Prepare the 0.10.0 release: NuGet, the MCP registry, and README figures

Three packages ship: Core (the extraction engine), Cli (the xaflogic tool) and
Mcp. Version 0.9.0 was the point the repository went public and never reached a
package feed, so everything since is gathered under 0.10.0.

The MCP server becomes installable on its own. It was a library the CLI hosted,
which meant the only way to get it was to install the whole CLI; it is now also a
dotnet tool carrying PackageType=McpServer and a .mcp/server.json manifest, so
`dnx XafLogicExplainer.Mcp` runs it and the MCP registry can list it. One
implementation, two ways in.

Module auto-discovery moved into the Mcp project, because both entry points need
it and neither can ask: a marketplace plugin declares `xaflogic mcp` with no
arguments, and an MCP client launching dnx is in the same position. Discovery is
what makes "install it and it works" true rather than aspirational.

Publishing uses NuGet Trusted Publishing -- OIDC at run time, no API key stored
anywhere. The release job refuses to push when the tag disagrees with the packed
version, when any package is missing its .snupkg, or when the MCP manifest's two
version fields have drifted from the tag. Each of those would otherwise fail
quietly: --skip-duplicate reports success on a version mismatch, absent symbols
surface months later when someone tries to step into the library, and a stale
manifest makes the registry advertise a version that does not exist.

The tests run against the test project rather than the solution, because the
solution carries the Blazor widget and its DevExpress reference cannot restore on
a public runner.

The site's three figures are now in the README as well. They are exported rather
than copied: inline in the page they inherit its tokens and its theme switch,
and a standalone file inherits nothing -- GitHub renders SVG through an <img>,
which cannot see the theme of the page framing it, so a copied figure would
arrive colourless and unsized. site/export-figures.py resolves the tokens for
each theme and adds the namespace, and <picture> lets GitHub choose. Generated,
so they cannot drift from the site.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: peopleworks

.github/workflows/nuget.yml

@@ -0,0 +1,107 @@
+# Publish XafLogicExplainer.Core (library), .Cli (dotnet tool) and .Mcp (dotnet tool + MCP server)
+# to NuGet.org.
+#
+# No API key is stored anywhere. This uses NuGet Trusted Publishing, which trades this workflow's
+# OIDC token for a short-lived key at run time. It needs a policy at
+# nuget.org -> Account -> Trusted Publishing:
+#
+#   Package Owner: peopleworksservices · Repository Owner: peopleworks
+#   Repository: XAFLogicExplainer · Workflow File: nuget.yml
+#
+# To ship a version: bump <Version> in Directory.Build.props and the two version fields in
+# src/XafLogicExplainer.Mcp/.mcp/server.json, merge, then publish a GitHub Release tagged
+# v<that version>. Tests must pass before anything is pushed.
+name: Publish NuGet
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write # required to obtain the OIDC token for trusted publishing
+
+jobs:
+  publish:
+    # Only v<version> tags mean "publish to NuGet". Any other release tag would be read as a
+    # package version, find nothing packed under that name, and fail — a red X on a release that
+    # did nothing wrong.
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref_name, 'v')
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+
+      # A broken build must never reach NuGet — published versions cannot be deleted.
+      #
+      # The test project is named rather than the solution: the solution carries the Blazor
+      # widget, whose DevExpress package reference cannot restore on a public runner. Building
+      # the tests pulls in Core and Mcp, which is everything being published bar the CLI.
+      - name: Test
+        run: dotnet test tests/XafLogicExplainer.Tests -c Release --nologo
+
+      - name: Pack
+        run: |
+          dotnet pack src/XafLogicExplainer.Core -c Release -o out
+          dotnet pack src/XafLogicExplainer.Cli  -c Release -o out
+          dotnet pack src/XafLogicExplainer.Mcp  -c Release -o out
+          ls -1 out/
+
+      - name: Check the release tag matches what we built
+        if: github.event_name == 'release'
+        run: |
+          want="${GITHUB_REF_NAME#v}"
+
+          # Guards the classic footgun: tagging v0.11.0 while Directory.Build.props still says
+          # 0.10.0. --skip-duplicate would swallow that silently and report success.
+          if ! ls out/*."$want".nupkg >/dev/null 2>&1; then
+            echo "::error::Release is tagged $GITHUB_REF_NAME, but nothing packed as version $want."
+            echo "Bump <Version> in Directory.Build.props to $want, or retag the release."
+            ls -1 out/
+            exit 1
+          fi
+
+          # Symbols are a .NET Foundation eligibility criterion, and a gap here would only surface
+          # months later when someone tries to step into the library. Every .nupkg must have its
+          # .snupkg beside it — that adjacency is also what makes the push pick it up.
+          for pkg in out/*."$want".nupkg; do
+            if [ ! -f "${pkg%.nupkg}.snupkg" ]; then
+              echo "::error::$pkg has no matching .snupkg — symbol publishing is broken."
+              echo "Check IncludeSymbols/SymbolPackageFormat in Directory.Build.props."
+              exit 1
+            fi
+          done
+
+          # The MCP manifest carries its own version twice and the MCP registry serves it to
+          # clients. If it drifts, the registry advertises a version that does not exist.
+          manifest="src/XafLogicExplainer.Mcp/.mcp/server.json"
+          server_version=$(jq -r '.version' "$manifest")
+          package_version=$(jq -r '.packages[0].version' "$manifest")
+          if [ "$server_version" != "$want" ] || [ "$package_version" != "$want" ]; then
+            echo "::error::$manifest says version=$server_version, packages[0].version=$package_version — expected $want."
+            exit 1
+          fi
+
+          echo "Tag $GITHUB_REF_NAME matches the packages and the MCP manifest."
+
+      - name: NuGet login (trusted publishing)
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: peopleworksservices
+
+      # The glob deliberately names only *.nupkg: the NuGet client pushes the matching .snupkg to
+      # the symbol server on its own whenever one sits beside the package. Adding *.snupkg here
+      # would push each symbol package twice.
+      - name: Push to NuGet
+        run: |
+          dotnet nuget push "out/*.nupkg" \
+            --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" \
+            --source https://api.nuget.org/v3/index.json \
+            --skip-duplicate

CHANGELOG.md

@@ -7,6 +7,19 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.10.0] — 2026-08-10
+
+First release published to NuGet. Version 0.9.0 was the point the repository went public; nothing
+was ever pushed to a package feed under it, so everything since is gathered here.
+
+Three packages: `XafLogicExplainer.Core` (the extraction engine),
+`XafLogicExplainer.Cli` (the `xaflogic` tool) and `XafLogicExplainer.Mcp`
+(an MCP server, installable on its own with `dnx`).
+
+Still 0.x deliberately. The extraction engine is production-proven, but this release changed its
+behaviour in six places and has been verified against one real application. 1.0.0 is earned once
+the extractor has read codebases we did not write.
+
 ### Added
 
 - **`xaflogic agents`** — writes `AGENTS.md`, `CLAUDE.md` and `.github/copilot-instructions.md`
@@ -112,11 +125,8 @@ documentation:
 
 ### Planned
 
-- MCP server, so any agent can query an XAF codebase live
-- Agent skill installable from this repository, alongside DevExpress's own `dx-xaf` plugin
 - AI provider abstraction (OpenAI, Azure OpenAI, Anthropic, Ollama) for `--enrich`
-- xUnit test suite over a synthetic XAF fixture that needs no DevExpress reference
-- Optional DevExpress ground-truth catalog, generated locally by licensees
+- Splitting the 1,500-line `Program.cs` into one file per command
 
 ## [0.9.0] — 2026-08-10
 
@@ -164,5 +174,6 @@ applications; this is the point where it becomes a community project.
 - `XafLogicExplainer.Core` references no DevExpress assemblies and needs no DevExpress license.
   Only the Blazor widget does.
 
-[Unreleased]: https://github.com/peopleworks/XAFLogicExplainer/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/peopleworks/XAFLogicExplainer/compare/v0.10.0...HEAD
+[0.10.0]: https://github.com/peopleworks/XAFLogicExplainer/releases/tag/v0.10.0
 [0.9.0]: https://github.com/peopleworks/XAFLogicExplainer/releases/tag/v0.9.0

Directory.Build.props

@@ -10,10 +10,11 @@
   -->
 
   <PropertyGroup>
-    <!-- One version for the whole repo. 0.9.x is deliberate: the extraction pipeline is
-         proven in production, but the agent-facing surface (MCP server, AGENTS.md sink)
-         is still landing. 1.0.0 is earned when those ship, not assumed. -->
-    <Version>0.9.0</Version>
+    <!-- One version for the whole repo, and the version the release tag must match.
+         Still 0.x deliberately: the extraction engine is production-proven, but this release
+         changed its behaviour in six places and has been verified against one real application.
+         1.0.0 is earned once the extractor has read codebases we did not write. -->
+    <Version>0.10.0</Version>
 
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
@@ -37,6 +38,7 @@
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
     <PackageProjectUrl>https://github.com/peopleworks/XAFLogicExplainer</PackageProjectUrl>
     <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PackageIcon>icon.png</PackageIcon>
     <PackageTags>xaf;devexpress;expressapp;roslyn;documentation;mcp;ai-agents;xpo;efcore;xafml</PackageTags>
     <PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance>
   </PropertyGroup>
@@ -66,9 +68,11 @@
     <SymbolPackageFormat>snupkg</SymbolPackageFormat>
   </PropertyGroup>
 
-  <!-- The README is packed into every NuGet package, so each one needs it at its own root. -->
+  <!-- The README and icon are packed into every NuGet package, so each one needs them at its own
+       root. Declared once here rather than repeated in three csproj files that would drift. -->
   <ItemGroup Condition="'$(IsPackable)' != 'false'">
     <None Include="$(MSBuildThisFileDirectory)README.md" Pack="true" PackagePath="\" Visible="false" />
+    <None Include="$(MSBuildThisFileDirectory)assets\icon.png" Pack="true" PackagePath="\" Visible="false" />
   </ItemGroup>
 
 </Project>

README.md

@@ -2,6 +2,9 @@
 
 [![CI](https://github.com/peopleworks/XAFLogicExplainer/actions/workflows/ci.yml/badge.svg)](https://github.com/peopleworks/XAFLogicExplainer/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/github/license/peopleworks/XAFLogicExplainer?color=blue)](LICENSE)
+[![NuGet CLI](https://img.shields.io/nuget/v/XafLogicExplainer.Cli?logo=nuget&label=CLI)](https://www.nuget.org/packages/XafLogicExplainer.Cli)
+[![NuGet Core](https://img.shields.io/nuget/v/XafLogicExplainer.Core?logo=nuget&label=Core)](https://www.nuget.org/packages/XafLogicExplainer.Core)
+[![NuGet MCP](https://img.shields.io/nuget/v/XafLogicExplainer.Mcp?logo=nuget&label=MCP%20server)](https://www.nuget.org/packages/XafLogicExplainer.Mcp)
 [![.NET 10](https://img.shields.io/badge/.NET-10-512BD4?logo=dotnet&logoColor=white)](https://dotnet.microsoft.com/)
 [![MCP](https://img.shields.io/badge/MCP-server-000000?logo=modelcontextprotocol&logoColor=white)](https://modelcontextprotocol.io/)
 [![XAF](https://img.shields.io/badge/DevExpress-XAF-FF7200?logo=devexpress&logoColor=white)](https://www.devexpress.com/products/net/application_framework/)
@@ -22,6 +25,11 @@ whatever agent you code with.
 DevExpress has done excellent work making AI agents fluent in XAF. Two pieces already exist,
 and this is the third:
 
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/how-it-fits-dark.svg">
+  <img alt="Three kinds of knowledge an agent needs about an XAF codebase. Two are already solved by DevExpress tooling; the third — what your own application does — is the gap this project fills." src="docs/assets/how-it-fits-light.svg">
+</picture>
+
 | Teaches the agent… | Tool |
 | --- | --- |
 | How XAF works in general | [DevExpress `agent-skills`](https://github.com/DevExpress/agent-skills) |
@@ -40,6 +48,11 @@ for the official reference, and use this for your own codebase. None of them rep
 
 ## What it extracts
 
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/extraction-pipeline-dark.svg">
+  <img alt="Source files are parsed as syntax by Roslyn, never compiled, producing a model rendered to agent files, an MCP server, or Markdown and JSON." src="docs/assets/extraction-pipeline-light.svg">
+</picture>
+
 Everything below is read as **syntax**, using Roslyn. Your project never has to compile, and this
 tool never links against DevExpress assemblies:
 
@@ -71,6 +84,12 @@ No account, no API key, no server. Your agent understands the application on its
 forever. Dumping 70 KB of entity detail there would crowd out the actual question. So the output is
 tiered:
 
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/two-tier-context-dark.svg">
+  <img alt="What a full documentation dump costs an agent's context on every request, against the tiered output that leaves that room free." src="docs/assets/two-tier-context-light.svg">
+</picture>
+
+
 | | | |
 | --- | --- | --- |
 | `AGENTS.md` | ~11 KB | Always loaded: ground rules, complete inventories, conventions, recipes |
@@ -94,17 +113,24 @@ application while you work on it, and cannot go stale.
 /plugin install xaf-logic-explainer@peopleworks-xaf
 ```
 
-That installs a skill and an MCP server in one step. For any other MCP client, add:
+That installs a skill and an MCP server in one step. For any other MCP client, either run it
+straight from NuGet with no install:
 
 ```json
 {
   "mcpServers": {
-    "xaf": { "command": "xaflogic", "args": ["mcp"] }
+    "xaf": { "command": "dnx", "args": ["XafLogicExplainer.Mcp", "--yes"] }
   }
 }
 ```
 
-Started from a solution directory it finds the XAF module by itself.
+…or point at the CLI if you already have it:
+
+```json
+{ "mcpServers": { "xaf": { "command": "xaflogic", "args": ["mcp"] } } }
+```
+
+Started from a solution directory it finds the XAF module by itself, so neither form needs a path.
 
 | Tool | Answers |
 | --- | --- |