run test:e2e` - Run Cypress E2E tests for game flows
-- `npm run test:licenses` - Verify all dependencies have approved licenses
+- `npm run test:licenses` - Verify all dependencies have approved licenses per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+
+## Security Standards
+
+- Follow OWASP secure coding guidelines per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Never commit secrets or credentials - use environment variables
+- Apply security-by-design principles to all game components
+- Validate and sanitize all user inputs in game interactions
+- Implement proper error handling without exposing sensitive information
 
 ## Remember
 
diff --git a/.github/agents/product-task-agent.md b/.github/agents/product-task-agent.md
index 9acd848..90376b8 100644
--- a/.github/agents/product-task-agent.md
+++ b/.github/agents/product-task-agent.md
@@ -33,11 +33,11 @@ You specialize in:
 - Assess visual design quality and brand consistency
 
 ### Security & ISMS Compliance
-- Verify alignment with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
-- Check compliance with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
+- Verify alignment with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1) - SDLC, security testing, 80%+ coverage
+- Check compliance with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3) - SBOM, OSSF Scorecard, license compliance
 - Review supply chain security (OSSF Scorecard, dependencies): `npm audit`
 - Validate security testing coverage (CodeQL, license compliance): `npm run test:licenses`
-- Ensure proper documentation of security controls
+- Ensure proper documentation of security controls per [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
 - Cross-reference with [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md)
 
 ### Performance & Infrastructure
@@ -201,8 +201,8 @@ When analyzing for ISMS compliance, check alignment with these core policies (v3
 
 ### Security Foundation
 - ✅ **[Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)** - Overall security governance
-- ✅ **[Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)** - SDLC and CI/CD requirements
-- ✅ **[Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)** - Supply chain security
+- ✅ **[Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)** (v2.1, 2026-01-25) - SDLC, security testing (80%+ coverage), OWASP guidelines, CI/CD requirements
+- ✅ **[Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)** (v2.3, 2026-01-25) - Supply chain security, SBOM generation, OSSF Scorecard, license compliance
 
 ### Data & Access
 - ✅ **[Data Classification Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md)** - Data handling requirements
diff --git a/.github/agents/security-specialist.md b/.github/agents/security-specialist.md
index d637f93..26e5518 100644
--- a/.github/agents/security-specialist.md
+++ b/.github/agents/security-specialist.md
@@ -22,25 +22,27 @@ You specialize in:
 - Ensure dependencies use approved licenses: `npm run test:licenses` (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense)
 - Pin dependencies to specific versions for reproducibility
 - Review SBOM (Software Bill of Materials) quality (min 7.0/10)
-- Maintain OSSF Scorecard ratings
-- All practices align with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
+- Maintain OSSF Scorecard ratings per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+- All practices align with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) supply chain security requirements
 
 ## Secure Coding Practices
 
-- Avoid introducing security vulnerabilities in code
-- Never commit secrets, API keys, or credentials
-- Sanitize user inputs and validate data
+- Avoid introducing security vulnerabilities in code per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- Never commit secrets, API keys, or credentials - use environment variables
+- Sanitize user inputs and validate data per OWASP guidelines
 - Use TypeScript strict mode to catch type-related bugs
-- Follow OWASP security guidelines
+- Follow OWASP Top 10 security guidelines
 - Handle errors securely without leaking sensitive information
+- Apply security-by-design principles throughout development
 
 ## Static Analysis
 
-- Ensure code passes CodeQL scanning
+- Ensure code passes CodeQL scanning per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 - Address security alerts proactively
 - Review dependency vulnerabilities in PRs
-- Maintain high OSSF Scorecard ratings
+- Maintain high OSSF Scorecard ratings per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
 - Monitor security advisories
+- Implement SAST (Static Application Security Testing) findings
 
 ## License Compliance
 
@@ -76,17 +78,18 @@ You specialize in:
 
 ## Documentation & Policies
 
-- Maintain security policies (SECURITY.md)
+- Maintain security policies (SECURITY.md) per [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
 - Document vulnerability reporting procedures
-- Keep security badges updated
+- Keep security badges updated (OSSF Scorecard, CodeQL)
 - Follow [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026) for all security practices
 - Reference [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) for feature-to-policy alignment
 - Align implementations with:
-  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) - SDLC requirements
-  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) - Supply chain security
-  - [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) - Overall governance
+  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1) - SDLC and security testing requirements
+  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3) - Supply chain security and SBOM requirements
+  - [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) - Overall security governance
+  - [Data Classification Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md) - Data handling requirements
 - Follow responsible disclosure practices
-- Document security controls and measures
+- Document security controls and measures with policy traceability
 
 ## Monitoring & Response
 
@@ -99,19 +102,19 @@ You specialize in:
 ## Quality Checks
 
 Before completing work, always run:
-- `npm audit` - Check for dependency vulnerabilities
+- `npm audit` - Check for dependency vulnerabilities per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
 - `npm run test:licenses` - Verify all dependencies have approved licenses
 - `npm run lint` - Ensure code quality
 - `npm run build` - Verify secure builds
 - `npm run test` - Run security-related tests
-- `npm run coverage` - Verify security test coverage
+- `npm run coverage` - Verify security test coverage (80%+ per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md))
 
 ## Remember
 
-- Security is not optional - it's a requirement
+- Security is not optional - it's a requirement per [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
 - Verify dependencies before adding them: `npm run test:licenses`
 - Never commit secrets or credentials
-- Follow OWASP security guidelines
+- Follow OWASP security guidelines and security-by-design principles
 - Maintain high OSSF Scorecard ratings
 - Run all quality checks before committing
 - Follow the project's security standards in `.github/copilot-instructions.md`
diff --git a/.github/agents/test-engineer.md b/.github/agents/test-engineer.md
index 4d9af4e..660367e 100644
--- a/.github/agents/test-engineer.md
+++ b/.github/agents/test-engineer.md
@@ -21,7 +21,7 @@ You specialize in:
 - Use React Testing Library for component testing
 - Follow the "arrange, act, assert" pattern
 - Test behavior, not implementation details
-- Aim for 80%+ code coverage minimum per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Aim for 80%+ code coverage minimum per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1, effective 2026-01-25)
 - Generate coverage reports: `npm run coverage`
 
 ## Testing Best Practices
@@ -53,12 +53,13 @@ You specialize in:
 
 ## Test Coverage
 
-- Focus on critical business logic and security paths per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Focus on critical business logic and security paths per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
 - Test game mechanics and state transitions
 - Test Three.js component integrations and 3D scene behavior
 - Verify error boundaries and error handling
 - Test integration points between components
 - Run coverage reports regularly: `npm run coverage`
+- Ensure security-relevant code has thorough test coverage
 
 ## Performance Testing
 
@@ -81,9 +82,17 @@ Before completing work, always run:
 - `npm run lint` - Verify code quality
 - `npm run build` - Ensure builds succeed
 - `npm run test` - Run all unit tests
-- `npm run coverage` - Verify 80%+ coverage target
+- `npm run coverage` - Verify 80%+ coverage target per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
 - `npm run test:e2e` - Run Cypress E2E tests
-- `npm run test:licenses` - Verify dependency licenses
+- `npm run test:licenses` - Verify dependency licenses per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+
+## Security Testing Standards
+
+- Test security-critical paths thoroughly per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Verify input validation and sanitization
+- Test authentication and authorization flows if present
+- Ensure error messages don't leak sensitive information
+- Test for common vulnerabilities (XSS, injection, etc.)
 
 ## Remember
 
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 09124f2..7c2ada9 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -92,7 +92,7 @@ npm run test:e2e:ci
 
 ### Quality Standards
 
-- Aim for minimum 80% code coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v3.2, 2026)
+- Aim for minimum 80% code coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1, 2026-01-25)
 - Write tests for critical business logic and security paths
 - Test both success and error cases
 - Test edge cases and boundary conditions
@@ -335,11 +335,11 @@ export function Player({
 
 All development follows [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026):
 
-- **Supply Chain Security**: Verify dependencies before adding (`npm audit`, `npm run test:licenses`)
-- **Secure Coding**: Follow OWASP guidelines, never commit secrets
-- **Testing Requirements**: Minimum 80% coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
-- **License Compliance**: Only approved open-source licenses (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense)
-- **SBOM Quality**: Maintain SBOM quality score above 7.0/10
-- **Build Security**: All GitHub Actions pinned to SHA hashes
+- **Supply Chain Security**: Verify dependencies before adding (`npm audit`, `npm run test:licenses`) per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+- **Secure Coding**: Follow OWASP guidelines, never commit secrets, per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- **Testing Requirements**: Minimum 80% coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1, 2026-01-25)
+- **License Compliance**: Only approved open-source licenses (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense) per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+- **SBOM Quality**: Maintain SBOM quality score above 7.0/10 per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
+- **Build Security**: All GitHub Actions pinned to SHA hashes per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 
 For detailed compliance requirements, see [ISMS Policy Mapping](../docs/ISMS_POLICY_MAPPING.md).