More fixes

.codex/skills/dotnet-microsoft-agent-framework/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: dotnet-microsoft-agent-framework
+version: "1.4.0"
+category: "AI"
+description: "Build .NET AI agents and multi-agent workflows with Microsoft Agent Framework using the right agent type, threads, tools, workflows, hosting protocols, and enterprise guardrails."
+compatibility: "Requires preview-era Microsoft Agent Framework packages and a .NET application that truly needs agentic or workflow orchestration."
+---
+
+# Microsoft Agent Framework
+
+## Trigger On
+
+- building or reviewing `.NET` code that uses `Microsoft.Agents.*`, `Microsoft.Extensions.AI`, `AIAgent`, `AgentThread`, or Agent Framework hosting packages
+- choosing between `ChatClientAgent`, Responses agents, hosted agents, custom agents, workflows, or durable agents
+- adding tools, MCP, A2A, OpenAI-compatible hosting, AG-UI, DevUI, background responses, or OpenTelemetry
+- migrating from Semantic Kernel agent APIs or aligning AutoGen-style multi-agent patterns to Agent Framework
+
+## Workflow
+
+1. Decide whether the problem should stay deterministic. If plain code or a typed workflow without LLM autonomy is enough, do that instead of adding an agent.
+2. Choose the execution shape first: single `AIAgent`, explicit `Workflow`, Azure Functions durable agent, ASP.NET Core hosted agent, AG-UI remote UI, or DevUI local debugging.
+3. Choose the agent type and provider intentionally. Prefer the simplest agent that satisfies the threading, tooling, and hosting requirements.
+4. Keep agents stateless and keep conversation or long-lived state in `AgentThread`. Treat serialized threads as opaque provider-specific state.
+5. Add only the tools and middleware that the scenario needs. Narrow the tool surface, require approval for side effects, and treat MCP, A2A, and third-party services as trust boundaries.
+6. For workflows, model executors, edges, request-response ports, checkpoints, shared state, and human-in-the-loop explicitly rather than hiding control flow in prompts.
+7. Prefer Responses-based protocols for new remote/OpenAI-compatible integrations unless you specifically need Chat Completions compatibility.
+8. Use durable agents only when you truly need Azure Functions serverless hosting, durable thread storage, or deterministic long-running orchestrations.
+9. Verify preview status, package maturity, docs recency, and provider-specific limitations before locking a production architecture.
+
+## Architecture
+
+```mermaid
+flowchart LR
+  A["Task"] --> B{"Deterministic code is enough?"}
+  B -->|Yes| C["Write normal .NET code or a plain workflow"]
+  B -->|No| D{"One dynamic decision-maker is enough?"}
+  D -->|Yes| E["Use an `AIAgent` / `ChatClientAgent`"]
+  D -->|No| F["Use a typed `Workflow`"]
+  F --> G{"Needs durable Azure hosting or week-long execution?"}
+  G -->|Yes| H["Use durable agents on Azure Functions"]
+  G -->|No| I["Use in-process workflows"]
+  E --> J{"Need a remote protocol or UI?"}
+  F --> J
+  J -->|OpenAI-compatible HTTP| K["ASP.NET Core Hosting.OpenAI"]
+  J -->|Agent-to-agent protocol| L["A2A hosting"]
+  J -->|Web UI protocol| M["AG-UI"]
+  J -->|Local debug shell| N["DevUI (dev only)"]
+```
+
+## Core Knowledge
+
+- `AIAgent` is the common runtime abstraction. It should stay mostly stateless.
+- `AgentThread` holds conversation identity and long-lived interaction state. Treat serialized thread payloads as opaque provider-owned data.
+- `AgentResponse` and `AgentResponseUpdate` are not just text containers. They can include tool calls, tool results, structured output, reasoning-like updates, and response metadata.
+- `ChatClientAgent` is the safest default when you already have an `IChatClient` and do not need a hosted-agent service.
+- `Workflow` is an explicit graph of executors and edges. Use it when the control flow must stay inspectable, typed, resumable, or human-steerable.
+- Hosting layers such as OpenAI-compatible HTTP, A2A, and AG-UI are adapters over your in-process agent or workflow. They do not replace the core architecture choice.
+- Durable agents are a hosting and persistence decision for Azure Functions. They are not the default answer for ordinary app-level orchestration.
+
+## Decision Cheatsheet
+
+| If you need | Default choice | Why |
+|---|---|---|
+| One model-backed assistant with normal .NET composition | `ChatClientAgent` or `chatClient.AsAIAgent(...)` | Lowest friction, middleware-friendly, works with `IChatClient` |
+| OpenAI-style future-facing APIs, background responses, or richer response state | Responses-based agent | Better fit for new OpenAI-compatible integrations |
+| Simple client-managed chat history | Chat Completions agent | Keeps request/response simple |
+| Service-hosted agents and service-owned threads/tools | Azure AI Foundry Agent or other hosted agent | Managed runtime is the requirement |
+| Typed multi-step orchestration | `Workflow` | Control flow stays explicit and testable |
+| Week-long or failure-resilient Azure execution | Durable agent on Azure Functions | Durable Task gives replay and persisted state |
+| Agent-to-agent interoperability | A2A hosting or A2A proxy agent | This is protocol-level delegation, not local inference |
+| Browser or web UI protocol integration | AG-UI | Designed for remote UI sync and approval flows |
+
+## Common Failure Modes
+
+- Adding an agent where deterministic code or a plain typed workflow would be clearer and cheaper.
+- Assuming agent instance fields are the durable source of truth instead of storing real state in `AgentThread`, stores, or workflow state.
+- Picking Chat Completions when the scenario really needs Responses features such as background execution or service-backed response chains.
+- Treating hosted-agent services and local `IChatClient` agents as if they share the same thread and tool guarantees.
+- Hiding orchestration inside prompts instead of modeling executors, edges, requests, checkpoints, and HITL explicitly.
+- Exposing too many tools at once, especially side-effecting tools without approvals, middleware checks, or clear trust boundaries.
+- Treating DevUI as a production UI surface instead of a development and debugging tool.
+
+## Deliver
+
+- a justified architecture choice: agent vs workflow vs durable orchestration
+- the concrete .NET agent type, provider, and package set
+- an explicit thread, tool, middleware, and observability strategy
+- hosting and protocol decisions for OpenAI-compatible APIs, A2A, AG-UI, or Azure Functions
+- migration notes when replacing Semantic Kernel agent APIs or AutoGen-style orchestration
+
+## Validate
+
+- the scenario really needs agentic behavior and is not better served by deterministic code
+- the selected agent type matches the provider, thread model, and tool model
+- `AgentThread` lifecycle, serialization, and compatibility boundaries are explicit
+- tool approval, MCP headers, and third-party trust boundaries are handled safely
+- workflows define checkpoints, request-response, shared state, and HITL paths deliberately
+- DevUI is treated as a development sample, not a production surface
+- docs or packages marked preview are called out, and Python-only docs are not mistaken for guaranteed .NET APIs
+
+When a decision depends on exact wording, long-tail feature coverage, or a less-common integration, check the local official docs snapshot before relying on summaries.
+
+## References
+
+- [official-docs-index.md](references/official-docs-index.md) - Slim local Microsoft Learn snapshot map with direct links to every mirrored page, live-only support pages, and API-reference pointers
+- [patterns.md](references/patterns.md) - Architecture routing, agent types, provider and thread model selection, and durable-agent guidance
+- [providers.md](references/providers.md) - Provider, SDK, endpoint, package, and Responses-vs-ChatCompletions selection
+- [tools.md](references/tools.md) - Function tools, hosted tools, tool approval, agent-as-tool, and service limitations
+- [sessions.md](references/sessions.md) - `AgentThread`, chat history storage, reducers, context providers, and thread serialization
+- [middleware.md](references/middleware.md) - Agent, function-calling, and `IChatClient` middleware with guardrail patterns
+- [workflows.md](references/workflows.md) - Executors, edges, requests and responses, checkpoints, orchestrations, and declarative workflow notes
+- [mcp.md](references/mcp.md) - MCP integration, agent-as-MCP, security rules, and MCP-vs-A2A guidance
+- [hosting.md](references/hosting.md) - ASP.NET Core hosting, OpenAI-compatible APIs, A2A, AG-UI, Azure Functions, and Purview integration
+- [devui.md](references/devui.md) - DevUI capabilities, modes, auth, tracing, and safe usage boundaries
+- [migration.md](references/migration.md) - Semantic Kernel and AutoGen migration notes, concept mapping, and breaking-model shifts
+- [support.md](references/support.md) - Preview status, official support channels, and recurring troubleshooting checks
+- [examples.md](references/examples.md) - Quick-start and tutorial recipe index covering the official docs set

.codex/skills/dotnet-microsoft-agent-framework/agents/agent-framework-router/AGENT.md

@@ -0,0 +1,76 @@
+---
+name: agent-framework-router
+description: Microsoft Agent Framework routing agent for agent-vs-workflow decisions, agent types, AgentThread state, tools, workflows, hosting protocols, durable agents, and migration from Semantic Kernel or AutoGen. Use when the repo is already clearly on Microsoft Agent Framework and the remaining ambiguity is inside framework-specific design choices.
+tools: Read, Edit, Glob, Grep, Bash
+model: inherit
+skills:
+  - dotnet-microsoft-agent-framework
+  - dotnet-microsoft-extensions-ai
+  - dotnet-mcp
+  - dotnet-azure-functions
+  - dotnet-aspnet-core
+  - dotnet-semantic-kernel
+---
+
+# Microsoft Agent Framework Router
+
+## Role
+
+Act as a narrow Microsoft Agent Framework companion agent for repos that are already clearly on `Microsoft.Agents.*`. Triage the dominant framework concern first, then route into the right skill guidance without drifting back into broad generic `.NET` or generic AI routing.
+
+This is a skill-scoped agent. It lives under `skills/dotnet-microsoft-agent-framework/` because it only makes sense next to framework-specific implementation guidance and the local docs snapshot for Agent Framework.
+
+## Trigger On
+
+- the repo already references `Microsoft.Agents.*`, `AIAgent`, `AgentThread`, `Microsoft.Agents.AI.Workflows`, or Agent Framework hosting packages
+- the task is primarily about agent-vs-workflow choice, provider selection, thread/state handling, tools, middleware, hosting, AG-UI, A2A, DevUI, or durable-agent execution
+- the ambiguity is inside Microsoft Agent Framework design choices rather than across unrelated `.NET` stacks
+
+## Workflow
+
+1. Confirm the repo is truly using Microsoft Agent Framework and identify the current runtime shape: local `IChatClient` agent, hosted agent service, explicit workflow, ASP.NET Core hosting, or Azure Functions durable hosting.
+2. Classify the dominant framework concern:
+   - architecture choice: deterministic code vs agent vs workflow
+   - provider and agent type selection
+   - `AgentThread`, chat history, and state boundaries
+   - tools, middleware, approvals, and MCP
+   - workflows, checkpoints, request-response, and HITL
+   - hosting, protocol adapters, and remote interoperability
+   - migration from Semantic Kernel or AutoGen
+3. Route to `dotnet-microsoft-agent-framework` as the main implementation skill.
+4. Pull in adjacent skills only when the problem crosses a clear boundary:
+   - `dotnet-microsoft-extensions-ai` for `IChatClient` composition and provider abstractions
+   - `dotnet-mcp` for MCP client/server boundaries and tool exposure
+   - `dotnet-azure-functions` for durable-agent hosting and Azure Functions runtime concerns
+   - `dotnet-aspnet-core` for ASP.NET Core hosting integration and HTTP surface design
+   - `dotnet-semantic-kernel` when the main task is migration, coexistence, or framework replacement
+5. End with the validation surface that matters for the chosen concern: thread persistence, tool approval safety, workflow checkpoints, hosting protocol behavior, or migration parity.
+
+## Routing Map
+
+| Signal | Route |
+|-------|-------|
+| `AIAgent` vs `Workflow`, agent count, orchestration shape | `dotnet-microsoft-agent-framework` |
+| `AgentThread`, chat history stores, serialized sessions, reducers, context providers | `dotnet-microsoft-agent-framework` |
+| Function tools, tool approvals, agent-as-tool, hosted tools | `dotnet-microsoft-agent-framework` |
+| MCP tools, MCP trust boundaries, exposing agents through MCP | `dotnet-microsoft-agent-framework` + `dotnet-mcp` |
+| `IChatClient`, provider abstraction, OpenAI vs Azure OpenAI vs local chat clients | `dotnet-microsoft-agent-framework` + `dotnet-microsoft-extensions-ai` |
+| Workflows, executors, edges, checkpoints, request-response, HITL | `dotnet-microsoft-agent-framework` |
+| ASP.NET Core hosting, OpenAI-compatible HTTP APIs, A2A, AG-UI | `dotnet-microsoft-agent-framework` + `dotnet-aspnet-core` |
+| Durable agents, Azure Functions orchestration, replay-safe design | `dotnet-microsoft-agent-framework` + `dotnet-azure-functions` |
+| Semantic Kernel migration or coexistence | `dotnet-microsoft-agent-framework` + `dotnet-semantic-kernel` |
+
+## Deliver
+
+- confirmed Microsoft Agent Framework runtime shape
+- dominant framework concern classification
+- primary skill path and any necessary adjacent skills
+- main risk area such as wrong agent type, weak thread model, hidden orchestration, unsafe tool surface, protocol mismatch, or migration drift
+- validation checklist aligned to the chosen path
+
+## Boundaries
+
+- Do not act as a broad AI router when the work is no longer Microsoft Agent Framework-centric.
+- Do not default to agents when deterministic code or a typed workflow is clearly the better fit.
+- Do not assume hosted agents, local `IChatClient` agents, and durable agents share the same thread, tool, or state guarantees.
+- Do not replace the detailed implementation guidance that belongs in `skills/dotnet-microsoft-agent-framework/SKILL.md`.

.codex/skills/dotnet-microsoft-agent-framework/references/devui.md

@@ -0,0 +1,63 @@
+# DevUI
+
+## What DevUI Actually Is
+
+DevUI is a sample app for development-time testing of agents and workflows.
+
+It gives you:
+
+- a local web UI
+- an OpenAI-compatible local API surface
+- trace viewing
+- directory discovery for sample entities
+- a quick way to exercise inputs without building your real frontend
+
+It is not a production hosting surface.
+
+## `.NET` Caveat
+
+The current docs are explicit that `.NET` DevUI documentation is still limited and mostly "coming soon", while Python has the richer published guidance.
+
+So for `.NET` work:
+
+- treat DevUI docs as conceptual guidance
+- do not invent `.NET` APIs that the docs do not actually publish
+- do not anchor production architecture on DevUI behavior
+
+## Good Uses
+
+- smoke-testing prompts and tools locally
+- checking whether a workflow input shape is usable
+- tracing runs during early development
+- trying sample entities before you wire real hosting
+
+## Bad Uses
+
+- production chat surfaces
+- public internet endpoints
+- security boundaries
+- long-lived integration contracts
+
+## DevUI Versus Real Hosting
+
+| Need | Use DevUI? | Real Answer |
+| --- | --- | --- |
+| Local debugging | Yes | DevUI is good here |
+| Human-facing production UI | No | AG-UI or your own app |
+| OpenAI-compatible production endpoint | No | Hosting.OpenAI |
+| Agent-to-agent interoperability | No | A2A |
+| Secure public service boundary | No | ASP.NET Core hosting with your own auth and policies |
+
+## Safe Usage Rules
+
+- Keep it on localhost by default.
+- If you expose it to a network, add auth and still treat it as non-production.
+- Be careful with side-effecting tools even in local demos.
+- Do not mistake "it works in DevUI" for "the production contract is done".
+
+## Source Pages
+
+- `references/official-docs/user-guide/devui/index.md`
+- `references/official-docs/user-guide/devui/security.md`
+- `references/official-docs/user-guide/devui/tracing.md`
+- `references/official-docs/user-guide/devui/directory-discovery.md`