Andes-Software-Solutions · RorroRojas3 · Sep 3, 2026 · Aug 23, 2026 · Sep 3, 2026
@@ -46,7 +46,7 @@ Privacy invariant: progress events and reports never carry prompt content, tool
 - Events and logs must never carry prompt content, tool arguments, or tool results. Tool-argument capture exists only behind `ToolTrackingOptions.IncludeToolArguments` (default `false`).
 - Public API changes require XML docs (missing docs fail the build) and a matching update under `docs\`.
 - Packaging metadata lives in each package's csproj; `dotnet pack -c Release` must produce the nupkg + snupkg with the README embedded (root README for core, each satellite's own `README.md` for the satellites).
-- The four packages version in **lockstep** (all `0.8.0` today); each satellite's `ProjectReference` to core becomes a `>= {version}` NuGet dependency automatically.
+- The four packages version in **lockstep** (all `0.9.0` today); each satellite's `ProjectReference` to core becomes a `>= {version}` NuGet dependency automatically.
 
 ## C# coding standards (always)
 

@@ -1,7 +1,29 @@
-# Keeps the SHA-pinned actions in .github/workflows up to date via reviewable PRs.
+# Keeps the SHA-pinned actions in .github/workflows and the NuGet pins in
+# Directory.Packages.props up to date via reviewable PRs.
 version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+
+  # NuGet pins live in Directory.Packages.props (central package management);
+  # Dependabot's NuGet updater edits the <PackageVersion> rows there.
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      nuget-stable:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # Majors are reviewed by hand (floor changes need a lockstep bump + release notes).
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+      # Capped by Microsoft.Extensions.AI.OpenAI's [2.12.0, 2.13.0) range; patches still flow.
+      - dependency-name: "OpenAI"
+        update-types: ["version-update:semver-minor", "version-update:semver-major"]
@@ -4,7 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <RootNamespace>Andes.Extensions.AI</RootNamespace>
     <PackageId>Andes.Extensions.AI.Agent</PackageId>
-    <Version>0.8.0</Version>
+    <Version>0.9.0</Version>
     <Authors>Rodrigo Rojas</Authors>
     <Description>Microsoft Agent Framework support for Andes.Extensions.AI tool tracking: classifies agents exposed as function tools as agent tools ("Calling {Agent} Agent"), attributes each agent run's token usage to the calling tool's scope, and optionally reports the agent's own function invocations as progress statuses.</Description>
     <PackageTags>AI;IChatClient;Microsoft.Extensions.AI;AgentFramework;Microsoft.Agents.AI;agents;middleware;progress;tools</PackageTags>

@@ -4,7 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <RootNamespace>Andes.Extensions.AI</RootNamespace>
     <PackageId>Andes.Extensions.AI.Mcp</PackageId>
-    <Version>0.8.0</Version>
+    <Version>0.9.0</Version>
     <Authors>Rodrigo Rojas</Authors>
     <Description>Model Context Protocol (MCP) support for Andes.Extensions.AI tool tracking: classifies McpClientTool instances as MCP tools ("Calling {Server} MCP") and bridges MCP progress notifications into chat progress updates with numeric progress values.</Description>
     <PackageTags>AI;IChatClient;Microsoft.Extensions.AI;MCP;ModelContextProtocol;middleware;progress;tools</PackageTags>

@@ -4,7 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <RootNamespace>Andes.Extensions.AI</RootNamespace>
     <PackageId>Andes.Extensions.AI.UI</PackageId>
-    <Version>0.8.0</Version>
+    <Version>0.9.0</Version>
     <Authors>Rodrigo Rojas</Authors>
     <Description>UI status contract for Andes.Extensions.AI tool tracking: serializable records (and a matching TypeScript interface) that project the tracked chat stream into an assistant-activity hierarchy — the assistant's own functions, MCP tools, and agents, each with sub-statuses, nested children, and token usage — for rendering live progress in Blazor, a console, or any TypeScript SPA.</Description>
     <PackageTags>AI;IChatClient;Microsoft.Extensions.AI;UI;Blazor;TypeScript;progress;streaming;middleware;tools</PackageTags>

@@ -4,7 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <RootNamespace>Andes.Extensions.AI</RootNamespace>
     <PackageId>Andes.Extensions.AI</PackageId>
-    <Version>0.8.0</Version>
+    <Version>0.9.0</Version>
     <Authors>Rodrigo Rojas</Authors>
     <Description>Middleware extensions for Microsoft.Extensions.AI: per-request and per-tool token usage tracking, and streaming status/progress propagation for IChatClient pipelines.</Description>
     <PackageTags>AI;IChatClient;Microsoft.Extensions.AI;middleware;tokens;usage;streaming;progress;tools</PackageTags>

@@ -8,7 +8,7 @@
   <ItemGroup>
     <PackageVersion Include="Azure.AI.OpenAI" Version="2.1.0" />
     <PackageVersion Include="coverlet.collector" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Agents.AI" Version="1.17.0" />
+    <PackageVersion Include="Microsoft.Agents.AI" Version="1.20.0" />
     <PackageVersion Include="Microsoft.Extensions.AI" Version="10.9.0" />
     <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="10.9.0" />
     <PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="10.9.0" />
@@ -18,11 +18,14 @@
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
     <PackageVersion Include="ModelContextProtocol" Version="2.2.0" />
     <PackageVersion Include="ModelContextProtocol.Core" Version="2.2.0" />
+    <!-- OpenAI is capped by Microsoft.Extensions.AI.OpenAI 10.9.0, whose nuspec declares OpenAI [2.12.0, 2.13.0).
+         Pinning 2.13.0 or later raises NU1608, which TreatWarningsAsErrors turns into a restore failure.
+         Bump OpenAI only together with a Microsoft.Extensions.AI.OpenAI release whose range admits it. -->
     <PackageVersion Include="OpenAI" Version="2.12.0" />
     <PackageVersion Include="Spectre.Console" Version="0.57.2" />
     <PackageVersion Include="xunit" Version="2.9.3" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.0" />
-    <PackageVersion Include="Xunit.SkippableFact" Version="1.5.61" />
+    <PackageVersion Include="Xunit.SkippableFact" Version="1.5.85" />
   </ItemGroup>
 
 </Project>
@@ -18,7 +18,7 @@ This guide covers installation, how classification and usage capture work, the d
 dotnet add package Andes.Extensions.AI.Agent
 ```
 
-Installing the package brings in the core `Andes.Extensions.AI` package (>= 0.6.0) and [`Microsoft.Agents.AI`](https://www.nuget.org/packages/Microsoft.Agents.AI) (>= 1.17.0, stable).
+Installing the package brings in the core `Andes.Extensions.AI` package (>= 0.9.0) and [`Microsoft.Agents.AI`](https://www.nuget.org/packages/Microsoft.Agents.AI) (>= 1.20.0, stable).
 
 ## Quickstart
 

@@ -16,7 +16,7 @@ This guide covers installation, how classification and the progress bridge work,
 dotnet add package Andes.Extensions.AI.Mcp
 ```
 
-Installing the package brings in the core `Andes.Extensions.AI` package (>= 0.6.0) and [`ModelContextProtocol.Core`](https://www.nuget.org/packages/ModelContextProtocol.Core) (>= 2.2.0). Apps that build MCP clients or servers with the full `ModelContextProtocol` package are unaffected — the satellite only needs the Core types.
+Installing the package brings in the core `Andes.Extensions.AI` package (>= 0.9.0) and [`ModelContextProtocol.Core`](https://www.nuget.org/packages/ModelContextProtocol.Core) (>= 2.2.0). Apps that build MCP clients or servers with the full `ModelContextProtocol` package are unaffected — the satellite only needs the Core types.
 
 ## Quickstart
 

@@ -16,7 +16,7 @@ This guide covers installation, the two DTO layers, the mapper and reducer, the
 dotnet add package Andes.Extensions.AI.UI
 ```
 
-Installing the package brings in the core `Andes.Extensions.AI` package (>= 0.8.0) and `Microsoft.Extensions.AI.Abstractions` — nothing else. The package does not reference the [MCP](mcp.md) or [Agent](agents.md) satellites; it doesn't need to, because `ToolKind` (the `Unknown`/`Function`/`McpTool`/`Agent` badge every activity carries) already lives in core, shared by every satellite.
+Installing the package brings in the core `Andes.Extensions.AI` package (>= 0.9.0) and `Microsoft.Extensions.AI.Abstractions` — nothing else. The package does not reference the [MCP](mcp.md) or [Agent](agents.md) satellites; it doesn't need to, because `ToolKind` (the `Unknown`/`Function`/`McpTool`/`Agent` badge every activity carries) already lives in core, shared by every satellite.
 
 ## Quickstart
 

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.302",
+    "version": "10.0.400",
     "rollForward": "latestFeature"
   }
 }
@@ -0,0 +1,22 @@
+# 0.9.0
+
+**Tag:** `v0.9.0` · **Date:** 2026-09-03
+
+All changes since [`v0.8.0`](v0.8.0.md).
+
+Every NuGet pin was checked against nuget.org on 2026-09-02 and the ones that could move to a newer stable version did: the Agent satellite's floor rises to `Microsoft.Agents.AI` 1.20.0, the three integration-test projects pick up `Xunit.SkippableFact` 1.5.85, `global.json` and a new weekly `nuget` Dependabot lane keep the SDK and future pin reviews current, and `OpenAI` deliberately stays put with the reason now documented in the props file — no source changed, no public API changed, and all four packages ship at 0.9.0 in lockstep with the satellites depending on core `>= 0.9.0`.
+
+## Changed
+
+- **`Microsoft.Agents.AI` 1.17.0 → 1.20.0** (`Directory.Packages.props`): the Agent satellite's new floor — the packed nuspec will read `Microsoft.Agents.AI >= 1.20.0`. The 1.17.0 → 1.19.0 step already landed in commit `1292ed1` ("chore: Update Microsoft.Agents.AI to version 1.19.0 and bump SDK version to 10.0.400", 2026-08-23, the only commit since tag `v0.8.0`); 1.19.0 → 1.20.0 lands in this release. The upstream `dotnet-1.20.0` release (published 2026-08-31) lists no breaking changes and no changes to the abstractions the satellite uses (`DelegatingAIAgent.RunCoreAsync`/`RunCoreStreamingAsync`, `AIAgentBuilder.Use(...)` function-invocation middleware, `AsAIFunction(...)`), and it still depends on `Microsoft.Extensions.AI >= 10.9.0` — this repo's existing pin. Two transitive floors move indirectly as a result (not pinned by this repo): `Microsoft.Extensions.FileSystemGlobbing` 10.0.6 → 10.0.11 and `Microsoft.Extensions.VectorData.Abstractions` 10.7.0 → 10.8.2.
+- **`Xunit.SkippableFact` 1.5.61 → 1.5.85** (`Directory.Packages.props`): referenced only by the three integration-test projects; nothing shipped references it. Upstream 1.5.85 (2026-08-24) adds package code signing and preserves test output for dynamically skipped tests — no API change, since the tests use only `[SkippableFact]`, `Skip.If`, and `Skip.IfNot`.
+- **`OpenAI` deliberately stays at 2.12.0**, although 2.13.0 (2026-08-10) is on nuget.org: `Microsoft.Extensions.AI.OpenAI` 10.9.0's nuspec declares `OpenAI [2.12.0, 2.13.0)`, and no newer `Microsoft.Extensions.AI.OpenAI` exists yet, so pinning 2.13.0 raises NU1608 — which `TreatWarningsAsErrors` turns into a restore failure. The cap is now documented in an XML comment above the pin in `Directory.Packages.props`. The pin is consumed only by the Responses sample and the core integration-test project; nothing shipped references it.
+- **Every other pin was already the latest stable and is unchanged**: `Microsoft.Extensions.AI` / `.Abstractions` / `.OpenAI` 10.9.0, `ModelContextProtocol` / `.Core` 2.2.0, `Microsoft.Extensions.Configuration.Binder` / `.Json` / `Microsoft.Extensions.Hosting` 10.0.11 (11.0 is preview-only), `Azure.AI.OpenAI` 2.1.0 (2.9.0-beta.1 is prerelease), `Spectre.Console` 0.57.2, `xunit` 2.9.3, `xunit.runner.visualstudio` 4.0.0, `Microsoft.NET.Test.Sdk` 18.9.0, `coverlet.collector` 10.0.1. `xunit.v3` 4.0.0 is a different package id requiring a test-suite migration and is deferred to a later release.
+- **`global.json`**: SDK `10.0.302` → **`10.0.400`** (commit `1292ed1`; `rollForward: latestFeature` unchanged), the current .NET 10 SDK band per the .NET releases index.
+- **New weekly `nuget` ecosystem entry in `.github/dependabot.yml`** (the existing `github-actions` entry is unchanged): Dependabot's NuGet updater edits the `<PackageVersion>` rows in `Directory.Packages.props` directly, since the repo uses central package management. Minor and patch updates are grouped into a single PR under the `nuget-stable` group; semver-major updates are ignored across the board so a floor change stays a deliberate, hand-reviewed lockstep bump with release notes; `OpenAI` additionally ignores minor updates (on top of the blanket major ignore) to respect the `Microsoft.Extensions.AI.OpenAI` cap above, while its patch updates still flow through.
+- **Docs updated to the actual floors**: [`docs/agents.md`](../docs/agents.md) now states core `>= 0.9.0` and `Microsoft.Agents.AI >= 1.20.0` (previously `>= 0.6.0` / `>= 1.17.0`); [`docs/mcp.md`](../docs/mcp.md) now states core `>= 0.9.0` (previously `>= 0.6.0`); [`docs/ui.md`](../docs/ui.md) now states core `>= 0.9.0` (previously `>= 0.8.0`). `.claude/CLAUDE.md` project memory now says the four packages are at 0.9.0.
+- **All four packages version in lockstep at 0.9.0; the satellites depend on core `>= 0.9.0`.** No public API changes, no code changes.
+
+## Verification
+
+No new tests — nothing in the shipped code changed. The release was verified the way `nuget.yml` builds it. `dotnet restore` is clean (no NU1608 or other NuGet diagnostics), and a before/after diff of `dotnet list package --include-transitive` shows only the expected moves — `Microsoft.Agents.AI` and `Microsoft.Agents.AI.Abstractions` 1.19.0 → 1.20.0, `Xunit.SkippableFact` 1.5.61 → 1.5.85, and the two indirect floors noted above — while `dotnet list package --outdated` lists nothing but the deliberately held `OpenAI` 2.13.0. `dotnet build --configuration Release` succeeds with warnings as errors (the 1.20.0 bump surfaced no obsoletions or analyzer diagnostics), and `dotnet format --verify-no-changes` reports nothing. `dotnet test --configuration Release --no-build` passed 172 of 172 with 0 skipped: 162 unit tests (core 82, UI 31, Agent 28, MCP 21) and 10 Azure OpenAI integration tests run for real against the configured deployments (core 5, including the Responses API reasoning test; MCP 2; Agent 3 — the end-to-end validation of the 1.20.0 bump). `dotnet pack` of the four projects produced a 0.9.0 `.nupkg` and `.snupkg` for each; the nuspecs inside carry version 0.9.0, `readme=README.md`, `icon=icon.png` (the UI package also ships `typescript/andes-assistant-ui.ts`), and the expected floors: core → `Microsoft.Extensions.AI >= 10.9.0`; Mcp → core `>= 0.9.0` and `ModelContextProtocol.Core >= 2.2.0`; Agent → core `>= 0.9.0` and `Microsoft.Agents.AI >= 1.20.0`; UI → core `>= 0.9.0` and `Microsoft.Extensions.AI.Abstractions >= 10.9.0`.