Modernize agent guidance and decouple NuGet package identities

[rodri-oliveira-dev]

Agent governance

• Imported and adapted eleven repository-local .NET skills in total.
• Existing skills retained:
  • dotnet-issue-implementation
  • dotnet-refactoring-engineer
  • dotnet-pr-review
  • dotnet-library-change
  • ci-release-governance
• Added from/adapted from dotnet/skills:
  • authoring-github-workflows
  • nuget-trusted-publishing
  • test-gap-analysis
  • microbenchmarking
  • directory-build-organization
  • binlog-failure-analysis
• Added the required supporting references/ files and .agents/THIRD-PARTY-NOTICES.md with MIT attribution to the .NET Foundation.
• Updated AGENTS.md with task routing and composition guidance for the new skills.
• Adapted the imported guidance to Dapper-FluentMap rather than copying template assumptions: master remains the default branch, the existing benchmark project is preferred, OIDC Trusted Publishing/release recovery remain authoritative, public packages preserve netstandard2.0, and the repository is correctly documented as using explicit PackageReference versions rather than Central Package Management.
• Documented that project identity, assembly identity, namespace identity and NuGet PackageId are independent identities.

Architecture

• Added and configured ADR Guard as a repository-local .NET tool (RodriOliveira.AdrGuard 0.1.8).
• Added ADR 0001 - Decouple NuGet Package IDs from FluentMap project identities, status Accepted.
• Introduced eng/package-catalog.json as the package catalog separating project identity from package identity.
• Renamed only the three new NuGet PackageIds:
  • Dapper.FluentMap.DependencyInjection -> FluentMap.DependencyInjection
  • Dapper.FluentMap.Analyzers -> FluentMap.Analyzers
  • Dapper.FluentMap.Generators -> FluentMap.Generators
• Preserved assemblies, namespaces, project names, project paths and public APIs.

Release engineering

• Corrected NuGet preflight semantics so flat-container 404 is treated only as "PackageId/version is not currently published", not proof of publisher authorization.
• Improved dotnet nuget push diagnostics by keeping original command output and adding PackageId/version context.
• Improved partial-release recovery and idempotency by checking package-version state explicitly, validating existing NuGet.org artifacts with signature-aware package-content comparison, publishing only missing packages and accepting only tags that already point to the validated SHA.
• Made rollback non-destructive for package registries; partial registry publication is recovered through validation and publish-missing recovery instead of unlisting/deleting registry artifacts.
• Preserved OIDC Trusted Publishing and least-privilege permissions.
• Kept v3.0.0 and the already published Dapper.FluentMap/Dapper.FluentMap.Dommel 3.0.0 artifacts immutable.
• Prepared the repository for a coherent 3.0.1 release across the full package family.

Validation

Previous functional/release validation on d80c58ae4f7d377eb34c1a22f3f216fd1927fd53 completed successfully:

dotnet tool restore
dotnet tool run adr-guard check docs/adr
dotnet tool run adr-guard index docs/adr
python -m check_jsonschema --builtin-schema vendor.github-workflows .github/workflows/*.yml
./eng/validate-slnx-equivalence.ps1
dotnet restore ./Dapper.FluentMap.slnx
dotnet build ./Dapper.FluentMap.slnx --configuration Release --no-restore
dotnet test ./Dapper.FluentMap.slnx --configuration Release --no-build

• Tests: 478 total, 464 passed, 14 skipped, 0 failed.
• Pack validation produced 5 .nupkg and 3 .snupkg artifacts for the 3.0.1 validation set.
• NuGet presentation metadata, release-artifact manifest and consumer-smoke validation passed.
• CI, repository configuration, analyzer/generator compatibility, Dapper compatibility, Pack, SonarQube Cloud and CI Gate passed on that functional head.

The subsequent agent-only commit a22fa714253e96b17553edd33d8b1a5d5eeac5ab adds 18 skill/reference/notice files and updates only AGENTS.md; no runtime source, project, release workflow, package identity or release script is changed. CI was triggered for this head to revalidate the repository.

Package inspection

• Dapper.FluentMap.3.0.1.nupkg -> PackageId Dapper.FluentMap, assembly Dapper.FluentMap.dll.
• Dapper.FluentMap.Dommel.3.0.1.nupkg -> PackageId Dapper.FluentMap.Dommel, assembly Dapper.FluentMap.Dommel.dll.
• FluentMap.DependencyInjection.3.0.1.nupkg -> PackageId FluentMap.DependencyInjection, assembly Dapper.FluentMap.DependencyInjection.dll.
• FluentMap.Analyzers.3.0.1.nupkg -> PackageId FluentMap.Analyzers, analyzer assembly analyzers/dotnet/cs/Dapper.FluentMap.Analyzers.dll.
• FluentMap.Generators.3.0.1.nupkg -> PackageId FluentMap.Generators, analyzer assembly analyzers/dotnet/cs/Dapper.FluentMap.Generators.dll.

Codex review

• Requested Codex review on the PR.
• Addressed three P1 findings from the first Codex review in d80c58a.
• Re-requested Codex review for that functional head; the Codex connector returned a transient ref-resolution error even though GitHub reported the SHA as the PR head and required checks passed.

No package, tag, or GitHub Release was published by this PR.

Note: dotnet format ./Dapper.FluentMap.slnx --verify-no-changes --no-restore reports pre-existing whitespace/EOL/charset issues in benchmark/test/source files outside this PR's edited code path, so no unrelated formatting cleanup is included.

[rodri-oliveira-dev]

@codex please review this PR with special focus on:

• public API compatibility;
• PackageId vs assembly/namespace separation;
• package catalog correctness;
• release workflow correctness;
• recovery idempotency;
• NuGet publication safety;
• OIDC/permissions;
• tag immutability;
• CI/ADR Guard integration;
• stale package identity references.

Please prioritize correctness and release-safety findings over style-only suggestions.

[github-actions]

SonarQube Cloud success

The SonarQube Cloud Quality Gate passed for this PR.

Quality Gate status: OK

Metric	Status	Actual	Threshold
new_reliability_rating	OK	1	1
new_security_rating	OK	1	1
new_maintainability_rating	OK	1	1
new_duplicated_lines_density	OK	0.0	3
new_security_hotspots_reviewed	OK	100.0	100

• Open workflow run
• Open SonarQube Cloud dashboard

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a36fb15463

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[rodri-oliveira-dev]

@codex review

Please re-review the latest PR state after d80c58a, especially the fixes for:

• NuGet.org signed .nupkg validation;
• non-destructive release rollback and recovery idempotency;
• consumer smoke package-version parameterization;
• public API compatibility and PackageId vs assembly/namespace separation.

Prioritize correctness and release-safety findings over style-only suggestions.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Provided git ref d80c58ae4f7d377eb34c1a22f3f216fd1927fd53 does not exist

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[rodri-oliveira-dev]

@codex review

Retrying after confirming that d80c58ae4f7d377eb34c1a22f3f216fd1927fd53 is the current pushed PR head and all CI checks passed. Please review the latest state for release safety, PackageId identity separation, recovery idempotency, and public API compatibility.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Provided git ref d80c58ae4f7d377eb34c1a22f3f216fd1927fd53 does not exist

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".