← Csproj Modernizer / API
Tokens

Drive Csproj Modernizer from your own code

The page reads your MSBuild files in the browser for free — .csproj, .vbproj, .fsproj, Directory.Build.props, Directory.Build.targets, Directory.Packages.props, other .props/.targets and packages.config — parses every file with line numbers, runs a deterministic subset of the anti-pattern catalogue over them (unquoted conditions, hardcoded paths, $(TargetFramework) conditions in .props, publish-on-build forks, defaults in .targets, analyzers without PrivateAssets, NETSDK1022 duplicates, ...) and, for a legacy project, lists what an SDK-style rewrite must keep. Its two paid steps are available over HTTP. You send one JSON object with task set to "audit" or "modernize", the files as a files string and the page’s check as a facts string, and the model replies with one JSON object: an audit with a BAD-to-GOOD fix per finding and an answer for every flag, or an SDK-style rewrite of the legacy project with what was removed, what was kept and what to do by hand.

Base URL: https://api.skillsafe.ai/v1/app-api. Every call sends Content-Type: application/json and, once you have a token, Authorization: Bearer <token>. The paths below (/guest, /me, /estimate, /run, /jobs/{job_id}, /run-stream) are relative to it, exactly as sdk.js calls them. A plain-text summary of the app for agents is at /llms.txt.

The response envelope

Responses are JSON of the form {"ok": ..., "data": ..., "error": {...}}. The page’s SDK (sdk.js) decides success from the HTTP status, not from ok: on a 2xx it returns data; otherwise it raises an error whose message is error.message (or the HTTP status text when the body carries none), with status, code (error.code) and details (error.details) attached. A body that is not JSON is treated as {}. 

{ "ok": true,  "data": { ... } }
{ "ok": false, "error": { "code": "...", "message": "...", "details": { ... } } }

Error codes

Branch on the HTTP status and error.code, show error.message. The page handles 401 and 402 by name; the rest reach it as a generic failure (“The run failed: ...”).

HTTPerror.codeWhat it means / what to do
400VALIDATION_ERRORThe body is not a JSON object or a declared field has the wrong type. task, files and facts are all strings; sending files as an array or facts as an object is the usual cause.
401UNAUTHORIZEDNo token, or one that expired or was revoked. The page forgets the signed-in user and says “Your session expired - sign in again.” Get a new token.
402INSUFFICIENT_CREDITSThe balance cannot cover the run. The page says “Not enough credits for this run.” with a top-up link, and tries never to submit into a 402: it disables the run button when the /me balance is below the estimate’s min_credits.
404NOT_FOUNDA wrong path, or a job id that does not belong to this token.
409CONFLICTAn Idempotency-Key replayed with a different body. Send the original body, or use a new key (the page bumps its :a<attempt> suffix for a retry).
429RATE_LIMITEDToo many requests. Back off with a delay; do not tight-loop, and never resend a metered run without its original Idempotency-Key.

Failures that do not arrive as an HTTP status:

WhatWhat happens
event: error on /run-streamThe SDK raises an error carrying the event’s message, code and job_id.
Job status: "failed"Polling stops; the job’s error field says why.
Polling past 180 sThe SDK’s own client-side limit (waitForJob, 1 s interval, 180 000 ms default): it throws “job timed out”. The job itself is not cancelled.

The task field: two lanes

task routes the run, and it takes exactly two values. Each lane has its own reply contract, and a reply never mixes them. The skill’s instructions tell the model to do the audit when task is missing or anything else, so a typo silently gets you an audit: always send one of the two values.

taskWhat it doesverdictUse it when
"audit"Reviews every file against the anti-pattern catalogue: confirms or dismisses each page flag, adds what text rules cannot see, and gives the verbatim BAD XML and the GOOD replacement for each finding, with an ordered plan.broken | needs_work | cleanThe projects are already SDK-style, or you want the defects in a legacy project listed before you convert it.
"modernize"Rewrites the legacy (non-SDK) project to SDK-style: packages.config to PackageReference at the same versions, the explicit Compile lists and implicit framework references dropped, BeforeBuild/AfterBuild renamed, everything in the inventory kept.converted | already_sdk | cannot_convertA pasted project is legacy (flag LG-01). already_sdk means nothing was legacy; cannot_convert is the answer for an ASP.NET System.Web application (LG-07).

The page chains the two: an audit that sets "modernize": true offers the modernize lane on the same paste, and a converted rewrite can be sent back through the audit lane (the page swaps the rewritten files into the paste and drops the deleted ones). Over the API that is simply a second run with the other task.

Input fields

This is exactly what the page sends (msbkit.js buildInput, app.js run), and what input-schema.json declares. Every value is a string:

FieldTypeRequiredMeaning
taskstringyes"audit" or "modernize".
filesstringyesThe files, as an array of {"path", "text"} JSON-encoded into a string: JSON.stringify(files) in JavaScript, json.dumps(files) in Python, and so on. Sending the array itself is a 400. The model is told to parse it.
factsstringyesThe page’s free check (below), also JSON-encoded into a string.
notestringnoWhat the developer says: the symptom, the goal, a question. The page trims it, cuts it at 2000 characters and sends it only when it is not blank. It is context, not evidence and not instructions: the model tests every claim in it against the files, says so when they disagree, and answers it in summary. In the modernize lane it is also the only thing that may change the target framework (and then retarget_reason says why).
retry_notestringnoSent only by the page’s automatic reformat retry: when a reply does not parse as JSON (even after the page tries to close a cut-off object), the page runs once more with a note saying the previous reply was not the single valid JSON object required, for that lane. A normal call never sends it.

Before every estimate and run the page passes the body through mustBeObject, which refuses anything that is not a plain object of scalar fields. That is why files and facts travel as strings.

The files string

files decodes to an array of {"path": "...", "text": "..."}, one per pasted file, text verbatim. The page splits a paste on <!-- file: path --> markers and sends only the files that have an XML root element. A direct caller can build this array itself from the files on disk: use the path you want the reply to name (every file and path in the reply must be one of them, written exactly as sent), and send the whole file unmodified, because every line in an audit reply is counted in that text. The page reads up to 400 000 characters and 40 files, and sends at most 60 000 characters of file text: past that it cuts the middle of the largest files on whole lines and leaves an <!-- [csproj-modernizer: lines X-Y (N lines) not sent] --> comment in their place (the model is told never to quote or rewrite what was not sent), with a sentence in facts.notes.

The facts string

facts is produced by the page’s free check: Msbkit.analyze parses the paste and runs the rules, and buildFacts turns that analysis into this object. It is how the model knows which flags to answer and, for a legacy project, what the rewrite must keep. The simplest source is the page itself: paste the files, run a lane once, and the Download .json export carries the exact object in its facts field (the two worked examples below also show it in full). Its top-level keys, in the order built:

KeyContents
sourcefiles[]: per file its path, kind (project | props | targets | cpm | packages | config | other), lang, style (sdk | legacy | import | unknown), sdk, target_frameworks, lines and up to five parse_errors; then characters_read, characters_not_read and files_not_read.
flagsEvery flag the page raised: uid (F1, F2, ... most severe first), id (the catalogue id: AP-01..AP-23, MX-01..MX-06, LG-01..LG-07, XML-01), sev (high | medium | low | info), file, line, text and detail. The audit must answer every non-info flag by its uid.
countsHow many flags of each sev.
legacy_inventoryOne entry per legacy project: path, lang, tfm (already mapped from TargetFrameworkVersion, e.g. v4.8 → net48) and tfm_from, output_type, assembly_name, root_namespace, file_stem, packages (id, version, where found), project_refs, references (non-implicit), special_items (with CopyToOutputDirectory, Link and similar metadata), keep_properties, custom_targets, renamed_targets, assembly_info, compile_count, fs_compile_order, web/wpf/winforms and define_extra. Empty when nothing is legacy.
verdict_candidates{"audit": ..., "modernize": ...}: the verdict each lane’s flags point at (the page’s own reading).
notesPlain sentences about what was not read or not sent.

Without the page’s check. facts is required, but nothing checks its contents: a minimal string such as "{}" or "{\"flags\":[],\"legacy_inventory\":[]}" is accepted, and the model still reads the files. You lose what the check adds: with no flags there is nothing to confirm or dismiss (flag_answers comes back empty and every finding cites []), with no legacy_inventory the modernize lane has no list of packages, references, items, properties and targets it is held to, and with no verdict_candidates there is no second opinion on the verdict. Build it with the page’s own msbkit.js (it runs in Node: K.buildInput(task, K.analyze(pasteText), note) returns the whole body) or copy it from the page.

The output contracts

The model is instructed (SKILL.md) to reply with one JSON object and nothing else — no prose, no code fences — with every array of its lane present ([] when empty). The run’s output text is that object.

task: "audit"

task: "modernize"

How the page reads a reply (recon.js normalize): it strips a code fence and parses from the first { to the last }. A reply is read as the lane that was asked for, unless it names the other lane and carries that lane’s body (findings for audit, files for modernize). An unknown verdict shows as needs_work or converted and counts as a disagreement; an unknown severity becomes warning, an unknown action rewrite; ids like AP02 become AP-02; flags keeps only F<n> values; findings with no file, evidence and title and files with no path are dropped; questions, plan, manual_steps and risks are capped at 5, 10, 12 and 10.

Worked examples

Both are built with the app’s own modules from the examples the page ships (the example buttons on the app page), exactly as the page builds them: K.buildInput(e.lane, K.analyze(e.raw), e.note). Each shows the decoded files array and facts object (save them under the file names given to run the samples in steps 3–5), the request body, and a saved model reply (reply set r2).

Audit: Two projects and a Directory.Build pair that race and override each other

4 files: Directory.Build.props, Directory.Build.targets, src/Orders.Core/Orders.Core.csproj, src/Orders.Api/Orders.Api.csproj. The page’s free check raises 13 flags (6 high, 4 medium, 3 low) and its own reading of the audit verdict is broken. The developer’s note: “CI fails about one build in five with 'The process cannot access the file Orders.Core.dll because it is being used by another process', and TreatWarningsAsErrors=false in Orders.Api seems to be ignored. What is going on?”

The files array, decoded — save it as audit-files.json:

[
  {
    "path": "Directory.Build.props",
    "text": "<Project>\n  <PropertyGroup>\n    <Nullable>enable</Nullable>\n    <ImplicitUsings>enable</ImplicitUsings>\n    <Company>Quorlex</Company>\n  </PropertyGroup>\n\n  <PropertyGroup Condition=\"'$(TargetFramework)' == 'net8.0'\">\n    <GenerateDocumentationFile>true</GenerateDocumentationFile>\n  </PropertyGroup>\n\n  <ItemGroup>\n    <PackageReference Include=\"StyleCop.Analyzers\" Version=\"1.2.0-beta.556\" />\n  </ItemGroup>\n</Project>"
  },
  {
    "path": "Directory.Build.targets",
    "text": "<Project>\n  <PropertyGroup>\n    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>\n    <Authors>Quorlex Build Team</Authors>\n  </PropertyGroup>\n</Project>"
  },
  {
    "path": "src/Orders.Core/Orders.Core.csproj",
    "text": "<Project Sdk=\"Microsoft.NET.Sdk\">\n  <PropertyGroup>\n    <TargetFramework>net8.0</TargetFramework>\n    <OutputPath>C:\\builds\\output\\Orders.Core</OutputPath>\n  </PropertyGroup>\n\n  <PropertyGroup Condition=\"$(Configuration) == Debug\">\n    <DefineConstants>ENABLE_TRACING</DefineConstants>\n  </PropertyGroup>\n\n  <ItemGroup>\n    <Compile Include=\"OrderMath.cs\" />\n    <Compile Update=\"OrderMath.cs\" AutoGen=\"true\" />\n  </ItemGroup>\n\n  <Target Name=\"PublishOnBuild\" AfterTargets=\"Build\">\n    <MSBuild Projects=\"$(MSBuildProjectFullPath)\" Targets=\"Publish\" Properties=\"_IsPublishing=true\" />\n  </Target>\n</Project>"
  },
  {
    "path": "src/Orders.Api/Orders.Api.csproj",
    "text": "<Project Sdk=\"Microsoft.NET.Sdk.Web\">\n  <PropertyGroup>\n    <TargetFramework>net8.0</TargetFramework>\n    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>\n  </PropertyGroup>\n\n  <ItemGroup>\n    <ProjectReference Include=\"..\\Orders.Core\\Orders.Core.csproj\" SetTargetFramework=\"TargetFramework=net8.0\" />\n  </ItemGroup>\n\n  <Target Name=\"StampVersion\" BeforeTargets=\"Build\">\n    <Exec Command=\"echo $(Version) &gt; $(IntermediateOutputPath)version.txt\" />\n  </Target>\n</Project>"
  }
]

The facts object, decoded and complete — save it as audit-facts.json:

{
  "source": {
    "files": [
      {
        "path": "Directory.Build.props",
        "kind": "props",
        "lang": null,
        "style": "import",
        "sdk": null,
        "target_frameworks": [],
        "lines": 15,
        "parse_errors": []
      },
      {
        "path": "Directory.Build.targets",
        "kind": "targets",
        "lang": null,
        "style": "import",
        "sdk": null,
        "target_frameworks": [],
        "lines": 6,
        "parse_errors": []
      },
      {
        "path": "src/Orders.Core/Orders.Core.csproj",
        "kind": "project",
        "lang": "C#",
        "style": "sdk",
        "sdk": "Microsoft.NET.Sdk",
        "target_frameworks": [
          "net8.0"
        ],
        "lines": 19,
        "parse_errors": []
      },
      {
        "path": "src/Orders.Api/Orders.Api.csproj",
        "kind": "project",
        "lang": "C#",
        "style": "sdk",
        "sdk": "Microsoft.NET.Sdk.Web",
        "target_frameworks": [
          "net8.0"
        ],
        "lines": 14,
        "parse_errors": []
      }
    ],
    "characters_read": 1841,
    "characters_not_read": 0,
    "files_not_read": 0
  },
  "flags": [
    {
      "uid": "F1",
      "id": "AP-21",
      "sev": "high",
      "file": "Directory.Build.props",
      "line": 9,
      "text": "GenerateDocumentationFile is conditioned on $(TargetFramework) in a .props file",
      "detail": "$(TargetFramework) is still empty when a .props file is evaluated for a single-targeting project, so the condition never matches. Move it to Directory.Build.targets or the project file. Item conditions are fine."
    },
    {
      "uid": "F2",
      "id": "AP-03",
      "sev": "high",
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 4,
      "text": "Hardcoded absolute path in OutputPath: C:\\builds\\output\\Orders.Core",
      "detail": "Breaks on every other machine, CI agent and OS. Build it from $(MSBuildThisFileDirectory), $(MSBuildProjectDirectory) or a repo-root property."
    },
    {
      "uid": "F3",
      "id": "AP-02",
      "sev": "high",
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 7,
      "text": "Unquoted comparison in a Condition on <PropertyGroup>: $(Configuration) == Debug",
      "detail": "Quote both sides with single quotes, e.g. '$(Configuration)' == 'Release'. An empty or spaced value makes the unquoted form misread or fail to parse."
    },
    {
      "uid": "F4",
      "id": "AP-05",
      "sev": "high",
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 12,
      "text": "1 source file listed with <Compile Include> (OrderMath.cs)",
      "detail": "The SDK already globs **/*.cs, so these are duplicates: the build fails with NETSDK1022 (duplicate Compile items) unless default compile items are turned off. Delete them; use Compile Remove to opt a file out."
    },
    {
      "uid": "F5",
      "id": "AP-22",
      "sev": "high",
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 17,
      "text": "<MSBuild Projects=\"$(MSBuildProjectFullPath)\"> passes _IsPublishing=true",
      "detail": "A global property that does not change the output path forks a second instance of that project which writes the same bin/obj as the build the solution already runs: a double build and file-lock races. Run the target in the same instance (DependsOnTargets) or give the fork its own output path."
    },
    {
      "uid": "F6",
      "id": "AP-23",
      "sev": "high",
      "file": "src/Orders.Api/Orders.Api.csproj",
      "line": 8,
      "text": "SetTargetFramework=\"TargetFramework=net8.0\" on the reference to Orders.Core.csproj, which already single-targets net8.0",
      "detail": "Path-neutral: the forked instance writes the same bin/obj as the one the solution builds. Remove the metadata."
    },
    {
      "uid": "F7",
      "id": "AP-07",
      "sev": "medium",
      "file": "Directory.Build.props",
      "line": 13,
      "text": "StyleCop.Analyzers has no PrivateAssets=\"all\"",
      "detail": "without it the analyzer or build tool flows to every project and package that consumes this one."
    },
    {
      "uid": "F8",
      "id": "MX-02",
      "sev": "medium",
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 8,
      "text": "DefineConstants is set to 'ENABLE_TRACING' without $(DefineConstants)",
      "detail": "This replaces the constants already defined for the configuration (DEBUG and TRACE, and anything an earlier group added). Append instead: $(DefineConstants);ENABLE_TRACING."
    },
    {
      "uid": "F9",
      "id": "AP-12",
      "sev": "medium",
      "file": "src/Orders.Api/Orders.Api.csproj",
      "line": 4,
      "text": "Orders.Api.csproj sets TreatWarningsAsErrors to 'false', but Directory.Build.targets (line 3) sets it to 'true' after the project body",
      "detail": "The project's value never takes effect: the .targets file is imported later and wins. Move the default to a .props file with a condition."
    },
    {
      "uid": "F10",
      "id": "AP-11",
      "sev": "medium",
      "file": "src/Orders.Api/Orders.Api.csproj",
      "line": 11,
      "text": "Target StampVersion runs on every build (BeforeTargets=Build) without Inputs and Outputs",
      "detail": "With both attributes MSBuild skips it when nothing changed; register what it writes in FileWrites so Clean removes it."
    },
    {
      "uid": "F11",
      "id": "AP-12",
      "sev": "low",
      "file": "Directory.Build.targets",
      "line": 3,
      "text": "2 properties given an unconditional value in a .targets file (TreatWarningsAsErrors, Authors)",
      "detail": ".targets files are imported after the project body, so these silently override what a project sets. Defaults belong in a .props file, written as <X Condition=\"'$(X)' == ''\">."
    },
    {
      "uid": "F12",
      "id": "AP-17",
      "sev": "low",
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 13,
      "text": "<Compile Include> and <Compile Update> of OrderMath.cs in one ItemGroup",
      "detail": "Update only sees items that exist when it is evaluated; put the Update in its own ItemGroup (or fold the metadata into the Include)."
    },
    {
      "uid": "F13",
      "id": "AP-01",
      "sev": "low",
      "file": "src/Orders.Api/Orders.Api.csproj",
      "line": 12,
      "text": "<Exec> runs `echo $(Version) > $(IntermediateOutputPath)version.txt`",
      "detail": "Use <WriteLinesToFile>: it works the same on every OS and registers the file."
    }
  ],
  "counts": {
    "high": 6,
    "medium": 4,
    "low": 3,
    "info": 0
  },
  "legacy_inventory": [],
  "verdict_candidates": {
    "audit": "broken",
    "modernize": "already_sdk"
  },
  "notes": []
}

The request body the page sends, trimmed for display: the full body is 8,290 characters of compact JSON, and the two long strings are cut here after their first characters, with the cut marked inside the string. Untrimmed, files is the compact JSON.stringify of the first block and facts of the second; the JavaScript makeInput in step 3 rebuilds the body byte for byte from the two saved files. 

{
  "task": "audit",
  "files": "[{\"path\":\"Directory.Build.props\",\"text\":\"<Project>\\n  <PropertyGroup>\\n    <Nullable>enable</Nullable>\\n    <ImplicitUsings>enable</ImplicitUsings>\\n    <Compan ... [trimmed for display: 160 of 1,952 characters shown]",
  "facts": "{\"source\":{\"files\":[{\"path\":\"Directory.Build.props\",\"kind\":\"props\",\"lang\":null,\"style\":\"import\",\"sdk\":null,\"target_frameworks\":[],\"lines\":15,\"parse_errors\":[]}, ... [trimmed for display: 160 of 5,406 characters shown]",
  "note": "CI fails about one build in five with 'The process cannot access the file Orders.Core.dll because it is being used by another process', and TreatWarningsAsErrors=false in Orders.Api seems to be ignored. What is going on?"
}

The page would send this with Idempotency-Key: csproj-modernizer:audit:6eb72c89-2062:a1 (see step 4). The saved reply, in full: 

{
  "task": "audit",
  "verdict": "broken",
  "headline": "Orders.Core is built twice on an ordinary build - a self-forked Publish in its own project and a re-targeted ProjectReference from Orders.Api - which matches the intermittent Orders.Core.dll file-lock failures, on top of a hardcoded OutputPath, an unquoted condition, a duplicate Compile item that will hit NETSDK1022, and a Directory.Build.props condition on $(TargetFramework) that can never match.",
  "findings": [
    {
      "id": "AP-21",
      "flags": [
        "F1"
      ],
      "file": "Directory.Build.props",
      "line": 8,
      "severity": "error",
      "title": "GenerateDocumentationFile conditioned on $(TargetFramework) in a .props file",
      "evidence": "  <PropertyGroup Condition=\"'$(TargetFramework)' == 'net8.0'\">\n    <GenerateDocumentationFile>true</GenerateDocumentationFile>\n  </PropertyGroup>",
      "bad": "  <PropertyGroup Condition=\"'$(TargetFramework)' == 'net8.0'\">\n    <GenerateDocumentationFile>true</GenerateDocumentationFile>\n  </PropertyGroup>",
      "good": "<!-- moved to Directory.Build.targets, imported after TargetFramework is set -->\n  <PropertyGroup Condition=\"'$(TargetFramework)' == 'net8.0'\">\n    <GenerateDocumentationFile>true</GenerateDocumentationFile>\n  </PropertyGroup>",
      "why": "Directory.Build.props is imported before the project's own <TargetFramework> property is set, so $(TargetFramework) is empty when this Condition runs for both Orders.Core.csproj and Orders.Api.csproj (each single-targets net8.0): the PropertyGroup never matches and GenerateDocumentationFile is never enabled for either project. Move the condition to Directory.Build.targets (imported after the project body) or into each project file."
    },
    {
      "id": "AP-03",
      "flags": [
        "F2"
      ],
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 4,
      "severity": "error",
      "title": "Hardcoded absolute OutputPath",
      "evidence": "    <OutputPath>C:\\builds\\output\\Orders.Core</OutputPath>",
      "bad": "    <OutputPath>C:\\builds\\output\\Orders.Core</OutputPath>",
      "good": "    <OutputPath>$(MSBuildThisFileDirectory)output\\Orders.Core\\</OutputPath>",
      "why": "OutputPath is pinned to C:\\builds\\output\\Orders.Core, a path that only exists on one machine. On any other Windows machine it needs that exact folder tree, and on a Linux/macOS CI agent the literal string \"C:\\builds\\...\" isn't a drive path at all. Check what output layout CI actually expects, then build the path from $(MSBuildThisFileDirectory) or a repo-root property instead of a machine-specific absolute one."
    },
    {
      "id": "AP-02",
      "flags": [
        "F3"
      ],
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 7,
      "severity": "error",
      "title": "Unquoted Configuration comparison",
      "evidence": "  <PropertyGroup Condition=\"$(Configuration) == Debug\">",
      "bad": "  <PropertyGroup Condition=\"$(Configuration) == Debug\">\n    <DefineConstants>ENABLE_TRACING</DefineConstants>\n  </PropertyGroup>",
      "good": "  <PropertyGroup Condition=\"'$(Configuration)' == 'Debug'\">\n    <DefineConstants>ENABLE_TRACING</DefineConstants>\n  </PropertyGroup>",
      "why": "Both sides of == are bare words. Check whether $(Configuration) is ever empty or contains anything unusual for this repo's build invocations; an unquoted comparison can misread or fail to parse in those cases, silently skipping the DefineConstants below. Quote both sides so the comparison is always a literal string match."
    },
    {
      "id": "AP-05",
      "flags": [
        "F4"
      ],
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 12,
      "severity": "error",
      "title": "Explicit Compile Include duplicates the SDK glob",
      "evidence": "    <Compile Include=\"OrderMath.cs\" />",
      "bad": "    <Compile Include=\"OrderMath.cs\" />",
      "good": "<!-- removed: the SDK already globs OrderMath.cs via the default Compile item -->",
      "why": "Microsoft.NET.Sdk already globs **/*.cs, which includes OrderMath.cs. Default compile items are not turned off anywhere in this project, so this Include adds the same file a second time and the build will fail with NETSDK1022 (duplicate 'Compile' items). Delete the Include; the file is already compiled by the default glob."
    },
    {
      "id": "AP-22",
      "flags": [
        "F5"
      ],
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 16,
      "severity": "error",
      "title": "PublishOnBuild forks a second instance of this project",
      "evidence": "  <Target Name=\"PublishOnBuild\" AfterTargets=\"Build\">\n    <MSBuild Projects=\"$(MSBuildProjectFullPath)\" Targets=\"Publish\" Properties=\"_IsPublishing=true\" />\n  </Target>",
      "bad": "  <Target Name=\"PublishOnBuild\" AfterTargets=\"Build\">\n    <MSBuild Projects=\"$(MSBuildProjectFullPath)\" Targets=\"Publish\" Properties=\"_IsPublishing=true\" />\n  </Target>",
      "good": "  <PropertyGroup>\n    <_PublishWasInvokedDirectly Condition=\"'$(_IsPublishing)' == 'true'\">true</_PublishWasInvokedDirectly>\n  </PropertyGroup>\n\n  <Target Name=\"PublishOnBuild\" AfterTargets=\"Build\" DependsOnTargets=\"Publish\" Condition=\"'$(_PublishWasInvokedDirectly)' != 'true'\" />",
      "why": "This target runs the <MSBuild> task against its own project file after every Build, passing _IsPublishing=true - a global property that is not part of the outer build's property set. MSBuild will treat that as a second, separate instance of Orders.Core.csproj, and its Publish (which depends on Build) recompiles into the same OutputPath the outer build just used: a concrete match for the intermittent 'Orders.Core.dll ... being used by another process' failure in the note. Capture the SDK's own _IsPublishing signal and run Publish through DependsOnTargets in the same instance instead of forking one."
    },
    {
      "id": "AP-23",
      "flags": [
        "F6"
      ],
      "file": "src/Orders.Api/Orders.Api.csproj",
      "line": 8,
      "severity": "error",
      "title": "SetTargetFramework re-injects the TFM Orders.Core already single-targets",
      "evidence": "    <ProjectReference Include=\"..\\Orders.Core\\Orders.Core.csproj\" SetTargetFramework=\"TargetFramework=net8.0\" />",
      "bad": "    <ProjectReference Include=\"..\\Orders.Core\\Orders.Core.csproj\" SetTargetFramework=\"TargetFramework=net8.0\" />",
      "good": "    <ProjectReference Include=\"..\\Orders.Core\\Orders.Core.csproj\" />",
      "why": "Orders.Core.csproj already single-targets net8.0. Passing SetTargetFramework=\"TargetFramework=net8.0\" still adds an explicit global property to this reference's build request, so MSBuild treats it as a project instance distinct from any other build of Orders.Core.csproj that doesn't carry that property - a path-neutral second build writing the same bin/obj as the first. Together with the PublishOnBuild self-fork in Orders.Core, this is the other concrete source of the flaky file-lock failure in the note. Remove the metadata."
    },
    {
      "id": "AP-07",
      "flags": [
        "F7"
      ],
      "file": "Directory.Build.props",
      "line": 13,
      "severity": "warning",
      "title": "StyleCop.Analyzers has no PrivateAssets",
      "evidence": "    <PackageReference Include=\"StyleCop.Analyzers\" Version=\"1.2.0-beta.556\" />",
      "bad": "    <PackageReference Include=\"StyleCop.Analyzers\" Version=\"1.2.0-beta.556\" />",
      "good": "    <PackageReference Include=\"StyleCop.Analyzers\" Version=\"1.2.0-beta.556\" PrivateAssets=\"all\" />",
      "why": "This PackageReference is in Directory.Build.props, so every project in the repo picks it up. Without PrivateAssets=\"all\" it also propagates to anything that references Orders.Core.csproj or Orders.Api.csproj, forcing the analyzer on consumers that never asked for it. Add PrivateAssets=\"all\"."
    },
    {
      "id": "MX-02",
      "flags": [
        "F8"
      ],
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 8,
      "severity": "warning",
      "title": "DefineConstants overwritten instead of appended",
      "evidence": "    <DefineConstants>ENABLE_TRACING</DefineConstants>",
      "bad": "    <DefineConstants>ENABLE_TRACING</DefineConstants>",
      "good": "    <DefineConstants>$(DefineConstants);ENABLE_TRACING</DefineConstants>",
      "why": "This replaces DefineConstants outright, so whenever this Debug PropertyGroup matches, the SDK's own DEBUG;TRACE symbols for the configuration are lost and only ENABLE_TRACING remains. Append with $(DefineConstants); to keep them."
    },
    {
      "id": "AP-12",
      "flags": [
        "F9",
        "F11"
      ],
      "file": "Directory.Build.targets",
      "line": 3,
      "severity": "warning",
      "title": "Property defaults set unconditionally in Directory.Build.targets",
      "evidence": "    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>\n    <Authors>Quorlex Build Team</Authors>",
      "bad": "  <PropertyGroup>\n    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>\n    <Authors>Quorlex Build Team</Authors>\n  </PropertyGroup>",
      "good": "<!-- moved to Directory.Build.props -->\n<PropertyGroup>\n  <TreatWarningsAsErrors Condition=\"'$(TreatWarningsAsErrors)' == ''\">true</TreatWarningsAsErrors>\n  <Authors Condition=\"'$(Authors)' == ''\">Quorlex Build Team</Authors>\n</PropertyGroup>",
      "why": "Directory.Build.targets is imported after the project body, so both properties always win over anything a project sets earlier. Concretely, Orders.Api.csproj sets TreatWarningsAsErrors to false (its line 4), but this line makes it true again on every build - the second thing the note asks about. Raised from the catalogue's baseline style banding because a pasted project's explicit value is demonstrably being discarded here, not just hypothetically. Move both properties to Directory.Build.props guarded by '$(X)' == '' so a project's own value is respected as an override."
    },
    {
      "id": "AP-11",
      "flags": [
        "F10"
      ],
      "file": "src/Orders.Api/Orders.Api.csproj",
      "line": 11,
      "severity": "warning",
      "title": "StampVersion has no Inputs/Outputs",
      "evidence": "  <Target Name=\"StampVersion\" BeforeTargets=\"Build\">\n    <Exec Command=\"echo $(Version) &gt; $(IntermediateOutputPath)version.txt\" />\n  </Target>",
      "bad": "  <Target Name=\"StampVersion\" BeforeTargets=\"Build\">\n    <Exec Command=\"echo $(Version) &gt; $(IntermediateOutputPath)version.txt\" />\n  </Target>",
      "good": "  <Target Name=\"StampVersion\" BeforeTargets=\"Build\" Inputs=\"$(MSBuildProjectFullPath)\" Outputs=\"$(IntermediateOutputPath)version.txt\">\n    <Exec Command=\"echo $(Version) &gt; $(IntermediateOutputPath)version.txt\" />\n  </Target>",
      "why": "Without Inputs/Outputs this target's Exec reruns on every build even when $(Version) hasn't changed, and version.txt isn't registered for Clean to remove. Give it Inputs/Outputs so MSBuild can skip it incrementally and track the file."
    },
    {
      "id": "AP-17",
      "flags": [
        "F12"
      ],
      "file": "src/Orders.Core/Orders.Core.csproj",
      "line": 12,
      "severity": "style",
      "title": "Compile Include and Update of the same item in one ItemGroup",
      "evidence": "    <Compile Include=\"OrderMath.cs\" />\n    <Compile Update=\"OrderMath.cs\" AutoGen=\"true\" />",
      "bad": "  <ItemGroup>\n    <Compile Include=\"OrderMath.cs\" />\n    <Compile Update=\"OrderMath.cs\" AutoGen=\"true\" />\n  </ItemGroup>",
      "good": "  <ItemGroup>\n    <Compile Include=\"OrderMath.cs\" />\n  </ItemGroup>\n  <ItemGroup>\n    <Compile Update=\"OrderMath.cs\" AutoGen=\"true\" />\n  </ItemGroup>",
      "why": "Update only reliably sees items that already exist in the same group; put the Update in its own ItemGroup so evaluation order can't matter. This becomes moot once the Include above is deleted for AP-05 - only split the groups if the Include has to stay."
    },
    {
      "id": "AP-01",
      "flags": [
        "F13"
      ],
      "file": "src/Orders.Api/Orders.Api.csproj",
      "line": 12,
      "severity": "style",
      "title": "Exec used for a plain file write",
      "evidence": "    <Exec Command=\"echo $(Version) &gt; $(IntermediateOutputPath)version.txt\" />",
      "bad": "    <Exec Command=\"echo $(Version) &gt; $(IntermediateOutputPath)version.txt\" />",
      "good": "    <WriteLinesToFile File=\"$(IntermediateOutputPath)version.txt\" Lines=\"$(Version)\" Overwrite=\"true\" />",
      "why": "echo redirected with > depends on which shell MSBuild invokes and isn't tracked by MSBuild at all. WriteLinesToFile does the same job as a built-in task, registers the file, and behaves the same on every OS."
    }
  ],
  "flag_answers": [
    {
      "flag": "F1",
      "status": "confirmed",
      "reason": "Directory.Build.props loads before TargetFramework is set on either single-targeting project, so the condition never matches; see the AP-21 finding."
    },
    {
      "flag": "F2",
      "status": "confirmed",
      "reason": "OutputPath is a Windows-only absolute path; see the AP-03 finding."
    },
    {
      "flag": "F3",
      "status": "confirmed",
      "reason": "Both sides of == are unquoted in this Condition; see the AP-02 finding."
    },
    {
      "flag": "F4",
      "status": "confirmed",
      "reason": "The Include duplicates the SDK's default Compile glob and will hit NETSDK1022; see the AP-05 finding."
    },
    {
      "flag": "F5",
      "status": "confirmed",
      "reason": "The self MSBuild call forks a second instance of Orders.Core.csproj; see the AP-22 finding."
    },
    {
      "flag": "F6",
      "status": "confirmed",
      "reason": "SetTargetFramework re-asserts the TFM Orders.Core already single-targets, forking a second build instance; see the AP-23 finding."
    },
    {
      "flag": "F7",
      "status": "confirmed",
      "reason": "No PrivateAssets on the analyzer package, which is shared repo-wide via Directory.Build.props; see the AP-07 finding."
    },
    {
      "flag": "F8",
      "status": "confirmed",
      "reason": "DefineConstants is a plain assignment, not an append; see the MX-02 finding."
    },
    {
      "flag": "F9",
      "status": "confirmed",
      "reason": "Directory.Build.targets sets TreatWarningsAsErrors unconditionally after the project body, discarding Orders.Api's own false; see the AP-12 finding."
    },
    {
      "flag": "F10",
      "status": "confirmed",
      "reason": "StampVersion has BeforeTargets but no Inputs/Outputs; see the AP-11 finding."
    },
    {
      "flag": "F11",
      "status": "confirmed",
      "reason": "Both TreatWarningsAsErrors and Authors are set unconditionally in the .targets file; folded into the same AP-12 finding as F9."
    },
    {
      "flag": "F12",
      "status": "confirmed",
      "reason": "Compile Include and Update of OrderMath.cs share one ItemGroup; see the AP-17 finding."
    },
    {
      "flag": "F13",
      "status": "confirmed",
      "reason": "The Exec runs echo with redirection instead of a built-in task; see the AP-01 finding."
    }
  ],
  "plan": [
    "Stop the double build of Orders.Core: remove SetTargetFramework=\"TargetFramework=net8.0\" from Orders.Api's ProjectReference (AP-23), and replace Orders.Core's self-invoking PublishOnBuild <MSBuild> call with a same-instance DependsOnTargets=\"Publish\" guarded by _PublishWasInvokedDirectly (AP-22) - this is what races on Orders.Core.dll.",
    "In Orders.Core.csproj: quote both sides of the Debug condition ('$(Configuration)' == 'Debug', AP-02), delete the duplicate <Compile Include=\"OrderMath.cs\" /> (AP-05, which also removes the AP-17 Include/Update overlap), and change DefineConstants to append ($(DefineConstants);ENABLE_TRACING, MX-02).",
    "Replace Orders.Core.csproj's hardcoded OutputPath (C:\\builds\\output\\Orders.Core) with a path built from $(MSBuildThisFileDirectory) (AP-03).",
    "Move GenerateDocumentationFile's $(TargetFramework) condition out of Directory.Build.props into Directory.Build.targets or the project files (AP-21).",
    "Move TreatWarningsAsErrors and Authors out of Directory.Build.targets into Directory.Build.props with '$(X)' == '' guards so Orders.Api's own false is respected (AP-12) - this answers the note's second question.",
    "Add PrivateAssets=\"all\" to StyleCop.Analyzers (AP-07), give StampVersion Inputs/Outputs (AP-11), and swap its Exec echo for WriteLinesToFile (AP-01)."
  ],
  "modernize": false,
  "questions": [],
  "summary": "The flaky 'Orders.Core.dll ... being used by another process' failure has two concrete sources: Orders.Core's PublishOnBuild target re-invokes itself via <MSBuild> with _IsPublishing=true after every Build (AP-22), and Orders.Api's ProjectReference reasserts SetTargetFramework=net8.0 on a project that already single-targets net8.0 (AP-23) - both fork a second instance of Orders.Core.csproj that writes the same bin/obj the first build is still using, which only shows up some of the time. TreatWarningsAsErrors=false in Orders.Api.csproj is overridden because Directory.Build.targets sets it unconditionally to true and .targets files import after the project body, so the project's own value never wins (AP-12); the same import-order issue silences GenerateDocumentationFile's $(TargetFramework) condition in Directory.Build.props, which loads before TargetFramework is even set (AP-21). Orders.Core.csproj also has a hardcoded Windows-only OutputPath, an unquoted Debug condition, and an explicit Compile Include that duplicates the SDK's glob and will fail with NETSDK1022. Fix the two forks first, then the import-order and file-list issues."
}

Held to the page’s own reconciliation (recon.js, run by check.js on this exact body and reply), this reply has 0 disagreements in 88 statements checked.

What the step 4 samples print for this reply (after the truncated/charged line; the Python form):

broken - Orders.Core is built twice on an ordinary build - a self-forked Publish in its own project and a re-targeted ProjectReference from Orders.Api - which matches the intermittent Orders.Core.dll file-lock failures, on top of a hardcoded OutputPath, an unquoted condition, a duplicate Compile item that will hit NETSDK1022, and a Directory.Build.props condition on $(TargetFramework) that can never match.
AP-21 Directory.Build.props 8 error
AP-03 src/Orders.Core/Orders.Core.csproj 4 error
AP-02 src/Orders.Core/Orders.Core.csproj 7 error
AP-05 src/Orders.Core/Orders.Core.csproj 12 error
AP-22 src/Orders.Core/Orders.Core.csproj 16 error
AP-23 src/Orders.Api/Orders.Api.csproj 8 error
AP-07 Directory.Build.props 13 warning
MX-02 src/Orders.Core/Orders.Core.csproj 8 warning
AP-12 Directory.Build.targets 3 warning
AP-11 src/Orders.Api/Orders.Api.csproj 11 warning
AP-17 src/Orders.Core/Orders.Core.csproj 12 style
AP-01 src/Orders.Api/Orders.Api.csproj 12 style

Modernize: A .NET Framework 4.8 console importer with packages.config

2 files: src/Quorlex.Importer/Quorlex.Importer.csproj, src/Quorlex.Importer/packages.config. src/Quorlex.Importer/Quorlex.Importer.csproj is a legacy project (TargetFrameworkVersion v4.8, mapped to net48) with 2 packages in its inventory. The page’s check raises 8 flags and reads the modernize verdict as converted. The developer’s note: “Move this importer to SDK-style first. It stays on .NET Framework 4.8 for now; .NET 8 comes later.”

The files array, decoded — save it as modernize-files.json:

[
  {
    "path": "src/Quorlex.Importer/Quorlex.Importer.csproj",
    "text": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Project ToolsVersion=\"15.0\" DefaultTargets=\"Build\" xmlns=\"http://schemas.microsoft.com/developer/msbuild/2003\">\n  <Import Project=\"$(MSBuildExtensionsPath)\\$(MSBuildToolsVersion)\\Microsoft.Common.props\" Condition=\"Exists('$(MSBuildExtensionsPath)\\$(MSBuildToolsVersion)\\Microsoft.Common.props')\" />\n  <PropertyGroup>\n    <Configuration Condition=\" '$(Configuration)' == '' \">Debug</Configuration>\n    <Platform Condition=\" '$(Platform)' == '' \">AnyCPU</Platform>\n    <ProjectGuid>{7B3E6A41-2C5D-4F0E-9A8B-3D1C0E5F4A21}</ProjectGuid>\n    <OutputType>Exe</OutputType>\n    <RootNamespace>Quorlex.Importer</RootNamespace>\n    <AssemblyName>quorlex-import</AssemblyName>\n    <TargetFrameworkVersion>v4.8</TargetFrameworkVersion>\n    <FileAlignment>512</FileAlignment>\n    <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>\n    <Deterministic>true</Deterministic>\n    <LangVersion>7.3</LangVersion>\n    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>\n  </PropertyGroup>\n  <PropertyGroup Condition=\" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' \">\n    <PlatformTarget>AnyCPU</PlatformTarget>\n    <DebugSymbols>true</DebugSymbols>\n    <DebugType>full</DebugType>\n    <Optimize>false</Optimize>\n    <OutputPath>bin\\Debug\\</OutputPath>\n    <DefineConstants>DEBUG;TRACE</DefineConstants>\n    <ErrorReport>prompt</ErrorReport>\n    <WarningLevel>4</WarningLevel>\n    <Prefer32Bit>false</Prefer32Bit>\n  </PropertyGroup>\n  <PropertyGroup Condition=\" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' \">\n    <PlatformTarget>AnyCPU</PlatformTarget>\n    <DebugType>pdbonly</DebugType>\n    <Optimize>true</Optimize>\n    <OutputPath>bin\\Release\\</OutputPath>\n    <DefineConstants>TRACE;IMPORTER_RELEASE</DefineConstants>\n    <ErrorReport>prompt</ErrorReport>\n    <WarningLevel>4</WarningLevel>\n    <Prefer32Bit>false</Prefer32Bit>\n  </PropertyGroup>\n  <ItemGroup>\n    <Reference Include=\"CsvHelper, Version=30.0.0.0, Culture=neutral, PublicKeyToken=8c4959082be5c823, processorArchitecture=MSIL\">\n      <HintPath>..\\..\\packages\\CsvHelper.30.0.1\\lib\\net47\\CsvHelper.dll</HintPath>\n    </Reference>\n    <Reference Include=\"Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL\">\n      <HintPath>..\\..\\packages\\Newtonsoft.Json.13.0.3\\lib\\net45\\Newtonsoft.Json.dll</HintPath>\n    </Reference>\n    <Reference Include=\"System\" />\n    <Reference Include=\"System.Configuration\" />\n    <Reference Include=\"System.Core\" />\n    <Reference Include=\"System.Xml.Linq\" />\n    <Reference Include=\"System.Data.DataSetExtensions\" />\n    <Reference Include=\"Microsoft.CSharp\" />\n    <Reference Include=\"System.Data\" />\n    <Reference Include=\"System.Net.Http\" />\n    <Reference Include=\"System.Xml\" />\n  </ItemGroup>\n  <ItemGroup>\n    <Compile Include=\"ImportJob.cs\" />\n    <Compile Include=\"Mapping\\CustomerMap.cs\" />\n    <Compile Include=\"Program.cs\" />\n    <Compile Include=\"Properties\\AssemblyInfo.cs\" />\n  </ItemGroup>\n  <ItemGroup>\n    <None Include=\"App.config\" />\n    <None Include=\"packages.config\" />\n    <Content Include=\"mappings\\customers.json\">\n      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>\n    </Content>\n  </ItemGroup>\n  <ItemGroup>\n    <ProjectReference Include=\"..\\Quorlex.Data\\Quorlex.Data.csproj\">\n      <Project>{2F1B8C0D-6E4A-4B9F-8C21-5A7D3E9B0C14}</Project>\n      <Name>Quorlex.Data</Name>\n    </ProjectReference>\n  </ItemGroup>\n  <Import Project=\"$(MSBuildToolsPath)\\Microsoft.CSharp.targets\" />\n  <Target Name=\"AfterBuild\">\n    <Copy SourceFiles=\"$(ProjectDir)run-import.cmd\" DestinationFolder=\"$(OutDir)\" />\n  </Target>\n</Project>"
  },
  {
    "path": "src/Quorlex.Importer/packages.config",
    "text": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<packages>\n  <package id=\"CsvHelper\" version=\"30.0.1\" targetFramework=\"net48\" />\n  <package id=\"Newtonsoft.Json\" version=\"13.0.3\" targetFramework=\"net48\" />\n</packages>"
  }
]

The facts object, decoded and complete — save it as modernize-facts.json:

{
  "source": {
    "files": [
      {
        "path": "src/Quorlex.Importer/Quorlex.Importer.csproj",
        "kind": "project",
        "lang": "C#",
        "style": "legacy",
        "sdk": null,
        "target_frameworks": [
          "net48"
        ],
        "lines": 79,
        "parse_errors": []
      },
      {
        "path": "src/Quorlex.Importer/packages.config",
        "kind": "packages",
        "lang": null,
        "style": "none",
        "sdk": null,
        "target_frameworks": [],
        "lines": 5,
        "parse_errors": []
      }
    ],
    "characters_read": 3983,
    "characters_not_read": 0,
    "files_not_read": 0
  },
  "flags": [
    {
      "uid": "F1",
      "id": "AP-06",
      "sev": "medium",
      "file": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "line": 40,
      "text": "<Reference Include=\"CsvHelper\"> points into the packages folder",
      "detail": "The packages.config pattern: no transitive dependencies, no version resolution, a restore that must be run separately. Replace with <PackageReference Include=\"CsvHelper\" Version=\"30.0.1\" />."
    },
    {
      "uid": "F2",
      "id": "AP-06",
      "sev": "medium",
      "file": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "line": 43,
      "text": "<Reference Include=\"Newtonsoft.Json\"> points into the packages folder",
      "detail": "The packages.config pattern: no transitive dependencies, no version resolution, a restore that must be run separately. Replace with <PackageReference Include=\"Newtonsoft.Json\" Version=\"13.0.3\" />."
    },
    {
      "uid": "F3",
      "id": "LG-01",
      "sev": "info",
      "file": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "line": 2,
      "text": "Quorlex.Importer.csproj is a legacy (non-SDK) project (ToolsVersion 15.0)",
      "detail": "The modernize lane rewrites it to SDK-style; the audit catalogue applies to it only partly."
    },
    {
      "uid": "F4",
      "id": "LG-06",
      "sev": "info",
      "file": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "line": 19,
      "text": "Per-configuration property groups (17 properties)",
      "detail": "The SDK's Debug/Release defaults match the standard ones; only the non-standard values survive."
    },
    {
      "uid": "F5",
      "id": "LG-04",
      "sev": "info",
      "file": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "line": 40,
      "text": "Packages come from packages.config / HintPath references",
      "detail": "They become <PackageReference> items with the same versions; binding redirects are generated."
    },
    {
      "uid": "F6",
      "id": "LG-05",
      "sev": "info",
      "file": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "line": 46,
      "text": "8 framework references the SDK adds implicitly (System, System.Core, System.Xml.Linq, System.Data.DataSetExtensions)",
      "detail": "Delete them after migration."
    },
    {
      "uid": "F7",
      "id": "LG-02",
      "sev": "info",
      "file": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "line": 57,
      "text": "4 Compile items listed by hand",
      "detail": "SDK-style projects glob them; only files outside the folder or with special metadata stay."
    },
    {
      "uid": "F8",
      "id": "LG-03",
      "sev": "info",
      "file": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "line": 60,
      "text": "Properties/AssemblyInfo is compiled",
      "detail": "The SDK generates these attributes; keep the file and GenerateAssemblyInfo=false, or move the values into the project and delete it (otherwise CS0579 duplicate attributes)."
    }
  ],
  "counts": {
    "high": 0,
    "medium": 2,
    "low": 0,
    "info": 6
  },
  "legacy_inventory": [
    {
      "path": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "lang": "C#",
      "style": "legacy",
      "tfm_from": "v4.8",
      "tfm": "net48",
      "output_type": "Exe",
      "assembly_name": "quorlex-import",
      "root_namespace": "Quorlex.Importer",
      "file_stem": "Quorlex.Importer",
      "packages": [
        {
          "id": "CsvHelper",
          "version": "30.0.1",
          "from": "packages.config"
        },
        {
          "id": "Newtonsoft.Json",
          "version": "13.0.3",
          "from": "packages.config"
        }
      ],
      "project_refs": [
        "..\\Quorlex.Data\\Quorlex.Data.csproj"
      ],
      "references": [
        {
          "include": "System.Configuration",
          "hint_path": null
        }
      ],
      "special_items": [
        {
          "type": "Content",
          "include": "mappings\\customers.json",
          "metadata": {
            "CopyToOutputDirectory": "PreserveNewest"
          }
        }
      ],
      "keep_properties": [
        {
          "name": "OutputType",
          "value": "Exe",
          "condition": "",
          "line": 8
        },
        {
          "name": "AssemblyName",
          "value": "quorlex-import",
          "condition": "",
          "line": 10
        },
        {
          "name": "LangVersion",
          "value": "7.3",
          "condition": "",
          "line": 15
        },
        {
          "name": "TreatWarningsAsErrors",
          "value": "true",
          "condition": "",
          "line": 16
        },
        {
          "name": "Prefer32Bit",
          "value": "false",
          "condition": " '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ",
          "line": 27
        }
      ],
      "custom_targets": [],
      "renamed_targets": [
        "AfterBuild"
      ],
      "assembly_info": true,
      "compile_count": 4,
      "fs_compile_order": [],
      "web": false,
      "wpf": false,
      "winforms": false,
      "define_extra": [
        {
          "name": "IMPORTER_RELEASE",
          "condition": "'$(Configuration)|$(Platform)' == 'Release|AnyCPU'"
        }
      ]
    }
  ],
  "verdict_candidates": {
    "audit": "needs_work",
    "modernize": "converted"
  },
  "notes": []
}

The request body, trimmed for display the same way (the full body is 9,501 characters): 

{
  "task": "modernize",
  "files": "[{\"path\":\"src/Quorlex.Importer/Quorlex.Importer.csproj\",\"text\":\"<?xml version=\\\"1.0\\\" encoding=\\\"utf-8\\\"?>\\n<Project ToolsVersion=\\\"15.0\\\" DefaultTargets=\\\"Buil ... [trimmed for display: 160 of 4,185 characters shown]",
  "facts": "{\"source\":{\"files\":[{\"path\":\"src/Quorlex.Importer/Quorlex.Importer.csproj\",\"kind\":\"project\",\"lang\":\"C#\",\"style\":\"legacy\",\"sdk\":null,\"target_frameworks\":[\"net48\" ... [trimmed for display: 160 of 4,336 characters shown]",
  "note": "Move this importer to SDK-style first. It stays on .NET Framework 4.8 for now; .NET 8 comes later."
}

The page would send this with Idempotency-Key: csproj-modernizer:modernize:e851b2f6-251d:a1. The saved reply, in full: 

{
  "task": "modernize",
  "verdict": "converted",
  "headline": "Quorlex.Importer.csproj is now SDK-style on net48, with CsvHelper and Newtonsoft.Json as PackageReference instead of packages.config.",
  "project": "src/Quorlex.Importer/Quorlex.Importer.csproj",
  "target_framework": "net48",
  "retarget_reason": "",
  "files": [
    {
      "path": "src/Quorlex.Importer/Quorlex.Importer.csproj",
      "action": "rewrite",
      "content": "<Project Sdk=\"Microsoft.NET.Sdk\">\n\n  <PropertyGroup>\n    <OutputType>Exe</OutputType>\n    <TargetFramework>net48</TargetFramework>\n    <AssemblyName>quorlex-import</AssemblyName>\n    <LangVersion>7.3</LangVersion>\n    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>\n    <Prefer32Bit>false</Prefer32Bit>\n    <GenerateAssemblyInfo>false</GenerateAssemblyInfo>\n  </PropertyGroup>\n\n  <PropertyGroup Condition=\" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' \">\n    <DefineConstants>$(DefineConstants);IMPORTER_RELEASE</DefineConstants>\n  </PropertyGroup>\n\n  <ItemGroup>\n    <Reference Include=\"System.Configuration\" />\n  </ItemGroup>\n\n  <ItemGroup>\n    <PackageReference Include=\"CsvHelper\" Version=\"30.0.1\" />\n    <PackageReference Include=\"Newtonsoft.Json\" Version=\"13.0.3\" />\n  </ItemGroup>\n\n  <ItemGroup>\n    <ProjectReference Include=\"..\\Quorlex.Data\\Quorlex.Data.csproj\" />\n  </ItemGroup>\n\n  <ItemGroup>\n    <None Update=\"mappings\\customers.json\">\n      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>\n    </None>\n  </ItemGroup>\n\n  <Target Name=\"CopyAfterBuild\" AfterTargets=\"Build\">\n    <Copy SourceFiles=\"$(ProjectDir)run-import.cmd\" DestinationFolder=\"$(OutDir)\" />\n  </Target>\n\n</Project>\n"
    },
    {
      "path": "src/Quorlex.Importer/packages.config",
      "action": "delete",
      "content": ""
    }
  ],
  "removed": [
    {
      "what": "the <?xml ...?> declaration, ToolsVersion/DefaultTargets/xmlns attributes on <Project>, and the Microsoft.Common.props / Microsoft.CSharp.targets imports",
      "why": "the Microsoft.NET.Sdk import brings all of this in automatically; SDK-style projects don't declare them"
    },
    {
      "what": "<ProjectGuid>{7B3E6A41-2C5D-4F0E-9A8B-3D1C0E5F4A21}</ProjectGuid>",
      "why": "not used by SDK-style tooling; the project is tracked by path, not this GUID"
    },
    {
      "what": "<Configuration Condition=\" '$(Configuration)' == '' \">Debug</Configuration> and <Platform Condition=\" '$(Platform)' == '' \">AnyCPU</Platform>",
      "why": "MSBuild/dotnet build already default Configuration to Debug and Platform to AnyCPU when neither is supplied"
    },
    {
      "what": "<FileAlignment>512</FileAlignment>",
      "why": "512 is already the compiler default"
    },
    {
      "what": "<Deterministic>true</Deterministic>",
      "why": "true is already the SDK compiler default"
    },
    {
      "what": "<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>",
      "why": "not in the inventoried keep list for this project; verify after conversion whether CsvHelper/Newtonsoft.Json still need a generated redirect in app.config (see risks)"
    },
    {
      "what": "<RootNamespace>Quorlex.Importer</RootNamespace>",
      "why": "equals the project file name (Quorlex.Importer.csproj), which is the SDK's default root namespace"
    },
    {
      "what": "the Debug|AnyCPU and Release|AnyCPU groups' PlatformTarget, DebugSymbols, DebugType, Optimize, OutputPath, ErrorReport, WarningLevel, and Debug's DefineConstants=DEBUG;TRACE",
      "why": "these match the SDK's own Debug/Release defaults for a net48 project; only the Release DefineConstants addition (IMPORTER_RELEASE) and Prefer32Bit were non-default values and are kept"
    },
    {
      "what": "<Compile Include=\"ImportJob.cs\" />, <Compile Include=\"Mapping\\CustomerMap.cs\" />, <Compile Include=\"Program.cs\" />, <Compile Include=\"Properties\\AssemblyInfo.cs\" />",
      "why": "Microsoft.NET.Sdk globs **/*.cs by default; listing them explicitly would duplicate the glob and fail with NETSDK1022 unless default items were disabled"
    },
    {
      "what": "<Reference Include=\"System\" />, System.Core, System.Xml.Linq, System.Data.DataSetExtensions, Microsoft.CSharp, System.Data, System.Net.Http, System.Xml",
      "why": "Microsoft.NET.Sdk references these implicitly for a net48 target; System.Configuration is the one reference kept because it is not part of that implicit set"
    },
    {
      "what": "<Reference Include=\"CsvHelper, Version=30.0.0.0, ...\"> and <Reference Include=\"Newtonsoft.Json, Version=13.0.0.0, ...\"> with their packages/ HintPath",
      "why": "replaced by <PackageReference> items at the same NuGet package versions (30.0.1, 13.0.3) from packages.config; NuGet restore resolves the assemblies instead of a checked-in packages/ folder"
    },
    {
      "what": "<None Include=\"App.config\" />",
      "why": "the SDK's default None glob already includes every non-Compile/EmbeddedResource file, App.config included"
    },
    {
      "what": "<None Include=\"packages.config\" /> and the packages.config file itself",
      "why": "superseded by <PackageReference> items; packages.config is deleted"
    },
    {
      "what": "the <Project>{2F1B8C0D-6E4A-4B9F-8C21-5A7D3E9B0C14}</Project> and <Name>Quorlex.Data</Name> child elements of the Quorlex.Data ProjectReference",
      "why": "legacy VS project-system metadata; SDK-style MSBuild resolves ProjectReference by path alone"
    }
  ],
  "kept": [
    {
      "what": "<OutputType>Exe</OutputType>",
      "why": "not Library, so it is not the SDK default"
    },
    {
      "what": "<AssemblyName>quorlex-import</AssemblyName>",
      "why": "differs from the file name Quorlex.Importer, so it must stay explicit"
    },
    {
      "what": "<LangVersion>7.3</LangVersion>",
      "why": "explicit developer choice; the SDK wouldn't otherwise pin it"
    },
    {
      "what": "<TreatWarningsAsErrors>true</TreatWarningsAsErrors>",
      "why": "explicit developer choice, not an SDK default"
    },
    {
      "what": "<Prefer32Bit>false</Prefer32Bit>",
      "why": "explicit non-default value in the legacy file, set identically in both Debug and Release, so it is hoisted to the unconditioned PropertyGroup instead of repeated per-config"
    },
    {
      "what": "Release-only <DefineConstants>$(DefineConstants);IMPORTER_RELEASE</DefineConstants>",
      "why": "custom constant beyond DEBUG/TRACE; appended with $(DefineConstants) so it doesn't overwrite the SDK's own Release value (MX-02)"
    },
    {
      "what": "<Reference Include=\"System.Configuration\" />",
      "why": "not part of the SDK's implicit net48 framework reference set"
    },
    {
      "what": "CsvHelper 30.0.1 and Newtonsoft.Json 13.0.3 as PackageReference",
      "why": "same packages, same versions as packages.config, now managed by NuGet restore"
    },
    {
      "what": "ProjectReference to ..\\Quorlex.Data\\Quorlex.Data.csproj",
      "why": "project dependency, unchanged"
    },
    {
      "what": "mappings\\customers.json as <None Update> with CopyToOutputDirectory=PreserveNewest",
      "why": "the SDK's default None glob already creates this item; Update adds the same copy metadata the legacy Content item had (a Content Update here would silently match nothing, since Microsoft.NET.Sdk doesn't default Content items)"
    },
    {
      "what": "the AfterBuild target's Copy task, renamed to CopyAfterBuild with AfterTargets=\"Build\"",
      "why": "Microsoft.NET.Sdk imports its own empty AfterBuild target after the project body, so a target still named AfterBuild would never run (MX-05); the Copy step itself is unchanged"
    },
    {
      "what": "Properties/AssemblyInfo.cs (left on disk, not deleted)",
      "why": "GenerateAssemblyInfo is set to false so the SDK does not generate duplicate attributes (CS0579) alongside it"
    }
  ],
  "manual_steps": [
    "Run dotnet restore / dotnet build once to confirm CsvHelper 30.0.1 and Newtonsoft.Json 13.0.3 restore via PackageReference and the project still compiles.",
    "Confirm run-import.cmd still exists at the project root, since CopyAfterBuild still copies $(ProjectDir)run-import.cmd to $(OutDir).",
    "Check the built output's quorlex-import.exe.config for the binding redirects AutoGenerateBindingRedirects used to add; add <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects> back if any are missing.",
    "Optional follow-up: move the attributes from Properties/AssemblyInfo.cs into the project (or generated properties), delete Properties/AssemblyInfo.cs, and remove GenerateAssemblyInfo=false.",
    "Delete packages.config from source control (this reply already returns that as a delete) and confirm no other tooling (CI restore step, NuGet.Config) still expects it.",
    "Re-run the importer once end-to-end (or its tests) to confirm CsvHelper/Newtonsoft.Json behavior and the customers.json mapping file are unaffected."
  ],
  "risks": [
    "DebugType/Optimize/OutputPath/WarningLevel are no longer set explicitly for Debug/Release; check what the SDK actually produces for a net48 target before assuming parity with the legacy full/pdbonly PDB settings, especially if a symbol pipeline depends on the exact debug-info format.",
    "AutoGenerateBindingRedirects is no longer set explicitly; verify the generated quorlex-import.exe.config still carries any redirects CsvHelper/Newtonsoft.Json need (see manual_steps).",
    "The default Compile glob now recurses the whole src/Quorlex.Importer folder; verify there are no stray .cs files there that weren't in the original explicit Compile list, since they will now compile too.",
    "mappings\\customers.json moved from <Content Include> to <None Update>; the file is still copied to output with CopyToOutputDirectory=PreserveNewest, but if any custom target or code specifically queries MSBuild Content items (rather than reading the file from disk at runtime), update it to expect a None item instead."
  ],
  "questions": [],
  "summary": "Quorlex.Importer.csproj is rewritten as a plain Microsoft.NET.Sdk project on net48, per the note staying on .NET Framework 4.8 for now (no .NET 8 retarget attempted). CsvHelper and Newtonsoft.Json move from packages.config/HintPath references to PackageReference at the same versions (30.0.1, 13.0.3), and packages.config is deleted. The four explicit Compile items, the eight implicit framework references, and the redundant App.config/packages.config None items are dropped in favor of the SDK's default globs, while System.Configuration, the Quorlex.Data ProjectReference, the customers.json copy item, LangVersion/TreatWarningsAsErrors/Prefer32Bit/OutputType/AssemblyName, and the extra Release DefineConstants all stay. AfterBuild is renamed CopyAfterBuild (AfterTargets=\"Build\") since the SDK would otherwise silently drop the legacy target name, and GenerateAssemblyInfo is turned off so Properties/AssemblyInfo.cs keeps compiling."
}

Held to the page’s own reconciliation (recon.js, run by check.js on this exact body and reply), this reply has 0 disagreements in 27 statements checked.

What the step 5 samples print for this reply (the Python form):

converted - Quorlex.Importer.csproj is now SDK-style on net48, with CsvHelper and Newtonsoft.Json as PackageReference instead of packages.config.
target_framework: net48
rewrite src/Quorlex.Importer/Quorlex.Importer.csproj
delete src/Quorlex.Importer/packages.config

The page checks the reply against the files; the API does not

What comes back from the API is the model’s raw text in output.output. The page holds it to account before showing it (recon.js reconcile, with the facts and the files it sent), and a direct API caller gets none of this:

If you call the API directly, apply your own checks — the evidence against your files, every flag answered, the kept packages and versions — and build the result before you commit anything.

Step 1 — a tiny client helper and a token

One function per language that does what sdk.js does for every call: JSON in, bearer token if you have one, data out on a 2xx, an error carrying status, error.code and error.message otherwise. The later steps assume this helper is in the same file (for Go, Java and C#, the later snippets go inside main / the top-level statements; Java’s makeInput from step 3 goes in the class).

Then a token. Two kinds work:

BASE="https://api.skillsafe.ai/v1/app-api"
TOKEN="${SKILLSAFE_TOKEN:-YOUR_TOKEN}"   # see below

# api METHOD PATH [extra curl args...] -- prints the whole envelope; pipe to jq
api() {
  method="$1"; path="$2"; shift 2
  curl -sS -X "$method" "$BASE$path" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $TOKEN" "$@"
}
# success: jq '.data'      failure: jq '.error | {code, message}'

# ---- get a token
# personal token: export SKILLSAFE_TOKEN=... (from /tokens.html) and skip this
# guest token: no Authorization header on this one call
TOKEN=$(curl -sS -X POST "$BASE/guest" \
  -H "Content-Type: application/json" \
  -d '{"slug":"csproj-modernizer"}' | jq -r '.data.token')
echo "guest token: ${TOKEN:0:12}..."

Step 2 — GET /me

Who the token belongs to and what it can spend. sdk.js documents the shape as {subject_type, subject_id, credits, profile?}. The page treats the caller as signed in only when subject_type is "user", shows credits as the balance (1 credit = $0.0001, so it divides by 10 000 for the dollar figure), and compares it with the estimate in step 3 before it lets you run. 

api GET /me | jq '.data // .error'

Step 3 — build the input, then POST /estimate

First a small makeInput that does what buildInput does: task, then files and facts as compact JSON strings, then the note when it is not blank. The samples build the audit input from the two blocks of the audit worked example; step 5 reuses makeInput for the modernize one. Then price it. The body of /estimate is the same input you will send to /run; no job is created and nothing is charged — /estimate is free. From the response the page reads:

FieldMeaning
hold_creditsA reservation, not a price: the worst case the platform holds while the run is in flight. The page shows it as “reserves N credits ... for the audit run”. What you actually pay is the job’s charged_credits after settlement (step 4), normally less; the rest of the hold is released. A balance below the hold is allowed but the reply may be cut short (truncated: true).
min_creditsThe smallest balance that can start a run. Below it the page disables the run button, because the call would be a 402.
sponsor_enabledWhen true, a caller who is not signed in may run; otherwise the page asks them to sign in.
warningsInput warnings (for example a missing required field). They do not refuse the call, so check them before you run.

The page re-prices whenever the files, the note or the lane change. The amounts move with the model’s rates and grow with the size of files and facts (a rewrite also writes a whole project file back), so read them from the call rather than hard-coding them. 

# audit-files.json and audit-facts.json = the two blocks of the audit worked example.
# jq -c turns each into ONE compact string; note is optional (the page trims it, max 2000 chars).
BODY=$(jq -n --arg files "$(jq -c . audit-files.json)" --arg facts "$(jq -c . audit-facts.json)" \
  --arg note "CI fails about one build in five with 'The process cannot access the file Orders.Core.dll because it is being used by another process', and TreatWarningsAsErrors=false in Orders.Api seems to be ignored. What is going on?" \
  '{task: "audit", files: $files, facts: $facts, note: $note}')

api POST /estimate -d "$BODY" \
  | jq '.error // (.data | {hold_credits, min_credits, sponsor_enabled, warnings, model, model_alias, markup_bps})'

Step 4 — POST /run, then poll the job (audit)

Send the same input to /run with an Idempotency-Key header, using a personal token. Its data carries a job_id. Poll GET /jobs/{job_id} the way sdk.js waitForJob does: every second until status is succeeded or failed, giving up on the client side after 180 seconds. On the finished job, read:

Idempotency key. Resending a request with the same key must not start a second paid run, so derive the key from the input, not from the clock — and include the lane, so an audit and a rewrite of the same files never share a key. The page uses csproj-modernizer:<lane>:<hash>:a<attempt>, where <lane> is audit or modernize, <hash> is a 32-bit djb2 hash of JSON.stringify(input) in hex, a dash, and the string’s length in hex, and <attempt> is 1 for a normal run and 2 for the automatic reformat retry (which also adds retry_note). For the two worked examples that is csproj-modernizer:audit:6eb72c89-2062:a1 and csproj-modernizer:modernize:e851b2f6-251d:a1. The format is the page’s convention, not a requirement: any stable, unique string does. The samples below use the lane and a SHA-256 prefix.

The page itself uses /run-stream (step 5), not /run; both take the same body and header. 

KEY="csproj-modernizer:audit:$(printf '%s' "$BODY" | shasum -a 256 | cut -c1-16):a1"

JOB=$(api POST /run -H "Idempotency-Key: $KEY" -d "$BODY" | jq -r '.data.job_id')

for i in $(seq 180); do                       # 1 s interval, 180 s client-side limit
  J=$(api GET "/jobs/$JOB")
  S=$(printf '%s' "$J" | jq -r '.data.status')
  if [ "$S" = "succeeded" ] || [ "$S" = "failed" ]; then break; fi
  sleep 1
done

printf '%s' "$J" | jq '.data | {status, truncated, charged_credits, error}'
printf '%s' "$J" | jq -r '.data.output.output' | jq '{verdict, headline, findings: [(.findings // [])[] | {id, file, line, severity}]}'

Step 5 — POST /run-stream (Server-Sent Events, modernize)

The alternative to step 4, and what the page uses: same kind of body, same Idempotency-Key header, one request. Run one or the other for a given input, not both. To show the second lane, the samples build the modernize input from the modernize worked example (with its own key) and stream it; to stream the audit instead, pass the step 3 input and key. The response is text/event-stream. sdk.js splits it into frames on a blank line, takes the event name from an event: line (default message) and concatenates the data: lines, skips frames with no data or with data that is not JSON, and handles these events:

EventDataWhat the SDK does
delta{text}Passes text to onDelta.
jobjob infoPasses it to onJob (the page uses it to advance its progress display).
donethe final payload: {job_id, status, charged_credits, output}Keeps it as the result.
pendinga payloadTreated exactly like done. If it carries a job_id and no output, poll that job as in step 4.
error{message, code, job_id}After the stream ends, raises an error with those fields.

If the response is not text/event-stream, it is an ordinary JSON envelope: the SDK returns its data (an idempotent replay returns this way) or raises the error on a non-2xx status. Handle both shapes.

From the final payload the page reads output.output (falling back to the concatenated delta text), truncated and charged_credits. Browsers receive progress ticks rather than deltas from this endpoint, so the page relies on the final payload; if the stream fails part-way, it tries to recover a partial reply from whatever delta text arrived. The samples print the verdict and headline, the target_framework, and each returned file’s action and path; the rewritten project itself is that file’s content. 

# the modernize worked example: modernize-files.json and modernize-facts.json
MBODY=$(jq -n --arg files "$(jq -c . modernize-files.json)" --arg facts "$(jq -c . modernize-facts.json)" \
  --arg note "Move this importer to SDK-style first. It stays on .NET Framework 4.8 for now; .NET 8 comes later." \
  '{task: "modernize", files: $files, facts: $facts, note: $note}')
MKEY="csproj-modernizer:modernize:$(printf '%s' "$MBODY" | shasum -a 256 | cut -c1-16):a1"

# -N turns off buffering so frames print as they arrive
api POST /run-stream -N -H "Idempotency-Key: $MKEY" -d "$MBODY"

# frames look like:
#   event: job
#   data: {...}
#
#   event: done
#   data: {"job_id":"...","status":"...","charged_credits":...,"output":{"output":"{\"task\":\"modernize\",...}"}}

# keep only the final reply text:
api POST /run-stream -N -H "Idempotency-Key: $MKEY" -d "$MBODY" \
  | awk '/^event:/{ev=$2} /^data:/ && ev=="done"{sub(/^data: */,""); print}' \
  | jq -r '.output.output' | jq '{verdict, headline, target_framework, files: [(.files // [])[] | {path, action}]}'

What the page does that you now do

Or skip all of this and use Csproj Modernizer in the browser: the check, the flags, the legacy inventory and the Markdown and CSV exports are free.