[polewskm]

Summary

Updates the project from project-template v0.41.1 to v0.61.2 with .template/Update-Project.ps1 -Ref v0.61.2, then applies the template's changes to the project-owned files by hand.

• Template-owned files replaced: .template/, agent commands, prompts, skills, instructions, build/ProjectTemplate*.props/globalconfig, BannedSymbols.txt, build/dod.ps1, build/Update-PublicApi.ps1, and so on. New: CONTRIBUTING.md, SECURITY.md, docs/decisions/, nuget.config (restore is limited to nuget.org), and the workflows template-update.yml, copilot-setup-steps.yml and code-review-auto-merge.yml. The template's publish.yml is deleted: the project publishes from a release with the publish job of its own main.yml (NuGet API key), and both would fire on every release.
• Template settings that now apply: .editorconfig (file header template, generated-code rule for Migrations, analyzer severities), Directory.Packages.props (BannedApiAnalyzers, Nullable.Extended.Analyzer, PublicApiAnalyzers), .gitignore, and Dependabot cooldown, security groups and no offers of a new .NET SDK major. The build now fails on banned APIs, the null-forgiving operator and unused usings.
• Project-owned files updated by hand: AGENTS.md (new instruction lines, Definition of Done command, gate: ./build/dod.ps1 -Fast, review-bots, max-review-rounds, prelude, the template's Landing text, real conventions; release stays none and draft stays no, the project's existing choices), README.md (Project and License sections), CONTRIBUTING.md and SECURITY.md (pointing at what the project really does), .github/workflows/code-review.yml.
• NCode Review moves from v1.0.0 to v1.1.2 (564bb16f8f4f25f88dcc47baae10d7edf55ca504) in code-review.yml, with the review job's concurrency.group line from that release's caller, so a /review comment followed by more lines, such as an agent's --- footer, reviews the pull request instead of cancelling the review in progress. The 3-day dependency cooldown is not met (v1.1.2 was published on 2026-11-02); the maintainer asked for the latest bot.
• Conflicts resolved: global.json keeps SDK 10.0.403 and gains allowPrerelease: false. .github/workflows/ci.yml keeps the project's .NET 6.0.x runtime step (the test project targets net6.0) and takes the template's job. copilot-setup-steps.yml gets the same .NET 6.0.x step.
• main.yml now also installs the SDK global.json pins in its three jobs: its build job failed because the runner has no SDK 10.0.403 (it installed only 6.0.x), which is unrelated to the template update.

Analyzer fixes

• Public API tracking: the library source is identical to tag v1.0.1, so build/Update-PublicApi.ps1 -Release recorded the 61 public entries in PublicAPI.Shipped.txt as a baseline only; PublicAPI.Unshipped.txt holds only #nullable enable. No library code changed.
• Added CHANGELOG.md (Keep a Changelog 1.1.0), docs/metrics.md and the decision index say the project defines none yet.

Verification

./build/dod.ps1 -Fast ends with Definition of Done: PASSED, 33 of 33 tests pass. Caveats: locally I temporarily set global.json to SDK 10.0.114 with rollForward: latestMajor (10.0.403 cannot be downloaded in this environment) and ran the tests with DOTNET_ROLL_FORWARD=Major because no .NET 6 runtime is installed. Neither change is committed. CI runs the real configuration.

Needs a human decision

• code-review-auto-merge.yml is new: the template's exception (ADR-0006) that auto-merges Dependabot's NCode Review pin bump. Kept, and recorded in AGENTS.md. Keep or delete it.
• AssemblyVersion: the template pins AssemblyVersion to <major>.0.0.0 (1.0.0.0 for 1.x) when the project sets none. The project never set one, so releases up to 1.0.1 had AssemblyVersion equal to the package version (for example 1.0.1.0); the next 1.x release therefore carries a lower assembly version than 1.0.1. This is disclosed in CHANGELOG.md. To keep the old behavior, set <AssemblyVersion> explicitly in Directory.Build.props; I did not.
• main.yml is also named "CI", like the template's ci.yml, and both build the project. Consider removing or renaming it (the README badge points to it).
• The changelog has no sections for v1.0.0 and v1.0.1; the update suggests /plan-migration Backfill CHANGELOG.md from the releases v1.0.0..v1.0.1.
• .copier-answers.yml has license: '' while the .editorconfig file header names Apache-2.0; the answer can be set with Update-Project.ps1 -Data.

[ncode-review]

🤖 NCode Review at 4ee8185: 11 new findings on the changed lines.

[ncode-review]

_{Superseded by the review at 3fcbe20.}

[polewskm]

Autopilot: Round 2 on the review of 4ee8185, all 11 threads answered. Fixed in c8bd021 and 3fcbe20: the duplicate publish.yml is deleted (the project publishes from main.yml) and copilot-setup-steps.yml gets the .NET 6.0.x step (F1), the CONTRIBUTING link (F2), the changelog (F7), docs/metrics.md and the decision index (F10), and the SECURITY.md paragraph describing the publish path. c8bd021 also fixes the code-review.yml comments on the concurrency group and the cooldown exception. Also in 3fcbe20: main.yml installs the SDK global.json pins, which was the cause of the red build check (the runner had no SDK 10.0.403, unrelated to this PR's changes); AGENTS.md Conventions now records the public API and publishing rules and the ADR-0006 exception (F4). Answered without a change: the AssemblyVersion question (F3, disclosed in the changelog and PR description for the maintainer), the PR-description gaps (F5, description updated), the license answer (F6), and the template-owned items (F8, F9, F11), which belong upstream in NCodeGroup/project-template. The draft: no Landing value is the project's existing choice, unchanged.

---

Generated by Claude Code

[polewskm]

/review

[ncode-review]

🤖 Review complete

Verdict: ✅ Approve — Re-review of what changed since the last review at 4ee8185: 15 hunks in 9 files and changes taken back in 5 files, by correctness only. No further findings above nits.

1 reviewer run — 0 findings (run details)

Reviewer	Model	Findings	Top
correctness	sonnet-5-5	0	🟢

_{Trial: findings are posted as review threads and in the check run. $0.09 on Amazon Bedrock, 16s, at 3fcbe20. (how to interact)}

📋 Outcomes

Merged at 3fcbe20: 4 fixed, 7 dismissed, 0 acknowledged, 0 ignored.

Finding	Reviewer	Severity	Outcome
F1	architecture, completeness	🟠 Should fix	✅ fixed
F2	completeness	🟠 Should fix	✅ fixed
F3	api-compat	🟡 Nit	👎 dismissed
F4	conventions, rule-check	🟡 Nit	👎 dismissed
F5	intent	🟡 Nit	👎 dismissed
F6	hygiene	🟡 Nit	👎 dismissed
F7	hygiene	🟡 Nit	✅ fixed
F8	hygiene	🟡 Nit	👎 dismissed
F9	hygiene	🟡 Nit	👎 dismissed
F10	hygiene	🟡 Nit	✅ fixed
F11	hygiene	🟡 Nit	👎 dismissed