[kieronlanning]

Summary

Takes Purview.BuildSdk 1.3.0 and bumps this repository's own point release.

File	Change
global.json	Purview.BuildSdk 1.0.0-prerelease.60 -> 1.3.0
package.json	version 2.0.0-prerelease.39 -> 2.0.0-prerelease.40
src/src/Samples.Web/Samples.Web.csproj	declares its CA1515 suppression as a deliberate exemption
src/src/EventSourcing/EventSourcing.csproj	packs the bundled skills at .agents/ explicitly

Why 1.3.0

Purview.BuildSdk 1.3.0 is the current stable release on nuget.org; this repository was pinned to the
pre-1.0 1.0.0-prerelease.60 SDK, so this also moves the repository onto the stable 1.3.0 line. 1.3.0
stops recompiling every project on every build, so every consuming repository should pick it up.

Version accounting

2.0.0-prerelease.40 is the next point release after 2.0.0-prerelease.39. The newest release tag in
this repository is v2.0.0-prerelease.39, which 2.0.0-prerelease.39 already occupies, so the bump does
not collide with an existing tag. The version is on a prerelease line, so the point release here is the
next prerelease increment of the same patch. No tag was pushed by hand: the release pipeline owns tagging
(v{version}) when this merges to main.

Two source changes 1.3.0 requires

Samples.Web and PRSGD0008. 1.3.0 adds PRSGD0008 (ValidatePurviewStylePolicy), so a repository
may no longer add CA1515 (or the other accessibility rules) to NoWarn itself - the rule must be fixed
rather than suppressed. Samples.Web legitimately suppresses CA1515: the only public type in that
assembly is the public partial class Program that ASP.NET Core's public-program source generator emits
for a top-level-statements entry point. It is generated code, so it cannot be made internal here. The
project now records the same rule in PurviewPolicyExemptNoWarn, the SDK's supported way to declare a
deliberate exemption (the mechanism aspire-resourcekit's Example.AppHost uses for CA1034/CA1062),
which keeps the rest of the accessibility policy enforced instead of opting out with
DisablePurviewStylePolicyValidation.

src/src/Benchmarks/Benchmarks.csproj keeps its CA1515 entry unchanged: the SDK injects the
test-context rule set for benchmark projects, so the entry is already exempt and the rule does not fire.

The core package and its bundled skills. 1.3.0 stopped contributing .agents/** content to packages.
It packs the Sdk/ folder verbatim, so this project's skills moved to Sdk/.agents/skills/... inside
Purview.EventSourcing.nupkg - a path nothing reads - which failed
PackValidation:RequiredContent (.agents/**/*). The core project now packs Sdk/.agents/** explicitly
at .agents/skills/..., the path ResolvePurviewSkillSources reads from a restored package and the path
Sdk/README.md promises consumers, and drops the redundant copy inside the packed Sdk/ folder. The
package keeps exactly one copy, in the same place it was before 1.3.0.

Follow-up worth considering (deliberately not done here, because it changes what consumers receive): 1.3.0
moved the repository-owned skills convention to skills/<name>/SKILL.md at the repository root, which is
where every other purview-dev repository keeps them. Migrating src/src/EventSourcing/Sdk/.agents/skills
to that location, then dropping the .agents/**/* assertion and the README section, would align this
repository with the SDK's new model.

Validation

• dotnet restore src/EventSourcing.slnx succeeds against Purview.BuildSdk 1.3.0.
• dotnet build src/EventSourcing.slnx succeeds against Purview.BuildSdk 1.3.0: 0 errors, no
  PRSGD0008; the remaining warnings are the pre-existing NU1902/NU1903 advisories.
• dotnet pack src/src/EventSourcing/EventSourcing.csproj produces a package whose contents satisfy
  every PackValidation:RequiredContent entry for purview.eventsourcing, including
  .agents/skills/**/*.md once, at the package root.

Merge

Left open for review - this PR is not merged.