diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3994097..7460c59 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,3 +78,82 @@ jobs:
           path: |
             dist/selftest
             dist/kit
+
+  manager:
+    name: Manager (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: manager
+    env:
+      TOOL_VERSION: 0.0.0-ci.${{ github.run_number }}
+      OUT: ../dist/manager
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: |
+            8.0.x
+            10.0.x
+
+      - name: Build
+        run: dotnet build DragoAnt.MSBuildKit.Manager.slnx -c Release -nologo
+
+      - name: Test
+        run: |
+          mkdir -p "$OUT"
+          dotnet test --solution DragoAnt.MSBuildKit.Manager.slnx -c Release --no-build \
+            --coverage --coverage-output-format cobertura --report-trx --report-xunit-junit \
+            --results-directory "$OUT/TestResults" 2>&1 | tee "$OUT/test.log"
+
+      - name: Prove the tests ran on Microsoft.Testing.Platform
+        run: |
+          grep -q 'Test run summary:' "$OUT/test.log" || { echo "dotnet test did not run on Microsoft.Testing.Platform (no MTP summary in the log)"; exit 1; }
+          echo "dotnet test ran on Microsoft.Testing.Platform (manager/global.json test.runner)" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Coverage gate (70 %)
+        run: |
+          files=$(find "$OUT/TestResults" -name '*.cobertura.xml')
+          [ -n "$files" ] || { echo "no cobertura report"; exit 1; }
+          for f in $files; do
+            rate=$(tr -d '\r' < "$f" | sed -n 's/.*<coverage line-rate="\([0-9.]*\)".*/\1/p' | head -n 1)
+            awk -v r="$rate" -v f="$f" 'BEGIN { printf "line coverage %.1f %% in %s\n", r * 100, f; exit !(r >= 0.70) }'
+          done
+
+      - name: Pack the tool
+        run: dotnet pack src/DragoAnt.MSBuildKit.Manager/DragoAnt.MSBuildKit.Manager.csproj -c Release -nologo -o "$OUT/feed" -p:Version="$TOOL_VERSION"
+
+      - name: Install and run the packed tool
+        run: |
+          dotnet tool install --tool-path "$OUT/tools" --add-source "$OUT/feed" DragoAnt.MSBuildKit.Manager --version "$TOOL_VERSION"
+          "$OUT/tools/mskit-manager" --help
+          "$OUT/tools/mskit-manager" status --json > "$OUT/status.json"
+          cat "$OUT/status.json"
+          tr -d '\r' < "$OUT/status.json" | grep -q "\"version\": \"$TOOL_VERSION\"" || { echo "status --json did not report $TOOL_VERSION"; exit 1; }
+
+      - name: Test results
+        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
+        with:
+          name: Manager tests (${{ matrix.os }})
+          path: dist/manager/TestResults/*.trx
+          reporter: dotnet-trx
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: manager-${{ matrix.os }}
+          path: dist/manager
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 788b188..4a49c06 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to this project are documented here. The format follows [Kee
 
 ## [Unreleased]
 
+### Added
+
+- `manager/`: the first build of `mskit-manager`, the `DragoAnt.MSBuildKit.Manager` .NET tool (`net8.0`, `net10.0`, `RollForward=Major`) that will install, update and migrate the kit. This build has one command, `status [--json]`, which prints the tool version; the logo goes to stderr, only on a terminal and never with `--no-logo`, so `--json` output always parses. Each run writes a log under `<system temp>/mskit-manager/logs/`, named after the command, newest 20 kept. Not published yet.
+
 ## [0.2.1] - 2026-10-05
 
 ### Added
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 77d26d1..daf94dd 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -8,6 +8,7 @@ Issues and pull requests are welcome.
 - `samples/MinimalLibrary` is a consumer with a library and a test project; its `.toolkit/` is installed by the self-test and not committed.
 - `tests/run.sh` is the self-test; `tests/fixtures/PackageChecks` breaks every package rule on purpose.
 - `tools/pack-kit.sh` builds the release zip and its SHA-256.
+- `manager/` is the `mskit-manager` .NET tool: its own solution, central package versions and `global.json`, built against `manager/.toolkit/` — the working-tree kit installed with `sh kit/.toolkit/update.sh --source kit --root manager` and committed.
 
 ## Build and test
 
@@ -19,6 +20,14 @@ sh tests/run.sh
 
 It installs the working-tree kit into the sample and the fixtures with `update.sh`, then checks the computed versions for local, branch, pull-request and tag builds, runs the sample's tests with coverage, inspects the packed nuspec, and asserts that every `MSKIT_PKG` check fires on the fixtures. CI runs the same script on Linux and Windows.
 
+The tool's tests run from `manager/`, so its `global.json` selects Microsoft.Testing.Platform:
+
+```sh
+cd manager && dotnet test --solution DragoAnt.MSBuildKit.Manager.slnx
+```
+
+CI's `manager` job also packs the tool, installs it into a tool path and runs `mskit-manager --help` and `status --json`.
+
 ## Changing the kit
 
 - A new property defaults with `Condition="'$(Name)'==''"`, so a consumer's value always wins, and gets a row in the README.
diff --git a/manager/.toolkit/kit.json b/manager/.toolkit/kit.json
new file mode 100644
index 0000000..e5e1742
--- /dev/null
+++ b/manager/.toolkit/kit.json
@@ -0,0 +1,6 @@
+{
+  "repository": "DragoAnt/MSBuildKit",
+  "version": "0.0.0-local",
+  "sha256": "",
+  "parts": []
+}
diff --git a/manager/.toolkit/kit.parts b/manager/.toolkit/kit.parts
new file mode 100644
index 0000000..180cd2b
--- /dev/null
+++ b/manager/.toolkit/kit.parts
@@ -0,0 +1,20 @@
+# DragoAnt.MSBuildKit parts: <name> <default|optional> [required parts...]
+# The folder of a part is msbuild/DragoAnt.MSBuildKit.<name> ("Trunk" is msbuild/DragoAnt.MSBuildKit).
+Core default
+Trunk default
+Vcs.GitHub default
+TfmConstants default
+Packaging default
+Testing default
+Testing.XUnit.v3 default Testing
+Locals.Compile default
+Locals.DirectorySecrets default
+Locals.Secrets default
+PrivateAssets default
+Project.RoslynComponent optional
+Project.CodeAnalyzer optional Project.RoslynComponent
+Project.CodeFixer optional Project.RoslynComponent Project.CodeAnalyzer
+Project.SourceGenerator optional Project.RoslynComponent
+PackageAsProj optional
+ProjMetadata optional
+EF optional
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/audit/audit.autodetect-mutex.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/audit/audit.autodetect-mutex.targets
new file mode 100644
index 0000000..74fc36e
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/audit/audit.autodetect-mutex.targets
@@ -0,0 +1,15 @@
+<Project>
+
+  <!-- MSKIT_CORE001: the project name matched more than one auto-detect regex. -->
+  <Target Name="ValidateAutoDetectedProjectTypeMutex"
+          BeforeTargets="CoreCompile;Build"
+          Condition="@(MSKit_AutoDetectedProjectType-&gt;Count()) &gt; 1">
+    <PropertyGroup>
+      <_MSKit_AutoDetectedTypes>@(MSKit_AutoDetectedProjectType, ', ')</_MSKit_AutoDetectedTypes>
+    </PropertyGroup>
+    <Error Code="MSKIT_CORE001"
+           File="$(MSBuildProjectFullPath)"
+           Text="Project '$(MSBuildProjectName)' auto-detected as MULTIPLE project types: $(_MSKit_AutoDetectedTypes).%0AA project can be exactly ONE type.%0AFix ONE of:%0A  1. Rename the project so its name matches only ONE auto-detect regex%0A  2. Override the conflicting MSKit_*ProjectNameRegex in Directory.Build.props to exclude this project name%0A  3. Set the corresponding MSKit_Disable*AutoDetect=true in the csproj and import the explicit endpoint instead (e.g. MSKit_DisableCodeAnalyzerAutoDetect=true + Import &quot;$(CodeAnalyzerCommonPropsPath)&quot;)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/audit/audit.roslyn-satellites.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/audit/audit.roslyn-satellites.targets
new file mode 100644
index 0000000..d5b0b61
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/audit/audit.roslyn-satellites.targets
@@ -0,0 +1,33 @@
+<Project>
+
+  <!-- MSKIT_ROSLYN001..003: a project name matched a Roslyn auto-detect regex, but the kit part
+       that wires that project type is not installed. -->
+
+  <Target Name="ValidateCodeAnalyzerSatelliteAttached"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(MSKit_IsCodeAnalyzerAutoDetected)'=='True'
+                      AND '$(MSKit_CodeAnalyzerSatelliteAttached)'!='true'">
+    <Error Code="MSKIT_ROSLYN001"
+           File="$(MSBuildProjectFullPath)"
+           Text="Project '$(MSBuildProjectName)' name matches the CodeAnalyzer auto-detect regex '$(_MSKit_CodeAnalyzerProjectNameRegex_Shared)' but the kit part 'DragoAnt.MSBuildKit.Project.CodeAnalyzer' is not installed.%0AFix: pwsh .toolkit/update.ps1 -Add Project.CodeAnalyzer   (or: sh .toolkit/update.sh --add Project.CodeAnalyzer)%0AOr, if this project is not a Roslyn analyzer, rename it or set MSKit_DisableCodeAnalyzerAutoDetect=true in the csproj." />
+  </Target>
+
+  <Target Name="ValidateCodeFixerSatelliteAttached"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(MSKit_IsCodeFixerAutoDetected)'=='True'
+                      AND '$(MSKit_CodeFixerSatelliteAttached)'!='true'">
+    <Error Code="MSKIT_ROSLYN002"
+           File="$(MSBuildProjectFullPath)"
+           Text="Project '$(MSBuildProjectName)' name matches the CodeFixer auto-detect regex '$(_MSKit_CodeFixerProjectNameRegex_Shared)' but the kit part 'DragoAnt.MSBuildKit.Project.CodeFixer' is not installed.%0AFix: pwsh .toolkit/update.ps1 -Add Project.CodeFixer   (or: sh .toolkit/update.sh --add Project.CodeFixer)%0AOr, if this project is not a Roslyn code-fix provider, rename it or set MSKit_DisableCodeFixerAutoDetect=true in the csproj." />
+  </Target>
+
+  <Target Name="ValidateSourceGeneratorSatelliteAttached"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(MSKit_IsSourceGeneratorAutoDetected)'=='True'
+                      AND '$(MSKit_SourceGeneratorSatelliteAttached)'!='true'">
+    <Error Code="MSKIT_ROSLYN003"
+           File="$(MSBuildProjectFullPath)"
+           Text="Project '$(MSBuildProjectName)' name matches the SourceGenerator auto-detect regex '$(_MSKit_SourceGeneratorProjectNameRegex_Shared)' but the kit part 'DragoAnt.MSBuildKit.Project.SourceGenerator' is not installed.%0AFix: pwsh .toolkit/update.ps1 -Add Project.SourceGenerator   (or: sh .toolkit/update.sh --add Project.SourceGenerator)%0AOr, if this project is not a Roslyn source generator, rename it or set MSKit_DisableSourceGeneratorAutoDetect=true in the csproj." />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/core.common.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/core.common.props
new file mode 100644
index 0000000..cac50d6
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/core.common.props
@@ -0,0 +1,32 @@
+<Project>
+
+  <PropertyGroup>
+    <MSKit_Diagnostic Condition="'$(MSKit_Diagnostic)'==''">false</MSKit_Diagnostic>
+    <!-- True on a developer machine; the Vcs.GitHub part flips it to False on GitHub Actions. -->
+    <MSKit_IsDevEnv Condition="'$(MSKit_IsDevEnv)'==''">True</MSKit_IsDevEnv>
+
+    <!-- A Version that exists before the kit loads (-p:Version=... or Directory.Build.props
+         above the import) is the caller's decision: the version engine then renders nothing. -->
+    <MSKit_ExplicitVersion Condition="'$(MSKit_ExplicitVersion)'==''">$(Version)</MSKit_ExplicitVersion>
+
+    <MSKit_ImplicitPackageVersions Condition="'$(MSKit_ImplicitPackageVersions)'==''">True</MSKit_ImplicitPackageVersions>
+
+    <MSKit_Templates Condition="'$(MSKit_Templates)'==''">$(MSBuildThisFileDirectory)../../.local/</MSKit_Templates>
+
+    <MSKit_SlnFileDirectory Condition="'$(MSKit_SlnFileDirectory)'=='' AND '$(SlnxFilePath)'!=''">$([System.IO.Path]::GetDirectoryName('$(SlnxFilePath)').Replace('\', '/').TrimEnd('/'))/</MSKit_SlnFileDirectory>
+    <MSKit_SlnFileDirectory Condition="'$(MSKit_SlnFileDirectory)'==''">$(MSBuildThisFileDirectory)../../../</MSKit_SlnFileDirectory>
+    <MSKit_SlnFileDirectory>$([System.IO.Path]::GetFullPath('$(MSKit_SlnFileDirectory)').Replace('\', '/').TrimEnd('/'))/</MSKit_SlnFileDirectory>
+
+    <MSKit_SlnFileName Condition="'$(MSKit_SlnFileName)'=='' AND '$(SlnxFilePath)'!=''">$([System.IO.Path]::GetFileNameWithoutExtension('$(SlnxFilePath)'))</MSKit_SlnFileName>
+
+    <MSKit_ToolkitMSBuildDir Condition="'$(MSKit_ToolkitMSBuildDir)'==''">$([System.IO.Path]::GetFullPath('$(MSBuildThisFileDirectory)../').Replace('\', '/').TrimEnd('/'))/</MSKit_ToolkitMSBuildDir>
+    <MSKit_ToolkitDir Condition="'$(MSKit_ToolkitDir)'==''">$([System.IO.Path]::GetFullPath('$(MSBuildThisFileDirectory)../../').Replace('\', '/').TrimEnd('/'))/</MSKit_ToolkitDir>
+
+    <_ProjectObjDir>$(BaseIntermediateOutputPath)</_ProjectObjDir>
+    <_ProjectObjDir Condition="'$(_ProjectObjDir)'==''">obj</_ProjectObjDir>
+    <MSKit_ProjectObjDir Condition="$([System.IO.Path]::IsPathRooted('$(_ProjectObjDir)'))">$(_ProjectObjDir)</MSKit_ProjectObjDir>
+    <MSKit_ProjectObjDir Condition="'$(MSKit_ProjectObjDir)'==''">$([System.IO.Path]::GetFullPath('$(MSBuildProjectDirectory)/$(_ProjectObjDir)'))</MSKit_ProjectObjDir>
+    <MSKit_ProjectObjDir>$([System.IO.Path]::GetFullPath('$(MSKit_ProjectObjDir)').TrimEnd('/').Replace('\', '/'))</MSKit_ProjectObjDir>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/core.locals.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/core.locals.props
new file mode 100644
index 0000000..162da03
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/core.locals.props
@@ -0,0 +1,8 @@
+<Project>
+
+  <PropertyGroup>
+    <MSKit_LocalSecretsBaseDirectory Condition="'$(MSKit_LocalSecretsBaseDirectory)'=='' AND $([MSBuild]::IsOsPlatform('Windows'))">$([System.Environment]::GetFolderPath(SpecialFolder.ApplicationData))\Microsoft\UserSecrets\</MSKit_LocalSecretsBaseDirectory>
+    <MSKit_LocalSecretsBaseDirectory Condition="'$(MSKit_LocalSecretsBaseDirectory)'=='' AND ($([MSBuild]::IsOsPlatform('Linux')) OR $([MSBuild]::IsOsPlatform('OSX')))">$([System.Environment]::GetFolderPath(SpecialFolder.UserProfile))/.microsoft/usersecrets/</MSKit_LocalSecretsBaseDirectory>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/core.locals.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/core.locals.targets
new file mode 100644
index 0000000..fcae3d7
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/core.locals.targets
@@ -0,0 +1,8 @@
+<Project>
+
+  <!-- UserSecretsId is set in the csproj, after every props file, so this lives in targets. -->
+  <PropertyGroup Condition="'$(UserSecretsId)'!=''">
+    <LocalSecretsDir Condition="'$(LocalSecretsDir)'==''">$(MSKit_LocalSecretsBaseDirectory)$(UserSecretsId)</LocalSecretsDir>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/git.root.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/git.root.props
new file mode 100644
index 0000000..74b018a
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/git.root.props
@@ -0,0 +1,29 @@
+<Project>
+
+  <!-- GitHub Actions checks out tags and pull requests detached, so .git/HEAD holds a SHA there:
+       the CI ref name wins over the local HEAD whenever Actions is running. -->
+  <PropertyGroup Condition="'$(MSKit_Branch)'=='' AND '$(GITHUB_ACTIONS)'=='true' AND '$(GITHUB_HEAD_REF)'!=''">
+    <MSKit_Branch>$(GITHUB_HEAD_REF)</MSKit_Branch>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(MSKit_Branch)'=='' AND '$(GITHUB_ACTIONS)'=='true' AND '$(GITHUB_REF_NAME)'!=''">
+    <MSKit_Branch>$(GITHUB_REF_NAME)</MSKit_Branch>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <MSKit_GitRoot Condition="'$(MSKit_GitRoot)'==''">$([MSBuild]::GetDirectoryNameOfFileAbove('$(MSBuildProjectDirectory)', '.git'))</MSKit_GitRoot>
+    <MSKit_GitRoot Condition="'$(MSKit_GitRoot)'==''">$([MSBuild]::GetDirectoryNameOfFileAbove('$(MSBuildProjectDirectory)', '.git/HEAD'))</MSKit_GitRoot>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(MSKit_GitRoot)'!=''">
+    <_MSKit_GitHeadFile Condition="Exists('$(MSKit_GitRoot)/.git/HEAD')">$(MSKit_GitRoot)/.git/HEAD</_MSKit_GitHeadFile>
+    <!-- In a git worktree .git is a file pointing at the worktree's own git dir. -->
+    <_MSKit_GitDirPointer Condition="'$(_MSKit_GitHeadFile)'=='' AND Exists('$(MSKit_GitRoot)/.git')">$([System.IO.File]::ReadAllText('$(MSKit_GitRoot)/.git').Trim().Replace('gitdir: ', ''))</_MSKit_GitDirPointer>
+    <_MSKit_GitDirPointer Condition="'$(_MSKit_GitDirPointer)'!='' AND !$([System.IO.Path]::IsPathRooted('$(_MSKit_GitDirPointer)'))">$(MSKit_GitRoot)/$(_MSKit_GitDirPointer)</_MSKit_GitDirPointer>
+    <_MSKit_GitHeadFile Condition="'$(_MSKit_GitDirPointer)'!='' AND Exists('$(_MSKit_GitDirPointer)/HEAD')">$(_MSKit_GitDirPointer)/HEAD</_MSKit_GitHeadFile>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(MSKit_Branch)'=='' AND '$(_MSKit_GitHeadFile)'!=''">
+    <MSKit_Branch>$([System.IO.File]::ReadAllText('$(_MSKit_GitHeadFile)').Trim().Replace('ref: refs/heads/', ''))</MSKit_Branch>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/git.routine.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/git.routine.props
new file mode 100644
index 0000000..2993abe
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/git.routine.props
@@ -0,0 +1,12 @@
+<Project>
+
+  <PropertyGroup>
+    <MSKit_Branch Condition="'$(MSKit_Branch)'=='' AND '$(GITHUB_REF_NAME)'!=''">$(GITHUB_REF_NAME)</MSKit_Branch>
+    <MSKit_Branch Condition="'$(MSKit_Branch)'==''">unknown-branch</MSKit_Branch>
+    <MSKit_CommitSha Condition="'$(MSKit_CommitSha)'==''"></MSKit_CommitSha>
+    <MSKit_IsStableBranchRegex Condition="'$(MSKit_IsStableBranchRegex)'==''">^(main|master|release/.+)$</MSKit_IsStableBranchRegex>
+    <MSKit_IsStableBranch>false</MSKit_IsStableBranch>
+    <MSKit_IsStableBranch Condition="$([System.Text.RegularExpressions.Regex]::IsMatch($(MSKit_Branch), $(MSKit_IsStableBranchRegex), RegexOptions.IgnoreCase))">true</MSKit_IsStableBranch>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/init.props
new file mode 100644
index 0000000..edfb4ee
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/init.props
@@ -0,0 +1,10 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory)core.common.props" />
+  <Import Project="$(MSBuildThisFileDirectory)git.root.props" />
+  <Import Project="$(MSBuildThisFileDirectory)git.routine.props" />
+  <Import Project="$(MSBuildThisFileDirectory)tfm.routine.props" />
+  <Import Project="$(MSBuildThisFileDirectory)core.locals.props" />
+  <Import Project="$(MSBuildThisFileDirectory)project-types.autodetect.props" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/init.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/init.targets
new file mode 100644
index 0000000..2869ae6
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/init.targets
@@ -0,0 +1,5 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory)core.locals.targets" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/project-types.autodetect.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/project-types.autodetect.props
new file mode 100644
index 0000000..b6ae321
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/project-types.autodetect.props
@@ -0,0 +1,46 @@
+<Project>
+
+  <!-- Filename-based detection of Roslyn project types. Override a regex in Directory.Build.props,
+       or turn detection off with MSKit_Disable<Type>AutoDetect=true and import the matching
+       $(<Type>CommonPropsPath) explicitly. The lookbehind keeps the kit's own part names from
+       matching themselves. -->
+  <PropertyGroup>
+    <MSKit_CodeAnalyzerProjectNameRegex Condition="'$(MSKit_CodeAnalyzerProjectNameRegex)'==''">(?&lt;!^DragoAnt\.MSBuildKit\.Project)\.Analyzers$</MSKit_CodeAnalyzerProjectNameRegex>
+    <MSKit_CodeFixerProjectNameRegex Condition="'$(MSKit_CodeFixerProjectNameRegex)'==''">(?&lt;!^DragoAnt\.MSBuildKit\.Project)\.CodeFixes$</MSKit_CodeFixerProjectNameRegex>
+    <MSKit_SourceGeneratorProjectNameRegex Condition="'$(MSKit_SourceGeneratorProjectNameRegex)'==''">(?&lt;!^DragoAnt\.MSBuildKit\.Project)\.SourceGenerator$</MSKit_SourceGeneratorProjectNameRegex>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <MSKit_IsCodeAnalyzerAutoDetected Condition="'$(MSKit_IsCodeAnalyzerAutoDetected)'==''
+                                                  AND '$(IsCodeAnalyzer)'==''
+                                                  AND '$(MSKit_DisableCodeAnalyzerAutoDetect)'!='true'
+                                                  AND '$(MSKit_CodeAnalyzerProjectNameRegex)'!=''">$([System.Text.RegularExpressions.Regex]::IsMatch($(MSBuildProjectName), $(MSKit_CodeAnalyzerProjectNameRegex)))</MSKit_IsCodeAnalyzerAutoDetected>
+    <IsCodeAnalyzer Condition="'$(IsCodeAnalyzer)'=='' AND '$(MSKit_IsCodeAnalyzerAutoDetected)'=='True'">True</IsCodeAnalyzer>
+
+    <MSKit_IsCodeFixerAutoDetected Condition="'$(MSKit_IsCodeFixerAutoDetected)'==''
+                                               AND '$(IsCodeFixer)'==''
+                                               AND '$(MSKit_DisableCodeFixerAutoDetect)'!='true'
+                                               AND '$(MSKit_CodeFixerProjectNameRegex)'!=''">$([System.Text.RegularExpressions.Regex]::IsMatch($(MSBuildProjectName), $(MSKit_CodeFixerProjectNameRegex)))</MSKit_IsCodeFixerAutoDetected>
+    <IsCodeFixer Condition="'$(IsCodeFixer)'=='' AND '$(MSKit_IsCodeFixerAutoDetected)'=='True'">True</IsCodeFixer>
+
+    <MSKit_IsSourceGeneratorAutoDetected Condition="'$(MSKit_IsSourceGeneratorAutoDetected)'==''
+                                                     AND '$(IsSourceGenerator)'==''
+                                                     AND '$(MSKit_DisableSourceGeneratorAutoDetect)'!='true'
+                                                     AND '$(MSKit_SourceGeneratorProjectNameRegex)'!=''">$([System.Text.RegularExpressions.Regex]::IsMatch($(MSBuildProjectName), $(MSKit_SourceGeneratorProjectNameRegex)))</MSKit_IsSourceGeneratorAutoDetected>
+    <IsSourceGenerator Condition="'$(IsSourceGenerator)'=='' AND '$(MSKit_IsSourceGeneratorAutoDetected)'=='True'">true</IsSourceGenerator>
+  </PropertyGroup>
+
+  <!-- Snapshots of the regexes the detection used; audits read these, not a later csproj override. -->
+  <PropertyGroup>
+    <_MSKit_CodeAnalyzerProjectNameRegex_Shared>$(MSKit_CodeAnalyzerProjectNameRegex)</_MSKit_CodeAnalyzerProjectNameRegex_Shared>
+    <_MSKit_CodeFixerProjectNameRegex_Shared>$(MSKit_CodeFixerProjectNameRegex)</_MSKit_CodeFixerProjectNameRegex_Shared>
+    <_MSKit_SourceGeneratorProjectNameRegex_Shared>$(MSKit_SourceGeneratorProjectNameRegex)</_MSKit_SourceGeneratorProjectNameRegex_Shared>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <MSKit_AutoDetectedProjectType Include="CodeAnalyzer" Condition="'$(MSKit_IsCodeAnalyzerAutoDetected)'=='True'" />
+    <MSKit_AutoDetectedProjectType Include="CodeFixer" Condition="'$(MSKit_IsCodeFixerAutoDetected)'=='True'" />
+    <MSKit_AutoDetectedProjectType Include="SourceGenerator" Condition="'$(MSKit_IsSourceGeneratorAutoDetected)'=='True'" />
+  </ItemGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/tfm.routine.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/tfm.routine.props
new file mode 100644
index 0000000..0239a0f
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Core/tfm.routine.props
@@ -0,0 +1,42 @@
+<Project>
+
+  <!-- Lets a csproj switch between TargetFramework and TargetFrameworks against a shared value in
+       Directory.Build.props. It runs in props because the SDK locks IsCrossTargetingBuild before
+       the targets phase. The DBP text is read directly, because Pack re-evaluates each inner build
+       with TargetFramework as a global property, which looks exactly like a DBP declaration. -->
+  <PropertyGroup>
+    <_MSKit_DbpFilePath>$([MSBuild]::GetPathOfFileAbove('Directory.Build.props'))</_MSKit_DbpFilePath>
+    <_MSKit_DbpText Condition="'$(_MSKit_DbpFilePath)' != '' AND Exists('$(_MSKit_DbpFilePath)')">$([System.IO.File]::ReadAllText('$(_MSKit_DbpFilePath)'))</_MSKit_DbpText>
+
+    <_MSKit_DbpHasTargetFramework Condition="'$(_MSKit_DbpText)' != '' AND ($(_MSKit_DbpText.Contains('&lt;TargetFramework&gt;')) OR $(_MSKit_DbpText.Contains('&lt;TargetFramework ')))">True</_MSKit_DbpHasTargetFramework>
+    <_MSKit_DbpHasTargetFrameworks Condition="'$(_MSKit_DbpText)' != '' AND ($(_MSKit_DbpText.Contains('&lt;TargetFrameworks&gt;')) OR $(_MSKit_DbpText.Contains('&lt;TargetFrameworks ')))">True</_MSKit_DbpHasTargetFrameworks>
+
+    <MSKit_TargetFramework_Shared Condition="'$(_MSKit_DbpHasTargetFramework)' == 'True'">$([System.Text.RegularExpressions.Regex]::Match($(_MSKit_DbpText), '&lt;TargetFramework[^&gt;/]*&gt;([^&lt;]*)&lt;/TargetFramework&gt;').Groups[1].Value)</MSKit_TargetFramework_Shared>
+    <MSKit_TargetFrameworks_Shared Condition="'$(_MSKit_DbpHasTargetFrameworks)' == 'True'">$([System.Text.RegularExpressions.Regex]::Match($(_MSKit_DbpText), '&lt;TargetFrameworks[^&gt;/]*&gt;([^&lt;]*)&lt;/TargetFrameworks&gt;').Groups[1].Value)</MSKit_TargetFrameworks_Shared>
+  </PropertyGroup>
+
+  <!-- A text precheck keeps the regex off projects that declare neither element.
+       MSKit_GuardXmlPeekRoutine=False disables it. -->
+  <PropertyGroup>
+    <_MSKit_GuardXmlPeekRoutine Condition="'$(MSKit_GuardXmlPeekRoutine)'!='False'">True</_MSKit_GuardXmlPeekRoutine>
+    <_MSKit_CsprojText Condition="'$(_MSKit_GuardXmlPeekRoutine)'=='True' AND '$(_MSKit_CsprojText)'==''">$([System.IO.File]::ReadAllText('$(MSBuildProjectFullPath)'))</_MSKit_CsprojText>
+    <_MSKit_RoutineHasTargetFramework Condition="'$(_MSKit_GuardXmlPeekRoutine)'!='True'">True</_MSKit_RoutineHasTargetFramework>
+    <_MSKit_RoutineHasTargetFramework Condition="'$(_MSKit_GuardXmlPeekRoutine)'=='True' AND ($(_MSKit_CsprojText.Contains('&lt;TargetFramework&gt;')) OR $(_MSKit_CsprojText.Contains('&lt;TargetFramework ')))">True</_MSKit_RoutineHasTargetFramework>
+    <_MSKit_RoutineHasTargetFrameworks Condition="'$(_MSKit_GuardXmlPeekRoutine)'!='True'">True</_MSKit_RoutineHasTargetFrameworks>
+    <_MSKit_RoutineHasTargetFrameworks Condition="'$(_MSKit_GuardXmlPeekRoutine)'=='True' AND ($(_MSKit_CsprojText.Contains('&lt;TargetFrameworks&gt;')) OR $(_MSKit_CsprojText.Contains('&lt;TargetFrameworks ')))">True</_MSKit_RoutineHasTargetFrameworks>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <MSKit_TargetFramework_Proj Condition="'$(_MSKit_RoutineHasTargetFramework)'=='True'">$([System.Text.RegularExpressions.Regex]::Match($(_MSKit_CsprojText), '&lt;TargetFramework[^&gt;/]*&gt;([^&lt;]*)&lt;/TargetFramework&gt;').Groups[1].Value)</MSKit_TargetFramework_Proj>
+    <MSKit_TargetFrameworks_Proj Condition="'$(_MSKit_RoutineHasTargetFrameworks)'=='True'">$([System.Text.RegularExpressions.Regex]::Match($(_MSKit_CsprojText), '&lt;TargetFrameworks[^&gt;/]*&gt;([^&lt;]*)&lt;/TargetFrameworks&gt;').Groups[1].Value)</MSKit_TargetFrameworks_Proj>
+  </PropertyGroup>
+
+  <!-- The csproj declares only one shape: clear the shared value of the other shape. -->
+  <PropertyGroup Condition="'$(MSKit_TargetFrameworks_Proj)'!='' AND '$(MSKit_TargetFramework_Proj)'=='' AND '$(MSKit_TargetFramework_Shared)'!=''">
+    <TargetFramework></TargetFramework>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(MSKit_TargetFramework_Proj)'!='' AND '$(MSKit_TargetFrameworks_Proj)'=='' AND '$(MSKit_TargetFrameworks_Shared)'!=''">
+    <TargetFrameworks></TargetFrameworks>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/init.props
new file mode 100644
index 0000000..47e2180
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/init.props
@@ -0,0 +1,3 @@
+<Project>
+  <Import Project="$(MSBuildThisFileDirectory)local.compile.props" />
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/init.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/init.targets
new file mode 100644
index 0000000..3c6b4c8
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/init.targets
@@ -0,0 +1,3 @@
+<Project>
+  <Import Project="$(MSBuildThisFileDirectory)local.compile.targets" />
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/local.compile.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/local.compile.props
new file mode 100644
index 0000000..b068b85
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/local.compile.props
@@ -0,0 +1,7 @@
+<Project>
+
+  <PropertyGroup>
+    <LocalCompileTemplateDir Condition="'$(LocalCompileTemplateDir)'==''">$(MSKit_Templates)LocalCompile/</LocalCompileTemplateDir>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/local.compile.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/local.compile.targets
new file mode 100644
index 0000000..77eb087
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Compile/local.compile.targets
@@ -0,0 +1,40 @@
+<Project InitialTargets="CreateLocalCompileFiles">
+
+  <PropertyGroup>
+    <_LocalCompileNamespace>$(RootNamespace)</_LocalCompileNamespace>
+    <_LocalCompileNamespace Condition="'$(_LocalCompileNamespace)'==''">$(MSBuildProjectName)</_LocalCompileNamespace>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(UserSecretsId)' != ''">
+    <LocalCompileFile Include="@(LocalCompile->'$(LocalSecretsDir)/%(Filename)%(Extension)')"
+                      Template="$(LocalCompileTemplateDir)%(Filename)%(Extension)" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <LocalCompileFile Update="@(LocalCompileFile)" Visible="False" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Compile Include="@(LocalCompileFile)">
+      <Link>%(Filename)</Link>
+    </Compile>
+  </ItemGroup>
+
+  <!-- Create LocalCompile files in LocalSecretsDir from templates in .toolkit/.local/LocalCompile/.
+       Templates contain the real code (may have ctor args, interface impls, etc.).
+       Default namespace-only stub is generated only when a new LocalCompile item has no template yet. -->
+  <Target Condition="'@(LocalCompileFile)'!=''" Name="CreateLocalCompileFiles">
+    <MakeDir Directories="$(LocalSecretsDir)" Condition="!Exists('$(LocalSecretsDir)')" />
+
+    <MakeDir Directories="$(LocalCompileTemplateDir)" Condition="!Exists('$(LocalCompileTemplateDir)')" />
+
+    <WriteLinesToFile
+      File="%(LocalCompileFile.Template)"
+      Condition="!Exists('%(LocalCompileFile.Template)')"
+      Lines="namespace $(_LocalCompileNamespace)%3B" />
+
+    <Copy Condition="!Exists('%(LocalCompileFile.Identity)')"
+          SourceFiles="%(Template)" DestinationFiles="%(Identity)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.props
new file mode 100644
index 0000000..effb46d
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.props
@@ -0,0 +1,9 @@
+<Project>
+
+  <PropertyGroup>
+    <MSKit_SlnSecretsCleanUp Condition="'$(MSKit_SlnSecretsCleanUp)'=='' AND '$(MSKit_IsDevEnv)'!='True'">True</MSKit_SlnSecretsCleanUp>
+  </PropertyGroup>
+
+  <Import Project="$(MSBuildThisFileDirectory)local.directory.secrets.props" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.targets
new file mode 100644
index 0000000..d2456b2
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.targets
@@ -0,0 +1,10 @@
+<Project>
+
+  <Import Condition="'$(MSKit_SlnSecretsCleanUp)'=='True'"
+          Project="$(MSBuildThisFileDirectory)local.directory.secrets.cleanup.targets" />
+
+  <ImportGroup Condition="'$(MSKit_IsDevEnv)'=='True'">
+    <Import Project="$(MSBuildThisFileDirectory)local.directory.secrets.targets" />
+  </ImportGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/local.directory.secrets.cleanup.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/local.directory.secrets.cleanup.targets
new file mode 100644
index 0000000..eb8172a
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/local.directory.secrets.cleanup.targets
@@ -0,0 +1,19 @@
+<Project InitialTargets="CleanupLocalSlnSecretsProps;CleanupLocalSlnSecretsTargets">
+
+  <Target Condition="'$(LocalSlnSecretsProps)'!='' AND Exists('$(LocalSlnSecretsProps)')"
+          Name="CleanupLocalSlnSecretsProps"
+          BeforeTargets="CreateLocalSlnSecretsProps;Restore;CoreCompile;Build;Publish">
+
+    <Delete Files="$(LocalSlnSecretsProps)" />
+
+  </Target>
+
+  <Target Condition="'$(LocalSlnSecretsTargets)'!='' AND Exists('$(LocalSlnSecretsTargets)')"
+          Name="CleanupLocalSlnSecretsTargets"
+          BeforeTargets="CreateLocalSlnSecretsTargets;Restore;CoreCompile;Build;Publish">
+
+    <Delete Files="$(LocalSlnSecretsTargets)" />
+
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/local.directory.secrets.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/local.directory.secrets.props
new file mode 100644
index 0000000..8dec6d3
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/local.directory.secrets.props
@@ -0,0 +1,31 @@
+<Project>
+
+  <PropertyGroup>
+    <MSKit_SlnSecretsId Condition="'$(MSKit_SlnSecretsId)'==''">$(MSKit_SlnFileName)</MSKit_SlnSecretsId>
+    <!-- MSKit_UseSlnSecretsProps: Import solution-level secrets .props file. -->
+    <MSKit_UseSlnSecretsProps Condition="'$(MSKit_UseSlnSecretsProps)'==''">False</MSKit_UseSlnSecretsProps>
+
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(MSKit_SlnSecretsId)'!=''">
+    <LocalSlnSecretsDir>$(MSKit_LocalSecretsBaseDirectory)$(MSKit_SlnSecretsId)</LocalSlnSecretsDir>
+    <LocalSlnSecretsProps Condition="'$(MSKit_UseSlnSecretsProps)'=='True'">$(LocalSlnSecretsDir)/Directory.Secrets.props</LocalSlnSecretsProps>
+
+    <LocalSlnSecretsTemplateDir>$(MSKit_Templates)</LocalSlnSecretsTemplateDir>
+    <LocalSlnSecretsTemplateProps Condition="'$(MSKit_UseSlnSecretsProps)'=='True'">$(LocalSlnSecretsTemplateDir)/Directory.Secrets.props</LocalSlnSecretsTemplateProps>
+  </PropertyGroup>
+
+  <Import Condition="Exists('$(LocalSlnSecretsProps)') AND '$(MSKit_IsDevEnv)'=='True'" Project="$(LocalSlnSecretsProps)" />
+
+  <PropertyGroup>
+    <!-- MSKit_UseSlnSecretsTargets: Import solution-level secrets .targets file. -->
+    <MSKit_UseSlnSecretsTargets Condition="'$(MSKit_UseSlnSecretsTargets)'==''">False</MSKit_UseSlnSecretsTargets>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(MSKit_SlnSecretsId)'!=''">
+    <LocalSlnSecretsTargets Condition="'$(MSKit_UseSlnSecretsTargets)'=='True'">$(LocalSlnSecretsDir)/Directory.Secrets.targets</LocalSlnSecretsTargets>
+
+    <LocalSlnSecretsTemplateTargets Condition="'$(MSKit_UseSlnSecretsTargets)'=='True'">$(LocalSlnSecretsTemplateDir)/Directory.Secrets.targets</LocalSlnSecretsTemplateTargets>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/local.directory.secrets.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/local.directory.secrets.targets
new file mode 100644
index 0000000..71e24f6
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.DirectorySecrets/local.directory.secrets.targets
@@ -0,0 +1,73 @@
+<Project
+  InitialTargets="CreateLocalSlnSecretsTemplateProps;CreateLocalSlnSecretsTemplateTargets;CreateLocalSlnSecretsProps;CreateLocalSlnSecretsTargets">
+
+  <Import Condition="Exists('$(LocalSlnSecretsTargets)')" Project="$(LocalSlnSecretsTargets)" />
+
+  <ItemGroup>
+    <None Condition="'$(LocalSlnSecretsProps)'!=''" Include="$(LocalSlnSecretsProps)">
+      <Link>Directory.Secrets.props</Link>
+      <ExcludeFromSingleFile>true</ExcludeFromSingleFile>
+    </None>
+    <None Condition="'$(LocalSlnSecretsTargets)'!=''" Include="$(LocalSlnSecretsTargets)">
+      <Link>Directory.Secrets.targets</Link>
+      <ExcludeFromSingleFile>true</ExcludeFromSingleFile>
+    </None>
+  </ItemGroup>
+
+  <PropertyGroup>
+    <LocalSlnSecretsEmptyTemplateNewBody>&lt;Project&gt;
+&lt;/Project&gt;
+    </LocalSlnSecretsEmptyTemplateNewBody>
+  </PropertyGroup>
+
+  <Target Condition="'$(LocalSlnSecretsTemplateProps)' != '' AND !Exists('$(LocalSlnSecretsTemplateProps)')"
+          Name="CreateLocalSlnSecretsTemplateProps">
+    <MakeDir Directories="$(LocalSlnSecretsTemplateDir)" Condition="!Exists('$(LocalSlnSecretsTemplateDir)')" />
+
+    <WriteLinesToFile
+      File="$(LocalSlnSecretsTemplateProps)"
+      Overwrite="true"
+      Lines="$(LocalSlnSecretsEmptyTemplateNewBody)" />
+
+    <Message Text="The file '$(LocalSlnSecretsTemplateProps)' was created." Importance="High" />
+  </Target>
+
+  <Target Condition="'$(LocalSlnSecretsTemplateTargets)' != '' AND !Exists('$(LocalSlnSecretsTemplateTargets)')"
+          Name="CreateLocalSlnSecretsTemplateTargets">
+    <MakeDir Directories="$(LocalSlnSecretsTemplateDir)" Condition="!Exists('$(LocalSlnSecretsTemplateDir)')" />
+
+    <WriteLinesToFile
+      File="$(LocalSlnSecretsTemplateTargets)"
+      Overwrite="true"
+      Lines="$(LocalSlnSecretsEmptyTemplateNewBody)" />
+
+    <Message Text="The file '$(LocalSlnSecretsTemplateTargets)' was created." Importance="High" />
+  </Target>
+
+  <Target Condition="'$(LocalSlnSecretsProps)' != '' AND !Exists('$(LocalSlnSecretsProps)')"
+          Name="CreateLocalSlnSecretsProps" AfterTargets="CreateLocalSlnSecretsTemplateProps">
+    <MakeDir Directories="$(LocalSlnSecretsDir)" Condition="!Exists('$(LocalSlnSecretsDir)')" />
+
+    <Copy Condition="Exists('$(LocalSlnSecretsTemplateProps)')" SourceFiles="$(LocalSlnSecretsTemplateProps)"
+          DestinationFiles="$(LocalSlnSecretsProps)" />
+
+    <WriteLinesToFile
+      File="$(LocalSlnSecretsProps)"
+      Overwrite="true"
+      Condition="!Exists('$(LocalSlnSecretsProps)')" Lines="$(LocalSlnSecretsEmptyTemplateNewBody)" />
+  </Target>
+
+  <Target Condition="'$(LocalSlnSecretsTargets)' != '' AND !Exists('$(LocalSlnSecretsTargets)')"
+          Name="CreateLocalSlnSecretsTargets" AfterTargets="CreateLocalSlnSecretsTemplateTargets">
+    <MakeDir Directories="$(LocalSlnSecretsDir)" Condition="!Exists('$(LocalSlnSecretsDir)')" />
+
+    <Copy Condition="Exists('$(LocalSlnSecretsTemplateTargets)')" SourceFiles="$(LocalSlnSecretsTemplateTargets)"
+          DestinationFiles="$(LocalSlnSecretsTargets)" />
+
+    <WriteLinesToFile
+      File="$(LocalSlnSecretsTargets)"
+      Overwrite="true"
+      Condition="!Exists('$(LocalSlnSecretsTargets)')" Lines="$(LocalSlnSecretsEmptyTemplateNewBody)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/init.props
new file mode 100644
index 0000000..b796e6c
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/init.props
@@ -0,0 +1,7 @@
+<Project>
+
+  <PropertyGroup>
+    <MSKit_SecretsCleanUp Condition="'$(MSKit_SecretsCleanUp)'=='' AND '$(MSKit_IsDevEnv)'!='True'">True</MSKit_SecretsCleanUp>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/init.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/init.targets
new file mode 100644
index 0000000..ce7b418
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/init.targets
@@ -0,0 +1,14 @@
+<Project>
+
+  <!--  We can init secrets in targets only due UserSecretsId set in csproj after all props.
+        LocalSecretsDir is computed by DragoAnt.MSBuildKit.Core (core.locals.targets). -->
+  <Import Project="$(MSBuildThisFileDirectory)local.secrets.props" />
+
+  <Import Condition="'$(MSKit_SecretsCleanUp)'=='True'"
+          Project="$(MSBuildThisFileDirectory)local.secrets.cleanup.targets" />
+
+  <ImportGroup Condition="'$(MSKit_IsDevEnv)'=='True'">
+    <Import Project="$(MSBuildThisFileDirectory)local.secrets.targets" />
+  </ImportGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/local.secrets.cleanup.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/local.secrets.cleanup.targets
new file mode 100644
index 0000000..ed00d8e
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/local.secrets.cleanup.targets
@@ -0,0 +1,10 @@
+<Project InitialTargets="CleanupLocalSecrets">
+
+  <Target Condition="'$(LocalSecrets)'!='' AND Exists('$(LocalSecrets)')"
+          Name="CleanupLocalSecrets"
+          BeforeTargets="CreateLocalSecrets;Restore;CoreCompile;Build;Publish">
+
+    <Delete Files="$(LocalSecrets)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/local.secrets.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/local.secrets.props
new file mode 100644
index 0000000..0de50b5
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/local.secrets.props
@@ -0,0 +1,10 @@
+<Project>
+
+  <PropertyGroup Condition="'$(UserSecretsId)'!=''">
+    <LocalSecrets>$(LocalSecretsDir)/secrets.json</LocalSecrets>
+
+    <LocalSecretsTemplateDir>$(MSKit_Templates)</LocalSecretsTemplateDir>
+    <LocalSecretsTemplate>$(LocalSecretsTemplateDir)/$(UserSecretsId).secrets.json</LocalSecretsTemplate>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/local.secrets.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/local.secrets.targets
new file mode 100644
index 0000000..dcce4ad
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Locals.Secrets/local.secrets.targets
@@ -0,0 +1,61 @@
+<Project InitialTargets="CreateLocalSecretsTemplate;CreateLocalSecrets;MSKit_CopySecretsToProject">
+
+  <PropertyGroup>
+    <UserSecretsLinkNamePrefix Condition="'$(UserSecretsLinkNamePrefix)'==''">appsettings</UserSecretsLinkNamePrefix>
+    <!-- MSKit_CopySecretsToProject: Copy secrets files to project directory. -->
+    <MSKit_CopySecretsToProject Condition="'$(MSKit_CopySecretsToProject)'==''">false</MSKit_CopySecretsToProject>
+    <!--@formatter:off-->
+    <LocalSecretsEmptyTemplateNewBody>{
+}
+    </LocalSecretsEmptyTemplateNewBody>
+    <!--@formatter:on-->
+  </PropertyGroup>
+
+  <ItemGroup>
+    <None Condition="'$(LocalSecrets)'!=''" Include="$(LocalSecrets)">
+      <Link>$(UserSecretsLinkNamePrefix).UserSecrets.json</Link>
+      <!-- MSKit_CopyUserSecretsIdToOutput: Include UserSecretsId in build output. -->
+      <CopyToOutputDirectory Condition="'$(MSKit_CopyUserSecretsIdToOutput)' == 'true'">Always</CopyToOutputDirectory>
+      <!-- MSKit_CopyUserSecretsIdToPublish: Include UserSecretsId in publish output. -->
+      <CopyToPublishDirectory Condition="'$(MSKit_CopyUserSecretsIdToPublish)' == 'true'">Always</CopyToPublishDirectory>
+      <ExcludeFromSingleFile>true</ExcludeFromSingleFile>
+    </None>
+  </ItemGroup>
+
+  <Target Condition="'$(LocalSecretsTemplate)'!='' AND !Exists('$(LocalSecretsTemplate)')"
+          Name="CreateLocalSecretsTemplate">
+    <MakeDir Directories="$(LocalSecretsTemplateDir)" Condition="!Exists('$(LocalSecretsTemplateDir)')" />
+
+    <WriteLinesToFile
+      File="$(LocalSecretsTemplate)"
+      Overwrite="true"
+      Lines="$(LocalSecretsEmptyTemplateNewBody)" />
+
+    <Message Text="The file '$(LocalSecretsTemplate)' was created." Importance="High" />
+  </Target>
+
+  <Target Condition="'$(LocalSecrets)'!='' AND !Exists('$(LocalSecrets)')"
+          Name="CreateLocalSecrets" AfterTargets="CreateLocalSecretsTemplate">
+    <MakeDir Directories="$(LocalSecretsDir)" Condition="!Exists('$(LocalSecretsDir)')" />
+
+    <Copy Condition="Exists('$(LocalSecretsTemplate)')" SourceFiles="$(LocalSecretsTemplate)" DestinationFiles="$(LocalSecrets)" />
+
+    <WriteLinesToFile
+      File="$(LocalSecrets)"
+      Overwrite="true"
+      Condition="!Exists('$(LocalSecrets)')" Lines="$(LocalSecretsEmptyTemplateNewBody)" />
+  </Target>
+
+  <Target Condition="'$(MSKit_CopySecretsToProject)'=='true' AND '$(CopySecretsToProjectFileName)' != '' AND Exists('$(LocalSecrets)')"
+          Name="MSKit_CopySecretsToProject" AfterTargets="CreateLocalSecrets">
+
+    <Copy SourceFiles="$(LocalSecrets)" DestinationFiles="$(MSBuildProjectDirectory)/$(CopySecretsToProjectFileName)" />
+
+    <WriteLinesToFile
+      File="$(MSBuildProjectDirectory)/.gitignore"
+      Overwrite="true"
+      Lines="$(CopySecretsToProjectFileName)">
+    </WriteLinesToFile>
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/audit/audit.package.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/audit/audit.package.targets
new file mode 100644
index 0000000..563bc1e
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/audit/audit.package.targets
@@ -0,0 +1,126 @@
+<Project>
+
+  <!-- nuget.org package checks, MSKIT_PKG001..019, run by `dotnet pack`. They are warnings on a
+       developer machine and errors on CI (MSKit_PackageChecksAsErrors). Turn single checks off with
+       MSKit_SkipPackageChecks=MSKIT_PKG004;MSKIT_PKG016 (or by listing the code in NoWarn), or all
+       of them with MSKit_SkipPackageChecks=All. -->
+
+  <PropertyGroup>
+    <MSKit_PackageChecksAsErrors Condition="'$(MSKit_PackageChecksAsErrors)'=='' AND '$(MSKit_IsDevEnv)'!='True'">True</MSKit_PackageChecksAsErrors>
+    <MSKit_PackageDescriptionMinLength Condition="'$(MSKit_PackageDescriptionMinLength)'==''">30</MSKit_PackageDescriptionMinLength>
+    <MSKit_SemVerRegex Condition="'$(MSKit_SemVerRegex)'==''">^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$</MSKit_SemVerRegex>
+    <MSKit_PackageIconSize Condition="'$(MSKit_PackageIconSize)'==''">128</MSKit_PackageIconSize>
+    <_MSKit_PkgRules>https://learn.microsoft.com/nuget/create-packages/package-authoring-best-practices</_MSKit_PkgRules>
+    <_MSKit_PkgReadmeRules>https://learn.microsoft.com/nuget/nuget-org/package-readme-on-nuget-org</_MSKit_PkgReadmeRules>
+  </PropertyGroup>
+
+  <Target Name="MSKit_PackageChecks"
+          BeforeTargets="GenerateNuspec"
+          DependsOnTargets="MSKit_ResolvePackageUrls;MSKit_GeneratePackageReadme;_MSKit_ResolveAllowedImageHosts"
+          Condition="'$(IsPackable)'=='True' AND '$(MSKit_SkipPackageChecks)'!='All' AND '$(MSKit_SkipPackageChecks)'!='True'">
+
+    <MSKit_PackageAssets Mode="Inspect"
+                         ReadmePath="$(MSKit_PackageReadmeSourcePath)"
+                                IconPath="$(MSKit_PackageIconSourcePath)"
+                                AllowedImageHosts="$(_MSKit_AllowedImageHosts)">
+      <Output TaskParameter="RelativeImages" PropertyName="_MSKit_RelativeImages" />
+      <Output TaskParameter="DisallowedImages" PropertyName="_MSKit_DisallowedImages" />
+      <Output TaskParameter="RelativeLinks" PropertyName="_MSKit_RelativeLinks" />
+      <Output TaskParameter="HtmlTags" PropertyName="_MSKit_HtmlTags" />
+      <Output TaskParameter="Alerts" PropertyName="_MSKit_Alerts" />
+      <Output TaskParameter="HasMermaid" PropertyName="_MSKit_HasMermaid" />
+      <Output TaskParameter="IconIsPng" PropertyName="_MSKit_IconIsPng" />
+      <Output TaskParameter="IconWidth" PropertyName="_MSKit_IconWidth" />
+      <Output TaskParameter="IconHeight" PropertyName="_MSKit_IconHeight" />
+    </MSKit_PackageAssets>
+
+    <PropertyGroup>
+      <_MSKit_Description>$(PackageDescription)</_MSKit_Description>
+      <_MSKit_Description Condition="'$(_MSKit_Description)'==''">$(Description)</_MSKit_Description>
+      <_MSKit_Description>$(_MSKit_Description.Trim())</_MSKit_Description>
+      <_MSKit_DescriptionIsPlaceholder Condition="'$(_MSKit_Description)'=='' OR '$(_MSKit_Description)'=='Package Description' OR '$(_MSKit_Description)'=='$(PackageId)' OR '$(_MSKit_Description)'=='$(MSBuildProjectName)'">True</_MSKit_DescriptionIsPlaceholder>
+      <_MSKit_PkgVersion>$(PackageVersion)</_MSKit_PkgVersion>
+      <_MSKit_PkgVersion Condition="'$(_MSKit_PkgVersion)'==''">$(Version)</_MSKit_PkgVersion>
+      <_MSKit_RepoUrlFinal>$(RepositoryUrl)</_MSKit_RepoUrlFinal>
+      <_MSKit_RepoUrlFinal Condition="'$(_MSKit_RepoUrlFinal)'==''">$(PrivateRepositoryUrl)</_MSKit_RepoUrlFinal>
+      <_MSKit_LicenseIsOpen Condition="'$(PackageLicenseExpression)'!=''">True</_MSKit_LicenseIsOpen>
+    </PropertyGroup>
+
+    <ItemGroup>
+      <_MSKit_PkgFinding Include="MSKIT_PKG001" Condition="'$(_MSKit_DescriptionIsPlaceholder)'=='True'"
+                         Text="Package '$(PackageId)' has no real Description ('$(_MSKit_Description)'). nuget.org search shows it first: say what the package does and what sets it apart, in one or two sentences."
+                         Rule="$(_MSKit_PkgRules)#description" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG002" Condition="'$(_MSKit_DescriptionIsPlaceholder)'!='True' AND $(_MSKit_Description.Length) &lt; $(MSKit_PackageDescriptionMinLength)"
+                         Text="Package '$(PackageId)' Description is $(_MSKit_Description.Length) characters ('$(_MSKit_Description)'); write at least $(MSKit_PackageDescriptionMinLength): what it does and for whom (MSKit_PackageDescriptionMinLength sets the bar)."
+                         Rule="$(_MSKit_PkgRules)#description" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG003" Condition="'$(PackageReadmeFile)'==''"
+                         Text="Package '$(PackageId)' ships no README. Add package.readme.md next to the csproj: what it is, how to start, a short example, where to give feedback."
+                         Rule="$(_MSKit_PkgRules)#readme" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG004" Condition="'$(PackageTags)'==''"
+                         Text="Package '$(PackageId)' has no PackageTags. Add a few search terms that are not already in the package id."
+                         Rule="$(_MSKit_PkgRules)#tags" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG005" Condition="'$(PackageIcon)'==''"
+                         Text="Package '$(PackageId)' has no icon. Set PackageIconPath to a 128x128 PNG (the company layer of the kit sets one for every package)."
+                         Rule="$(_MSKit_PkgRules)#icon" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG006" Condition="'$(PackageLicenseExpression)'=='' AND '$(PackageLicenseFile)'==''"
+                         Text="Package '$(PackageId)' has no licence. Without one nobody may use it. Set PackageLicenseExpression to an SPDX id (for example MIT)."
+                         Rule="$(_MSKit_PkgRules)#licensing" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG007" Condition="'$(PackageLicenseUrl)'!=''"
+                         Text="Package '$(PackageId)' uses the deprecated PackageLicenseUrl. Replace it with PackageLicenseExpression (an SPDX id) or PackageLicenseFile."
+                         Rule="$(_MSKit_PkgRules)#licensing" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG008" Condition="'$(PackageIconUrl)'!=''"
+                         Text="Package '$(PackageId)' uses the deprecated PackageIconUrl. Pack the image and point PackageIcon (or the kit's PackageIconPath) at it."
+                         Rule="$(_MSKit_PkgRules)#icon" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG009" Condition="'$(_MSKit_RelativeImages)'!=''"
+                         Text="The package README of '$(PackageId)' has relative images, which nuget.org does not render: $(_MSKit_RelativeImages). Use absolute https URLs from an allowed host."
+                         Rule="$(_MSKit_PkgReadmeRules)#allowed-domains-for-images-and-badges" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG010" Condition="'$(_MSKit_HtmlTags)'!=''"
+                         Text="The package README of '$(PackageId)' contains HTML, which nuget.org does not render: $(_MSKit_HtmlTags). Use Markdown instead."
+                         Rule="$(_MSKit_PkgReadmeRules)#supported-markdown-features" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG011" Condition="'$(_MSKit_Alerts)'!=''"
+                         Text="The package README of '$(PackageId)' uses GitHub alert blocks, which nuget.org shows as plain quotes: $(_MSKit_Alerts). Use a bold lead-in such as **Note:** instead."
+                         Rule="$(_MSKit_PkgReadmeRules)#supported-markdown-features" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG012" Condition="'$(_MSKit_DisallowedImages)'!=''"
+                         Text="The package README of '$(PackageId)' loads images from hosts nuget.org blocks: $(_MSKit_DisallowedImages). Host them on an allowed domain (img.shields.io, raw.githubusercontent.com, ...)."
+                         Rule="$(_MSKit_PkgReadmeRules)#allowed-domains-for-images-and-badges" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG013" Condition="'$(_MSKit_PkgVersion)'!='' AND !$([System.Text.RegularExpressions.Regex]::IsMatch('$(_MSKit_PkgVersion)', '$(MSKit_SemVerRegex)'))"
+                         Text="Package '$(PackageId)' version '$(_MSKit_PkgVersion)' is not SemVer 2.0 (MAJOR.MINOR.PATCH[-prerelease][+metadata])."
+                         Rule="$(_MSKit_PkgRules)#package-version" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG014" Condition="'$(_MSKit_RepoUrlFinal)'=='' OR '$(PackageProjectUrl)'==''"
+                         Text="Package '$(PackageId)' has no repository or project URL. Set RepositoryUrl, or build from a git clone whose origin remote Source Link can read."
+                         Rule="$(_MSKit_PkgRules)#repository-type-and-url" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG015" Condition="'$(MSKit_PackageIconSourcePath)'!='' AND Exists('$(MSKit_PackageIconSourcePath)') AND ('$(_MSKit_IconIsPng)'!='True' OR '$(_MSKit_IconWidth)'!='$(MSKit_PackageIconSize)' OR '$(_MSKit_IconHeight)'!='$(MSKit_PackageIconSize)')"
+                         Text="Package '$(PackageId)' icon is not a $(MSKit_PackageIconSize)x$(MSKit_PackageIconSize) PNG (PNG: $(_MSKit_IconIsPng), size: $(_MSKit_IconWidth)x$(_MSKit_IconHeight))."
+                         Rule="$(_MSKit_PkgRules)#icon" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG016" Condition="'$(PackageReleaseNotes)'==''"
+                         Text="Package '$(PackageId)' has no PackageReleaseNotes. Set them, or a link to the changelog (the kit links the releases page by default on GitHub, and on any host the generated readme knows with MSKit_PackageReadmeFrom)."
+                         Rule="$(_MSKit_PkgRules)#release-notes" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG017" Condition="'$(_MSKit_RelativeLinks)'!=''"
+                         Text="The package README of '$(PackageId)' has relative links, which break on nuget.org: $(_MSKit_RelativeLinks). Use absolute URLs."
+                         Rule="$(_MSKit_PkgReadmeRules)" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG018" Condition="'$(_MSKit_LicenseIsOpen)'=='True' AND $(Copyright.ToLowerInvariant().Contains('all rights reserved'))"
+                         Text="Package '$(PackageId)' is licensed '$(PackageLicenseExpression)' but its Copyright says 'all rights reserved' ('$(Copyright)'). Use 'Copyright (c) YEAR OWNER'."
+                         Rule="$(_MSKit_PkgRules)#copyright" />
+      <_MSKit_PkgFinding Include="MSKIT_PKG019" Condition="'$(_MSKit_HasMermaid)'=='True'"
+                         Text="The package README of '$(PackageId)' contains a Mermaid diagram, which nuget.org shows as code. Link to the diagram on GitHub instead."
+                         Rule="$(_MSKit_PkgReadmeRules)#supported-markdown-features" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <_MSKit_PkgSkip Include="$(MSKit_SkipPackageChecks)" />
+      <_MSKit_PkgSkip Include="$(NoWarn)" />
+      <_MSKit_PkgFinding Remove="@(_MSKit_PkgSkip)" />
+    </ItemGroup>
+
+    <Warning Condition="'@(_MSKit_PkgFinding)'!='' AND '$(MSKit_PackageChecksAsErrors)'!='True'"
+             Code="%(_MSKit_PkgFinding.Identity)"
+             Text="%(_MSKit_PkgFinding.Text) Rule: %(_MSKit_PkgFinding.Rule) (to skip: MSKit_SkipPackageChecks=%(_MSKit_PkgFinding.Identity))"
+             File="$(MSBuildProjectFullPath)" />
+    <Error Condition="'@(_MSKit_PkgFinding)'!='' AND '$(MSKit_PackageChecksAsErrors)'=='True'"
+           ContinueOnError="ErrorAndContinue"
+           Code="%(_MSKit_PkgFinding.Identity)"
+           Text="%(_MSKit_PkgFinding.Text) Rule: %(_MSKit_PkgFinding.Rule) (to skip: MSKit_SkipPackageChecks=%(_MSKit_PkgFinding.Identity))"
+           File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/init.props
new file mode 100644
index 0000000..91ed9f6
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/init.props
@@ -0,0 +1,27 @@
+<Project>
+
+  <!-- Build settings every published package needs, set for all projects so a library and the
+       projects it references are built the same way. Each one yields to a value you set. -->
+  <PropertyGroup>
+    <!-- Source Link (built into the .NET 8+ SDK) records the commit and repository URL. -->
+    <PublishRepositoryUrl Condition="'$(PublishRepositoryUrl)'==''">true</PublishRepositoryUrl>
+    <EmbedUntrackedSources Condition="'$(EmbedUntrackedSources)'==''">true</EmbedUntrackedSources>
+    <Deterministic Condition="'$(Deterministic)'==''">true</Deterministic>
+    <!-- Must be set before the SDK targets, which default it to false. -->
+    <GenerateDocumentationFile Condition="'$(GenerateDocumentationFile)'==''">True</GenerateDocumentationFile>
+    <!-- Normalizes the source paths in PDBs; only on CI, so local debugging keeps real paths. -->
+    <ContinuousIntegrationBuild Condition="'$(ContinuousIntegrationBuild)'=='' AND '$(MSKit_IsDevEnv)'!='True'">true</ContinuousIntegrationBuild>
+
+    <NuGetAudit Condition="'$(NuGetAudit)'==''">true</NuGetAudit>
+    <NuGetAuditMode Condition="'$(NuGetAuditMode)'==''">all</NuGetAuditMode>
+    <NuGetAuditLevel Condition="'$(NuGetAuditLevel)'==''">low</NuGetAuditLevel>
+
+    <!-- The generated package readme links these pages. `auto` derives them from the repository
+         host; set one empty in the csproj (or -p:MSKit_ReleasesUrl=) to leave the link out. -->
+    <MSKit_ReleasesUrl Condition="'$(MSKit_ReleasesUrl)'==''">auto</MSKit_ReleasesUrl>
+    <MSKit_IssuesUrl Condition="'$(MSKit_IssuesUrl)'==''">auto</MSKit_IssuesUrl>
+    <!-- The generated readme's first level-1 heading; `auto` is the PackageId, empty keeps the README's. -->
+    <MSKit_PackageReadmeTitle Condition="'$(MSKit_PackageReadmeTitle)'==''">auto</MSKit_PackageReadmeTitle>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/init.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/init.targets
new file mode 100644
index 0000000..1d52011
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/init.targets
@@ -0,0 +1,5 @@
+<Project>
+
+  <Import Condition="'$(IsPackable)'=='True'" Project="$(MSBuildThisFileDirectory)package.targets" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/nuget.allowed-image-hosts.txt b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/nuget.allowed-image-hosts.txt
new file mode 100644
index 0000000..c4a2e1d
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/nuget.allowed-image-hosts.txt
@@ -0,0 +1,41 @@
+# Hosts nuget.org renders package-readme images and badges from, one per line.
+# Source: https://learn.microsoft.com/nuget/nuget-org/package-readme-on-nuget-org#allowed-domains-for-images-and-badges
+# (page updated 2026-07-07, read 2026-10-05). Refreshed with kit releases; never fetched at build time.
+# github.com is allowed only for Actions workflow badges (github.com/.../workflows/.../badge.svg), a path the check handles itself.
+api.codacy.com
+api.codeclimate.com
+api.dependabot.com
+api.reuse.software
+api.travis-ci.com
+app.codacy.com
+app.deepsource.com
+avatars.githubusercontent.com
+badgen.net
+badges.gitter.im
+camo.githubusercontent.com
+caniuse.bitsofco.de
+cdn.jsdelivr.net
+cdn.syncfusion.com
+ci.appveyor.com
+circleci.com
+cloudback.it
+codecov.io
+codefactor.io
+coveralls.io
+dev.azure.com
+devpod.sh
+flat.badgen.net
+gitlab.com
+i.imgur.com
+img.shields.io
+infragistics.com
+isitmaintained.com
+media.githubusercontent.com
+opencollective.com
+raw.github.com
+raw.githubusercontent.com
+snyk.io
+sonarcloud.io
+travis-ci.com
+travis-ci.org
+user-images.githubusercontent.com
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.inspect.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.inspect.targets
new file mode 100644
index 0000000..bdb9dd4
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.inspect.targets
@@ -0,0 +1,13 @@
+<Project>
+
+  <!-- Mode="Inspect" reads the package README and icon for the MSKIT_PKG checks; Mode="GenerateReadme"
+       writes the readme generated from MSKit_PackageReadmeFrom. The code is in package.tasks.cs.txt. -->
+  <UsingTask TaskName="MSKit_PackageAssets"
+             TaskFactory="RoslynCodeTaskFactory"
+             AssemblyFile="$(MSBuildToolsPath)/Microsoft.Build.Tasks.Core.dll">
+    <Task>
+      <Code Type="Class" Language="cs" Source="$(MSBuildThisFileDirectory)package.tasks.cs.txt" />
+    </Task>
+  </UsingTask>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.readme.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.readme.targets
new file mode 100644
index 0000000..38995aa
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.readme.targets
@@ -0,0 +1,141 @@
+<Project>
+
+  <!-- MSKit_PackageReadmeFrom: the package readme is generated from the repository README on pack,
+       never on build. Relative links and images become absolute URLs pinned to the commit,
+       nuget:skip / nuget:only blocks are applied, release and issue links are added to the overview.
+       The MSKIT_PKG checks then read the generated file. Full description: docs/package-readme.md. -->
+
+  <PropertyGroup>
+    <MSKit_PackageReadmeAllowedImageHostsFile Condition="'$(MSKit_PackageReadmeAllowedImageHostsFile)'==''">$(MSBuildThisFileDirectory)nuget.allowed-image-hosts.txt</MSKit_PackageReadmeAllowedImageHostsFile>
+    <_MSKit_ReadmeStampPath>$(MSKit_GeneratedPackageReadmePath).inputs</_MSKit_ReadmeStampPath>
+    <_MSKit_ReadmeFindingsBase>$(MSKit_GeneratedPackageReadmePath).findings</_MSKit_ReadmeFindingsBase>
+    <_MSKit_ReadmeReleasesUrlPath>$(MSKit_GeneratedPackageReadmePath).releases</_MSKit_ReadmeReleasesUrlPath>
+  </PropertyGroup>
+
+  <Target Name="_MSKit_ResolveAllowedImageHosts">
+    <ReadLinesFromFile Condition="'$(MSKit_PackageReadmeAllowedImageHosts)'=='' AND Exists('$(MSKit_PackageReadmeAllowedImageHostsFile)')"
+                       File="$(MSKit_PackageReadmeAllowedImageHostsFile)">
+      <Output TaskParameter="Lines" ItemName="_MSKit_AllowedImageHostLine" />
+    </ReadLinesFromFile>
+    <ItemGroup>
+      <_MSKit_AllowedImageHost Include="@(_MSKit_AllowedImageHostLine)" Condition="!$([System.String]::Copy('%(_MSKit_AllowedImageHostLine.Identity)').StartsWith('#'))" />
+    </ItemGroup>
+    <PropertyGroup>
+      <_MSKit_AllowedImageHosts>$(MSKit_PackageReadmeAllowedImageHosts)</_MSKit_AllowedImageHosts>
+      <_MSKit_AllowedImageHosts Condition="'$(_MSKit_AllowedImageHosts)'==''">@(_MSKit_AllowedImageHost)</_MSKit_AllowedImageHosts>
+    </PropertyGroup>
+  </Target>
+
+  <Target Name="MSKit_GeneratePackageReadme"
+          BeforeTargets="GenerateNuspec"
+          Condition="'$(_MSKit_GeneratesReadme)'=='True'"
+          DependsOnTargets="_MSKit_PackageReadmeInputs;_MSKit_WritePackageReadme;_MSKit_ReportPackageReadmeFindings;_MSKit_DefaultReleaseNotesFromReadme" />
+
+  <Target Name="_MSKit_PackageReadmeFromMissing"
+          BeforeTargets="GenerateNuspec"
+          Condition="'$(MSKit_PackageReadmeFrom)'!='' AND '$(_MSKit_GeneratesReadme)'!='True' AND '$(MSKit_SkipPackageChecks)'!='All'">
+    <Warning Code="MSKIT_PKG020" File="$(MSBuildProjectFullPath)"
+             Text="MSKit_PackageReadmeFrom names '$(MSKit_PackageReadmeFrom)', but $(_MSKit_ReadmeFromPath) does not exist, so no readme is generated for '$(PackageId)'. The path is relative to the git root ($(MSKit_GitRoot))." />
+  </Target>
+
+  <!-- Everything that changes the generated text goes into a stamp written only when it differs,
+       so an unchanged README and unchanged settings skip the generator entirely. -->
+  <Target Name="_MSKit_PackageReadmeInputs"
+          DependsOnTargets="MSKit_ResolvePackageUrls;_InitializeNuspecRepositoryInformationProperties;_MSKit_ResolveAllowedImageHosts">
+    <PropertyGroup>
+      <_MSKit_ReadmeCommit>$(RepositoryCommit)</_MSKit_ReadmeCommit>
+      <_MSKit_ReadmeCommit Condition="'$(_MSKit_ReadmeCommit)'==''">$(SourceRevisionId)</_MSKit_ReadmeCommit>
+      <_MSKit_ReadmeCommit Condition="'$(_MSKit_ReadmeCommit)'==''">$(MSKit_CommitSha)</_MSKit_ReadmeCommit>
+      <_MSKit_ReadmeRepoRoot>$(MSKit_GitRoot)</_MSKit_ReadmeRepoRoot>
+      <_MSKit_ReadmeRepoRoot Condition="'$(_MSKit_ReadmeRepoRoot)'==''">$([System.IO.Path]::GetDirectoryName('$(_MSKit_ReadmeFromPath)'))</_MSKit_ReadmeRepoRoot>
+      <_MSKit_RepositoryVisibility>$(MSKit_RepositoryVisibility)</_MSKit_RepositoryVisibility>
+      <_MSKit_RepositoryVisibility Condition="'$(_MSKit_RepositoryVisibility)'==''">$(CI_PROJECT_VISIBILITY)</_MSKit_RepositoryVisibility>
+    </PropertyGroup>
+    <ItemGroup>
+      <_MSKit_ReadmeStampLine Include="package=$(PackageId)" />
+      <_MSKit_ReadmeStampLine Include="source=$(_MSKit_ReadmeFromPath)" />
+      <_MSKit_ReadmeStampLine Include="root=$(_MSKit_ReadmeRepoRoot)" />
+      <_MSKit_ReadmeStampLine Include="url=$(_MSKit_RepoUrl)" />
+      <_MSKit_ReadmeStampLine Include="commit=$(_MSKit_ReadmeCommit)" />
+      <_MSKit_ReadmeStampLine Include="provider=$(MSKit_RepoProvider)" />
+      <_MSKit_ReadmeStampLine Include="blob=$(MSKit_RepoBlobUrlTemplate)" />
+      <_MSKit_ReadmeStampLine Include="raw=$(MSKit_RepoRawUrlTemplate)" />
+      <_MSKit_ReadmeStampLine Include="releases=$(MSKit_ReleasesUrl)" />
+      <_MSKit_ReadmeStampLine Include="issues=$(MSKit_IssuesUrl)" />
+      <_MSKit_ReadmeStampLine Include="title=$(MSKit_PackageReadmeTitle)" />
+      <_MSKit_ReadmeStampLine Include="visibility=$(_MSKit_RepositoryVisibility)" />
+      <_MSKit_ReadmeStampLine Include="hosts=$(_MSKit_AllowedImageHosts)" />
+      <_MSKit_ReadmeStampLine Include="@(SourceLinkGitHubHost->'github=%(Identity)')" />
+      <_MSKit_ReadmeStampLine Include="@(SourceLinkGitLabHost->'gitlab=%(Identity)')" />
+      <_MSKit_ReadmeStampLine Include="@(SourceLinkAzureReposHost->'azure=%(Identity)')" />
+      <_MSKit_ReadmeStampLine Include="@(SourceLinkBitbucketGitHost->'bitbucket=%(Identity)')" />
+      <_MSKit_ReadmeStampLine Include="@(SourceLinkGiteaHost->'gitea=%(Identity)')" />
+    </ItemGroup>
+    <MakeDir Directories="$([System.IO.Path]::GetDirectoryName('$(MSKit_GeneratedPackageReadmePath)'))" />
+    <WriteLinesToFile File="$(_MSKit_ReadmeStampPath)" Lines="@(_MSKit_ReadmeStampLine)" Overwrite="true" WriteOnlyWhenDifferent="true" />
+  </Target>
+
+  <Target Name="_MSKit_WritePackageReadme"
+          Inputs="$(_MSKit_ReadmeFromPath);$(_MSKit_ReadmeStampPath);$(MSKit_PackageReadmeAllowedImageHostsFile);$(MSBuildThisFileFullPath);$(MSBuildThisFileDirectory)package.tasks.cs.txt"
+          Outputs="$(MSKit_GeneratedPackageReadmePath)">
+    <MSKit_PackageAssets Mode="GenerateReadme"
+                         ReadmePath="$(_MSKit_ReadmeFromPath)"
+                                 OutputPath="$(MSKit_GeneratedPackageReadmePath)"
+                                 FindingsBase="$(_MSKit_ReadmeFindingsBase)"
+                                 ReleasesUrlPath="$(_MSKit_ReadmeReleasesUrlPath)"
+                                 RepoRoot="$(_MSKit_ReadmeRepoRoot)"
+                                 PackageId="$(PackageId)"
+                                 RepositoryUrl="$(_MSKit_RepoUrl)"
+                                 Commit="$(_MSKit_ReadmeCommit)"
+                                 Provider="$(MSKit_RepoProvider)"
+                                 BlobTemplate="$(MSKit_RepoBlobUrlTemplate)"
+                                 RawTemplate="$(MSKit_RepoRawUrlTemplate)"
+                                 ReleasesUrl="$(MSKit_ReleasesUrl)"
+                                 IssuesUrl="$(MSKit_IssuesUrl)"
+                                 ReadmeTitle="$(MSKit_PackageReadmeTitle)"
+                                 Visibility="$(_MSKit_RepositoryVisibility)"
+                                 AllowedImageHosts="$(_MSKit_AllowedImageHosts)"
+                                 GitHubHosts="@(SourceLinkGitHubHost)"
+                                 GitLabHosts="@(SourceLinkGitLabHost)"
+                                 AzureReposHosts="@(SourceLinkAzureReposHost)"
+                                 BitbucketHosts="@(SourceLinkBitbucketGitHost)"
+                                 GiteaHosts="@(SourceLinkGiteaHost)" />
+  </Target>
+
+  <!-- Off GitHub, MSKit_ResolvePackageUrls has no release-notes default: use the releases page the
+       generator resolved, kept beside the generated file like the findings. -->
+  <Target Name="_MSKit_DefaultReleaseNotesFromReadme"
+          Condition="'$(PackageReleaseNotes)'=='' AND '$(MSKit_DefaultReleaseNotes)'!='False' AND Exists('$(_MSKit_ReadmeReleasesUrlPath)')">
+    <ReadLinesFromFile File="$(_MSKit_ReadmeReleasesUrlPath)">
+      <Output TaskParameter="Lines" PropertyName="_MSKit_ReadmeReleasesUrl" />
+    </ReadLinesFromFile>
+    <PropertyGroup>
+      <PackageReleaseNotes Condition="'$(_MSKit_ReadmeReleasesUrl)'!=''">$(_MSKit_ReadmeReleasesUrl)</PackageReleaseNotes>
+    </PropertyGroup>
+  </Target>
+
+  <!-- The findings are kept beside the generated file, so an incremental pack still reports them. -->
+  <Target Name="_MSKit_ReportPackageReadmeFindings" Condition="'$(MSKit_SkipPackageChecks)'!='All' AND '$(MSKit_SkipPackageChecks)'!='True'">
+    <ItemGroup>
+      <_MSKit_ReadmeCode Include="MSKIT_PKG020;MSKIT_PKG021;MSKIT_PKG022" />
+      <_MSKit_ReadmeSkip Include="$(MSKit_SkipPackageChecks);$(NoWarn)" />
+      <_MSKit_ReadmeCode Remove="@(_MSKit_ReadmeSkip)" />
+    </ItemGroup>
+    <PropertyGroup>
+      <_MSKit_ReadmeCodes>;@(_MSKit_ReadmeCode);</_MSKit_ReadmeCodes>
+    </PropertyGroup>
+    <ReadLinesFromFile Condition="Exists('$(_MSKit_ReadmeFindingsBase).MSKIT_PKG020.txt') AND $(_MSKit_ReadmeCodes.Contains(';MSKIT_PKG020;'))" File="$(_MSKit_ReadmeFindingsBase).MSKIT_PKG020.txt">
+      <Output TaskParameter="Lines" ItemName="_MSKit_ReadmeFinding020" />
+    </ReadLinesFromFile>
+    <ReadLinesFromFile Condition="Exists('$(_MSKit_ReadmeFindingsBase).MSKIT_PKG021.txt') AND $(_MSKit_ReadmeCodes.Contains(';MSKIT_PKG021;'))" File="$(_MSKit_ReadmeFindingsBase).MSKIT_PKG021.txt">
+      <Output TaskParameter="Lines" ItemName="_MSKit_ReadmeFinding021" />
+    </ReadLinesFromFile>
+    <ReadLinesFromFile Condition="Exists('$(_MSKit_ReadmeFindingsBase).MSKIT_PKG022.txt') AND $(_MSKit_ReadmeCodes.Contains(';MSKIT_PKG022;'))" File="$(_MSKit_ReadmeFindingsBase).MSKIT_PKG022.txt">
+      <Output TaskParameter="Lines" ItemName="_MSKit_ReadmeFinding022" />
+    </ReadLinesFromFile>
+    <Warning Condition="'@(_MSKit_ReadmeFinding020)'!=''" Code="MSKIT_PKG020" File="$(_MSKit_ReadmeFromPath)" Text="%(_MSKit_ReadmeFinding020.Identity) (to skip: MSKit_SkipPackageChecks=MSKIT_PKG020)" />
+    <Warning Condition="'@(_MSKit_ReadmeFinding021)'!=''" Code="MSKIT_PKG021" File="$(_MSKit_ReadmeFromPath)" Text="%(_MSKit_ReadmeFinding021.Identity) (to skip: MSKit_SkipPackageChecks=MSKIT_PKG021)" />
+    <Warning Condition="'@(_MSKit_ReadmeFinding022)'!=''" Code="MSKIT_PKG022" File="$(_MSKit_ReadmeFromPath)" Text="%(_MSKit_ReadmeFinding022.Identity) (to skip: MSKit_SkipPackageChecks=MSKIT_PKG022)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.targets
new file mode 100644
index 0000000..9b2c60d
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.targets
@@ -0,0 +1,96 @@
+<Project>
+
+  <!-- nuget.org metadata defaults for a packable project. Every value yields to one you set in the
+       csproj or Directory.Build.props. The rules and their sources are listed in the README
+       ("Packaging rules"); the checks live in audit/audit.package.targets. -->
+
+  <PropertyGroup>
+    <PackageId Condition="'$(PackageId)'==''">$(MSBuildProjectName)</PackageId>
+    <PackageRequireLicenseAcceptance Condition="'$(PackageRequireLicenseAcceptance)'==''">false</PackageRequireLicenseAcceptance>
+    <RepositoryType Condition="'$(RepositoryType)'==''">git</RepositoryType>
+    <PackageProjectUrl Condition="'$(PackageProjectUrl)'=='' AND '$(RepositoryUrl)'!=''">$(RepositoryUrl)</PackageProjectUrl>
+
+    <!-- Symbols go to nuget.org as a .snupkg next to the .nupkg; skipped when there is no
+         separate PDB to ship. -->
+    <IncludeSymbols Condition="'$(IncludeSymbols)'=='' And '$(IncludeBuildOutput)'!='false' And '$(DebugType)'!='embedded' And '$(DebugType)'!='none'">true</IncludeSymbols>
+    <IncludeSymbols Condition="'$(IncludeSymbols)'==''">false</IncludeSymbols>
+    <SymbolPackageFormat Condition="'$(SymbolPackageFormat)'==''">snupkg</SymbolPackageFormat>
+
+    <!-- Package validation: API compatibility across target frameworks, and against the last
+         release when MSKit_PackageValidationBaselineVersion (or PackageValidationBaselineVersion)
+         names it. -->
+    <EnablePackageValidation Condition="'$(EnablePackageValidation)'==''">true</EnablePackageValidation>
+    <PackageValidationBaselineVersion Condition="'$(PackageValidationBaselineVersion)'=='' AND '$(MSKit_PackageValidationBaselineVersion)'!=''">$(MSKit_PackageValidationBaselineVersion)</PackageValidationBaselineVersion>
+  </PropertyGroup>
+
+  <!-- MSKit_PackageReadmeFrom: the readme is generated at pack time from that file (relative to the
+       git root, or absolute); see package.readme.targets. It wins over package.readme.md. -->
+  <PropertyGroup Condition="'$(MSKit_PackageReadmeFrom)'!=''">
+    <_MSKit_ReadmeFromPath Condition="$([System.IO.Path]::IsPathRooted('$(MSKit_PackageReadmeFrom)'))">$([MSBuild]::NormalizePath('$(MSKit_PackageReadmeFrom)'))</_MSKit_ReadmeFromPath>
+    <_MSKit_ReadmeFromPath Condition="'$(_MSKit_ReadmeFromPath)'=='' AND '$(MSKit_GitRoot)'!=''">$([MSBuild]::NormalizePath('$(MSKit_GitRoot)', '$(MSKit_PackageReadmeFrom)'))</_MSKit_ReadmeFromPath>
+    <_MSKit_ReadmeFromPath Condition="'$(_MSKit_ReadmeFromPath)'==''">$([MSBuild]::NormalizePath('$(MSBuildProjectDirectory)', '$(MSKit_PackageReadmeFrom)'))</_MSKit_ReadmeFromPath>
+    <MSKit_GeneratedPackageReadmePath Condition="'$(MSKit_GeneratedPackageReadmePath)'==''">$([MSBuild]::NormalizePath('$(MSBuildProjectDirectory)', '$(BaseIntermediateOutputPath)', '$(Configuration)', 'package.readme.md'))</MSKit_GeneratedPackageReadmePath>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(_MSKit_ReadmeFromPath)'!='' AND Exists('$(_MSKit_ReadmeFromPath)')">
+    <_MSKit_GeneratesReadme>True</_MSKit_GeneratesReadme>
+    <PackageReadmeFile Condition="'$(PackageReadmeFile)'==''">readme.md</PackageReadmeFile>
+    <MSKit_PackageReadmeSourcePath>$(MSKit_GeneratedPackageReadmePath)</MSKit_PackageReadmeSourcePath>
+    <_MSKit_PacksReadme>True</_MSKit_PacksReadme>
+  </PropertyGroup>
+
+  <!-- README: package.readme.md next to the csproj, else README.md next to it, packed as readme.md.
+       Set MSKit_PackageReadmeSourcePath to use another file. -->
+  <PropertyGroup Condition="'$(PackageReadmeFile)'==''">
+    <MSKit_PackageReadmeSourcePath Condition="'$(MSKit_PackageReadmeSourcePath)'=='' AND Exists('$(MSBuildProjectDirectory)/package.readme.md')">$(MSBuildProjectDirectory)/package.readme.md</MSKit_PackageReadmeSourcePath>
+    <MSKit_PackageReadmeSourcePath Condition="'$(MSKit_PackageReadmeSourcePath)'=='' AND Exists('$(MSBuildProjectDirectory)/README.md')">$(MSBuildProjectDirectory)/README.md</MSKit_PackageReadmeSourcePath>
+    <PackageReadmeFile Condition="'$(MSKit_PackageReadmeSourcePath)'!='' AND Exists('$(MSKit_PackageReadmeSourcePath)')">readme.md</PackageReadmeFile>
+    <_MSKit_PacksReadme Condition="'$(PackageReadmeFile)'!=''">True</_MSKit_PacksReadme>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(PackageReadmeFile)'!='' AND '$(_MSKit_PacksReadme)'!='True' AND '$(MSKit_PackageReadmeSourcePath)'==''">
+    <MSKit_PackageReadmeSourcePath>$(MSBuildProjectDirectory)/$(PackageReadmeFile)</MSKit_PackageReadmeSourcePath>
+  </PropertyGroup>
+
+  <!-- Icon: PackageIconPath (the kit's company layer points it at .toolkit/res/package.icon.png),
+       packed as icon.png. -->
+  <PropertyGroup Condition="'$(PackageIcon)'=='' AND '$(PackageIconPath)'!='' AND Exists('$(PackageIconPath)')">
+    <PackageIcon>icon.png</PackageIcon>
+    <_MSKit_PacksIcon>True</_MSKit_PacksIcon>
+  </PropertyGroup>
+  <PropertyGroup>
+    <MSKit_PackageIconSourcePath Condition="'$(MSKit_PackageIconSourcePath)'=='' AND '$(_MSKit_PacksIcon)'=='True'">$(PackageIconPath)</MSKit_PackageIconSourcePath>
+    <MSKit_PackageIconSourcePath Condition="'$(MSKit_PackageIconSourcePath)'=='' AND '$(PackageIcon)'!=''">$(MSBuildProjectDirectory)/$(PackageIcon)</MSKit_PackageIconSourcePath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <None Condition="'$(_MSKit_PacksReadme)'=='True'" Include="$(MSKit_PackageReadmeSourcePath)" Pack="true" PackagePath="\$(PackageReadmeFile)" Visible="false" />
+    <None Condition="'$(_MSKit_PacksIcon)'=='True'" Include="$(PackageIconPath)" Pack="true" PackagePath="\icon.png" Visible="false" />
+
+    <None Include="build/**" PackagePath="build/" Pack="true" />
+    <None Include="buildMultiTargeting/**" PackagePath="buildMultiTargeting/" Pack="true" />
+    <None Include="buildTransitive/**" PackagePath="buildTransitive/" Pack="true" />
+  </ItemGroup>
+
+  <!-- Repository and project URLs are only final after Source Link has read the git remote,
+       so the defaults that depend on them are resolved in a target. -->
+  <PropertyGroup>
+    <_MSKit_ResolvePackageUrlsDependsOn Condition="'$(SourceControlInformationFeatureSupported)'=='true'">InitializeSourceControlInformation</_MSKit_ResolvePackageUrlsDependsOn>
+  </PropertyGroup>
+  <Target Name="MSKit_ResolvePackageUrls"
+          BeforeTargets="GenerateNuspec"
+          DependsOnTargets="$(_MSKit_ResolvePackageUrlsDependsOn)">
+    <PropertyGroup>
+      <_MSKit_RepoUrl>$(RepositoryUrl)</_MSKit_RepoUrl>
+      <_MSKit_RepoUrl Condition="'$(_MSKit_RepoUrl)'==''">$(PrivateRepositoryUrl)</_MSKit_RepoUrl>
+      <_MSKit_RepoUrl Condition="$(_MSKit_RepoUrl.EndsWith('.git'))">$(_MSKit_RepoUrl.Substring(0, $([MSBuild]::Subtract($(_MSKit_RepoUrl.Length), 4))))</_MSKit_RepoUrl>
+      <PackageProjectUrl Condition="'$(PackageProjectUrl)'==''">$(_MSKit_RepoUrl)</PackageProjectUrl>
+
+      <_MSKit_IsGitHubUrl Condition="$(PackageProjectUrl.StartsWith('https://github.com/'))">True</_MSKit_IsGitHubUrl>
+      <PackageReleaseNotes Condition="'$(PackageReleaseNotes)'=='' AND '$(MSKit_DefaultReleaseNotes)'!='False' AND '$(_MSKit_IsGitHubUrl)'=='True' AND '$(MSKit_IsReleaseTag)'=='True' AND '$(MSKit_ReleaseTagRaw)'!=''">$(PackageProjectUrl)/releases/tag/$(MSKit_ReleaseTagRaw)</PackageReleaseNotes>
+      <PackageReleaseNotes Condition="'$(PackageReleaseNotes)'=='' AND '$(MSKit_DefaultReleaseNotes)'!='False' AND '$(_MSKit_IsGitHubUrl)'=='True'">$(PackageProjectUrl)/releases</PackageReleaseNotes>
+    </PropertyGroup>
+  </Target>
+
+  <Import Project="$(MSBuildThisFileDirectory)package.inspect.targets" />
+  <Import Project="$(MSBuildThisFileDirectory)package.readme.targets" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.tasks.cs.txt b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.tasks.cs.txt
new file mode 100644
index 0000000..d0d5ddf
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Packaging/package.tasks.cs.txt
@@ -0,0 +1,446 @@
+// Inline MSBuild tasks of the Packaging part, compiled by the RoslynCodeTaskFactory that ships with
+// MSBuild. One task with two actions, so a pack compiles it once. The .txt extension keeps it out of
+// a project's default Compile glob.
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using Microsoft.Build.Framework;
+using Microsoft.Build.Utilities;
+
+public sealed class MSKit_PackageAssets : Task
+{
+    [Required] public string Mode { get; set; }
+
+    public override bool Execute()
+    {
+        if (Mode == "Inspect") Inspect();
+        else if (Mode == "GenerateReadme") GenerateReadme();
+        else Log.LogError("MSKit_PackageAssets: unknown Mode '" + Mode + "'.");
+        return !Log.HasLoggedErrors;
+    }
+
+    public string ReadmePath { get; set; }
+    public string IconPath { get; set; }
+    public string AllowedImageHosts { get; set; }
+    [Output] public string RelativeImages { get; set; }
+    [Output] public string DisallowedImages { get; set; }
+    [Output] public string RelativeLinks { get; set; }
+    [Output] public string HtmlTags { get; set; }
+    [Output] public string Alerts { get; set; }
+    [Output] public bool HasMermaid { get; set; }
+    [Output] public bool IconIsPng { get; set; }
+    [Output] public int IconWidth { get; set; }
+    [Output] public int IconHeight { get; set; }
+
+    private void Inspect()
+    {
+        var relativeImages = new List<string>();
+        var disallowedImages = new List<string>();
+        var relativeLinks = new List<string>();
+        var htmlTags = new List<string>();
+        var alerts = new List<string>();
+
+        if (!string.IsNullOrEmpty(ReadmePath) && File.Exists(ReadmePath))
+        {
+            var text = File.ReadAllText(ReadmePath);
+            HasMermaid = Regex.IsMatch(text, @"^\s*(```|~~~)\s*mermaid\b", RegexOptions.Multiline | RegexOptions.IgnoreCase);
+
+            var prose = Regex.Replace(text, @"^\s*(```|~~~)[\s\S]*?^\s*\1\s*$", "", RegexOptions.Multiline);
+            prose = Regex.Replace(prose, @"`[^`\r\n]*`", "");
+
+            var hosts = (AllowedImageHosts ?? "").Split(new[] { ';' }, StringSplitOptions.RemoveEmptyEntries)
+                .Select(h => h.Trim().ToLowerInvariant()).Where(h => h.Length > 0).ToList();
+
+            var images = new List<string>();
+            foreach (Match m in Regex.Matches(prose, @"!\[[^\]]*\]\(\s*<?([^)\s>]+)"))
+                images.Add(m.Groups[1].Value);
+            foreach (Match m in Regex.Matches(prose, @"<img\b[^>]*\bsrc\s*=\s*[""']([^""']+)[""']", RegexOptions.IgnoreCase))
+                images.Add(m.Groups[1].Value);
+
+            foreach (var url in images.Distinct())
+            {
+                Uri uri;
+                if (!Uri.TryCreate(url, UriKind.Absolute, out uri) || (uri.Scheme != "https" && uri.Scheme != "http"))
+                {
+                    relativeImages.Add(url);
+                    continue;
+                }
+                var host = uri.Host.ToLowerInvariant();
+                var allowed = hosts.Contains(host)
+                    || (host == "github.com" && Regex.IsMatch(uri.AbsolutePath, @"^/[^/]+/[^/]+/(actions/)?workflows/[^/]+/badge\.svg$", RegexOptions.IgnoreCase));
+                if (!allowed)
+                    disallowedImages.Add(url);
+            }
+
+            foreach (Match m in Regex.Matches(prose, @"(?<!!)\[[^\]]*\]\(\s*<?([^)\s>]+)"))
+            {
+                var target = m.Groups[1].Value;
+                if (target.StartsWith("#") || Regex.IsMatch(target, @"^[A-Za-z][A-Za-z0-9+.-]*:"))
+                    continue;
+                relativeLinks.Add(target);
+            }
+
+            foreach (Match m in Regex.Matches(prose, @"</?([A-Za-z][A-Za-z0-9-]*)(\s[^<>]*)?/?>"))
+            {
+                if (m.Value.Contains("://") || m.Value.Contains("@"))
+                    continue;
+                htmlTags.Add("<" + m.Groups[1].Value.ToLowerInvariant() + ">");
+            }
+
+            foreach (Match m in Regex.Matches(prose, @"^\s*>\s*\[!(NOTE|TIP|IMPORTANT|WARNING|CAUTION)\]", RegexOptions.Multiline | RegexOptions.IgnoreCase))
+                alerts.Add("[!" + m.Groups[1].Value.ToUpperInvariant() + "]");
+        }
+
+        if (!string.IsNullOrEmpty(IconPath) && File.Exists(IconPath))
+        {
+            var header = new byte[24];
+            using (var stream = File.OpenRead(IconPath))
+            {
+                var read = stream.Read(header, 0, header.Length);
+                IconIsPng = read == 24 && header[0] == 0x89 && header[1] == 0x50 && header[2] == 0x4E && header[3] == 0x47;
+            }
+            if (IconIsPng)
+            {
+                IconWidth = (header[16] << 24) | (header[17] << 16) | (header[18] << 8) | header[19];
+                IconHeight = (header[20] << 24) | (header[21] << 16) | (header[22] << 8) | header[23];
+            }
+        }
+
+        RelativeImages = string.Join(", ", relativeImages.Distinct());
+        DisallowedImages = string.Join(", ", disallowedImages.Distinct());
+        RelativeLinks = string.Join(", ", relativeLinks.Distinct());
+        HtmlTags = string.Join(", ", htmlTags.Distinct());
+        Alerts = string.Join(", ", alerts.Distinct());
+    }
+
+    public string OutputPath { get; set; }
+    public string FindingsBase { get; set; }
+    public string ReleasesUrlPath { get; set; }
+    public string RepoRoot { get; set; }
+    public string PackageId { get; set; }
+    public string RepositoryUrl { get; set; }
+    public string Commit { get; set; }
+    public string Provider { get; set; }
+    public string BlobTemplate { get; set; }
+    public string RawTemplate { get; set; }
+    public string ReleasesUrl { get; set; }
+    public string IssuesUrl { get; set; }
+    public string ReadmeTitle { get; set; }
+    public string Visibility { get; set; }
+    public string GitHubHosts { get; set; }
+    public string GitLabHosts { get; set; }
+    public string AzureReposHosts { get; set; }
+    public string BitbucketHosts { get; set; }
+    public string GiteaHosts { get; set; }
+
+    private void GenerateReadme()
+    {
+        var codes =new[] { "MSKIT_PKG020", "MSKIT_PKG021", "MSKIT_PKG022" };
+        var findings = codes.ToDictionary(c => c, c => new List<string>());
+        Action<string, string> report = (code, text) => findings[code].Add(text.Replace("\r", " ").Replace("\n", " "));
+
+        Func<string, string> norm = s => (s ?? "").Trim();
+        Func<string, HashSet<string>> hostSet = list => new HashSet<string>(
+            norm(list).Split(new[] { ';' }, StringSplitOptions.RemoveEmptyEntries)
+                .Select(h => Regex.Replace(h.Trim().ToLowerInvariant(), @"^[a-z][a-z0-9+.-]*://", ""))
+                .Select(h => h.Split('/')[0].Split(':')[0])
+                .Where(h => h.Length > 0));
+
+        var root = Path.GetFullPath(string.IsNullOrWhiteSpace(RepoRoot) ? Path.GetDirectoryName(ReadmePath) : RepoRoot).TrimEnd('\\', '/');
+        var readmeFull = Path.GetFullPath(ReadmePath);
+        var readmeDir = Path.GetDirectoryName(readmeFull);
+        var readmeRel = "";
+        if (readmeDir.Length > root.Length && readmeDir.StartsWith(root, StringComparison.OrdinalIgnoreCase) && (readmeDir[root.Length] == '\\' || readmeDir[root.Length] == '/'))
+            readmeRel = readmeDir.Substring(root.Length + 1).Replace('\\', '/');
+        var display = (readmeRel.Length > 0 ? readmeRel + "/" : "") + Path.GetFileName(readmeFull);
+
+        var repoUrl = norm(RepositoryUrl);
+        var m0 = Regex.Match(repoUrl, @"^[^@/\s]+@([^:/\s]+):(.+)$");
+        if (m0.Success) repoUrl = "https://" + m0.Groups[1].Value + "/" + m0.Groups[2].Value;
+        if (repoUrl.EndsWith(".git", StringComparison.OrdinalIgnoreCase)) repoUrl = repoUrl.Substring(0, repoUrl.Length - 4);
+        repoUrl = repoUrl.TrimEnd('/');
+        string host = "", repoPath = "", owner = "", repo = "";
+        Uri repoUri;
+        var hasRepo = Uri.TryCreate(repoUrl, UriKind.Absolute, out repoUri) && repoUri.Host.Length > 0;
+        if (hasRepo)
+        {
+            host = repoUri.Host.ToLowerInvariant();
+            repoPath = repoUri.AbsolutePath.Trim('/');
+            var scheme = repoUri.Scheme == "http" ? "http" : "https";
+            repoUrl = scheme + "://" + repoUri.Authority + (repoPath.Length > 0 ? "/" + repoPath : "");
+            var cut = repoPath.LastIndexOf('/');
+            owner = cut > 0 ? repoPath.Substring(0, cut) : "";
+            repo = cut >= 0 ? repoPath.Substring(cut + 1) : repoPath;
+        }
+
+        var provider = norm(Provider);
+        if (provider.Length == 0 && hasRepo)
+        {
+            if (host == "github.com" || hostSet(GitHubHosts).Contains(host)) provider = "GitHub";
+            else if (host == "gitlab.com" || hostSet(GitLabHosts).Contains(host)) provider = "GitLab";
+            else if (host == "dev.azure.com" || host.EndsWith(".visualstudio.com") || hostSet(AzureReposHosts).Contains(host)) provider = "AzureDevOps";
+            else if (host == "bitbucket.org" || hostSet(BitbucketHosts).Contains(host)) provider = "Bitbucket";
+            else if (host == "codeberg.org" || host == "gitea.com" || hostSet(GiteaHosts).Contains(host)) provider = "Gitea";
+        }
+
+        string blob = "", tree = "", raw = "", releases = "", issues = "";
+        switch (provider.ToLowerInvariant())
+        {
+            case "github":
+                blob = "{repoUrl}/blob/{commit}/{path}"; tree = "{repoUrl}/tree/{commit}/{path}";
+                raw = host == "github.com" ? "https://raw.githubusercontent.com/{repoPath}/{commit}/{path}" : "{repoUrl}/raw/{commit}/{path}";
+                releases = "{repoUrl}/releases"; issues = "{repoUrl}/issues";
+                break;
+            case "gitlab":
+                blob = "{repoUrl}/-/blob/{commit}/{path}"; tree = "{repoUrl}/-/tree/{commit}/{path}"; raw = "{repoUrl}/-/raw/{commit}/{path}";
+                releases = "{repoUrl}/-/releases"; issues = "{repoUrl}/-/issues";
+                break;
+            case "azuredevops":
+                blob = tree = raw = "{repoUrl}?path=/{path}&version=GC{commit}";
+                break;
+            case "bitbucket":
+                blob = tree = "{repoUrl}/src/{commit}/{path}"; raw = "{repoUrl}/raw/{commit}/{path}"; issues = "{repoUrl}/issues";
+                break;
+            case "gitea":
+                blob = tree = "{repoUrl}/src/commit/{commit}/{path}"; raw = "{repoUrl}/raw/commit/{commit}/{path}";
+                releases = "{repoUrl}/releases"; issues = "{repoUrl}/issues";
+                break;
+            case "":
+                break;
+            default:
+                report("MSKIT_PKG020", display + ": MSKit_RepoProvider '" + provider + "' is not one of GitHub, GitLab, AzureDevOps, Bitbucket, Gitea; set MSKit_RepoBlobUrlTemplate and MSKit_RepoRawUrlTemplate instead.");
+                break;
+        }
+        if (norm(BlobTemplate).Length > 0) { blob = norm(BlobTemplate); tree = blob.Contains("/blob/") ? blob.Replace("/blob/", "/tree/") : blob; }
+        if (norm(RawTemplate).Length > 0) raw = norm(RawTemplate);
+
+        var commit = norm(Commit);
+        string why = null;
+        if (!hasRepo && norm(BlobTemplate).Length == 0) why = "there is no repository URL (set RepositoryUrl)";
+        else if (blob.Length == 0 || raw.Length == 0) why = "the repository host '" + host + "' is not recognised (set MSKit_RepoProvider, add a SourceLinkGitLabHost / SourceLinkGitHubHost item, or set MSKit_RepoBlobUrlTemplate and MSKit_RepoRawUrlTemplate)";
+        else if (commit.Length == 0 && (blob.Contains("{commit}") || raw.Contains("{commit}"))) why = "there is no commit to pin them to (RepositoryCommit is empty)";
+        var canRewrite = why == null;
+        var unresolved = 0;
+
+        Func<string, string, string> expand = (template, path) => template
+            .Replace("{repoUrl}", repoUrl).Replace("{host}", host).Replace("{repoPath}", repoPath)
+            .Replace("{owner}", owner).Replace("{repo}", repo).Replace("{commit}", commit).Replace("{path}", path);
+
+        Func<string, string> combine = p =>
+        {
+            var parts = new List<string>();
+            if (!p.StartsWith("/"))
+                parts.AddRange(readmeRel.Split(new[] { '/' }, StringSplitOptions.RemoveEmptyEntries));
+            foreach (var s in p.Split('/'))
+            {
+                if (s.Length == 0 || s == ".") continue;
+                if (s == "..") { if (parts.Count == 0) return null; parts.RemoveAt(parts.Count - 1); continue; }
+                parts.Add(s);
+            }
+            return string.Join("/", parts);
+        };
+
+        var allowed = hostSet(AllowedImageHosts);
+        Action<string, int> checkImage = (url, n) =>
+        {
+            Uri u;
+            if (!Uri.TryCreate(url.Trim('<', '>'), UriKind.Absolute, out u) || (u.Scheme != "https" && u.Scheme != "http")) return;
+            var h = u.Host.ToLowerInvariant();
+            if (allowed.Contains(h) || (h == "github.com" && Regex.IsMatch(u.AbsolutePath, @"^/[^/]+/[^/]+/(actions/)?workflows/[^/]+/badge\.svg$", RegexOptions.IgnoreCase))) return;
+            report("MSKIT_PKG021", display + " line " + n + ": the image " + url + " comes from " + h + ", a host nuget.org does not show images from. Use an allowed host (nuget.allowed-image-hosts.txt in the kit) or point MSKit_RepoRawUrlTemplate at one.");
+        };
+
+        Func<string, bool, int, string> resolve = (target, isImage, n) =>
+        {
+            var angle = target.StartsWith("<") && target.EndsWith(">");
+            var t = angle ? target.Substring(1, target.Length - 2) : target;
+            if (t.Length == 0 || t.StartsWith("#") || t.StartsWith("//") || Regex.IsMatch(t, @"^[A-Za-z][A-Za-z0-9+.-]*:")) return target;
+            var cut = t.IndexOfAny(new[] { '?', '#' });
+            var p = cut >= 0 ? t.Substring(0, cut) : t;
+            var suffix = cut >= 0 ? t.Substring(cut) : "";
+            if (p.Length == 0) return target;
+            if (!canRewrite) { unresolved++; return target; }
+            var rp = combine(Uri.UnescapeDataString(p));
+            if (rp == null)
+            {
+                report("MSKIT_PKG020", display + " line " + n + ": " + t + " points outside the repository and is left as it is.");
+                return target;
+            }
+            var isDir = Directory.Exists(Path.Combine(root, rp.Replace('/', Path.DirectorySeparatorChar)));
+            var encoded = string.Join("/", rp.Split('/').Select(Uri.EscapeDataString));
+            var url = expand(isImage ? raw : (isDir ? tree : blob), encoded) + suffix;
+            return angle ? "<" + url + ">" : url;
+        };
+
+        var imageRe = new Regex(@"(!\[[^\[\]]*\]\(\s*)(<[^>]*>|[^)\s]+)");
+        var linkRe = new Regex(@"((?<!!)\[(?:[^\[\]]|\[[^\[\]]*\])*\]\(\s*)(<[^>]*>|[^)\s]+)");
+        var refDefRe = new Regex(@"^(\s{0,3}\[[^\]]+\]:\s*)(<[^>]*>|\S+)(.*)$");
+        var imageExtRe = new Regex(@"\.(png|jpe?g|gif|svg|webp|bmp|ico)$", RegexOptions.IgnoreCase);
+        var codeSpanRe = new Regex(@"(`+)[\s\S]*?(?<!`)\1(?!`)");
+
+        Func<string, int, string> rewriteProse = (s, n) =>
+        {
+            s = imageRe.Replace(s, m => { var r = resolve(m.Groups[2].Value, true, n); checkImage(r, n); return m.Groups[1].Value + r; });
+            return linkRe.Replace(s, m => m.Groups[1].Value + resolve(m.Groups[2].Value, false, n));
+        };
+        Func<string, int, string> rewriteLine = (line, n) =>
+        {
+            var rd = refDefRe.Match(line);
+            if (rd.Success)
+            {
+                var target = rd.Groups[2].Value;
+                var isImage = imageExtRe.IsMatch(target.Trim('<', '>').Split('?', '#')[0]);
+                var r = resolve(target, isImage, n);
+                if (isImage) checkImage(r, n);
+                return rd.Groups[1].Value + r + rd.Groups[3].Value;
+            }
+            var sb = new StringBuilder();
+            var pos = 0;
+            foreach (Match m in codeSpanRe.Matches(line))
+            {
+                sb.Append(rewriteProse(line.Substring(pos, m.Index - pos), n));
+                sb.Append(m.Value);
+                pos = m.Index + m.Length;
+            }
+            sb.Append(rewriteProse(line.Substring(pos), n));
+            return sb.ToString();
+        };
+
+        var skipOpen = new Regex(@"^\s*<!--\s*nuget:skip\s*-->\s*$");
+        var skipClose = new Regex(@"^\s*<!--\s*/nuget:skip\s*-->\s*$");
+        var onlyOpen = new Regex(@"^\s*<!--\s*nuget:only\s+(.+?)\s*-->\s*$");
+        var onlyClose = new Regex(@"^\s*<!--\s*/nuget:only\s*-->\s*$");
+        var fenceRe = new Regex(@"^\s{0,3}(`{3,}|~{3,})");
+
+        var lines = File.ReadAllText(readmeFull).Replace("\r\n", "\n").Replace("\r", "\n").Split('\n');
+        var outLines = new List<string>();
+        var outFence = new List<bool>();
+        string fence = null;
+        bool skipping = false, inOnly = false, keepOnly = true;
+        int skipLine = 0, onlyLine = 0;
+        for (var i = 0; i < lines.Length; i++)
+        {
+            var line = lines[i];
+            var n = i + 1;
+            var drop = skipping || (inOnly && !keepOnly);
+            if (fence != null)
+            {
+                if (Regex.IsMatch(line, @"^\s{0,3}" + Regex.Escape(fence.Substring(0, 1)) + "{" + fence.Length + @",}\s*$")) fence = null;
+                if (!drop) { outLines.Add(line); outFence.Add(true); }
+                continue;
+            }
+            if (skipOpen.IsMatch(line))
+            {
+                if (skipping) report("MSKIT_PKG020", display + " line " + n + ": nuget:skip opened again before line " + skipLine + "'s was closed.");
+                skipping = true; skipLine = n; continue;
+            }
+            if (skipClose.IsMatch(line))
+            {
+                if (!skipping) report("MSKIT_PKG020", display + " line " + n + ": /nuget:skip has no matching nuget:skip.");
+                skipping = false; continue;
+            }
+            var om = onlyOpen.Match(line);
+            if (om.Success)
+            {
+                if (inOnly) report("MSKIT_PKG020", display + " line " + n + ": nuget:only opened again before line " + onlyLine + "'s was closed.");
+                inOnly = true; onlyLine = n;
+                keepOnly = Regex.Split(om.Groups[1].Value.Trim(), @"[\s,]+").Any(id => string.Equals(id, PackageId, StringComparison.OrdinalIgnoreCase));
+                continue;
+            }
+            if (onlyClose.IsMatch(line))
+            {
+                if (!inOnly) report("MSKIT_PKG020", display + " line " + n + ": /nuget:only has no matching nuget:only.");
+                inOnly = false; keepOnly = true; continue;
+            }
+            var fm = fenceRe.Match(line);
+            if (fm.Success)
+            {
+                fence = fm.Groups[1].Value;
+                if (!drop) { outLines.Add(line); outFence.Add(true); }
+                continue;
+            }
+            if (drop) continue;
+            outLines.Add(rewriteLine(line, n));
+            outFence.Add(false);
+        }
+        if (skipping) report("MSKIT_PKG020", display + " line " + skipLine + ": nuget:skip is never closed, so everything after it is left out.");
+        if (inOnly) report("MSKIT_PKG020", display + " line " + onlyLine + ": nuget:only is never closed.");
+        if (!canRewrite && unresolved > 0)
+            report("MSKIT_PKG020", display + ": " + unresolved + " relative link(s) and image(s) stay relative because " + why + ".");
+
+        var title = norm(ReadmeTitle) == "auto" ? norm(PackageId) : norm(ReadmeTitle);
+        if (title.Length > 0)
+        {
+            var anyAtx = new Regex(@"^ {0,3}#{1,6}(?:[ \t]|$)");
+            var h1Atx = new Regex(@"^ {0,3}#(?:[ \t]|$)");
+            var setextH1 = new Regex(@"^ {0,3}=+[ \t]*$");
+            int from = -1, to = -1;
+            for (var i = 0; i < outLines.Count && from < 0; i++)
+            {
+                if (outFence[i]) continue;
+                if (h1Atx.IsMatch(outLines[i])) { from = to = i; continue; }
+                if (i + 1 < outLines.Count && !outFence[i + 1] && outLines[i].Trim().Length > 0 && !anyAtx.IsMatch(outLines[i]) && setextH1.IsMatch(outLines[i + 1]))
+                {
+                    from = i; to = i + 1;
+                    while (from > 0 && !outFence[from - 1] && outLines[from - 1].Trim().Length > 0 && !anyAtx.IsMatch(outLines[from - 1])) from--;
+                }
+            }
+            if (from >= 0)
+            {
+                outLines.RemoveRange(from, to - from + 1); outFence.RemoveRange(from, to - from + 1);
+                outLines.Insert(from, "# " + title); outFence.Insert(from, false);
+            }
+            else
+            {
+                outLines.InsertRange(0, new[] { "# " + title, "" }); outFence.InsertRange(0, new[] { false, false });
+            }
+        }
+
+        var releasesUrl = norm(ReleasesUrl) == "auto" ? (hasRepo && releases.Length > 0 ? expand(releases, "") : "") : expand(norm(ReleasesUrl), "");
+        var issuesUrl = norm(IssuesUrl) == "auto" ? (hasRepo && issues.Length > 0 ? expand(issues, "") : "") : expand(norm(IssuesUrl), "");
+        var start = -1;
+        var end = outLines.Count;
+        for (var i = 0; i < outLines.Count; i++)
+            if (!outFence[i] && Regex.IsMatch(outLines[i], @"^##\s+Overview\s*#*\s*$", RegexOptions.IgnoreCase)) { start = i + 1; break; }
+        if (start < 0) start = 0;
+        for (var i = start; i < outLines.Count; i++)
+            if (!outFence[i] && (start > 0 ? Regex.IsMatch(outLines[i], @"^#{1,2}\s") : Regex.IsMatch(outLines[i], @"^##\s"))) { end = i; break; }
+        var overview = string.Join("\n", outLines.GetRange(start, end - start));
+        var links = new List<string>();
+        if (releasesUrl.Length > 0 && !overview.Contains("](" + releasesUrl)) links.Add("[Release notes](" + releasesUrl + ")");
+        if (issuesUrl.Length > 0 && !overview.Contains("](" + issuesUrl)) links.Add("[Issues](" + issuesUrl + ")");
+        if (links.Count > 0)
+        {
+            var at = end;
+            while (at > start && outLines[at - 1].Trim().Length == 0) at--;
+            outLines.InsertRange(at, new[] { "", string.Join(" · ", links), "" });
+            outFence.InsertRange(at, new[] { false, false, false });
+        }
+
+        var visibility = norm(Visibility).ToLowerInvariant();
+        if (visibility == "private" || visibility == "internal")
+            report("MSKIT_PKG022", "The repository " + (repoUrl.Length > 0 ? repoUrl : "of " + PackageId) + " is " + visibility + ": the links in the package readme of " + PackageId + " will not open for people reading it on nuget.org. Publish from a public repository, or point MSKit_RepoBlobUrlTemplate and MSKit_RepoRawUrlTemplate at a public mirror.");
+
+        var result = new List<string>();
+        var blank = true;
+        for (var i = 0; i < outLines.Count; i++)
+        {
+            var isBlank = !outFence[i] && outLines[i].Trim().Length == 0;
+            if (isBlank && blank) continue;
+            result.Add(outLines[i]);
+            blank = isBlank;
+        }
+        while (result.Count > 0 && result[result.Count - 1].Trim().Length == 0) result.RemoveAt(result.Count - 1);
+
+        var utf8 = new UTF8Encoding(false);
+        Directory.CreateDirectory(Path.GetDirectoryName(Path.GetFullPath(OutputPath)));
+        File.WriteAllText(OutputPath, string.Join("\n", result) + "\n", utf8);
+        foreach (var code in codes)
+            File.WriteAllText(FindingsBase + "." + code + ".txt", string.Join("\n", findings[code]) + (findings[code].Count > 0 ? "\n" : ""), utf8);
+        if (!string.IsNullOrWhiteSpace(ReleasesUrlPath))
+            File.WriteAllText(ReleasesUrlPath, releasesUrl.Length > 0 ? releasesUrl + "\n" : "", utf8);
+    }
+}
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.PrivateAssets/init.last.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.PrivateAssets/init.last.targets
new file mode 100644
index 0000000..2d938a6
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.PrivateAssets/init.last.targets
@@ -0,0 +1,5 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory)private.assets.references.targets" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.PrivateAssets/private.assets.references.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.PrivateAssets/private.assets.references.targets
new file mode 100644
index 0000000..9226ef2
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.PrivateAssets/private.assets.references.targets
@@ -0,0 +1,14 @@
+<Project>
+
+  <!-- MSKit_ProjectReferenceAsPrivateAssets=True / MSKit_PackageReferenceAsPrivateAssets=True keep
+       a project's references from flowing to the projects and packages that depend on it. -->
+
+  <ItemGroup Condition="'$(MSKit_ProjectReferenceAsPrivateAssets)'=='True'">
+    <ProjectReference Update="@(ProjectReference)" PrivateAssets="All" />
+  </ItemGroup>
+
+  <ItemGroup Condition="'$(MSKit_PackageReferenceAsPrivateAssets)'=='True'">
+    <PackageReference Update="@(PackageReference)" PrivateAssets="All" />
+  </ItemGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/audit/audit.tests.project.xunit.v3.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/audit/audit.tests.project.xunit.v3.targets
new file mode 100644
index 0000000..febe8d5
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/audit/audit.tests.project.xunit.v3.targets
@@ -0,0 +1,15 @@
+<Project>
+
+  <!-- MSKIT_TEST005: xunit.v3 needs net8.0 or later. -->
+  <Target Name="ValidateXUnitV3TFM"
+          BeforeTargets="Build"
+          Condition="'$(IsTestsProject)'=='True'
+                      AND '$(MSKit_TestingFramework)'=='xunit.v3'
+                      AND '$(TargetFramework)'!=''
+                      AND '$(IsNET8_OR_GREATER)'!='True'">
+    <Error Code="MSKIT_TEST005"
+           File="$(MSBuildProjectFullPath)"
+           Text="MSKit_TestingFramework='xunit.v3' requires net8.0 or later. Current target framework: $(TargetFramework).%0AFix: target net8.0 or later in the test project." />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/implicit.package.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/implicit.package.targets
new file mode 100644
index 0000000..29bd17d
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/implicit.package.targets
@@ -0,0 +1,26 @@
+<Project>
+
+  <PropertyGroup>
+    <MSKit_PackageVersion_XunitV3 Condition="'$(MSKit_PackageVersion_XunitV3)'==''">4.0.1</MSKit_PackageVersion_XunitV3>
+    <MSKit_PackageVersion_XunitV3Assert Condition="'$(MSKit_PackageVersion_XunitV3Assert)'==''">$(MSKit_PackageVersion_XunitV3)</MSKit_PackageVersion_XunitV3Assert>
+    <MSKit_PackageVersion_XunitV3ExtensibilityCore Condition="'$(MSKit_PackageVersion_XunitV3ExtensibilityCore)'==''">$(MSKit_PackageVersion_XunitV3)</MSKit_PackageVersion_XunitV3ExtensibilityCore>
+    <MSKit_PackageVersion_XunitRunnerVisualStudio Condition="'$(MSKit_PackageVersion_XunitRunnerVisualStudio)'==''">4.0.0</MSKit_PackageVersion_XunitRunnerVisualStudio>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(MSKit_ImplicitPackageVersions)'=='True' AND '$(ManagePackageVersionsCentrally)'=='true'">
+    <PackageVersion Include="xunit.v3" Version="$(MSKit_PackageVersion_XunitV3)" ControlledBy="DragoAnt.MSBuildKit.Testing.XUnit.v3" />
+    <PackageVersion Include="xunit.v3.mtp-v2" Version="$(MSKit_PackageVersion_XunitV3)" ControlledBy="DragoAnt.MSBuildKit.Testing.XUnit.v3" />
+    <PackageVersion Include="xunit.v3.assert" Version="$(MSKit_PackageVersion_XunitV3Assert)" ControlledBy="DragoAnt.MSBuildKit.Testing.XUnit.v3" />
+    <PackageVersion Include="xunit.v3.extensibility.core" Version="$(MSKit_PackageVersion_XunitV3ExtensibilityCore)" ControlledBy="DragoAnt.MSBuildKit.Testing.XUnit.v3" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="$(MSKit_PackageVersion_XunitRunnerVisualStudio)" ControlledBy="DragoAnt.MSBuildKit.Testing.XUnit.v3" />
+  </ItemGroup>
+
+  <ItemGroup Condition="'$(MSKit_ImplicitPackageVersions)'=='True' AND '$(ManagePackageVersionsCentrally)'!='true'">
+    <PackageReference Update="xunit.v3"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_XunitV3)</Version></PackageReference>
+    <PackageReference Update="xunit.v3.mtp-v2"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_XunitV3)</Version></PackageReference>
+    <PackageReference Update="xunit.v3.assert"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_XunitV3Assert)</Version></PackageReference>
+    <PackageReference Update="xunit.v3.extensibility.core"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_XunitV3ExtensibilityCore)</Version></PackageReference>
+    <PackageReference Update="xunit.runner.visualstudio"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_XunitRunnerVisualStudio)</Version></PackageReference>
+  </ItemGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/init.last.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/init.last.targets
new file mode 100644
index 0000000..ea85fe1
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/init.last.targets
@@ -0,0 +1,6 @@
+<Project>
+
+  <!-- Imported last so the version defaults also reach references added by other parts. -->
+  <Import Project="$(MSBuildThisFileDirectory)implicit.package.targets" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/init.props
new file mode 100644
index 0000000..86ddd60
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/init.props
@@ -0,0 +1,12 @@
+<Project>
+
+  <PropertyGroup>
+    <MSKit_TestingFrameworkAttached Condition="'$(MSKit_TestingFramework)'=='xunit.v3'">true</MSKit_TestingFrameworkAttached>
+    <_MSKit_TestingFramework_xunit_v3_CommonPropsPath>$(MSBuildThisFileDirectory)tests.project.xunit.v3.common.props</_MSKit_TestingFramework_xunit_v3_CommonPropsPath>
+    <_MSKit_TestingFramework_xunit_v3_LibCommonPropsPath>$(MSBuildThisFileDirectory)tests.lib.project.xunit.v3.common.props</_MSKit_TestingFramework_xunit_v3_LibCommonPropsPath>
+  </PropertyGroup>
+
+  <Import Condition="('$(IsTestsProject)'=='True' Or '$(IsTestsLibProject)'=='True') AND '$(MSKit_TestingFramework)'=='xunit.v3'"
+          Project="$(MSBuildThisFileDirectory)tests.project.xunit.v3.routine.props" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/init.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/init.targets
new file mode 100644
index 0000000..d12608e
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/init.targets
@@ -0,0 +1,7 @@
+<Project>
+
+  <ImportGroup Condition="('$(IsTestsProject)'=='True' Or '$(IsTestsLibProject)'=='True') AND '$(MSKit_TestingFramework)'=='xunit.v3'">
+    <Import Project="$(MSBuildThisFileDirectory)tests.project.xunit.v3.routine.targets" />
+  </ImportGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.lib.project.xunit.v3.common.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.lib.project.xunit.v3.common.props
new file mode 100644
index 0000000..962eec1
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.lib.project.xunit.v3.common.props
@@ -0,0 +1,5 @@
+<Project>
+
+  <!-- A test helper library needs no runner wiring; its references come from the routine targets. -->
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.project.xunit.v3.common.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.project.xunit.v3.common.props
new file mode 100644
index 0000000..7fa68e2
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.project.xunit.v3.common.props
@@ -0,0 +1,8 @@
+<Project>
+
+  <!-- Reached through $(TestsProjectCommonPropsPath) for a project whose name auto-detect misses. -->
+  <PropertyGroup>
+    <UseMicrosoftTestingPlatformRunner Condition="'$(EnableMicrosoftTestingPlatform)'=='True'">true</UseMicrosoftTestingPlatformRunner>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.project.xunit.v3.routine.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.project.xunit.v3.routine.props
new file mode 100644
index 0000000..08b3e1f
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.project.xunit.v3.routine.props
@@ -0,0 +1,8 @@
+<Project>
+
+  <!-- https://xunit.net/docs/getting-started/v3/microsoft-testing-platform -->
+  <PropertyGroup>
+    <UseMicrosoftTestingPlatformRunner Condition="'$(EnableMicrosoftTestingPlatform)'=='True'">true</UseMicrosoftTestingPlatformRunner>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.project.xunit.v3.routine.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.project.xunit.v3.routine.targets
new file mode 100644
index 0000000..095e1fc
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing.XUnit.v3/tests.project.xunit.v3.routine.targets
@@ -0,0 +1,57 @@
+<Project InitialTargets="CreateXUnitRunnerJson">
+
+  <!-- Microsoft.Testing.Platform v2 is the default runner: xunit.v3.mtp-v2 plus the code coverage
+       (cobertura) and TRX extensions. EnableMicrosoftTestingPlatform=False falls back to VSTest. -->
+  <Choose>
+    <When Condition="'$(IsTestsProject)'=='True' AND '$(EnableMicrosoftTestingPlatform)'=='True'">
+      <ItemGroup>
+        <PackageReference Include="xunit.v3.mtp-v2" Allowed="True" />
+        <PackageReference Include="Microsoft.Testing.Extensions.CodeCoverage" Allowed="True" />
+        <PackageReference Include="Microsoft.Testing.Extensions.TrxReport" Allowed="True" />
+      </ItemGroup>
+    </When>
+    <When Condition="'$(IsTestsProject)'=='True'">
+      <ItemGroup>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Allowed="True" />
+        <PackageReference Include="xunit.runner.visualstudio" Allowed="True">
+          <PrivateAssets>all</PrivateAssets>
+          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+        <PackageReference Include="xunit.v3" Allowed="True" />
+      </ItemGroup>
+    </When>
+  </Choose>
+
+  <ItemGroup Condition="'$(IsTestsLibProject)'=='True'">
+    <PackageReference Include="xunit.v3.assert" Allowed="True" />
+    <PackageReference Include="xunit.v3.extensibility.core" Allowed="True" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <PropertyGroup Condition="'$(IsTestsProject)'=='True'">
+    <OutputType>Exe</OutputType>
+    <XunitRunnerConfigFileName Condition="'$(XunitRunnerConfigFileName)'==''">xunit.runner.json</XunitRunnerConfigFileName>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(IsTestsProject)'=='True'">
+    <Content Include="$(XunitRunnerConfigFileName)" CopyToOutputDirectory="PreserveNewest"
+             Condition="Exists('$(XunitRunnerConfigFileName)')" />
+  </ItemGroup>
+
+  <!-- Opt-in scaffold: MSKit_ScaffoldTestConfig=True writes a starter xunit.runner.json on a local build. -->
+  <Target Condition="'$(MSKit_ScaffoldTestConfig)'=='True' AND '$(IsTestsProject)'=='True' AND '$(MSKit_IsDevEnv)'=='True' AND !Exists('$(XunitRunnerConfigFileName)')"
+          Name="CreateXUnitRunnerJson">
+    <PropertyGroup>
+      <XunitRunnerJson>
+{
+    "$schema": "https://xunit.net/schema/current/xunit.runner.schema.json"
+}
+      </XunitRunnerJson>
+    </PropertyGroup>
+    <WriteLinesToFile File="$(XunitRunnerConfigFileName)" Overwrite="true" Lines="$(XunitRunnerJson)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/audit/audit.internalsVisibleTo.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/audit/audit.internalsVisibleTo.targets
new file mode 100644
index 0000000..8de8fe0
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/audit/audit.internalsVisibleTo.targets
@@ -0,0 +1,20 @@
+<Project>
+
+  <!-- InternalsVisibleTo configuration warnings. -->
+
+  <!-- Gated like test.project.internalsVisibleTo.targets: only non-test projects emit InternalsVisibleTo. -->
+  <Target Name="ValidateMSKitTestsDirSet" BeforeTargets="BeforeCompile" Condition="'$(InternalsVisibleToAllTestsProjects)'=='True'">
+    <Warning Code="MSKIT_TEST030" Condition="'$(MSKit_TestsDir)'==''"
+             Text="MSKit_TestsDir is empty — cannot auto-emit InternalsVisibleTo for sibling .Tests projects.%0AFix: set MSKit_TestsDir in Directory.Build.props:%0A  &lt;PropertyGroup&gt;%0A    &lt;MSKit_TestsDir&gt;$(MSBuildThisFileDirectory)tests&lt;/MSKit_TestsDir&gt;%0A  &lt;/PropertyGroup&gt;%0ATo disable auto InternalsVisibleTo, add to csproj:%0A  &lt;PropertyGroup&gt;%0A    &lt;InternalsVisibleToAllTestsProjects&gt;False&lt;/InternalsVisibleToAllTestsProjects&gt;%0A  &lt;/PropertyGroup&gt;"
+             File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+  <!-- Warn when MSKit_TestsDir points to a non-existent directory.
+       Gate: InternalsVisibleToAllTestsProjects==True — see ValidateMSKitTestsDirSet for rationale. -->
+  <Target Name="ValidateMSKitTestsDirExists" BeforeTargets="BeforeCompile" Condition="'$(InternalsVisibleToAllTestsProjects)'=='True'">
+    <Warning Code="MSKIT_TEST031" Condition="'$(MSKit_TestsDir)'!='' And !Exists('$(MSKit_TestsDir)')"
+             Text="MSKit_TestsDir='$(MSKit_TestsDir)' does not exist.%0AFix: point MSKit_TestsDir to an existing directory in Directory.Build.props:%0A  &lt;PropertyGroup&gt;%0A    &lt;MSKit_TestsDir&gt;$(MSBuildThisFileDirectory)tests&lt;/MSKit_TestsDir&gt;%0A  &lt;/PropertyGroup&gt;%0ATo disable auto InternalsVisibleTo, add to csproj:%0A  &lt;PropertyGroup&gt;%0A    &lt;InternalsVisibleToAllTestsProjects&gt;False&lt;/InternalsVisibleToAllTestsProjects&gt;%0A  &lt;/PropertyGroup&gt;"
+             File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/audit/audit.tests.lib.project.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/audit/audit.tests.lib.project.targets
new file mode 100644
index 0000000..11cb07e
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/audit/audit.tests.lib.project.targets
@@ -0,0 +1,37 @@
+<Project>
+
+  <!-- Test helper library checks, MSKIT_TEST020..022. A test helper library may also set IsTestsLibProject directly: everything it needs is wired in the targets phase. -->
+
+  <!-- MSKIT_TEST020: MSKit_TestingFramework must be set BEFORE LibCommonProps Import -->
+  <Target Name="ValidateTestingFrameworkSetBeforeLibCommonPropsImport"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(_MSKit_TestsLibProjectCommonPropsImported)'=='True'
+                      AND '$(_MSKit_TestingFrameworkAtLibCommonPropsImport)'==''">
+    <Error Code="MSKIT_TEST020"
+           File="$(MSBuildProjectFullPath)"
+           Text="MSKit_TestingFramework was not set when $(TestsLibProjectCommonPropsPath) was imported.%0AFix: set the framework PropertyGroup BEFORE the Import:%0A  &lt;PropertyGroup&gt;%0A    &lt;MSKit_TestingFramework&gt;xunit.v3&lt;/MSKit_TestingFramework&gt;%0A  &lt;/PropertyGroup&gt;%0A  &lt;Import Project=&quot;$(TestsLibProjectCommonPropsPath)&quot; /&gt;" />
+  </Target>
+
+  <!-- MSKIT_TEST021: framework changed after the Lib Import -->
+  <Target Name="ValidateTestingFrameworkUnchangedSinceLibImport"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(_MSKit_TestsLibProjectCommonPropsImported)'=='True'
+                      AND '$(_MSKit_TestingFrameworkAtLibCommonPropsImport)'!=''
+                      AND '$(_MSKit_TestingFrameworkAtLibCommonPropsImport)'!='$(MSKit_TestingFramework)'">
+    <Error Code="MSKIT_TEST021"
+           File="$(MSBuildProjectFullPath)"
+           Text="MSKit_TestingFramework changed after $(TestsLibProjectCommonPropsPath) was imported.%0AAt import: '$(_MSKit_TestingFrameworkAtLibCommonPropsImport)'   csproj-final: '$(MSKit_TestingFramework)'.%0AFix: move the framework PropertyGroup ABOVE the Import." />
+  </Target>
+
+  <!-- MSKIT_TEST022: no satellite or custom LibCommonProps path resolved -->
+  <Target Name="ValidateTestingFrameworkLibCommonPropsPathResolved"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(_MSKit_TestsLibProjectCommonPropsImported)'=='True'
+                      AND '$(MSKit_TestingFramework_LibCommonPropsPath)'==''
+                      AND '$(MSKit_TestingFramework)'!=''">
+    <Error Code="MSKIT_TEST022"
+           File="$(MSBuildProjectFullPath)"
+           Text="No LibCommonProps path resolved for MSKit_TestingFramework='$(MSKit_TestingFramework)'.%0AFix: use a framework the kit ships (xunit.v3) or set MSKit_TestingFramework_LibCommonPropsPath to a custom file." />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/audit/audit.tests.project.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/audit/audit.tests.project.targets
new file mode 100644
index 0000000..8075de2
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/audit/audit.tests.project.targets
@@ -0,0 +1,82 @@
+<Project>
+
+  <!-- Runnable-test-project checks, MSKIT_TEST010..026. BeforeTargets includes CoreCompile so they
+       fire before generated entry-point code can mask them with compiler errors. -->
+
+  <Target Name="ValidateTestingFrameworkSetBeforeCommonPropsImport"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(_MSKit_TestsProjectCommonPropsImported)'=='True'
+                      AND '$(_MSKit_TestingFrameworkAtCommonPropsImport)'==''">
+    <Error Code="MSKIT_TEST010"
+           File="$(MSBuildProjectFullPath)"
+           Text="MSKit_TestingFramework was not set when $(TestsProjectCommonPropsPath) was imported.%0AFix: set it BEFORE the Import:%0A  &lt;PropertyGroup&gt;%0A    &lt;MSKit_TestingFramework&gt;xunit.v3&lt;/MSKit_TestingFramework&gt;%0A  &lt;/PropertyGroup&gt;%0A  &lt;Import Project=&quot;$(TestsProjectCommonPropsPath)&quot; /&gt;" />
+  </Target>
+
+  <Target Name="ValidateTestingFrameworkUnchangedSinceImport"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(_MSKit_TestsProjectCommonPropsImported)'=='True'
+                      AND '$(_MSKit_TestingFrameworkAtCommonPropsImport)'!=''
+                      AND '$(_MSKit_TestingFrameworkAtCommonPropsImport)'!='$(MSKit_TestingFramework)'">
+    <Error Code="MSKIT_TEST011"
+           File="$(MSBuildProjectFullPath)"
+           Text="MSKit_TestingFramework changed after $(TestsProjectCommonPropsPath) was imported (at import: '$(_MSKit_TestingFrameworkAtCommonPropsImport)', final: '$(MSKit_TestingFramework)').%0AFix: move the framework PropertyGroup above the Import." />
+  </Target>
+
+  <Target Name="ValidateTestingFrameworkCommonPropsPathResolved"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(_MSKit_TestsProjectCommonPropsImported)'=='True'
+                      AND '$(MSKit_TestingFramework_CommonPropsPath)'==''
+                      AND '$(MSKit_TestingFramework)'!=''">
+    <Error Code="MSKIT_TEST012"
+           File="$(MSBuildProjectFullPath)"
+           Text="No framework wiring found for MSKit_TestingFramework='$(MSKit_TestingFramework)'.%0AFix: use a framework the kit ships (xunit.v3), or point MSKit_TestingFramework_CommonPropsPath at your own props file." />
+  </Target>
+
+  <!-- MSKIT_TEST013 reads the csproj text, comments stripped, so a direct declaration is caught
+       even when the name would also match auto-detect. -->
+  <Target Name="ValidateIsTestsProjectNotSetDirectly"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(IsTestsProject)'=='True'
+                      AND '$(_MSKit_TestsProjectCommonPropsImported)'!='True'
+                      AND Exists('$(MSBuildProjectFullPath)')">
+    <PropertyGroup>
+      <_MSKit_CsprojText013>$([System.IO.File]::ReadAllText('$(MSBuildProjectFullPath)'))</_MSKit_CsprojText013>
+      <_MSKit_CsprojText013>$([System.Text.RegularExpressions.Regex]::Replace($(_MSKit_CsprojText013), '&lt;!--[\s\S]*?--&gt;', ''))</_MSKit_CsprojText013>
+      <_MSKit_HasDirectIsTestsProject>$([System.Text.RegularExpressions.Regex]::IsMatch($(_MSKit_CsprojText013), '&lt;IsTestsProject\s*&gt;'))</_MSKit_HasDirectIsTestsProject>
+    </PropertyGroup>
+    <Error Code="MSKIT_TEST013"
+           File="$(MSBuildProjectFullPath)"
+           Condition="'$(_MSKit_HasDirectIsTestsProject)'=='True'"
+           Text="csproj '$(MSBuildProjectName)' declares &lt;IsTestsProject&gt; directly. That is set too late for the Microsoft.Testing.Platform wiring, which happens in the props phase.%0AFix: rename the project to match MSKit_TestsProjectNameRegex (default: names ending in .Tests), or replace the property with the explicit endpoint:%0A  &lt;PropertyGroup&gt;%0A    &lt;MSKit_TestingFramework&gt;xunit.v3&lt;/MSKit_TestingFramework&gt;%0A  &lt;/PropertyGroup&gt;%0A  &lt;Import Project=&quot;$(TestsProjectCommonPropsPath)&quot; /&gt;" />
+  </Target>
+
+  <Target Name="ValidateAutoDetectVsLibConflict"
+          BeforeTargets="CoreCompile;Build"
+          Condition="'$(MSKit_IsTestsProjectAutoDetected)'=='True'
+                      AND ('$(IsTestsLibProject)'=='True' OR '$(_MSKit_TestsLibProjectCommonPropsImported)'=='True')
+                      AND '$(MSKit_IsTestsLibProjectAutoDetected)'!='True'">
+    <Error Code="MSKIT_TEST014"
+           File="$(MSBuildProjectFullPath)"
+           Text="Project name '$(MSBuildProjectName)' matches the tests auto-detect regex '$(_MSKit_TestsProjectNameRegex_Shared)' but the project is marked as a test helper library. A project cannot be both.%0AFix one of:%0A  1. Rename the project so it no longer matches (e.g. 'Foo.Tests' to 'Foo.TestUtils')%0A  2. Override MSKit_TestsProjectNameRegex in Directory.Build.props%0A  3. Drop the IsTestsLibProject flag if this is a runnable test project" />
+  </Target>
+
+  <Target Name="ValidateTestingFrameworkSatelliteAttached"
+          BeforeTargets="CoreCompile;Build"
+          Condition="('$(IsTestsProject)'=='True' OR '$(IsTestsLibProject)'=='True')
+                      AND '$(MSKit_TestingFramework)'!=''
+                      AND '$(MSKit_TestingFrameworkAttached)'!='true'">
+    <Error Code="MSKIT_TEST026"
+           File="$(MSBuildProjectFullPath)"
+           Text="Project '$(MSBuildProjectName)' has MSKit_TestingFramework='$(MSKit_TestingFramework)' but no installed kit part wires that framework.%0AFix: use xunit.v3 (part DragoAnt.MSBuildKit.Testing.XUnit.v3), or set MSKit_TestingFramework_CommonPropsPath to your own wiring." />
+  </Target>
+
+  <Target Name="ValidateTestingFrameworkIsSet"
+          BeforeTargets="CoreCompile;Build"
+          Condition="('$(IsTestsProject)'=='True' OR '$(IsTestsLibProject)'=='True')
+                      AND '$(MSKit_TestingFramework)'==''">
+    <Error Code="MSKIT_TEST025"
+           File="$(MSBuildProjectFullPath)"
+           Text="Project '$(MSBuildProjectName)' is a test project but MSKit_TestingFramework is not set.%0AFix: add to Directory.Build.props:%0A  &lt;MSKit_TestingFramework&gt;xunit.v3&lt;/MSKit_TestingFramework&gt;" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/implicit.package.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/implicit.package.targets
new file mode 100644
index 0000000..68fa036
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/implicit.package.targets
@@ -0,0 +1,42 @@
+<Project>
+
+  <!-- Central package versions for the test stack. Each one is a property you can override in
+       Directory.Build.props; MSKit_ImplicitPackageVersions=False turns them all off. -->
+  <PropertyGroup>
+    <MSKit_PackageVersion_FluentAssertions Condition="'$(MSKit_PackageVersion_FluentAssertions)'==''">[7.2.2]</MSKit_PackageVersion_FluentAssertions>
+    <MSKit_PackageVersion_Shouldly Condition="'$(MSKit_PackageVersion_Shouldly)'==''">4.3.0</MSKit_PackageVersion_Shouldly>
+    <MSKit_PackageVersion_AwesomeAssertions Condition="'$(MSKit_PackageVersion_AwesomeAssertions)'==''">9.6.0</MSKit_PackageVersion_AwesomeAssertions>
+    <MSKit_PackageVersion_NSubstitute Condition="'$(MSKit_PackageVersion_NSubstitute)'==''">6.2.0</MSKit_PackageVersion_NSubstitute>
+    <MSKit_PackageVersion_NSubstituteAnalyzersCSharp Condition="'$(MSKit_PackageVersion_NSubstituteAnalyzersCSharp)'==''">1.0.17</MSKit_PackageVersion_NSubstituteAnalyzersCSharp>
+    <MSKit_PackageVersion_MicrosoftNetTestSdk Condition="'$(MSKit_PackageVersion_MicrosoftNetTestSdk)'==''">18.10.1</MSKit_PackageVersion_MicrosoftNetTestSdk>
+    <MSKit_PackageVersion_MicrosoftTestingExtensionsTrxReport Condition="'$(MSKit_PackageVersion_MicrosoftTestingExtensionsTrxReport)'==''">2.4.1</MSKit_PackageVersion_MicrosoftTestingExtensionsTrxReport>
+    <MSKit_PackageVersion_MicrosoftTestingExtensionsCodeCoverage Condition="'$(MSKit_PackageVersion_MicrosoftTestingExtensionsCodeCoverage)'==''">18.11.2</MSKit_PackageVersion_MicrosoftTestingExtensionsCodeCoverage>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(MSKit_ImplicitPackageVersions)'=='True' AND '$(ManagePackageVersionsCentrally)'=='true'">
+    <PackageVersion Include="FluentAssertions" Version="$(MSKit_PackageVersion_FluentAssertions)" ControlledBy="DragoAnt.MSBuildKit.Testing"
+                    Condition="'$(MSKit_TestsAssertions)'=='FluentAssertions'" />
+    <PackageVersion Include="Shouldly" Version="$(MSKit_PackageVersion_Shouldly)" ControlledBy="DragoAnt.MSBuildKit.Testing"
+                    Condition="'$(MSKit_TestsAssertions)'=='Shouldly'" />
+    <PackageVersion Include="AwesomeAssertions" Version="$(MSKit_PackageVersion_AwesomeAssertions)" ControlledBy="DragoAnt.MSBuildKit.Testing"
+                    Condition="'$(MSKit_TestsAssertions)'=='AwesomeAssertions'" />
+    <PackageVersion Include="NSubstitute" Version="$(MSKit_PackageVersion_NSubstitute)" ControlledBy="DragoAnt.MSBuildKit.Testing" />
+    <PackageVersion Include="NSubstitute.Analyzers.CSharp" Version="$(MSKit_PackageVersion_NSubstituteAnalyzersCSharp)" ControlledBy="DragoAnt.MSBuildKit.Testing" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="$(MSKit_PackageVersion_MicrosoftNetTestSdk)" ControlledBy="DragoAnt.MSBuildKit.Testing" />
+    <PackageVersion Include="Microsoft.Testing.Extensions.TrxReport" Version="$(MSKit_PackageVersion_MicrosoftTestingExtensionsTrxReport)" ControlledBy="DragoAnt.MSBuildKit.Testing" />
+    <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="$(MSKit_PackageVersion_MicrosoftTestingExtensionsCodeCoverage)" ControlledBy="DragoAnt.MSBuildKit.Testing" />
+  </ItemGroup>
+
+  <!-- Without Central Package Management the same versions go straight onto the references. -->
+  <ItemGroup Condition="'$(MSKit_ImplicitPackageVersions)'=='True' AND '$(ManagePackageVersionsCentrally)'!='true'">
+    <PackageReference Update="FluentAssertions"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_FluentAssertions)</Version></PackageReference>
+    <PackageReference Update="Shouldly"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_Shouldly)</Version></PackageReference>
+    <PackageReference Update="AwesomeAssertions"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_AwesomeAssertions)</Version></PackageReference>
+    <PackageReference Update="NSubstitute"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_NSubstitute)</Version></PackageReference>
+    <PackageReference Update="NSubstitute.Analyzers.CSharp"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_NSubstituteAnalyzersCSharp)</Version></PackageReference>
+    <PackageReference Update="Microsoft.NET.Test.Sdk"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_MicrosoftNetTestSdk)</Version></PackageReference>
+    <PackageReference Update="Microsoft.Testing.Extensions.TrxReport"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_MicrosoftTestingExtensionsTrxReport)</Version></PackageReference>
+    <PackageReference Update="Microsoft.Testing.Extensions.CodeCoverage"><Version Condition="'%(Version)'==''">$(MSKit_PackageVersion_MicrosoftTestingExtensionsCodeCoverage)</Version></PackageReference>
+  </ItemGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/init.last.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/init.last.targets
new file mode 100644
index 0000000..ea85fe1
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/init.last.targets
@@ -0,0 +1,6 @@
+<Project>
+
+  <!-- Imported last so the version defaults also reach references added by other parts. -->
+  <Import Project="$(MSBuildThisFileDirectory)implicit.package.targets" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/init.props
new file mode 100644
index 0000000..73ea576
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/init.props
@@ -0,0 +1,15 @@
+<Project>
+
+  <!-- Explicit endpoints for test projects whose names the auto-detect regex does not match:
+         <Import Project="$(TestsProjectCommonPropsPath)" />      runnable tests
+         <Import Project="$(TestsLibProjectCommonPropsPath)" />   test helper libraries -->
+  <PropertyGroup>
+    <TestsProjectCommonPropsPath>$(MSBuildThisFileDirectory)tests.project.common.props</TestsProjectCommonPropsPath>
+    <TestsLibProjectCommonPropsPath>$(MSBuildThisFileDirectory)tests.lib.project.common.props</TestsLibProjectCommonPropsPath>
+    <MSKit_TestsAssertions Condition="'$(MSKit_TestsAssertions)'==''">AwesomeAssertions</MSKit_TestsAssertions>
+    <MSKit_TestsMocking Condition="'$(MSKit_TestsMocking)'==''">NSubstitute</MSKit_TestsMocking>
+  </PropertyGroup>
+
+  <Import Project="$(MSBuildThisFileDirectory)tests.project.props" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/init.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/init.targets
new file mode 100644
index 0000000..958c8f9
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/init.targets
@@ -0,0 +1,9 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory)tests.project.targets" />
+
+  <ImportGroup Condition="'$(IsTestsProject)'=='True' Or '$(IsTestsLibProject)'=='True'">
+    <Import Project="$(MSBuildThisFileDirectory)tests.project.mtp.routine.targets" />
+  </ImportGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/test.project.internalsVisibleTo.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/test.project.internalsVisibleTo.targets
new file mode 100644
index 0000000..d651dd7
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/test.project.internalsVisibleTo.targets
@@ -0,0 +1,31 @@
+<Project>
+
+  <!-- Every non-test project shows its internals to the test projects found under MSKit_TestsDir
+       (default: the solution directory), and to Castle's DynamicProxyGenAssembly2 so NSubstitute
+       can mock internal types. -->
+  <PropertyGroup>
+    <MSKit_TestsDir Condition="'$(MSKit_TestsDir)'==''">$(MSKit_SlnFileDirectory)</MSKit_TestsDir>
+    <MSKit_TestsDir Condition="'$(MSKit_TestsDir)'=='' AND '$(MSKit_GitRoot)'!=''">$(MSKit_GitRoot)/</MSKit_TestsDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(MSKit_TestsDir)'!='' AND !$(MSKit_TestsDir.EndsWith('/')) AND !$(MSKit_TestsDir.EndsWith('\'))">
+    <MSKit_TestsDir>$(MSKit_TestsDir)/</MSKit_TestsDir>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(MSKit_TestsDir)'!='' And Exists('$(MSKit_TestsDir)')">
+    <_AllCsprojsUnderTestsDir Include="$(MSKit_TestsDir)**/*.csproj" Exclude="$(MSKit_TestsDir)**/bin/**;$(MSKit_TestsDir)**/obj/**;$(MSKit_TestsDir)**/node_modules/**" />
+  </ItemGroup>
+
+  <!-- Metadata batching over %(Filename) only filters per item inside a target. -->
+  <Target Name="_MSKit_PopulateInternalsVisibleTo"
+          BeforeTargets="BeforeCompile"
+          Condition="'$(MSKit_TestsDir)'!='' And Exists('$(MSKit_TestsDir)')">
+    <ItemGroup>
+      <InternalVisibleToProj Include="@(_AllCsprojsUnderTestsDir)"
+                             Condition="$([System.Text.RegularExpressions.Regex]::IsMatch('%(Filename)', '$(_MSKit_TestsProjectNameRegex_Shared)'))
+                                        OR $([System.Text.RegularExpressions.Regex]::IsMatch('%(Filename)', '$(_MSKit_TestsLibProjectNameRegex_Shared)'))" />
+      <InternalsVisibleTo Include="@(InternalVisibleToProj->'%(Filename)')" />
+      <InternalsVisibleTo Include="DynamicProxyGenAssembly2" />
+    </ItemGroup>
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.lib.project.common.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.lib.project.common.props
new file mode 100644
index 0000000..9685d6b
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.lib.project.common.props
@@ -0,0 +1,21 @@
+<Project>
+
+  <!-- Explicit endpoint for a test helper library. Set MSKit_TestingFramework before the import
+       (MSKIT_TEST020 checks it). -->
+  <PropertyGroup>
+    <_MSKit_TestingFrameworkAtLibCommonPropsImport>$(MSKit_TestingFramework)</_MSKit_TestingFrameworkAtLibCommonPropsImport>
+    <_MSKit_TestsLibProjectCommonPropsImported>True</_MSKit_TestsLibProjectCommonPropsImported>
+    <IsTestsLibProject>True</IsTestsLibProject>
+  </PropertyGroup>
+
+  <Import Project="$(MSBuildThisFileDirectory)tests.project.props"
+          Condition="'$(_MSKit_TestsProjectPropsImported)'!='True'" />
+
+  <PropertyGroup Condition="'$(MSKit_TestingFramework_LibCommonPropsPath)'==''">
+    <MSKit_TestingFramework_LibCommonPropsPath Condition="'$(MSKit_TestingFramework)'=='xunit.v3'">$(_MSKit_TestingFramework_xunit_v3_LibCommonPropsPath)</MSKit_TestingFramework_LibCommonPropsPath>
+  </PropertyGroup>
+
+  <Import Project="$(MSKit_TestingFramework_LibCommonPropsPath)"
+          Condition="'$(MSKit_TestingFramework_LibCommonPropsPath)'!=''" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.common.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.common.props
new file mode 100644
index 0000000..72b358c
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.common.props
@@ -0,0 +1,22 @@
+<Project>
+
+  <!-- Explicit endpoint for a runnable test project whose name the auto-detect regex does not
+       match. Set MSKit_TestingFramework before the import (MSKIT_TEST010 checks it). -->
+  <PropertyGroup>
+    <_MSKit_TestingFrameworkAtCommonPropsImport>$(MSKit_TestingFramework)</_MSKit_TestingFrameworkAtCommonPropsImport>
+    <_MSKit_TestsProjectCommonPropsImported>True</_MSKit_TestsProjectCommonPropsImported>
+    <IsTestsProject>True</IsTestsProject>
+    <EnableMicrosoftTestingPlatform Condition="'$(EnableMicrosoftTestingPlatform)'==''">True</EnableMicrosoftTestingPlatform>
+  </PropertyGroup>
+
+  <Import Project="$(MSBuildThisFileDirectory)tests.project.props"
+          Condition="'$(_MSKit_TestsProjectPropsImported)'!='True'" />
+
+  <PropertyGroup Condition="'$(MSKit_TestingFramework_CommonPropsPath)'==''">
+    <MSKit_TestingFramework_CommonPropsPath Condition="'$(MSKit_TestingFramework)'=='xunit.v3'">$(_MSKit_TestingFramework_xunit_v3_CommonPropsPath)</MSKit_TestingFramework_CommonPropsPath>
+  </PropertyGroup>
+
+  <Import Project="$(MSKit_TestingFramework_CommonPropsPath)"
+          Condition="'$(MSKit_TestingFramework_CommonPropsPath)'!=''" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.lib.global.usings.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.lib.global.usings.targets
new file mode 100644
index 0000000..3c3053d
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.lib.global.usings.targets
@@ -0,0 +1,28 @@
+<Project>
+
+  <!-- Assertion library and NSubstitute for every test project. MSKit_TestsAssertions picks the
+       library (AwesomeAssertions | FluentAssertions | Shouldly | None);       MSKit_TestsMocking picks NSubstitute | None; MSKit_TestsImplicitReferences=False turns all
+       of this off. -->
+
+  <ItemGroup>
+    <PackageReference Include="FluentAssertions" Allowed="True" Condition="'$(MSKit_TestsAssertions)'=='FluentAssertions'" />
+    <PackageReference Include="Shouldly" Allowed="True" Condition="'$(MSKit_TestsAssertions)'=='Shouldly'" />
+    <PackageReference Include="AwesomeAssertions" Allowed="True" Condition="'$(MSKit_TestsAssertions)'=='AwesomeAssertions'" />
+
+    <PackageReference Include="NSubstitute" Allowed="True" Condition="'$(MSKit_TestsMocking)'=='NSubstitute'" />
+    <PackageReference Include="NSubstitute.Analyzers.CSharp" Allowed="True" Condition="'$(MSKit_TestsMocking)'=='NSubstitute'">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="FluentAssertions" Condition="'$(MSKit_TestsAssertions)'=='FluentAssertions'" />
+    <Using Include="Shouldly" Condition="'$(MSKit_TestsAssertions)'=='Shouldly'" />
+    <Using Include="AwesomeAssertions" Condition="'$(MSKit_TestsAssertions)'=='AwesomeAssertions'" />
+    <Using Include="NSubstitute" Condition="'$(MSKit_TestsMocking)'=='NSubstitute'" />
+    <Using Include="NSubstitute.ExceptionExtensions" Condition="'$(MSKit_TestsMocking)'=='NSubstitute'" />
+    <Using Include="System.Diagnostics.CodeAnalysis" />
+  </ItemGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.mtp.routine.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.mtp.routine.targets
new file mode 100644
index 0000000..253fb90
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.mtp.routine.targets
@@ -0,0 +1,25 @@
+<Project InitialTargets="CreateMTPTestConfigJson">
+
+  <PropertyGroup>
+    <MTPTestConfigFileName Condition="'$(MTPTestConfigFileName)'==''">testconfig.json</MTPTestConfigFileName>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(IsTestsProject)'=='True'">
+    <Content Include="$(MTPTestConfigFileName)" CopyToOutputDirectory="PreserveNewest"
+             Condition="Exists('$(MTPTestConfigFileName)')" />
+  </ItemGroup>
+
+  <!-- Opt-in scaffold: MSKit_ScaffoldTestConfig=True writes a starter testconfig.json on a local build. -->
+  <Target Condition="'$(MSKit_ScaffoldTestConfig)'=='True' AND '$(MSKit_IsDevEnv)'=='True' AND '$(IsTestsProject)'=='True' AND !Exists('$(MTPTestConfigFileName)')"
+          Name="CreateMTPTestConfigJson">
+    <PropertyGroup>
+      <MTPTestConfigJson>
+{
+    "diagnosticMessages": false
+}
+      </MTPTestConfigJson>
+    </PropertyGroup>
+    <WriteLinesToFile File="$(MTPTestConfigFileName)" Overwrite="true" Lines="$(MTPTestConfigJson)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.props
new file mode 100644
index 0000000..fce3b86
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.props
@@ -0,0 +1,44 @@
+<Project>
+
+  <!-- Test-project detection and the Microsoft.Testing.Platform switches live in props: the
+       test framework packages' own .targets read them before Directory.Build.targets runs. -->
+
+  <PropertyGroup>
+    <MSKit_TestsProjectNameRegex Condition="'$(MSKit_TestsProjectNameRegex)'==''">\.(Tests(\.Integration|\.Unit)?|IntegrationTests|UnitTests)$</MSKit_TestsProjectNameRegex>
+    <MSKit_IsTestsProjectAutoDetected Condition="'$(MSKit_IsTestsProjectAutoDetected)'==''
+                                                  AND '$(IsTestsProject)'==''
+                                                  AND '$(MSKit_DisableTestsProjectAutoDetect)'!='true'
+                                                  AND '$(MSKit_TestsProjectNameRegex)'!=''">$([System.Text.RegularExpressions.Regex]::IsMatch($(MSBuildProjectName), $(MSKit_TestsProjectNameRegex)))</MSKit_IsTestsProjectAutoDetected>
+    <IsTestsProject Condition="'$(IsTestsProject)'=='' AND '$(MSKit_IsTestsProjectAutoDetected)'=='True'">True</IsTestsProject>
+
+    <!-- Test helper libraries: shared fixtures and base classes that are not runnable themselves. -->
+    <MSKit_TestsLibProjectNameRegex Condition="'$(MSKit_TestsLibProjectNameRegex)'==''">\.(TestsSuite|TestsFixtures|Fixtures)$</MSKit_TestsLibProjectNameRegex>
+    <MSKit_IsTestsLibProjectAutoDetected Condition="'$(MSKit_IsTestsLibProjectAutoDetected)'==''
+                                                     AND '$(IsTestsLibProject)'==''
+                                                     AND '$(MSKit_DisableTestsLibProjectAutoDetect)'!='true'
+                                                     AND '$(MSKit_TestsLibProjectNameRegex)'!=''">$([System.Text.RegularExpressions.Regex]::IsMatch($(MSBuildProjectName), $(MSKit_TestsLibProjectNameRegex)))</MSKit_IsTestsLibProjectAutoDetected>
+    <IsTestsLibProject Condition="'$(IsTestsLibProject)'=='' AND '$(MSKit_IsTestsLibProjectAutoDetected)'=='True'">True</IsTestsLibProject>
+
+    <_MSKit_TestsProjectNameRegex_Shared>$(MSKit_TestsProjectNameRegex)</_MSKit_TestsProjectNameRegex_Shared>
+    <_MSKit_TestsLibProjectNameRegex_Shared>$(MSKit_TestsLibProjectNameRegex)</_MSKit_TestsLibProjectNameRegex_Shared>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <MSKit_AutoDetectedProjectType Include="Tests" Condition="'$(MSKit_IsTestsProjectAutoDetected)'=='True'" />
+    <MSKit_AutoDetectedProjectType Include="TestsLib" Condition="'$(MSKit_IsTestsLibProjectAutoDetected)'=='True'" />
+  </ItemGroup>
+
+  <PropertyGroup Condition="'$(IsTestsProject)'=='True' AND '$(IsTestsLibProject)'!='True'">
+    <!-- Restore decides on the app host packs from the props-phase OutputType; set later, the
+         app host for a target framework the SDK does not bundle is never downloaded. -->
+    <OutputType>Exe</OutputType>
+    <EnableMicrosoftTestingPlatform Condition="'$(EnableMicrosoftTestingPlatform)'==''">True</EnableMicrosoftTestingPlatform>
+    <!-- Exit code 8 means "zero tests ran"; a project whose tests are all skipped is not a failure. -->
+    <TestingPlatformCommandLineArguments Condition="'$(TestingPlatformCommandLineArguments)'==''">--ignore-exit-code 8</TestingPlatformCommandLineArguments>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <_MSKit_TestsProjectPropsImported>True</_MSKit_TestsProjectPropsImported>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.targets
new file mode 100644
index 0000000..1bd4bba
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Testing/tests.project.targets
@@ -0,0 +1,35 @@
+<Project>
+
+  <!-- Runs after the csproj body, so an explicit IsTestsLibProject is final here: a test helper
+       library is never a runnable test project. -->
+  <PropertyGroup>
+    <IsTestsProject Condition="'$(IsTestsLibProject)'=='True'">False</IsTestsProject>
+    <OutputType Condition="'$(IsTestsLibProject)'=='True' AND '$(OutputType)'=='Exe'">Library</OutputType>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(IsTestsProject)'=='True'">
+    <IsPackable>False</IsPackable>
+    <GeneratePackageOnBuild>False</GeneratePackageOnBuild>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(EnableMicrosoftTestingPlatform)'=='True' AND '$(IsTestsProject)'=='True'">
+    <GenerateTestingPlatformEntryPoint Condition="'$(GenerateTestingPlatformEntryPoint)'==''">True</GenerateTestingPlatformEntryPoint>
+    <!-- SDK 8/9 `dotnet test` reaches Microsoft.Testing.Platform only through this bridge. -->
+    <TestingPlatformDotnetTestSupport Condition="'$(TestingPlatformDotnetTestSupport)'=='' AND ('$(IsNET8)'=='True' OR '$(IsNET9)'=='True')">True</TestingPlatformDotnetTestSupport>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(IsTestsProject)'!='True' And '$(IsTestsLibProject)'!='True'">
+    <InternalsVisibleToAllTestsProjects Condition="'$(InternalsVisibleToAllTestsProjects)'==''">True</InternalsVisibleToAllTestsProjects>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="('$(IsTestsProject)'=='True' Or '$(IsTestsLibProject)'=='True') And '$(ExcludeFromCodeCoverage)'==''">
+    <ExcludeFromCodeCoverage>True</ExcludeFromCodeCoverage>
+  </PropertyGroup>
+
+  <Import Condition="'$(InternalsVisibleToAllTestsProjects)'=='True'"
+          Project="$(MSBuildThisFileDirectory)test.project.internalsVisibleTo.targets" />
+
+  <Import Condition="('$(IsTestsProject)'=='True' Or '$(IsTestsLibProject)'=='True') AND '$(MSKit_TestsImplicitReferences)'!='False'"
+          Project="$(MSBuildThisFileDirectory)tests.project.lib.global.usings.targets" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/init.props
new file mode 100644
index 0000000..0f2d9a1
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/init.props
@@ -0,0 +1,5 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory)tfm.constants.props" Condition="'$(IsTfmConstantsImported)'!='true'" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/init.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/init.targets
new file mode 100644
index 0000000..6c58f27
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/init.targets
@@ -0,0 +1,5 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory)tfm.constants.targets" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/tfm.constants.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/tfm.constants.props
new file mode 100644
index 0000000..fca8585
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/tfm.constants.props
@@ -0,0 +1,44 @@
+<Project>
+
+  <PropertyGroup>
+    <IsTfmConstantsImported>true</IsTfmConstantsImported>
+
+    <IsNETFRAMEWORK Condition="'$(TargetFramework)'=='net48'">True</IsNETFRAMEWORK>
+
+    <IsNETSTANDARD20 Condition="'$(TargetFramework)'=='netstandard2.0'">True</IsNETSTANDARD20>
+    <IsNETSTANDARD21 Condition="'$(TargetFramework)'=='netstandard2.1'">True</IsNETSTANDARD21>
+    <IsNETSTANDARD Condition="'$(IsNETSTANDARD20)'=='True' OR '$(IsNETSTANDARD21)'=='True'">True</IsNETSTANDARD>
+
+    <IsNETFRAMEWORK_OR_STANDARD Condition="'$(IsNETFRAMEWORK)'=='True' OR '$(IsNETSTANDARD)'=='True'">True</IsNETFRAMEWORK_OR_STANDARD>
+
+    <IsNET7 Condition="'$(TargetFramework)'=='net7.0'">True</IsNET7>
+    <IsNET8 Condition="'$(TargetFramework)'=='net8.0'">True</IsNET8>
+    <IsNET9 Condition="'$(TargetFramework)'=='net9.0'">True</IsNET9>
+    <IsNET10 Condition="'$(TargetFramework)'=='net10.0'">True</IsNET10>
+    <IsNET11 Condition="'$(TargetFramework)'=='net11.0'">True</IsNET11>
+    <IsNET12 Condition="'$(TargetFramework)'=='net12.0'">True</IsNET12>
+    <IsNET13 Condition="'$(TargetFramework)'=='net13.0'">True</IsNET13>
+    <IsNET14 Condition="'$(TargetFramework)'=='net14.0'">True</IsNET14>
+
+    <IsNET14_OR_GREATER Condition="'$(IsNET14)'=='True'">True</IsNET14_OR_GREATER>
+    <IsNET13_OR_GREATER Condition="'$(IsNET13)'=='True' OR '$(IsNET14_OR_GREATER)'=='True'">True</IsNET13_OR_GREATER>
+    <IsNET12_OR_GREATER Condition="'$(IsNET12)'=='True' OR '$(IsNET13_OR_GREATER)'=='True'">True</IsNET12_OR_GREATER>
+    <IsNET11_OR_GREATER Condition="'$(IsNET11)'=='True' OR '$(IsNET12_OR_GREATER)'=='True'">True</IsNET11_OR_GREATER>
+    <IsNET10_OR_GREATER Condition="'$(IsNET10)'=='True' OR '$(IsNET11_OR_GREATER)'=='True'">True</IsNET10_OR_GREATER>
+    <IsNET9_OR_GREATER Condition="'$(IsNET9)'=='True' OR '$(IsNET10_OR_GREATER)'=='True'">True</IsNET9_OR_GREATER>
+    <IsNET8_OR_GREATER Condition="'$(IsNET8)'=='True' OR '$(IsNET9_OR_GREATER)'=='True'">True</IsNET8_OR_GREATER>
+    <IsNET7_OR_GREATER Condition="'$(IsNET7)'=='True' OR '$(IsNET8_OR_GREATER)'=='True'">True</IsNET7_OR_GREATER>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET7)'=='True'">7</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET8)'=='True'">8</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET9)'=='True'">9</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET10)'=='True'">10</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET11)'=='True'">11</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET12)'=='True'">12</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET13)'=='True'">13</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET14)'=='True'">14</TargetFrameworkVersionMajor>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/tfm.constants.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/tfm.constants.targets
new file mode 100644
index 0000000..d68b6f9
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.TfmConstants/tfm.constants.targets
@@ -0,0 +1,69 @@
+<Project>
+
+  <!-- tfm.constants.props again, after the csproj body: a single TargetFramework set there is
+       empty in the props phase. Keep the two definitions identical (tests/tfm-constants.sh). -->
+  <PropertyGroup>
+    <IsNETFRAMEWORK></IsNETFRAMEWORK>
+    <IsNETSTANDARD20></IsNETSTANDARD20>
+    <IsNETSTANDARD21></IsNETSTANDARD21>
+    <IsNETSTANDARD></IsNETSTANDARD>
+    <IsNETFRAMEWORK_OR_STANDARD></IsNETFRAMEWORK_OR_STANDARD>
+    <IsNET7></IsNET7>
+    <IsNET8></IsNET8>
+    <IsNET9></IsNET9>
+    <IsNET10></IsNET10>
+    <IsNET11></IsNET11>
+    <IsNET12></IsNET12>
+    <IsNET13></IsNET13>
+    <IsNET14></IsNET14>
+    <IsNET14_OR_GREATER></IsNET14_OR_GREATER>
+    <IsNET13_OR_GREATER></IsNET13_OR_GREATER>
+    <IsNET12_OR_GREATER></IsNET12_OR_GREATER>
+    <IsNET11_OR_GREATER></IsNET11_OR_GREATER>
+    <IsNET10_OR_GREATER></IsNET10_OR_GREATER>
+    <IsNET9_OR_GREATER></IsNET9_OR_GREATER>
+    <IsNET8_OR_GREATER></IsNET8_OR_GREATER>
+    <IsNET7_OR_GREATER></IsNET7_OR_GREATER>
+    <TargetFrameworkVersionMajor></TargetFrameworkVersionMajor>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <IsNETFRAMEWORK Condition="'$(TargetFramework)'=='net48'">True</IsNETFRAMEWORK>
+
+    <IsNETSTANDARD20 Condition="'$(TargetFramework)'=='netstandard2.0'">True</IsNETSTANDARD20>
+    <IsNETSTANDARD21 Condition="'$(TargetFramework)'=='netstandard2.1'">True</IsNETSTANDARD21>
+    <IsNETSTANDARD Condition="'$(IsNETSTANDARD20)'=='True' OR '$(IsNETSTANDARD21)'=='True'">True</IsNETSTANDARD>
+
+    <IsNETFRAMEWORK_OR_STANDARD Condition="'$(IsNETFRAMEWORK)'=='True' OR '$(IsNETSTANDARD)'=='True'">True</IsNETFRAMEWORK_OR_STANDARD>
+
+    <IsNET7 Condition="'$(TargetFramework)'=='net7.0'">True</IsNET7>
+    <IsNET8 Condition="'$(TargetFramework)'=='net8.0'">True</IsNET8>
+    <IsNET9 Condition="'$(TargetFramework)'=='net9.0'">True</IsNET9>
+    <IsNET10 Condition="'$(TargetFramework)'=='net10.0'">True</IsNET10>
+    <IsNET11 Condition="'$(TargetFramework)'=='net11.0'">True</IsNET11>
+    <IsNET12 Condition="'$(TargetFramework)'=='net12.0'">True</IsNET12>
+    <IsNET13 Condition="'$(TargetFramework)'=='net13.0'">True</IsNET13>
+    <IsNET14 Condition="'$(TargetFramework)'=='net14.0'">True</IsNET14>
+
+    <IsNET14_OR_GREATER Condition="'$(IsNET14)'=='True'">True</IsNET14_OR_GREATER>
+    <IsNET13_OR_GREATER Condition="'$(IsNET13)'=='True' OR '$(IsNET14_OR_GREATER)'=='True'">True</IsNET13_OR_GREATER>
+    <IsNET12_OR_GREATER Condition="'$(IsNET12)'=='True' OR '$(IsNET13_OR_GREATER)'=='True'">True</IsNET12_OR_GREATER>
+    <IsNET11_OR_GREATER Condition="'$(IsNET11)'=='True' OR '$(IsNET12_OR_GREATER)'=='True'">True</IsNET11_OR_GREATER>
+    <IsNET10_OR_GREATER Condition="'$(IsNET10)'=='True' OR '$(IsNET11_OR_GREATER)'=='True'">True</IsNET10_OR_GREATER>
+    <IsNET9_OR_GREATER Condition="'$(IsNET9)'=='True' OR '$(IsNET10_OR_GREATER)'=='True'">True</IsNET9_OR_GREATER>
+    <IsNET8_OR_GREATER Condition="'$(IsNET8)'=='True' OR '$(IsNET9_OR_GREATER)'=='True'">True</IsNET8_OR_GREATER>
+    <IsNET7_OR_GREATER Condition="'$(IsNET7)'=='True' OR '$(IsNET8_OR_GREATER)'=='True'">True</IsNET7_OR_GREATER>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET7)'=='True'">7</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET8)'=='True'">8</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET9)'=='True'">9</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET10)'=='True'">10</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET11)'=='True'">11</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET12)'=='True'">12</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET13)'=='True'">13</TargetFrameworkVersionMajor>
+    <TargetFrameworkVersionMajor Condition="'$(IsNET14)'=='True'">14</TargetFrameworkVersionMajor>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Vcs.GitHub/ci.github.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Vcs.GitHub/ci.github.props
new file mode 100644
index 0000000..30decc3
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Vcs.GitHub/ci.github.props
@@ -0,0 +1,27 @@
+<Project>
+
+  <!-- Maps the GitHub Actions environment onto the kit's CI properties. Actions sets
+       GITHUB_RUN_ID for every job, so its presence is what marks a CI build. -->
+  <PropertyGroup>
+    <MSKit_IsGitHubCI Condition="'$(GITHUB_ACTIONS)'=='true' OR '$(GITHUB_RUN_ID)'!=''">True</MSKit_IsGitHubCI>
+    <MSKit_IsDevEnv Condition="'$(GITHUB_RUN_ID)'!=''">False</MSKit_IsDevEnv>
+
+    <MSKit_CIPipelineId Condition="'$(MSKit_CIPipelineId)'==''">$(GITHUB_RUN_ID)</MSKit_CIPipelineId>
+    <!-- The run number, not the run id: run ids are ~11 digits and overflow version parts. -->
+    <MSKit_BuildNumber Condition="'$(MSKit_BuildNumber)'==''">$(GITHUB_RUN_NUMBER)</MSKit_BuildNumber>
+    <MSKit_CommitSha Condition="'$(MSKit_IsDevEnv)'!='True' AND '$(MSKit_CommitSha)'==''">$(GITHUB_SHA)</MSKit_CommitSha>
+
+    <MSKit_IsReleaseTag Condition="'$(MSKit_IsReleaseTag)'=='' AND '$(GITHUB_REF_TYPE)'=='tag'">True</MSKit_IsReleaseTag>
+    <MSKit_ReleaseTagRaw Condition="'$(MSKit_IsReleaseTag)'=='True' AND '$(MSKit_ReleaseTagRaw)'==''">$(GITHUB_REF_NAME)</MSKit_ReleaseTagRaw>
+    <MSKit_ReleaseTag Condition="'$(MSKit_IsReleaseTag)'=='True' AND '$(MSKit_ReleaseTag)'==''">$([System.Text.RegularExpressions.Regex]::Replace('$(MSKit_ReleaseTagRaw)', '^[vV]', ''))</MSKit_ReleaseTag>
+
+    <MSKit_PullRequestNumber Condition="'$(MSKit_PullRequestNumber)'=='' AND ('$(GITHUB_EVENT_NAME)'=='pull_request' OR '$(GITHUB_EVENT_NAME)'=='pull_request_target')">$([System.Text.RegularExpressions.Regex]::Match('$(GITHUB_REF)', 'refs/pull/(\d+)/').Groups[1].Value)</MSKit_PullRequestNumber>
+    <MSKit_PullRequestNumber Condition="'$(MSKit_PullRequestNumber)'=='' AND $([System.Text.RegularExpressions.Regex]::IsMatch('$(GITHUB_REF_NAME)', '^\d+/merge$'))">$([System.Text.RegularExpressions.Regex]::Match('$(GITHUB_REF_NAME)', '^\d+').Value)</MSKit_PullRequestNumber>
+
+    <RepositoryUrl Condition="'$(RepositoryUrl)'=='' AND '$(GITHUB_REPOSITORY)'!=''">$(GITHUB_SERVER_URL)/$(GITHUB_REPOSITORY)</RepositoryUrl>
+    <RepositoryUrl Condition="'$(RepositoryUrl)'=='/$(GITHUB_REPOSITORY)'">https://github.com/$(GITHUB_REPOSITORY)</RepositoryUrl>
+
+    <MSKit_VcsProvider>GitHub</MSKit_VcsProvider>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Vcs.GitHub/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Vcs.GitHub/init.props
new file mode 100644
index 0000000..48bdbb4
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit.Vcs.GitHub/init.props
@@ -0,0 +1,5 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory)ci.github.props" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.implicit.packages.duplicates.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.implicit.packages.duplicates.targets
new file mode 100644
index 0000000..b03a750
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.implicit.packages.duplicates.targets
@@ -0,0 +1,34 @@
+<Project>
+
+  <!-- MSKIT_DUP001: Directory.Packages.props declares a <PackageVersion> the kit already declares
+       (the kit's items carry ControlledBy metadata). NuGet would otherwise report NU1506 and pick
+       one silently. MSKit_SkipAudit_ImplicitPackageDuplicates=True bypasses the check. -->
+
+  <PropertyGroup>
+    <MSKit_SkipAudit_ImplicitPackageDuplicates Condition="'$(MSKit_SkipAudit_ImplicitPackageDuplicates)'==''">False</MSKit_SkipAudit_ImplicitPackageDuplicates>
+  </PropertyGroup>
+
+  <Target Name="MSKit_CheckImplicitPackageDuplicates"
+          BeforeTargets="CollectPackageReferences;Restore;Build"
+          Condition="'$(MSKit_SkipAudit_ImplicitPackageDuplicates)'!='True'
+                     AND '$(ManagePackageVersionsCentrally)'=='true'">
+    <ItemGroup>
+      <_MSKit_ConsumerIdentities Include="%(PackageVersion.Identity)"
+                                 Condition="'%(PackageVersion.ControlledBy)'==''" />
+    </ItemGroup>
+    <PropertyGroup>
+      <_MSKit_ConsumerIdsStr>;@(_MSKit_ConsumerIdentities, ';');</_MSKit_ConsumerIdsStr>
+    </PropertyGroup>
+    <ItemGroup>
+      <_MSKit_DuplicateReport Include="@(PackageVersion)"
+                              Condition="'%(PackageVersion.ControlledBy)'!=''
+                                         AND $(_MSKit_ConsumerIdsStr.Contains(';%(PackageVersion.Identity);'))" />
+    </ItemGroup>
+
+    <Error Code="MSKIT_DUP001"
+           Condition=" '@(_MSKit_DuplicateReport)' != '' "
+           Text="Directory.Packages.props declares &lt;PackageVersion&gt; entries the kit already provides:%0A%0A@(_MSKit_DuplicateReport->'  %(Identity)  &#x2190; provided by %(ControlledBy)','%0A')%0A%0AFix: remove those &lt;PackageVersion Include=&quot;...&quot; /&gt; lines. To pin another version, set the kit's version property instead (for example &lt;MSKit_PackageVersion_XunitV3&gt;), or turn the kit's versions off with &lt;MSKit_ImplicitPackageVersions&gt;False&lt;/MSKit_ImplicitPackageVersions&gt;.%0ATo bypass this check: &lt;MSKit_SkipAudit_ImplicitPackageDuplicates&gt;True&lt;/MSKit_SkipAudit_ImplicitPackageDuplicates&gt;"
+           File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.prerelease.packages.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.prerelease.packages.targets
new file mode 100644
index 0000000..534e94f
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.prerelease.packages.targets
@@ -0,0 +1,29 @@
+<Project>
+
+  <!-- MSKIT_PRE001: a stable-branch build references a prerelease version of one of your own
+       packages (ids starting with MSKit_PrereleasePackagePrefix). Warning by default;
+       MSKit_PrereleasePackageCheckAsWarning=false makes it an error. -->
+
+  <PropertyGroup>
+    <MSKit_PrereleasePackageCheckAsWarning Condition="'$(MSKit_PrereleasePackageCheckAsWarning)'==''">true</MSKit_PrereleasePackageCheckAsWarning>
+  </PropertyGroup>
+
+  <Target Condition="'$(MSKit_IsStableBranch)'=='true' AND '$(MSKit_PrereleasePackagePrefix)'!=''" Name="CheckPrereleasePackages" BeforeTargets="CoreCompile">
+    <ItemGroup>
+      <_MSKit_PackagesWithVersion Include="@(PackageReference)" Condition="'%(PackageReference.Version)' != ''" />
+      <_MSKit_PackagesWithVersion Include="@(PackageVersion)" Condition="'%(PackageVersion.Version)' != ''" />
+      <_MSKit_PrereleaseReferences Include="@(_MSKit_PackagesWithVersion)"
+                                   Condition="$([System.String]::Copy('%(_MSKit_PackagesWithVersion.Identity)').StartsWith('$(MSKit_PrereleasePackagePrefix)')) AND $([System.String]::Copy('%(_MSKit_PackagesWithVersion.Version)').Contains('-'))" />
+    </ItemGroup>
+    <PropertyGroup>
+      <_MSKit_PrereleaseText>Prerelease $(MSKit_PrereleasePackagePrefix)* packages referenced on stable branch '$(MSKit_Branch)':%0A@(_MSKit_PrereleaseReferences->'  %(Identity) %(Version)', '%0A')%0AFix: replace them with stable versions in Directory.Packages.props or the csproj.</_MSKit_PrereleaseText>
+    </PropertyGroup>
+    <Warning Code="MSKIT_PRE001"
+             Condition="'@(_MSKit_PrereleaseReferences)'!='' AND '$(MSKit_PrereleasePackageCheckAsWarning)'=='true'"
+             Text="$(_MSKit_PrereleaseText)" />
+    <Error Code="MSKIT_PRE001"
+           Condition="'@(_MSKit_PrereleaseReferences)'!='' AND '$(MSKit_PrereleasePackageCheckAsWarning)'!='true'"
+           Text="$(_MSKit_PrereleaseText)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.restrict.packages.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.restrict.packages.targets
new file mode 100644
index 0000000..4fba85c
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.restrict.packages.targets
@@ -0,0 +1,32 @@
+<Project InitialTargets="RestrictPackageReferenceAudit">
+
+  <!-- MSKIT_RES001 / MSKIT_RES002: a referenced package is banned (Type="Error") or discouraged
+       (Type="Warning") by an MSKit_RestrictPackageReference item:
+         <MSKit_RestrictPackageReference Include="Moq" Type="Error" Message="Use NSubstitute." />
+       SkipGlobalRestriction="True" on one PackageReference downgrades it to a warning. -->
+
+  <Target Name="RestrictPackageReferenceAudit" BeforeTargets="Restore;Build;CoreCompile">
+    <ItemGroup>
+      <MSKit_PackageReferenceNotAllowed Include="@(MSKit_RestrictPackageReference)"
+                                        Condition="'@(MSKit_RestrictPackageReference)'!='' And '@(PackageReference)'!='' and '%(Identity)'!=''" />
+      <MSKit_PackageReferenceNotAllowed Update="@(PackageReference)" Condition="'%(PackageReference.SkipGlobalRestriction)'=='True'"
+                                        SkipGlobalRestriction="True" />
+    </ItemGroup>
+
+    <Error Code="MSKIT_RES001"
+      Condition="'%(MSKit_PackageReferenceNotAllowed.Identity)'!='' And '%(MSKit_PackageReferenceNotAllowed.Type)'=='Error' And '%(MSKit_PackageReferenceNotAllowed.SkipGlobalRestriction)'!='True'"
+      Text="Package '%(MSKit_PackageReferenceNotAllowed.Identity)' is prohibited. %(MSKit_PackageReferenceNotAllowed.Message)%0AFix: remove the PackageReference or use the suggested alternative. To allow this one reference, add SkipGlobalRestriction=&quot;True&quot; to it."
+      File="$(MSBuildProjectFullPath)" />
+
+    <Warning Code="MSKIT_RES001"
+      Condition="'%(MSKit_PackageReferenceNotAllowed.Identity)'!='' And '%(MSKit_PackageReferenceNotAllowed.Type)'=='Error' And '%(MSKit_PackageReferenceNotAllowed.SkipGlobalRestriction)'=='True'"
+      Text="Package '%(MSKit_PackageReferenceNotAllowed.Identity)' is prohibited (allowed here by SkipGlobalRestriction). %(MSKit_PackageReferenceNotAllowed.Message)"
+      File="$(MSBuildProjectFullPath)" />
+
+    <Warning Code="MSKIT_RES002"
+      Condition="'%(MSKit_PackageReferenceNotAllowed.Identity)'!='' And '%(MSKit_PackageReferenceNotAllowed.Type)'=='Warning' And '%(MSKit_PackageReferenceNotAllowed.SkipGlobalRestriction)'!='True'"
+      Text="Package '%(MSKit_PackageReferenceNotAllowed.Identity)' is discouraged. %(MSKit_PackageReferenceNotAllowed.Message)%0ATo silence this for one reference, add SkipGlobalRestriction=&quot;True&quot; to it."
+      File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.restrict.reference.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.restrict.reference.targets
new file mode 100644
index 0000000..6e84fa3
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.restrict.reference.targets
@@ -0,0 +1,35 @@
+<Project InitialTargets="RestrictProjectReferenceAudit;RestrictAllowedPackageReferenceAudit">
+
+  <!-- MSKIT_RES003 / MSKIT_RES004: allow-list mode. With MSKit_RestrictProjectReferences=True
+       (or MSKit_RestrictPackageReferences=True, or MSKit_RestrictReferences=True for both), every
+       reference must carry Allowed="True". -->
+
+  <PropertyGroup>
+    <MSKit_RestrictReferences Condition="'$(MSKit_RestrictReferences)'==''">False</MSKit_RestrictReferences>
+    <MSKit_RestrictProjectReferences Condition="'$(MSKit_RestrictProjectReferences)'==''">$(MSKit_RestrictReferences)</MSKit_RestrictProjectReferences>
+    <MSKit_RestrictPackageReferences Condition="'$(MSKit_RestrictPackageReferences)'==''">$(MSKit_RestrictReferences)</MSKit_RestrictPackageReferences>
+  </PropertyGroup>
+
+  <Target Name="RestrictProjectReferenceAudit" Condition="'$(MSKit_RestrictProjectReferences)'=='True'" BeforeTargets="Restore;Build;CoreCompile">
+    <ItemGroup>
+      <MSKit_ProjectReferenceNotAllowed Include="@(ProjectReference)"
+                                        Condition=" '%(ProjectReference.Allowed)'!='True' AND '@(ProjectReference)'!='' AND '%(Identity)'!=''" />
+    </ItemGroup>
+    <Error Code="MSKIT_RES003"
+           Condition="'%(MSKit_ProjectReferenceNotAllowed.Identity)'!=''"
+           Text="ProjectReference '%(MSKit_ProjectReferenceNotAllowed.Identity)' is not allowed in this project.%0AFix: remove it, or mark it allowed: &lt;ProjectReference Include=&quot;%(MSKit_ProjectReferenceNotAllowed.Identity)&quot; Allowed=&quot;True&quot; /&gt;"
+           File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+  <Target Name="RestrictAllowedPackageReferenceAudit" Condition="'$(MSKit_RestrictPackageReferences)'=='True'" BeforeTargets="Restore;Build;CoreCompile">
+    <ItemGroup>
+      <_MSKit_PackageReferenceNotAllowListed Include="@(PackageReference)"
+                                             Condition=" '%(PackageReference.Allowed)'!='True' AND '@(PackageReference)'!='' AND '%(Identity)'!=''" />
+    </ItemGroup>
+    <Error Code="MSKIT_RES004"
+           Condition="'%(_MSKit_PackageReferenceNotAllowListed.Identity)'!=''"
+           Text="PackageReference '%(_MSKit_PackageReferenceNotAllowListed.Identity)' is not allowed in this project.%0AFix: remove it, or mark it allowed: &lt;PackageReference Include=&quot;%(_MSKit_PackageReferenceNotAllowListed.Identity)&quot; Allowed=&quot;True&quot; /&gt;"
+           File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.shared.properties.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.shared.properties.targets
new file mode 100644
index 0000000..eeda662
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.shared.properties.targets
@@ -0,0 +1,98 @@
+<Project InitialTargets="SharedPropertiesProjectAudit">
+  <!--  Validates the csproj-declared TF/TFs and TreatWarningsAsErrors against the shared
+        config, reading the MSKit_TargetFramework[s]_Shared / _Proj snapshot that Core's
+        tfm.routine.props captures at props phase.
+
+        A literal duplicate of the shared value is a non-bypassable error (SHARED006/007); a
+        DIFFERENT override is a bypassable warning (SHARED008/009); declaring both TF and TFs
+        in one csproj is an error (SHARED010); and a switch between the two shapes is handled
+        by Core's cleanup, not audited here. -->
+
+  <Target Name="SharedPropertiesProjectAudit" BeforeTargets="Restore;CoreCompile">
+
+    <PropertyGroup>
+      <_MSKit_GuardXmlPeek Condition="'$(MSKit_GuardXmlPeekAudit)'!='False'">True</_MSKit_GuardXmlPeek>
+      <_MSKit_SPC_CsprojText Condition="'$(_MSKit_GuardXmlPeek)'=='True'">$([System.IO.File]::ReadAllText('$(MSBuildProjectFullPath)'))</_MSKit_SPC_CsprojText>
+      <_MSKit_HasTargetFramework Condition="'$(_MSKit_GuardXmlPeek)'!='True'">True</_MSKit_HasTargetFramework>
+      <_MSKit_HasTargetFramework Condition="'$(_MSKit_GuardXmlPeek)'=='True' AND ($(_MSKit_SPC_CsprojText.Contains('&lt;TargetFramework&gt;')) OR $(_MSKit_SPC_CsprojText.Contains('&lt;TargetFramework ')))">True</_MSKit_HasTargetFramework>
+      <_MSKit_HasTargetFrameworks Condition="'$(_MSKit_GuardXmlPeek)'!='True'">True</_MSKit_HasTargetFrameworks>
+      <_MSKit_HasTargetFrameworks Condition="'$(_MSKit_GuardXmlPeek)'=='True' AND ($(_MSKit_SPC_CsprojText.Contains('&lt;TargetFrameworks&gt;')) OR $(_MSKit_SPC_CsprojText.Contains('&lt;TargetFrameworks ')))">True</_MSKit_HasTargetFrameworks>
+    </PropertyGroup>
+
+    <XmlPeek Condition="'$(_MSKit_HasTargetFramework)'=='True'" XmlInputPath="$(MSBuildProjectFullPath)" Query="Project/PropertyGroup/TargetFramework">
+      <Output TaskParameter="Result" ItemName="_MSKit_TF_NodeCheckXmlResult" />
+    </XmlPeek>
+    <XmlPeek Condition="'$(_MSKit_HasTargetFrameworks)'=='True'" XmlInputPath="$(MSBuildProjectFullPath)" Query="Project/PropertyGroup/TargetFrameworks">
+      <Output TaskParameter="Result" ItemName="_MSKit_TFs_NodeCheckXmlResult" />
+    </XmlPeek>
+    <PropertyGroup>
+      <_MSKit_TF_ProjNodeCount>@(_MSKit_TF_NodeCheckXmlResult-&gt;Count())</_MSKit_TF_ProjNodeCount>
+      <_MSKit_TFs_ProjNodeCount>@(_MSKit_TFs_NodeCheckXmlResult-&gt;Count())</_MSKit_TFs_ProjNodeCount>
+    </PropertyGroup>
+
+    <!-- MSKIT_SHARED006: csproj <TargetFramework> declares the SAME value as the shared config.
+         Pure literal duplicate; not bypassable. Reads MSKit_TargetFramework_Proj (set by Core
+         tfm.routine.props at props phase). -->
+    <Error Code="MSKIT_SHARED006"
+           Condition="'$(MSKit_TargetFramework_Proj)'!=''
+                      AND '$(MSKit_TargetFramework_Shared)'!=''
+                      AND '$(MSKit_TargetFramework_Proj)'=='$(MSKit_TargetFramework_Shared)'"
+           File="$(MSBuildProjectFullPath)"
+           Text="csproj '$(MSBuildProjectName)' declares &lt;TargetFramework&gt;$(MSKit_TargetFramework_Proj)&lt;/TargetFramework&gt; which equals Directory.Build.props's &lt;TargetFramework&gt;$(MSKit_TargetFramework_Shared)&lt;/TargetFramework&gt; - the csproj declaration is redundant.%0AFix: remove this from the csproj &lt;PropertyGroup&gt;:%0A  &lt;TargetFramework&gt;$(MSKit_TargetFramework_Proj)&lt;/TargetFramework&gt;%0ADirectory.Build.props is the single source of truth.%0AThis check is not bypassable; pure literal duplication is always a code smell." />
+
+    <!-- MSKIT_SHARED007: csproj <TargetFrameworks> declares the SAME value as the shared config.
+         Pure literal duplicate; not bypassable. -->
+    <Error Code="MSKIT_SHARED007"
+           Condition="'$(MSKit_TargetFrameworks_Proj)'!=''
+                      AND '$(MSKit_TargetFrameworks_Shared)'!=''
+                      AND '$(MSKit_TargetFrameworks_Proj)'=='$(MSKit_TargetFrameworks_Shared)'"
+           File="$(MSBuildProjectFullPath)"
+           Text="csproj '$(MSBuildProjectName)' declares &lt;TargetFrameworks&gt;$(MSKit_TargetFrameworks_Proj)&lt;/TargetFrameworks&gt; which equals Directory.Build.props's &lt;TargetFrameworks&gt;$(MSKit_TargetFrameworks_Shared)&lt;/TargetFrameworks&gt; - the csproj declaration is redundant.%0AFix: remove this from the csproj &lt;PropertyGroup&gt;:%0A  &lt;TargetFrameworks&gt;$(MSKit_TargetFrameworks_Proj)&lt;/TargetFrameworks&gt;%0ADirectory.Build.props is the single source of truth.%0AThis check is not bypassable; pure literal duplication is always a code smell." />
+
+    <!-- MSKIT_SHARED008: csproj <TargetFramework> overrides DBP's <TargetFramework> with a different value.
+         Warning by default; bypass with MSKit_SkipAudit_TargetFrameworkOverride=True.
+         Does not fire when the csproj switches shape. -->
+    <Warning Code="MSKIT_SHARED008"
+             Condition="'$(MSKit_SkipAudit_TargetFrameworkOverride)'!='True'
+                        AND '$(MSKit_TargetFramework_Proj)'!=''
+                        AND '$(MSKit_TargetFramework_Shared)'!=''
+                        AND '$(MSKit_TargetFramework_Proj)'!='$(MSKit_TargetFramework_Shared)'
+                        AND '$(MSKit_TargetFrameworks_Proj)'==''"
+             File="$(MSBuildProjectFullPath)"
+             Text="csproj '$(MSBuildProjectName)' declares &lt;TargetFramework&gt;$(MSKit_TargetFramework_Proj)&lt;/TargetFramework&gt; but Directory.Build.props centralizes &lt;TargetFramework&gt;$(MSKit_TargetFramework_Shared)&lt;/TargetFramework&gt; as the default.%0ARecommended: remove the csproj-level &lt;TargetFramework&gt; declaration (DBP is the single source of truth).%0ATo override intentionally, add to the csproj &lt;PropertyGroup&gt;:%0A  &lt;MSKit_SkipAudit_TargetFrameworkOverride&gt;True&lt;/MSKit_SkipAudit_TargetFrameworkOverride&gt;" />
+
+    <!-- MSKIT_SHARED009: csproj <TargetFrameworks> overrides DBP's <TargetFrameworks> with a different value.
+         Warning by default; bypass with MSKit_SkipAudit_TargetFrameworkOverride=True.
+         Does not fire when the csproj switches shape. -->
+    <Warning Code="MSKIT_SHARED009"
+             Condition="'$(MSKit_SkipAudit_TargetFrameworkOverride)'!='True'
+                        AND '$(MSKit_TargetFrameworks_Proj)'!=''
+                        AND '$(MSKit_TargetFrameworks_Shared)'!=''
+                        AND '$(MSKit_TargetFrameworks_Proj)'!='$(MSKit_TargetFrameworks_Shared)'
+                        AND '$(MSKit_TargetFramework_Proj)'==''"
+             File="$(MSBuildProjectFullPath)"
+             Text="csproj '$(MSBuildProjectName)' declares &lt;TargetFrameworks&gt;$(MSKit_TargetFrameworks_Proj)&lt;/TargetFrameworks&gt; but Directory.Build.props centralizes &lt;TargetFrameworks&gt;$(MSKit_TargetFrameworks_Shared)&lt;/TargetFrameworks&gt; as the default.%0ARecommended: remove the csproj-level &lt;TargetFrameworks&gt; declaration (DBP is the single source of truth).%0ATo override intentionally, add to the csproj &lt;PropertyGroup&gt;:%0A  &lt;MSKit_SkipAudit_TargetFrameworkOverride&gt;True&lt;/MSKit_SkipAudit_TargetFrameworkOverride&gt;" />
+
+    <!-- MSKIT_SHARED010: csproj declares BOTH <TargetFramework> AND <TargetFrameworks>.
+         Error, non-bypassable. SDK silently ignores <TargetFramework>
+         when <TargetFrameworks> is non-empty (cross-targeting wins); the redundant declaration
+         is a code smell that should be fixed at source. Uses NODE-presence count (not value)
+         so even the legacy <TargetFramework></TargetFramework> "clear" trick fires the audit. -->
+    <Error Code="MSKIT_SHARED010"
+           Condition="$(_MSKit_TF_ProjNodeCount) &gt; 0 AND $(_MSKit_TFs_ProjNodeCount) &gt; 0"
+           File="$(MSBuildProjectFullPath)"
+           Text="csproj '$(MSBuildProjectName)' declares BOTH &lt;TargetFramework&gt; AND &lt;TargetFrameworks&gt; in the same project. SDK silently ignores &lt;TargetFramework&gt; when &lt;TargetFrameworks&gt; is non-empty.%0AFix: remove one of these from the csproj &lt;PropertyGroup&gt; - pick the shape you actually want:%0A  &lt;TargetFramework&gt;$(MSKit_TargetFramework_Proj)&lt;/TargetFramework&gt;%0A    -- OR --%0A  &lt;TargetFrameworks&gt;$(MSKit_TargetFrameworks_Proj)&lt;/TargetFrameworks&gt;%0AThis check is not bypassable; declaring both is always wrong." />
+
+    <!-- TreatWarningsAsErrors - on CI, always skip: the pipeline controls it via -p:TreatWarningsAsErrors -->
+    <PropertyGroup>
+      <MSKit_SkipAudit_TreatWarningsAsErrors Condition="'$(MSKit_IsDevEnv)'!='True'">True</MSKit_SkipAudit_TreatWarningsAsErrors>
+    </PropertyGroup>
+    <Error Code="MSKIT_SHARED020"
+           Condition="'$(MSKit_SkipAudit_TreatWarningsAsErrors)'!='True'
+                      AND '$(MSKit_TreatWarningsAsErrors_Shared)'!=''
+                      AND '$(TreatWarningsAsErrors)'!='$(MSKit_TreatWarningsAsErrors_Shared)'"
+           File="$(MSBuildProjectFullPath)"
+           Text="Expected &lt;TreatWarningsAsErrors&gt;$(MSKit_TreatWarningsAsErrors_Shared)&lt;/TreatWarningsAsErrors&gt; (from shared config / Directory.Build.props). Actual csproj-final value: '$(TreatWarningsAsErrors)'.%0AFix: align the csproj value with the shared one, or remove the csproj override.%0ATo bypass this audit, add to csproj or Directory.Build.props:%0A  &lt;PropertyGroup&gt;%0A    &lt;MSKit_SkipAudit_TreatWarningsAsErrors&gt;True&lt;/MSKit_SkipAudit_TreatWarningsAsErrors&gt;%0A  &lt;/PropertyGroup&gt;" />
+
+  </Target>
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.version.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.version.targets
new file mode 100644
index 0000000..aaea8ee
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/audit/audit.version.targets
@@ -0,0 +1,93 @@
+<Project InitialTargets="RestrictManualVersion;ValidateVersionTemplate;ValidateReleaseTag">
+
+  <!-- Checks for the version engine (version.props / version.targets). Codes MSKIT_VER001..007. -->
+
+  <!-- MSKIT_VER001: <Version> declared in the csproj while a template strategy is active. -->
+  <Target Name="RestrictManualVersion"
+          Condition="'$(MSKit_VersionStrategy)'!='Manual'"
+          BeforeTargets="Restore;Build;CoreCompile">
+    <PropertyGroup>
+      <_MSKit_GuardXmlPeek Condition="'$(MSKit_GuardXmlPeekAudit)'!='False'">True</_MSKit_GuardXmlPeek>
+      <_MSKit_RMV_CsprojText Condition="'$(_MSKit_GuardXmlPeek)'=='True'">$([System.IO.File]::ReadAllText('$(MSBuildProjectFullPath)'))</_MSKit_RMV_CsprojText>
+      <_MSKit_HasVersion Condition="'$(_MSKit_GuardXmlPeek)'!='True'">True</_MSKit_HasVersion>
+      <_MSKit_HasVersion Condition="'$(_MSKit_GuardXmlPeek)'=='True' AND ($(_MSKit_RMV_CsprojText.Contains('&lt;Version&gt;')) OR $(_MSKit_RMV_CsprojText.Contains('&lt;Version ')))">True</_MSKit_HasVersion>
+    </PropertyGroup>
+
+    <XmlPeek Condition="'$(_MSKit_HasVersion)'=='True'" XmlInputPath="$(MSBuildProjectFullPath)" Query="Project/PropertyGroup/Version/text()">
+      <Output TaskParameter="Result" ItemName="_MSKit_VersionCheckNode" />
+    </XmlPeek>
+
+    <Error Code="MSKIT_VER001"
+           Condition="@(_MSKit_VersionCheckNode->Count()) &gt; 0"
+           Text="&lt;Version&gt; is declared in the project but MSKit_VersionStrategy='$(MSKit_VersionStrategy)' renders the version from a template, so the declared value is ignored.%0AFix: remove &lt;Version&gt; from the csproj (declare the next version as &lt;VersionPrefix&gt; in Directory.Version.props), or switch to manual versioning in Directory.Build.props:%0A  &lt;MSKit_VersionStrategy&gt;Manual&lt;/MSKit_VersionStrategy&gt;"
+           File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+  <!-- MSKIT_VER002 / MSKIT_VER003: a template uses a placeholder the engine does not know. -->
+  <Target Name="ValidateVersionTemplate"
+          Condition="'$(MSKit_VersionStrategy)'!='Manual'">
+
+    <PropertyGroup>
+      <_MSKit_ValidPlaceholders>prefix;buildNumber;pipelineId;branchSlug;branchTicket;branchAspectSuffix;buildDateUtcDash;buildDateUtcDot;versionTag;releaseTag;prNumber;commitShaShort</_MSKit_ValidPlaceholders>
+      <_MSKit_PlaceholderHelp>
+Valid placeholders:
+  {prefix}              - $(VersionPrefix), declared in Directory.Version.props
+  {buildNumber}         - CI run number (GITHUB_RUN_NUMBER); DateBased caps it at 65535
+  {pipelineId}          - CI run id (GITHUB_RUN_ID)
+  {releaseTag}          - the release tag with a leading v removed (tag builds only)
+  {prNumber}            - the pull request number (pull request builds only)
+  {branchSlug}          - the branch name with every character outside [0-9A-Za-z-] replaced by '-'
+  {branchTicket}        - the first [A-Za-z]+-[0-9]+ match in {branchSlug}, else {branchSlug}
+  {branchAspectSuffix}  - the part of {branchSlug} from its first '--' to the end, else empty
+  {buildDateUtcDash}    - UTC build time as yyyyMMdd-HHmmss
+  {buildDateUtcDot}     - UTC build time as yyyy.M.d
+  {versionTag}          - $(VersionTag)
+  {commitShaShort}      - the first 8 characters of the commit SHA
+      </_MSKit_PlaceholderHelp>
+      <_MSKit_AllTemplates>$(MSKit_VersionTemplate)|$(MSKit_StableVersionTemplate)|$(MSKit_ReleaseVersionTemplate)|$(MSKit_PullRequestVersionTemplate)</_MSKit_AllTemplates>
+      <_MSKit_TplHasTokens>false</_MSKit_TplHasTokens>
+      <_MSKit_TplHasTokens Condition="$([System.Text.RegularExpressions.Regex]::IsMatch('$(_MSKit_AllTemplates)', '\{[A-Za-z][A-Za-z0-9]*\}'))">true</_MSKit_TplHasTokens>
+      <_MSKit_TplNames Condition="'$(_MSKit_TplHasTokens)'=='true'">$([System.Text.RegularExpressions.Regex]::Replace('$(_MSKit_AllTemplates)', '[^{}]*\{([A-Za-z][A-Za-z0-9]*)\}[^{}]*', '$1;').TrimEnd(';'))</_MSKit_TplNames>
+    </PropertyGroup>
+
+    <ItemGroup>
+      <_MSKit_ValidPlaceholder Include="$(_MSKit_ValidPlaceholders.Split(';'))" />
+      <_MSKit_TplNameItem Include="$(_MSKit_TplNames.Split(';'))" Condition="'$(_MSKit_TplNames)'!=''" />
+      <_MSKit_UnknownPlaceholder Include="@(_MSKit_TplNameItem)" Exclude="@(_MSKit_ValidPlaceholder)" />
+    </ItemGroup>
+
+    <Error Code="MSKIT_VER002"
+           Condition="@(_MSKit_UnknownPlaceholder->Count()) &gt; 0"
+           Text="A version template contains unknown placeholder(s): @(_MSKit_UnknownPlaceholder -> '{%(Identity)}', ', ').%0ATemplates: MSKit_VersionTemplate='$(MSKit_VersionTemplate)', MSKit_StableVersionTemplate='$(MSKit_StableVersionTemplate)', MSKit_ReleaseVersionTemplate='$(MSKit_ReleaseVersionTemplate)', MSKit_PullRequestVersionTemplate='$(MSKit_PullRequestVersionTemplate)'.%0A$(_MSKit_PlaceholderHelp)"
+           File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+  <!-- MSKIT_VER004: the VersionTag strategy rendered an empty version. -->
+  <Target Name="ValidateRenderedVersionForVersionTag"
+          AfterTargets="RenderVersionFromTemplate"
+          Condition="'$(MSKit_VersionStrategy)'=='VersionTag'">
+    <Error Code="MSKIT_VER004"
+           Condition="'$(Version)'==''"
+           Text="MSKit_VersionStrategy='VersionTag' but VersionTag is empty.%0AFix: pass it on the command line (-p:VersionTag=1.2.3) or use MSKit_VersionStrategy=ReleaseTag, which reads the version from the release tag."
+           File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+  <!-- MSKIT_VER006: a release tag that is not SemVer 2.0. MSKIT_VER007: its version core differs
+       from the VersionPrefix the repository declares. -->
+  <Target Name="ValidateReleaseTag"
+          Condition="'$(MSKit_IsReleaseTag)'=='True' AND '$(MSKit_ExplicitVersion)'=='' AND '$(MSKit_VersionStrategy)'!='Manual' AND '$(MSKit_VersionStrategy)'!='DevEnv'"
+          BeforeTargets="Restore;Build">
+    <Error Code="MSKIT_VER006"
+           Condition="'$(MSKit_IsReleaseTagValid)'!='true'"
+           Text="Release tag '$(MSKit_ReleaseTagRaw)' is not a valid version. After removing a leading 'v' it must be SemVer 2.0: MAJOR.MINOR.PATCH with an optional -prerelease and +metadata (for example v2.1.0 or 2.1.0-beta.1).%0AFix: delete the tag and the GitHub release, then create a release whose tag is a version."
+           File="$(MSBuildProjectFullPath)" />
+    <PropertyGroup Condition="'$(MSKit_IsReleaseTagValid)'=='true'">
+      <_MSKit_ReleaseTagCore>$([System.Text.RegularExpressions.Regex]::Match('$(MSKit_ReleaseTag)', '^\d+\.\d+\.\d+').Value)</_MSKit_ReleaseTagCore>
+    </PropertyGroup>
+    <Warning Code="MSKIT_VER007"
+             Condition="'$(MSKit_SkipAudit_ReleaseTagPrefix)'!='True' AND '$(_MSKit_ReleaseTagCore)'!='' AND '$(MSKit_DeclaredVersionPrefix)'!='' AND '$(MSKit_DeclaredVersionPrefix)'!='$(_MSKit_ReleaseTagCore)'"
+             Text="Release tag '$(MSKit_ReleaseTagRaw)' has version core $(_MSKit_ReleaseTagCore), but the repository declares VersionPrefix $(MSKit_DeclaredVersionPrefix).%0AFix: bump &lt;VersionPrefix&gt; in Directory.Version.props after the release so branch and pull-request builds sort above it. Set MSKit_SkipAudit_ReleaseTagPrefix=True to silence this."
+             File="$(MSBuildProjectFullPath)" />
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.last.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.last.props
new file mode 100644
index 0000000..5787c55
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.last.props
@@ -0,0 +1,11 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory)twae.shared.init.props" />
+
+  <Import Condition="Exists('$(MSKit_SlnFileDirectory)Directory.GlobalUsings.props')"
+          Project="$(MSKit_SlnFileDirectory)Directory.GlobalUsings.props" />
+
+  <Import Condition="'$(MSKit_VersionStrategy)'!='Manual'"
+          Project="$(MSBuildThisFileDirectory)version.props" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.last.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.last.targets
new file mode 100644
index 0000000..d4f4b5e
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.last.targets
@@ -0,0 +1,7 @@
+<Project>
+
+  <Import Condition="Exists('$(MSKit_SlnFileDirectory)Directory.Packages.Metadata.targets')"
+          Project="$(MSKit_SlnFileDirectory)Directory.Packages.Metadata.targets" />
+  <Import Project="$(MSBuildThisFileDirectory)project.global.metadata.targets" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.props
new file mode 100644
index 0000000..ef44584
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.props
@@ -0,0 +1,17 @@
+<Project>
+
+  <PropertyGroup>
+    <Nullable Condition="'$(Nullable)'==''">enable</Nullable>
+    <ImplicitUsings Condition="'$(ImplicitUsings)'==''">enable</ImplicitUsings>
+    <LangVersion Condition="'$(LangVersion)'==''">latest</LangVersion>
+    <EnforceCodeStyleInBuild Condition="'$(EnforceCodeStyleInBuild)'==''">True</EnforceCodeStyleInBuild>
+    <GeneratePackageOnBuild Condition="'$(GeneratePackageOnBuild)'==''">False</GeneratePackageOnBuild>
+    <MSKit_IncludeCodeAnalysisGlobalUsings Condition="'$(MSKit_IncludeCodeAnalysisGlobalUsings)'==''">True</MSKit_IncludeCodeAnalysisGlobalUsings>
+  </PropertyGroup>
+
+  <Import Project="$(MSBuildThisFileDirectory)product.props" />
+
+  <Import Condition="Exists('$(MSKit_SlnFileDirectory)Directory.Version.props')"
+          Project="$(MSKit_SlnFileDirectory)Directory.Version.props" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.targets
new file mode 100644
index 0000000..8f6c1b4
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/init.targets
@@ -0,0 +1,16 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory)version.targets" />
+
+  <!-- Analyzer and source-generator projects keep a clean netstandard2.0 surface. -->
+  <Import Condition="'$(IsCodeAnalyzer)'!='True' And '$(IsSourceGenerator)'!='True' And '$(MSKit_IncludeCodeAnalysisGlobalUsings)'=='True'"
+          Project="$(MSBuildThisFileDirectory)project.global.usings.targets" />
+
+  <Import Condition="Exists('$(MSKit_SlnFileDirectory)Directory.GlobalUsings.targets')"
+          Project="$(MSKit_SlnFileDirectory)Directory.GlobalUsings.targets" />
+
+  <ItemGroup Condition="'$(ExcludeFromCodeCoverage)'=='true'">
+    <AssemblyAttribute Include="System.Diagnostics.CodeAnalysis.ExcludeFromCodeCoverage" />
+  </ItemGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/product.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/product.props
new file mode 100644
index 0000000..85cd674
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/product.props
@@ -0,0 +1,13 @@
+<Project>
+
+  <PropertyGroup>
+    <AssemblyTitle Condition="'$(AssemblyTitle)'==''">$(MSBuildProjectName)</AssemblyTitle>
+    <Year>$([System.DateTime]::UtcNow.Year)</Year>
+    <LegalTrademarks Condition="'$(LegalTrademarks)'==''">$(ManufacturerName)</LegalTrademarks>
+    <Company Condition="'$(Company)'==''">$(FullManufacturerName)</Company>
+    <!-- Licence-neutral on purpose: 'All rights reserved' contradicts an open-source licence. -->
+    <Copyright Condition="'$(Copyright)'==''">Copyright (c) $(Year) $(FullManufacturerName)</Copyright>
+    <Authors Condition="'$(Authors)'==''">$(ManufacturerName)</Authors>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/project.global.metadata.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/project.global.metadata.targets
new file mode 100644
index 0000000..9b34627
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/project.global.metadata.targets
@@ -0,0 +1,31 @@
+<Project>
+
+  <!--  Nuget packages additional metadata-->
+  <ItemGroup>
+    <PackageReference Update="ConfigureAwait.Fody">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>all</IncludeAssets>
+    </PackageReference>
+    <PackageReference Update="Fody">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>all</IncludeAssets>
+    </PackageReference>
+    <PackageReference Update="IgnoresAccessChecksToGenerator">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+    <PackageReference Update="Grpc.Tools">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+    <PackageReference Update="Microsoft.EntityFrameworkCore.Design">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+    <PackageReference Update="Microsoft.EntityFrameworkCore.Tools">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+  </ItemGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/project.global.usings.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/project.global.usings.targets
new file mode 100644
index 0000000..8e42751
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/project.global.usings.targets
@@ -0,0 +1,12 @@
+<Project>
+
+  <ItemGroup>
+    <Using Include="System.Diagnostics.CodeAnalysis" />
+    <Using Include="System.Runtime.CompilerServices" />
+    <Using Include="System.Runtime.CompilerServices.MethodImplOptions" Static="True" />
+    <Using Include="System.Diagnostics.CodeAnalysis.DynamicallyAccessedMemberTypes"
+           Condition="'$(TargetFramework)' != 'netstandard2.0'"
+           Static="True" />
+  </ItemGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/twae.shared.init.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/twae.shared.init.props
new file mode 100644
index 0000000..ffddb18
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/twae.shared.init.props
@@ -0,0 +1,8 @@
+<Project>
+
+  <!-- Captured before the csproj body so MSKIT_SHARED020 can compare against the shared value. -->
+  <PropertyGroup>
+    <MSKit_TreatWarningsAsErrors_Shared>$(TreatWarningsAsErrors)</MSKit_TreatWarningsAsErrors_Shared>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/version.props b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/version.props
new file mode 100644
index 0000000..6e356cf
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/version.props
@@ -0,0 +1,145 @@
+<Project>
+
+  <!-- Version engine. Each strategy ships default templates; override any template in
+       Directory.Build.props or a csproj. The placeholder set is closed and validated by
+       ValidateVersionTemplate (audit/audit.version.targets). The template is chosen in this order:
+         1. a release-tag build with MSKit_ReleaseVersionTemplate set
+         2. a pull-request build with MSKit_PullRequestVersionTemplate set
+         3. a stable branch (MSKit_IsStableBranch) -> MSKit_StableVersionTemplate
+         4. anything else -> MSKit_VersionTemplate -->
+
+  <PropertyGroup>
+    <MSKit_DeclaredVersionPrefix>$(VersionPrefix)</MSKit_DeclaredVersionPrefix>
+
+    <MSKit_VersionStrategy Condition="'$(MSKit_VersionStrategy)'==''">SemVer</MSKit_VersionStrategy>
+    <MSKit_VersionStrategy Condition="'$(MSKit_IsDevEnv)'=='True'">DevEnv</MSKit_VersionStrategy>
+
+    <MSKit_BuildNumber Condition="'$(MSKit_BuildNumber)'==''">0</MSKit_BuildNumber>
+    <MSKit_CIPipelineId Condition="'$(MSKit_CIPipelineId)'==''">0</MSKit_CIPipelineId>
+
+    <MSKit_ReleaseTagRegex Condition="'$(MSKit_ReleaseTagRegex)'==''">^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$</MSKit_ReleaseTagRegex>
+    <MSKit_IsReleaseTagValid>false</MSKit_IsReleaseTagValid>
+    <MSKit_IsReleaseTagValid Condition="'$(MSKit_ReleaseTag)'!='' AND $([System.Text.RegularExpressions.Regex]::IsMatch('$(MSKit_ReleaseTag)', '$(MSKit_ReleaseTagRegex)'))">true</MSKit_IsReleaseTagValid>
+  </PropertyGroup>
+
+  <!-- Set MSKit_BuildDateTimeUtc once in CI (property or env var) so every project in one build
+       renders the same date; otherwise each project reads UtcNow. -->
+  <PropertyGroup>
+    <MSKit_BuildDateTimeUtc Condition="'$(MSKit_BuildDateTimeUtc)'==''">$([System.Environment]::GetEnvironmentVariable('MSKit_BuildDateTimeUtc'))</MSKit_BuildDateTimeUtc>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(MSKit_BuildDateTimeUtc)'!=''">
+    <_MSKit_Ph_buildDateUtcDash>$([System.DateTime]::Parse('$(MSKit_BuildDateTimeUtc)').ToUniversalTime().ToString(yyyyMMdd-HHmmss))</_MSKit_Ph_buildDateUtcDash>
+    <_MSKit_Ph_buildDateUtcDot>$([System.DateTime]::Parse('$(MSKit_BuildDateTimeUtc)').ToUniversalTime().ToString(yyyy.M.d))</_MSKit_Ph_buildDateUtcDot>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(MSKit_BuildDateTimeUtc)'==''">
+    <_MSKit_Ph_buildDateUtcDash>$([System.DateTime]::UtcNow.ToString(yyyyMMdd-HHmmss))</_MSKit_Ph_buildDateUtcDash>
+    <_MSKit_Ph_buildDateUtcDot>$([System.DateTime]::UtcNow.ToString(yyyy.M.d))</_MSKit_Ph_buildDateUtcDot>
+  </PropertyGroup>
+
+  <Choose>
+    <When Condition="'$(MSKit_VersionStrategy)'=='ReleaseTag'">
+      <PropertyGroup>
+        <VersionPrefix Condition="'$(VersionPrefix)'==''">0.0.0</VersionPrefix>
+        <MSKit_ReleaseVersionTemplate Condition="'$(MSKit_ReleaseVersionTemplate)'==''">{releaseTag}</MSKit_ReleaseVersionTemplate>
+        <MSKit_PullRequestVersionTemplate Condition="'$(MSKit_PullRequestVersionTemplate)'==''">{prefix}-pr.{prNumber}.{buildNumber}</MSKit_PullRequestVersionTemplate>
+        <MSKit_VersionTemplate Condition="'$(MSKit_VersionTemplate)'==''">{prefix}-ci.{buildNumber}</MSKit_VersionTemplate>
+        <MSKit_StableVersionTemplate Condition="'$(MSKit_StableVersionTemplate)'==''">{prefix}-ci.{buildNumber}</MSKit_StableVersionTemplate>
+      </PropertyGroup>
+    </When>
+    <When Condition="'$(MSKit_VersionStrategy)'=='SemVer'">
+      <PropertyGroup>
+        <VersionPrefix Condition="'$(VersionPrefix)'==''">1.0.0</VersionPrefix>
+        <MSKit_VersionTemplate Condition="'$(MSKit_VersionTemplate)'==''">{prefix}-{buildDateUtcDash}-{branchTicket}{branchAspectSuffix}</MSKit_VersionTemplate>
+        <MSKit_StableVersionTemplate Condition="'$(MSKit_StableVersionTemplate)'==''">{prefix}</MSKit_StableVersionTemplate>
+      </PropertyGroup>
+    </When>
+    <When Condition="'$(MSKit_VersionStrategy)'=='SemVer4'">
+      <PropertyGroup>
+        <VersionPrefix Condition="'$(VersionPrefix)'==''">1.0.0</VersionPrefix>
+        <MSKit_VersionTemplate Condition="'$(MSKit_VersionTemplate)'==''">{prefix}.{buildNumber}-{buildDateUtcDash}-{branchTicket}{branchAspectSuffix}</MSKit_VersionTemplate>
+        <MSKit_StableVersionTemplate Condition="'$(MSKit_StableVersionTemplate)'==''">{prefix}.{buildNumber}</MSKit_StableVersionTemplate>
+      </PropertyGroup>
+    </When>
+    <When Condition="'$(MSKit_VersionStrategy)'=='DateBased'">
+      <PropertyGroup>
+        <VersionPrefix>$(_MSKit_Ph_buildDateUtcDot)</VersionPrefix>
+        <MSKit_BuildNumber>$([MSBuild]::Modulo($(MSKit_CIPipelineId), 65535))</MSKit_BuildNumber>
+        <MSKit_BuildNumber Condition="$(MSKit_BuildNumber) == 0">1</MSKit_BuildNumber>
+        <MSKit_VersionTemplate Condition="'$(MSKit_VersionTemplate)'==''">{buildDateUtcDot}.{buildNumber}-{branchTicket}{branchAspectSuffix}</MSKit_VersionTemplate>
+        <MSKit_StableVersionTemplate Condition="'$(MSKit_StableVersionTemplate)'==''">{buildDateUtcDot}.{buildNumber}</MSKit_StableVersionTemplate>
+      </PropertyGroup>
+    </When>
+    <When Condition="'$(MSKit_VersionStrategy)'=='VersionTag'">
+      <PropertyGroup>
+        <MSKit_VersionTemplate Condition="'$(MSKit_VersionTemplate)'==''">{versionTag}</MSKit_VersionTemplate>
+        <MSKit_StableVersionTemplate Condition="'$(MSKit_StableVersionTemplate)'==''">{versionTag}</MSKit_StableVersionTemplate>
+      </PropertyGroup>
+    </When>
+    <When Condition="'$(MSKit_VersionStrategy)'=='DevEnv'">
+      <PropertyGroup>
+        <VersionPrefix>9999.0.0</VersionPrefix>
+        <MSKit_ReleaseVersionTemplate></MSKit_ReleaseVersionTemplate>
+        <MSKit_PullRequestVersionTemplate></MSKit_PullRequestVersionTemplate>
+        <MSKit_VersionTemplate>9999.0.0</MSKit_VersionTemplate>
+        <MSKit_StableVersionTemplate>9999.0.0</MSKit_StableVersionTemplate>
+      </PropertyGroup>
+    </When>
+    <Otherwise>
+      <PropertyGroup>
+        <MSKit_VersionTemplate Condition="'$(MSKit_VersionTemplate)'==''"></MSKit_VersionTemplate>
+        <MSKit_StableVersionTemplate Condition="'$(MSKit_StableVersionTemplate)'==''"></MSKit_StableVersionTemplate>
+      </PropertyGroup>
+    </Otherwise>
+  </Choose>
+
+  <PropertyGroup>
+    <_MSKit_Ph_prefix>$(VersionPrefix)</_MSKit_Ph_prefix>
+    <_MSKit_Ph_versionTag>$(VersionTag)</_MSKit_Ph_versionTag>
+    <_MSKit_Ph_releaseTag Condition="'$(MSKit_IsReleaseTagValid)'=='true'">$(MSKit_ReleaseTag)</_MSKit_Ph_releaseTag>
+    <!-- An invalid tag renders a valid placeholder so restore does not fail first with an opaque
+         error; ValidateReleaseTag then stops the build with MSKIT_VER006. -->
+    <_MSKit_Ph_releaseTag Condition="'$(MSKit_IsReleaseTagValid)'!='true'">0.0.0-invalid-release-tag</_MSKit_Ph_releaseTag>
+    <_MSKit_Ph_prNumber>$(MSKit_PullRequestNumber)</_MSKit_Ph_prNumber>
+    <_MSKit_Ph_buildNumber>$(MSKit_BuildNumber)</_MSKit_Ph_buildNumber>
+    <_MSKit_Ph_pipelineId>$(MSKit_CIPipelineId)</_MSKit_Ph_pipelineId>
+    <_MSKit_Ph_branchSlug>$([System.Text.RegularExpressions.Regex]::Replace('$(MSKit_Branch)', '[^0-9A-Za-z-]', '-'))</_MSKit_Ph_branchSlug>
+
+    <_MSKit_BranchTicketMatch>$([System.Text.RegularExpressions.Regex]::Match($(_MSKit_Ph_branchSlug), '[A-Za-z]+-\d+').Value)</_MSKit_BranchTicketMatch>
+    <_MSKit_Ph_branchTicket Condition="'$(_MSKit_BranchTicketMatch)'!=''">$(_MSKit_BranchTicketMatch)</_MSKit_Ph_branchTicket>
+    <_MSKit_Ph_branchTicket Condition="'$(_MSKit_BranchTicketMatch)'==''">$(_MSKit_Ph_branchSlug)</_MSKit_Ph_branchTicket>
+
+    <_MSKit_BranchAspectIdx>$(_MSKit_Ph_branchSlug.IndexOf('--'))</_MSKit_BranchAspectIdx>
+    <_MSKit_Ph_branchAspectSuffix Condition="'$(_MSKit_BranchAspectIdx)'!='-1'">$(_MSKit_Ph_branchSlug.Substring($(_MSKit_BranchAspectIdx)))</_MSKit_Ph_branchAspectSuffix>
+
+    <_MSKit_Ph_commitShaShort Condition="$(MSKit_CommitSha.Length) &gt;= 8">$(MSKit_CommitSha.Substring(0, 8))</_MSKit_Ph_commitShaShort>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(MSKit_VersionStrategy)'!='Manual' AND '$(MSKit_ExplicitVersion)'==''">
+    <_MSKit_EffectiveTemplate Condition="'$(MSKit_IsStableBranch)'=='true'">$(MSKit_StableVersionTemplate)</_MSKit_EffectiveTemplate>
+    <_MSKit_EffectiveTemplate Condition="'$(MSKit_IsStableBranch)'!='true'">$(MSKit_VersionTemplate)</_MSKit_EffectiveTemplate>
+    <_MSKit_EffectiveTemplate Condition="'$(MSKit_PullRequestNumber)'!='' AND '$(MSKit_PullRequestVersionTemplate)'!=''">$(MSKit_PullRequestVersionTemplate)</_MSKit_EffectiveTemplate>
+    <_MSKit_EffectiveTemplate Condition="'$(MSKit_IsReleaseTag)'=='True' AND '$(MSKit_ReleaseVersionTemplate)'!=''">$(MSKit_ReleaseVersionTemplate)</_MSKit_EffectiveTemplate>
+
+    <_MSKit_Rendered>$(_MSKit_EffectiveTemplate)</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{prefix}', '$(_MSKit_Ph_prefix)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{buildNumber}', '$(_MSKit_Ph_buildNumber)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{pipelineId}', '$(_MSKit_Ph_pipelineId)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{branchSlug}', '$(_MSKit_Ph_branchSlug)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{branchTicket}', '$(_MSKit_Ph_branchTicket)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{branchAspectSuffix}', '$(_MSKit_Ph_branchAspectSuffix)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{buildDateUtcDash}', '$(_MSKit_Ph_buildDateUtcDash)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{buildDateUtcDot}', '$(_MSKit_Ph_buildDateUtcDot)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{versionTag}', '$(_MSKit_Ph_versionTag)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{releaseTag}', '$(_MSKit_Ph_releaseTag)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{prNumber}', '$(_MSKit_Ph_prNumber)'))</_MSKit_Rendered>
+    <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{commitShaShort}', '$(_MSKit_Ph_commitShaShort)'))</_MSKit_Rendered>
+
+    <_MSKit_RenderHasUnknown>false</_MSKit_RenderHasUnknown>
+    <_MSKit_RenderHasUnknown Condition="$([System.Text.RegularExpressions.Regex]::IsMatch('$(_MSKit_Rendered)', '\{[A-Za-z][A-Za-z0-9]*\}'))">true</_MSKit_RenderHasUnknown>
+
+    <Version Condition="'$(_MSKit_Rendered)'!='' AND '$(_MSKit_RenderHasUnknown)'!='true'">$(_MSKit_Rendered)</Version>
+    <!-- Detectable by -getProperty callers; a real build stops earlier on ValidateVersionTemplate. -->
+    <Version Condition="'$(_MSKit_RenderHasUnknown)'=='true'">unknown placeholder: $(_MSKit_Rendered)</Version>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/version.targets b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/version.targets
new file mode 100644
index 0000000..8b72fe8
--- /dev/null
+++ b/manager/.toolkit/msbuild/DragoAnt.MSBuildKit/version.targets
@@ -0,0 +1,38 @@
+<Project>
+
+  <!-- version.props renders statically so -getProperty:Version works, but it runs before the
+       csproj body. This target renders again once a csproj-level VersionPrefix or template is
+       final, and sets PackageVersion for pack. -->
+  <Target Name="RenderVersionFromTemplate"
+          Condition="'$(MSKit_VersionStrategy)'!='Manual' AND '$(MSKit_ExplicitVersion)'==''"
+          BeforeTargets="GenerateNuspec;CoreCompile;GetAssemblyVersion">
+
+    <PropertyGroup>
+      <_MSKit_Ph_prefix>$(VersionPrefix)</_MSKit_Ph_prefix>
+
+      <_MSKit_EffectiveTemplate Condition="'$(MSKit_IsStableBranch)'=='true'">$(MSKit_StableVersionTemplate)</_MSKit_EffectiveTemplate>
+      <_MSKit_EffectiveTemplate Condition="'$(MSKit_IsStableBranch)'!='true'">$(MSKit_VersionTemplate)</_MSKit_EffectiveTemplate>
+      <_MSKit_EffectiveTemplate Condition="'$(MSKit_PullRequestNumber)'!='' AND '$(MSKit_PullRequestVersionTemplate)'!=''">$(MSKit_PullRequestVersionTemplate)</_MSKit_EffectiveTemplate>
+      <_MSKit_EffectiveTemplate Condition="'$(MSKit_IsReleaseTag)'=='True' AND '$(MSKit_ReleaseVersionTemplate)'!=''">$(MSKit_ReleaseVersionTemplate)</_MSKit_EffectiveTemplate>
+
+      <_MSKit_Rendered>$(_MSKit_EffectiveTemplate)</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{prefix}', '$(_MSKit_Ph_prefix)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{buildNumber}', '$(_MSKit_Ph_buildNumber)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{pipelineId}', '$(_MSKit_Ph_pipelineId)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{branchSlug}', '$(_MSKit_Ph_branchSlug)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{branchTicket}', '$(_MSKit_Ph_branchTicket)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{branchAspectSuffix}', '$(_MSKit_Ph_branchAspectSuffix)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{buildDateUtcDash}', '$(_MSKit_Ph_buildDateUtcDash)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{buildDateUtcDot}', '$(_MSKit_Ph_buildDateUtcDot)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{versionTag}', '$(_MSKit_Ph_versionTag)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{releaseTag}', '$(_MSKit_Ph_releaseTag)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{prNumber}', '$(_MSKit_Ph_prNumber)'))</_MSKit_Rendered>
+      <_MSKit_Rendered>$(_MSKit_Rendered.Replace('{commitShaShort}', '$(_MSKit_Ph_commitShaShort)'))</_MSKit_Rendered>
+
+      <Version>$(_MSKit_Rendered)</Version>
+      <PackageVersion>$(_MSKit_Rendered)</PackageVersion>
+    </PropertyGroup>
+
+  </Target>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/init.company.props b/manager/.toolkit/msbuild/init.company.props
new file mode 100644
index 0000000..587098c
--- /dev/null
+++ b/manager/.toolkit/msbuild/init.company.props
@@ -0,0 +1,35 @@
+<Project>
+
+  <!-- The owner layer: loaded first, so every value here is a default the kit parts and your
+       Directory.Build.props can override. Fork the kit and change this file to use it for
+       another owner; everything else is owner-neutral. -->
+  <PropertyGroup>
+    <ManufacturerName>DragoAnt</ManufacturerName>
+    <FullManufacturerName>DragoAnt</FullManufacturerName>
+
+    <PackageLicenseExpression Condition="'$(PackageLicenseExpression)'=='' AND '$(PackageLicenseFile)'==''">MIT</PackageLicenseExpression>
+    <PackageIconPath Condition="'$(PackageIconPath)'==''">$(MSBuildThisFileDirectory)../res/package.icon.png</PackageIconPath>
+    <MSKit_PrereleasePackagePrefix Condition="'$(MSKit_PrereleasePackagePrefix)'==''">DragoAnt.</MSKit_PrereleasePackagePrefix>
+
+    <MSKit_IsStableBranchRegex Condition="'$(MSKit_IsStableBranchRegex)'==''">^(main|release/.+)$</MSKit_IsStableBranchRegex>
+    <MSKit_VersionStrategy Condition="'$(MSKit_VersionStrategy)'==''">ReleaseTag</MSKit_VersionStrategy>
+
+    <!-- Libraries are the norm in these repositories; test and sample projects opt out. -->
+    <IsPackable Condition="'$(IsPackable)'==''">True</IsPackable>
+
+    <TreatWarningsAsErrors Condition="'$(TreatWarningsAsErrors)'==''">True</TreatWarningsAsErrors>
+    <!-- CS1591: public members without XML docs. xUnit1051: CancellationToken overloads in tests. -->
+    <NoWarn>CS1591;xUnit1051;$(NoWarn)</NoWarn>
+    <!-- A newly disclosed vulnerability in a dependency stays a warning, so the fix can be
+         scheduled instead of blocking every build. -->
+    <WarningsNotAsErrors>$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
+
+    <MSKit_TestingFramework Condition="'$(MSKit_TestingFramework)'==''">xunit.v3</MSKit_TestingFramework>
+    <MSKit_TestsAssertions Condition="'$(MSKit_TestsAssertions)'==''">AwesomeAssertions</MSKit_TestsAssertions>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <MSKit_RestrictPackageReference Include="Moq" Type="Error" Message="Use NSubstitute for test doubles." />
+  </ItemGroup>
+
+</Project>
diff --git a/manager/.toolkit/msbuild/init.company.targets b/manager/.toolkit/msbuild/init.company.targets
new file mode 100644
index 0000000..45bff74
--- /dev/null
+++ b/manager/.toolkit/msbuild/init.company.targets
@@ -0,0 +1,5 @@
+<Project>
+
+  <!-- Owner-specific targets: loaded first in the targets phase. Empty for DragoAnt. -->
+
+</Project>
diff --git a/manager/.toolkit/msbuild/init.props b/manager/.toolkit/msbuild/init.props
new file mode 100644
index 0000000..580345c
--- /dev/null
+++ b/manager/.toolkit/msbuild/init.props
@@ -0,0 +1,26 @@
+<Project>
+
+  <!-- DragoAnt.MSBuildKit props entry point; Directory.Build.props imports it. Parts load in this
+       fixed order and only when installed. MSKit_BeforeInitProps / MSKit_AfterInitProps name your
+       own files to import before or after the kit. -->
+  <Import Project="$(MSKit_BeforeInitProps)" Condition="'$(MSKit_BeforeInitProps)' != '' and Exists('$(MSKit_BeforeInitProps)')" />
+  <Import Project="$(MSBuildThisFileDirectory)init.company.props" Condition="Exists('$(MSBuildThisFileDirectory)init.company.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Core/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Core/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Vcs.GitHub/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Vcs.GitHub/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.Compile/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.Compile/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.Secrets/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.Secrets/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.RoslynComponent/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.RoslynComponent/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.CodeFixer/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.CodeFixer/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.CodeAnalyzer/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.CodeAnalyzer/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.SourceGenerator/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.SourceGenerator/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.TfmConstants/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.TfmConstants/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Packaging/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Packaging/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing.XUnit.v3/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing.XUnit.v3/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.EF/init.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.EF/init.props')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit/init.last.props" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit/init.last.props')" />
+  <Import Project="$(MSKit_AfterInitProps)" Condition="'$(MSKit_AfterInitProps)' != '' and Exists('$(MSKit_AfterInitProps)')" />
+
+</Project>
diff --git a/manager/.toolkit/msbuild/init.targets b/manager/.toolkit/msbuild/init.targets
new file mode 100644
index 0000000..f4e11ab
--- /dev/null
+++ b/manager/.toolkit/msbuild/init.targets
@@ -0,0 +1,29 @@
+<Project>
+
+  <!-- DragoAnt.MSBuildKit targets entry point; Directory.Build.targets imports it. Every
+       installed part's audit/*.targets is imported last. -->
+  <Import Project="$(MSKit_BeforeInitTargets)" Condition="'$(MSKit_BeforeInitTargets)' != '' and Exists('$(MSKit_BeforeInitTargets)')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.TfmConstants/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.TfmConstants/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)init.company.targets" Condition="Exists('$(MSBuildThisFileDirectory)init.company.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Core/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Core/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.Compile/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.Compile/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.DirectorySecrets/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.Secrets/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Locals.Secrets/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.CodeAnalyzer/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.CodeAnalyzer/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.SourceGenerator/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.SourceGenerator/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Packaging/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Packaging/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing.XUnit.v3/init.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing.XUnit.v3/init.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit/init.last.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit/init.last.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.RoslynComponent/init.last.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.RoslynComponent/init.last.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing.XUnit.v3/init.last.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing.XUnit.v3/init.last.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing/init.last.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Testing/init.last.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.CodeAnalyzer/init.last.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.Project.CodeAnalyzer/init.last.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.PrivateAssets/init.last.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.PrivateAssets/init.last.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.PackageAsProj/init.last.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.PackageAsProj/init.last.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.ProjMetadata/init.last.targets" Condition="Exists('$(MSBuildThisFileDirectory)DragoAnt.MSBuildKit.ProjMetadata/init.last.targets')" />
+  <Import Project="$(MSBuildThisFileDirectory)*/audit/*.targets" />
+  <Import Project="$(MSKit_AfterInitTargets)" Condition="'$(MSKit_AfterInitTargets)' != '' and Exists('$(MSKit_AfterInitTargets)')" />
+
+</Project>
diff --git a/manager/.toolkit/res/package.icon.png b/manager/.toolkit/res/package.icon.png
new file mode 100644
index 0000000..e890a29
Binary files /dev/null and b/manager/.toolkit/res/package.icon.png differ
diff --git a/manager/.toolkit/update.ps1 b/manager/.toolkit/update.ps1
new file mode 100644
index 0000000..d5fdfea
--- /dev/null
+++ b/manager/.toolkit/update.ps1
@@ -0,0 +1,214 @@
+#!/usr/bin/env pwsh
+<#
+.SYNOPSIS
+Installs or updates DragoAnt.MSBuildKit in a repository's .toolkit/ folder.
+
+.DESCRIPTION
+Downloads a release zip of the kit from GitHub, checks its SHA-256 against the published
+checksum (and against .toolkit/kit.json when the version is unchanged), and rewrites
+.toolkit/msbuild/ with the default parts plus the optional parts you selected.
+
+.EXAMPLE
+pwsh .toolkit/update.ps1                         # update to the version in kit.json, else the latest
+pwsh .toolkit/update.ps1 -Version 0.2.0 -DryRun  # show what 0.2.0 would change
+pwsh .toolkit/update.ps1 -Add PackageAsProj      # install an optional part
+#>
+[CmdletBinding()]
+param(
+    # Kit version to install; default: the version in .toolkit/kit.json, else the latest release.
+    [string] $Version,
+    # Optional parts to install, e.g. PackageAsProj, EF, Project.SourceGenerator.
+    [string[]] $Add = @(),
+    # Optional parts to uninstall.
+    [string[]] $Remove = @(),
+    # Show what would change and change nothing.
+    [switch] $DryRun,
+    # Install from a local kit build (a folder containing .toolkit/ or a release zip).
+    [string] $Source,
+    # Expected SHA-256 of the release zip (or of a -Source zip).
+    [string] $Sha256,
+    # GitHub repository to download releases from.
+    [string] $Repo = 'DragoAnt/MSBuildKit',
+    # Repository root; default: the current folder.
+    [string] $Root
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Say([string] $text) { Write-Host "update: $text" }
+function Fail([string] $text) { throw "update: error: $text" }
+
+if (-not $Root) { $Root = (Get-Location).Path }
+$Root = (Resolve-Path $Root).Path
+$toolkit = Join-Path $Root '.toolkit'
+$kitJsonPath = Join-Path $toolkit 'kit.json'
+$kitJson = if (Test-Path $kitJsonPath) { Get-Content -Raw $kitJsonPath | ConvertFrom-Json } else { $null }
+function KitJsonValue([string] $name) {
+    if ($null -ne $kitJson -and $kitJson.PSObject.Properties.Name -contains $name) { return $kitJson.$name }
+    return $null
+}
+
+if ($Version) { $Version = $Version -replace '^[vV]', '' }
+if ($Sha256) { $Sha256 = $Sha256.ToLowerInvariant() }
+$recordedRepo = KitJsonValue 'repository'
+if ($recordedRepo -and $Repo -eq 'DragoAnt/MSBuildKit') { $Repo = $recordedRepo }
+
+$work = Join-Path ([System.IO.Path]::GetTempPath()) ("msbuildkit-" + [guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Path $work | Out-Null
+try {
+    $actualSha = ''
+    $kitDir = $null
+    if ($Source) {
+        if (Test-Path $Source -PathType Container) {
+            if (-not (Test-Path (Join-Path $Source '.toolkit/msbuild/init.props'))) { Fail "'$Source' is not a kit build: no .toolkit/msbuild/init.props" }
+            $kitDir = (Resolve-Path $Source).Path
+        }
+        elseif (Test-Path $Source -PathType Leaf) {
+            $actualSha = (Get-FileHash -Algorithm SHA256 $Source).Hash.ToLowerInvariant()
+            if ($Sha256 -and $actualSha -ne $Sha256) { Fail "SHA-256 mismatch for '$Source': expected $Sha256, got $actualSha" }
+            $kitDir = Join-Path $work 'kit'
+            Expand-Archive -Path $Source -DestinationPath $kitDir
+        }
+        else { Fail "-Source '$Source' does not exist" }
+        if (-not $Version) {
+            $versionFile = Join-Path $kitDir '.toolkit/kit.version'
+            $Version = if (Test-Path $versionFile) { (Get-Content $versionFile -TotalCount 1).Trim() } else { '0.0.0-local' }
+        }
+    }
+    else {
+        if (-not $Version) { $Version = KitJsonValue 'version' }
+        if (-not $Version) {
+            $latest = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/latest" -Headers @{ 'User-Agent' = 'msbuildkit-update' }
+            $Version = ($latest.tag_name -replace '^[vV]', '')
+            if (-not $Version) { Fail "no release found in $Repo" }
+        }
+        $zipName = "msbuildkit-$Version.zip"
+        $base = "https://github.com/$Repo/releases/download/v$Version"
+        $zipPath = Join-Path $work $zipName
+        Say "downloading $base/$zipName"
+        Invoke-WebRequest -Uri "$base/$zipName" -OutFile $zipPath
+        Invoke-WebRequest -Uri "$base/$zipName.sha256" -OutFile "$zipPath.sha256"
+        $published = ((Get-Content "$zipPath.sha256" -TotalCount 1) -split '\s+')[0].ToLowerInvariant()
+        $actualSha = (Get-FileHash -Algorithm SHA256 $zipPath).Hash.ToLowerInvariant()
+        if ($actualSha -ne $published) { Fail "SHA-256 mismatch for ${zipName}: published $published, downloaded $actualSha" }
+        $pinned = KitJsonValue 'sha256'
+        if (-not $Sha256 -and (KitJsonValue 'version') -eq $Version -and $pinned) { $Sha256 = $pinned.ToLowerInvariant() }
+        if ($Sha256 -and $actualSha -ne $Sha256) { Fail "SHA-256 mismatch for ${zipName}: expected $Sha256 (kit.json or -Sha256), got $actualSha" }
+        $kitDir = Join-Path $work 'kit'
+        Expand-Archive -Path $zipPath -DestinationPath $kitDir
+    }
+
+    $newToolkit = Join-Path $kitDir '.toolkit'
+    if (-not (Test-Path (Join-Path $newToolkit 'msbuild/init.props'))) { Fail 'the kit build has no .toolkit/msbuild/init.props' }
+    $partsPath = Join-Path $newToolkit 'kit.parts'
+    if (-not (Test-Path $partsPath)) { Fail 'the kit build has no .toolkit/kit.parts' }
+    if ((Test-Path $toolkit) -and (Resolve-Path $newToolkit).Path -eq (Resolve-Path $toolkit).Path) {
+        Fail 'the target .toolkit is the kit source itself; run from the repository you want to update, or pass -Root'
+    }
+    $parts = [ordered]@{}
+    foreach ($line in Get-Content $partsPath) {
+        $line = $line.Trim()
+        if (-not $line -or $line.StartsWith('#')) { continue }
+        $fields = $line -split '\s+'
+        $parts[$fields[0]] = [pscustomobject]@{ Kind = $fields[1]; Requires = @($fields | Select-Object -Skip 2) }
+    }
+    function PartDir([string] $name) { if ($name -eq 'Trunk') { 'DragoAnt.MSBuildKit' } else { "DragoAnt.MSBuildKit.$name" } }
+
+    $optional = [System.Collections.Generic.List[string]]::new()
+    $recordedParts = @(KitJsonValue 'parts' | Where-Object { $_ })
+    foreach ($p in @($recordedParts) + @($Add)) {
+        if (-not $parts.Contains($p)) { Fail "unknown part '$p'; known parts: $($parts.Keys -join ' ')" }
+        if ($parts[$p].Kind -eq 'optional' -and -not $optional.Contains($p)) { $optional.Add($p) }
+    }
+    foreach ($p in $Remove) {
+        if (-not $parts.Contains($p)) { Fail "unknown part '$p'" }
+        if ($parts[$p].Kind -ne 'optional') { Fail "'$p' is a default part and cannot be removed" }
+        [void]$optional.Remove($p)
+    }
+
+    $selected = [System.Collections.Generic.List[string]]::new()
+    foreach ($name in $parts.Keys) { if ($parts[$name].Kind -eq 'default') { $selected.Add($name) } }
+    $pending = [System.Collections.Generic.Queue[string]]::new([string[]]$optional)
+    while ($pending.Count -gt 0) {
+        $p = $pending.Dequeue()
+        if ($selected.Contains($p)) { continue }
+        $selected.Add($p)
+        foreach ($d in $parts[$p].Requires) { $pending.Enqueue($d) }
+    }
+    $recorded = @($parts.Keys | Where-Object { $selected.Contains($_) -and $parts[$_].Kind -eq 'optional' })
+
+    $stage = Join-Path $work 'stage/msbuild'
+    New-Item -ItemType Directory -Path $stage -Force | Out-Null
+    Get-ChildItem -File (Join-Path $newToolkit 'msbuild') | Copy-Item -Destination $stage
+    foreach ($p in $selected) {
+        $d = PartDir $p
+        $from = Join-Path $newToolkit "msbuild/$d"
+        if (-not (Test-Path $from)) { Fail "the kit build has no part folder msbuild/$d" }
+        Copy-Item -Recurse $from (Join-Path $stage $d)
+    }
+
+    $oldVersion = KitJsonValue 'version'
+    Say "kit $Repo $(if ($oldVersion) { $oldVersion } else { 'none' }) -> $Version$(if ($actualSha) { " (sha256 $actualSha)" })"
+    Say "parts: $($selected -join ' ')"
+
+    $currentMsbuild = Join-Path $toolkit 'msbuild'
+    function RelativeFiles([string] $dir) {
+        if (-not (Test-Path $dir)) { return @() }
+        $full = (Resolve-Path $dir).Path
+        @(Get-ChildItem -Recurse -File $full | ForEach-Object { $_.FullName.Substring($full.Length + 1).Replace('\', '/') } | Sort-Object)
+    }
+    $old = RelativeFiles $currentMsbuild
+    $new = RelativeFiles $stage
+    $changes = 0
+    foreach ($f in $new) {
+        if ($old -notcontains $f) { Say "  add    .toolkit/msbuild/$f"; $changes++ }
+        elseif ((Get-FileHash (Join-Path $currentMsbuild $f)).Hash -ne (Get-FileHash (Join-Path $stage $f)).Hash) { Say "  change .toolkit/msbuild/$f"; $changes++ }
+    }
+    foreach ($f in $old) { if ($new -notcontains $f) { Say "  remove .toolkit/msbuild/$f"; $changes++ } }
+
+    $dbp = Join-Path $Root 'Directory.Build.props'
+    $dbt = Join-Path $Root 'Directory.Build.targets'
+    if ($DryRun) {
+        Say "$changes file(s) under .toolkit/msbuild would change"
+        if (-not (Test-Path $dbp)) { Say '  would create Directory.Build.props' }
+        if (-not (Test-Path $dbt)) { Say '  would create Directory.Build.targets' }
+        Say 'dry run: nothing changed'
+        return
+    }
+
+    New-Item -ItemType Directory -Path $toolkit -Force | Out-Null
+    if (Test-Path $currentMsbuild) { Remove-Item -Recurse -Force $currentMsbuild }
+    Copy-Item -Recurse $stage $currentMsbuild
+    $res = Join-Path $newToolkit 'res'
+    if (Test-Path $res) { New-Item -ItemType Directory -Path (Join-Path $toolkit 'res') -Force | Out-Null; Copy-Item -Recurse -Force (Join-Path $res '*') (Join-Path $toolkit 'res') }
+    foreach ($f in 'update.sh', 'update.ps1', 'kit.parts') {
+        $from = Join-Path $newToolkit $f
+        if (Test-Path $from) { Copy-Item -Force $from (Join-Path $toolkit $f) }
+    }
+    Remove-Item -Force -ErrorAction SilentlyContinue (Join-Path $toolkit 'kit.version')
+
+    $partsJson = ($recorded | ForEach-Object { "`"$_`"" }) -join ', '
+    $json = "{`n  `"repository`": `"$Repo`",`n  `"version`": `"$Version`",`n  `"sha256`": `"$actualSha`",`n  `"parts`": [$partsJson]`n}`n"
+    [System.IO.File]::WriteAllText($kitJsonPath, $json)
+    Say "$changes file(s) under .toolkit/msbuild changed"
+
+    if (-not (Test-Path $dbp)) {
+        [System.IO.File]::WriteAllText($dbp, "<Project>`n`n  <Import Project=`"`$(MSBuildThisFileDirectory).toolkit/msbuild/init.props`" />`n`n</Project>`n")
+        Say 'created Directory.Build.props'
+    }
+    elseif ((Get-Content -Raw $dbp) -notmatch '\.toolkit[/\\]msbuild[/\\]init\.props') {
+        Say 'add to Directory.Build.props: <Import Project="$(MSBuildThisFileDirectory).toolkit/msbuild/init.props" />'
+    }
+    if (-not (Test-Path $dbt)) {
+        [System.IO.File]::WriteAllText($dbt, "<Project>`n`n  <Import Project=`"`$(MSBuildThisFileDirectory).toolkit/msbuild/init.targets`" />`n`n</Project>`n")
+        Say 'created Directory.Build.targets'
+    }
+    elseif ((Get-Content -Raw $dbt) -notmatch '\.toolkit[/\\]msbuild[/\\]init\.targets') {
+        Say 'add to Directory.Build.targets: <Import Project="$(MSBuildThisFileDirectory).toolkit/msbuild/init.targets" />'
+    }
+    Say "done: DragoAnt.MSBuildKit $Version installed in $toolkit"
+}
+finally {
+    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue $work
+}
diff --git a/manager/.toolkit/update.sh b/manager/.toolkit/update.sh
new file mode 100644
index 0000000..e1cc11c
--- /dev/null
+++ b/manager/.toolkit/update.sh
@@ -0,0 +1,228 @@
+#!/bin/sh
+# Installs or updates DragoAnt.MSBuildKit in a repository's .toolkit/ folder.
+# Usage: sh .toolkit/update.sh [--version X.Y.Z] [--add PART] [--remove PART] [--dry-run]
+#        [--source DIR|ZIP] [--sha256 HEX] [--repo OWNER/NAME] [--root DIR]
+
+# One brace group, parsed in full before it runs: the update may replace this file while it runs.
+{
+set -eu
+
+repo="DragoAnt/MSBuildKit"
+version=""
+source=""
+expected_sha=""
+root=""
+dry_run=0
+add_parts=""
+remove_parts=""
+
+usage() {
+  sed -n '2,4p' "$0" | sed 's/^# \{0,1\}//'
+  cat <<'EOF'
+
+  --version X.Y.Z   kit version to install (default: the version in .toolkit/kit.json, else the latest release)
+  --add PART        install an optional part (repeatable), e.g. --add PackageAsProj
+  --remove PART     uninstall an optional part (repeatable)
+  --dry-run         show what would change and change nothing
+  --source DIR|ZIP  install from a local kit build instead of a GitHub release
+  --sha256 HEX      expected SHA-256 of the release zip (or of a --source zip)
+  --repo OWNER/NAME GitHub repository to download releases from (default: DragoAnt/MSBuildKit)
+  --root DIR        repository root (default: the current folder)
+EOF
+}
+
+fail() { echo "update: error: $*" >&2; exit 1; }
+say() { echo "update: $*"; }
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --version) [ $# -ge 2 ] || fail "--version needs a value"; version="${2#v}"; shift 2 ;;
+    --source) [ $# -ge 2 ] || fail "--source needs a value"; source="$2"; shift 2 ;;
+    --sha256) [ $# -ge 2 ] || fail "--sha256 needs a value"; expected_sha=$(printf '%s' "$2" | tr 'A-F' 'a-f'); shift 2 ;;
+    --repo) [ $# -ge 2 ] || fail "--repo needs a value"; repo="$2"; shift 2 ;;
+    --root) [ $# -ge 2 ] || fail "--root needs a value"; root="$2"; shift 2 ;;
+    --add) [ $# -ge 2 ] || fail "--add needs a value"; add_parts="$add_parts $2"; shift 2 ;;
+    --remove) [ $# -ge 2 ] || fail "--remove needs a value"; remove_parts="$remove_parts $2"; shift 2 ;;
+    --dry-run) dry_run=1; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) fail "unknown argument '$1' (see --help)" ;;
+  esac
+done
+
+[ -n "$root" ] || root=$(pwd)
+[ -d "$root" ] || fail "root '$root' is not a directory"
+toolkit="$root/.toolkit"
+kit_json="$toolkit/kit.json"
+
+json_value() { [ -f "$kit_json" ] && sed -n "s/.*\"$1\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/p" "$kit_json" | head -n 1 || true; }
+json_parts() { [ -f "$kit_json" ] && sed -n 's/.*"parts"[[:space:]]*:[[:space:]]*\[\(.*\)\].*/\1/p' "$kit_json" | tr -d '" ' | tr ',' ' ' || true; }
+
+sha256_of() {
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1
+  elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | cut -d' ' -f1
+  else fail "neither sha256sum nor shasum is available"; fi
+}
+
+download() {
+  if command -v curl >/dev/null 2>&1; then curl -fsSL --retry 3 -o "$2" "$1"
+  elif command -v wget >/dev/null 2>&1; then wget -q -O "$2" "$1"
+  else fail "neither curl nor wget is available"; fi
+}
+
+extract_zip() {
+  if command -v unzip >/dev/null 2>&1; then unzip -q -o "$1" -d "$2"
+  else tar -xf "$1" -C "$2" || fail "cannot extract '$1': install unzip"; fi
+}
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT INT TERM
+kit_dir=""
+actual_sha=""
+
+[ -n "$repo" ] || fail "--repo is empty"
+recorded_repo=$(json_value repository)
+if [ -n "$recorded_repo" ] && [ "$repo" = "DragoAnt/MSBuildKit" ]; then repo="$recorded_repo"; fi
+
+if [ -n "$source" ]; then
+  if [ -d "$source" ]; then
+    [ -f "$source/.toolkit/msbuild/init.props" ] || fail "'$source' is not a kit build: no .toolkit/msbuild/init.props"
+    kit_dir="$source"
+  elif [ -f "$source" ]; then
+    actual_sha=$(sha256_of "$source")
+    if [ -n "$expected_sha" ] && [ "$actual_sha" != "$expected_sha" ]; then
+      fail "SHA-256 mismatch for '$source': expected $expected_sha, got $actual_sha"
+    fi
+    mkdir -p "$work/kit"; extract_zip "$source" "$work/kit"; kit_dir="$work/kit"
+  else
+    fail "--source '$source' does not exist"
+  fi
+  [ -n "$version" ] || version=$(sed -n '1p' "$kit_dir/.toolkit/kit.version" 2>/dev/null || true)
+  [ -n "$version" ] || version="0.0.0-local"
+else
+  [ -n "$version" ] || version=$(json_value version)
+  if [ -z "$version" ]; then
+    download "https://api.github.com/repos/$repo/releases/latest" "$work/latest.json" || fail "cannot query the latest release of $repo"
+    tag=$(sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$work/latest.json" | head -n 1)
+    [ -n "$tag" ] || fail "no release found in $repo"
+    version="${tag#v}"
+  fi
+  zip_name="msbuildkit-$version.zip"
+  base="https://github.com/$repo/releases/download/v$version"
+  say "downloading $base/$zip_name"
+  download "$base/$zip_name" "$work/$zip_name" || fail "cannot download $base/$zip_name"
+  download "$base/$zip_name.sha256" "$work/$zip_name.sha256" || fail "cannot download $base/$zip_name.sha256"
+  published_sha=$(cut -d' ' -f1 "$work/$zip_name.sha256" | tr 'A-F' 'a-f')
+  actual_sha=$(sha256_of "$work/$zip_name")
+  [ "$actual_sha" = "$published_sha" ] || fail "SHA-256 mismatch for $zip_name: published $published_sha, downloaded $actual_sha"
+  pinned_sha=$(json_value sha256)
+  if [ -z "$expected_sha" ] && [ "$(json_value version)" = "$version" ] && [ -n "$pinned_sha" ]; then expected_sha="$pinned_sha"; fi
+  if [ -n "$expected_sha" ] && [ "$actual_sha" != "$expected_sha" ]; then
+    fail "SHA-256 mismatch for $zip_name: expected $expected_sha (kit.json or --sha256), got $actual_sha"
+  fi
+  mkdir -p "$work/kit"; extract_zip "$work/$zip_name" "$work/kit"; kit_dir="$work/kit"
+fi
+
+new_toolkit="$kit_dir/.toolkit"
+[ -f "$new_toolkit/msbuild/init.props" ] || fail "the kit build has no .toolkit/msbuild/init.props"
+[ -f "$new_toolkit/kit.parts" ] || fail "the kit build has no .toolkit/kit.parts"
+if [ -d "$toolkit" ] && [ "$(cd "$new_toolkit" && pwd -P)" = "$(cd "$toolkit" && pwd -P)" ]; then fail "the target .toolkit is the kit source itself; run from the repository you want to update, or pass --root"; fi
+parts_file="$work/kit.parts"
+tr -d '\r' < "$new_toolkit/kit.parts" | grep -v '^[[:space:]]*#' | grep -v '^[[:space:]]*$' > "$parts_file"
+
+part_kind() { awk -v p="$1" '$1==p {print $2}' "$parts_file"; }
+part_deps() { awk -v p="$1" '$1==p {for (i=3;i<=NF;i++) print $i}' "$parts_file"; }
+part_dir() { if [ "$1" = "Trunk" ]; then echo "DragoAnt.MSBuildKit"; else echo "DragoAnt.MSBuildKit.$1"; fi; }
+
+optional=""
+for p in $(json_parts) $add_parts; do
+  kind=$(part_kind "$p")
+  [ -n "$kind" ] || fail "unknown part '$p'; known parts: $(awk '{print $1}' "$parts_file" | tr '\n' ' ')"
+  case " $optional " in *" $p "*) ;; *) if [ "$kind" = optional ]; then optional="$optional $p"; fi ;; esac
+done
+for p in $remove_parts; do
+  kind=$(part_kind "$p")
+  [ -n "$kind" ] || fail "unknown part '$p'"
+  [ "$kind" = optional ] || fail "'$p' is a default part and cannot be removed"
+  optional=$(echo " $optional " | sed "s/ $p / /g")
+done
+
+selected=$(awk '$2=="default" {print $1}' "$parts_file")
+pending="$optional"
+while [ -n "$(echo $pending)" ]; do
+  next=""
+  for p in $pending; do
+    case " $(echo $selected) " in *" $p "*) continue ;; esac
+    selected="$selected $p"
+    for d in $(part_deps "$p"); do next="$next $d"; done
+  done
+  pending="$next"
+done
+recorded=""
+for p in $selected; do if [ "$(part_kind "$p")" = optional ]; then recorded="$recorded $p"; fi; done
+recorded=$(echo $recorded)
+
+stage="$work/stage"
+mkdir -p "$stage/msbuild"
+for f in "$new_toolkit"/msbuild/*; do [ -f "$f" ] && cp "$f" "$stage/msbuild/"; done
+for p in $selected; do
+  d=$(part_dir "$p")
+  [ -d "$new_toolkit/msbuild/$d" ] || fail "the kit build has no part folder msbuild/$d"
+  cp -R "$new_toolkit/msbuild/$d" "$stage/msbuild/$d"
+done
+
+old_version=$(json_value version)
+say "kit $repo ${old_version:-none} -> $version${actual_sha:+ (sha256 $actual_sha)}"
+say "parts: $(echo $selected)"
+changes=0
+if [ -d "$toolkit/msbuild" ]; then
+  (cd "$toolkit/msbuild" && find . -type f | sort) > "$work/old.lst"
+else
+  : > "$work/old.lst"
+fi
+(cd "$stage/msbuild" && find . -type f | sort) > "$work/new.lst"
+for f in $(comm -13 "$work/old.lst" "$work/new.lst"); do say "  add    .toolkit/msbuild/${f#./}"; changes=$((changes+1)); done
+for f in $(comm -23 "$work/old.lst" "$work/new.lst"); do say "  remove .toolkit/msbuild/${f#./}"; changes=$((changes+1)); done
+for f in $(comm -12 "$work/old.lst" "$work/new.lst"); do
+  cmp -s "$toolkit/msbuild/$f" "$stage/msbuild/$f" || { say "  change .toolkit/msbuild/${f#./}"; changes=$((changes+1)); }
+done
+
+dbp="$root/Directory.Build.props"
+dbt="$root/Directory.Build.targets"
+
+if [ "$dry_run" -eq 1 ]; then
+  say "$changes file(s) under .toolkit/msbuild would change"
+  [ -f "$dbp" ] || say "  would create Directory.Build.props"
+  [ -f "$dbt" ] || say "  would create Directory.Build.targets"
+  say "dry run: nothing changed"
+  exit 0
+fi
+
+mkdir -p "$toolkit"
+rm -rf "$toolkit/msbuild"
+cp -R "$stage/msbuild" "$toolkit/msbuild"
+if [ -d "$new_toolkit/res" ]; then mkdir -p "$toolkit/res"; cp -R "$new_toolkit/res/." "$toolkit/res/"; fi
+cp "$new_toolkit/kit.parts" "$toolkit/kit.parts"
+rm -f "$toolkit/kit.version"
+say "$changes file(s) under .toolkit/msbuild changed"
+
+parts_json=""
+for p in $recorded; do parts_json="$parts_json${parts_json:+, }\"$p\""; done
+printf '{\n  "repository": "%s",\n  "version": "%s",\n  "sha256": "%s",\n  "parts": [%s]\n}\n' \
+  "$repo" "$version" "$actual_sha" "$parts_json" > "$kit_json"
+
+if [ ! -f "$dbp" ]; then
+  printf '<Project>\n\n  <Import Project="$(MSBuildThisFileDirectory).toolkit/msbuild/init.props" />\n\n</Project>\n' > "$dbp"
+  say "created Directory.Build.props"
+elif ! grep -q '\.toolkit[/\\]msbuild[/\\]init\.props' "$dbp"; then
+  say "add to Directory.Build.props: <Import Project=\"\$(MSBuildThisFileDirectory).toolkit/msbuild/init.props\" />"
+fi
+if [ ! -f "$dbt" ]; then
+  printf '<Project>\n\n  <Import Project="$(MSBuildThisFileDirectory).toolkit/msbuild/init.targets" />\n\n</Project>\n' > "$dbt"
+  say "created Directory.Build.targets"
+elif ! grep -q '\.toolkit[/\\]msbuild[/\\]init\.targets' "$dbt"; then
+  say "add to Directory.Build.targets: <Import Project=\"\$(MSBuildThisFileDirectory).toolkit/msbuild/init.targets\" />"
+fi
+for f in update.ps1 update.sh; do if [ -f "$new_toolkit/$f" ]; then cp "$new_toolkit/$f" "$toolkit/$f"; fi; done
+say "done: DragoAnt.MSBuildKit $version installed in $toolkit"
+exit 0
+}
diff --git a/manager/Directory.Build.props b/manager/Directory.Build.props
new file mode 100644
index 0000000..6927d4e
--- /dev/null
+++ b/manager/Directory.Build.props
@@ -0,0 +1,9 @@
+<Project>
+
+  <PropertyGroup>
+    <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
+  </PropertyGroup>
+
+  <Import Project="$(MSBuildThisFileDirectory).toolkit/msbuild/init.props" />
+
+</Project>
diff --git a/manager/Directory.Build.targets b/manager/Directory.Build.targets
new file mode 100644
index 0000000..07200a8
--- /dev/null
+++ b/manager/Directory.Build.targets
@@ -0,0 +1,5 @@
+<Project>
+
+  <Import Project="$(MSBuildThisFileDirectory).toolkit/msbuild/init.targets" />
+
+</Project>
diff --git a/manager/Directory.Packages.props b/manager/Directory.Packages.props
new file mode 100644
index 0000000..4bb3b86
--- /dev/null
+++ b/manager/Directory.Packages.props
@@ -0,0 +1,17 @@
+<Project>
+
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.12" />
+    <PackageVersion Include="Serilog.Extensions.Logging" Version="10.0.0" />
+    <PackageVersion Include="Serilog.Formatting.Compact" Version="3.0.0" />
+    <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
+    <PackageVersion Include="Spectre.Console.Cli" Version="0.57.2" />
+    <PackageVersion Include="Spectre.Console.Testing" Version="0.57.2" />
+  </ItemGroup>
+
+</Project>
diff --git a/manager/Directory.Version.props b/manager/Directory.Version.props
new file mode 100644
index 0000000..a64e0d3
--- /dev/null
+++ b/manager/Directory.Version.props
@@ -0,0 +1,7 @@
+<Project>
+
+  <PropertyGroup>
+    <VersionPrefix>0.3.0</VersionPrefix>
+  </PropertyGroup>
+
+</Project>
diff --git a/manager/DragoAnt.MSBuildKit.Manager.slnx b/manager/DragoAnt.MSBuildKit.Manager.slnx
new file mode 100644
index 0000000..8176523
--- /dev/null
+++ b/manager/DragoAnt.MSBuildKit.Manager.slnx
@@ -0,0 +1,8 @@
+<Solution>
+  <Folder Name="/src/">
+    <Project Path="src/DragoAnt.MSBuildKit.Manager/DragoAnt.MSBuildKit.Manager.csproj" />
+  </Folder>
+  <Folder Name="/tests/">
+    <Project Path="tests/DragoAnt.MSBuildKit.Manager.Tests/DragoAnt.MSBuildKit.Manager.Tests.csproj" />
+  </Folder>
+</Solution>
diff --git a/manager/global.json b/manager/global.json
new file mode 100644
index 0000000..1d364c6
--- /dev/null
+++ b/manager/global.json
@@ -0,0 +1,9 @@
+{
+  "sdk": {
+    "version": "10.0.100",
+    "rollForward": "latestFeature"
+  },
+  "test": {
+    "runner": "Microsoft.Testing.Platform"
+  }
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Cli/Commands/StatusCommand.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/Commands/StatusCommand.cs
new file mode 100644
index 0000000..796ab33
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/Commands/StatusCommand.cs
@@ -0,0 +1,25 @@
+using System.Text.Json;
+using DragoAnt.MSBuildKit.Manager.Cli.Settings;
+using Microsoft.Extensions.Logging;
+using Spectre.Console.Cli;
+
+namespace DragoAnt.MSBuildKit.Manager.Cli.Commands;
+
+internal sealed class StatusCommand(ToolConsole _console, ILogger<StatusCommand> _logger) : Command<StatusSettings>
+{
+    private static readonly JsonSerializerOptions JsonOptions = new() { PropertyNamingPolicy = JsonNamingPolicy.CamelCase, WriteIndented = true };
+
+    public override int Execute(CommandContext context, StatusSettings settings, CancellationToken cancellationToken)
+    {
+        _logger.LogInformation("{Tool} {Version}", ToolInfo.CommandName, ToolInfo.Version);
+
+        _console.Out.WriteLine(settings.Json
+            ? JsonSerializer.Serialize(new StatusJson(new ToolJson(ToolInfo.CommandName, ToolInfo.Version)), JsonOptions)
+            : $"{ToolInfo.CommandName} {ToolInfo.Version}");
+        return 0;
+    }
+
+    private sealed record StatusJson(ToolJson Tool);
+
+    private sealed record ToolJson(string Name, string Version);
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Cli/GlobalOptions.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/GlobalOptions.cs
new file mode 100644
index 0000000..d7889f9
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/GlobalOptions.cs
@@ -0,0 +1,40 @@
+namespace DragoAnt.MSBuildKit.Manager.Cli;
+
+/// <summary>Options every command accepts, anywhere on the command line. They are read before the command
+/// parser runs, because the logo and the log are set up first.</summary>
+/// <param name="NoLogo"><c>--no-logo</c>: never print the logo.</param>
+/// <param name="Diagnostic"><c>--diagnostic</c>: mirror debug events with <c>--log-to-console</c>.</param>
+/// <param name="LogToConsole"><c>--log-to-console</c>: mirror the log to stderr.</param>
+/// <param name="NoColor"><c>--no-color</c>: plain text output.</param>
+public sealed record GlobalOptions(bool NoLogo = false, bool Diagnostic = false, bool LogToConsole = false, bool NoColor = false)
+{
+    /// <summary>Reads the global flags and returns the arguments left for the commands, in their order.</summary>
+    public static (GlobalOptions Options, string[] Remaining) Parse(IReadOnlyList<string> args)
+    {
+        var options = new GlobalOptions();
+        var remaining = new List<string>(args.Count);
+        foreach (var arg in args)
+        {
+            switch (arg.ToLowerInvariant())
+            {
+                case "--no-logo":
+                    options = options with { NoLogo = true };
+                    break;
+                case "--diagnostic":
+                    options = options with { Diagnostic = true };
+                    break;
+                case "--log-to-console":
+                    options = options with { LogToConsole = true };
+                    break;
+                case "--no-color":
+                    options = options with { NoColor = true };
+                    break;
+                default:
+                    remaining.Add(arg);
+                    break;
+            }
+        }
+
+        return (options, remaining.ToArray());
+    }
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Cli/Logo.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/Logo.cs
new file mode 100644
index 0000000..bd9dad7
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/Logo.cs
@@ -0,0 +1,22 @@
+namespace DragoAnt.MSBuildKit.Manager.Cli;
+
+internal static class Logo
+{
+    private const string Ink = "\x1b[38;2;46;139;87m";
+    private const string Accent = "\x1b[38;2;218;165;32m";
+    private const string Dim = "\x1b[90m";
+    private const string Reset = "\x1b[0m";
+
+    // stdout carries results only, so the logo goes to stderr, and only when a person is watching it.
+    public static bool ShouldWrite(GlobalOptions options, bool errorIsTerminal) => !options.NoLogo && errorIsTerminal;
+
+    public static void Write(TextWriter error, string version, bool color)
+    {
+        string Paint(string code, string text) => color ? code + text + Reset : text;
+
+        error.WriteLine(" " + Paint(Ink, "╔╦╗╔═╗╦╔═╦╔╦╗") + "   " + Paint(Accent, $"{ToolInfo.CommandName} {version}"));
+        error.WriteLine(" " + Paint(Ink, "║║║╚═╗╠╩╗║ ║ ") + "   " + Paint(Dim, "DragoAnt MSBuildKit for .NET repositories"));
+        error.WriteLine(" " + Paint(Ink, "╩ ╩╚═╝╩ ╩╩ ╩ "));
+        error.WriteLine();
+    }
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Cli/Settings/StatusSettings.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/Settings/StatusSettings.cs
new file mode 100644
index 0000000..0cf3b47
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/Settings/StatusSettings.cs
@@ -0,0 +1,13 @@
+using System.ComponentModel;
+using Spectre.Console.Cli;
+
+namespace DragoAnt.MSBuildKit.Manager.Cli.Settings;
+
+/// <summary>Options of <c>status</c>.</summary>
+public sealed class StatusSettings : CommandSettings
+{
+    /// <summary>Print JSON instead of text.</summary>
+    [CommandOption("--json")]
+    [Description("Print JSON instead of text.")]
+    public bool Json { get; init; }
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Cli/ToolConsole.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/ToolConsole.cs
new file mode 100644
index 0000000..2d14352
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/ToolConsole.cs
@@ -0,0 +1,11 @@
+namespace DragoAnt.MSBuildKit.Manager.Cli;
+
+/// <summary>Where a run writes: <see cref="Out"/> carries results only; the logo, progress and errors go to <see cref="Error"/>.</summary>
+/// <param name="Out">Results — what a script or <c>--json</c> reader consumes.</param>
+/// <param name="Error">Everything meant for a person.</param>
+/// <param name="ErrorIsTerminal">True when <see cref="Error"/> is an interactive terminal.</param>
+public sealed record ToolConsole(TextWriter Out, TextWriter Error, bool ErrorIsTerminal)
+{
+    /// <summary>The process's own streams.</summary>
+    public static ToolConsole System => new(Console.Out, Console.Error, !Console.IsErrorRedirected);
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Cli/ToolInfo.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/ToolInfo.cs
new file mode 100644
index 0000000..4fd89de
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Cli/ToolInfo.cs
@@ -0,0 +1,24 @@
+using System.Reflection;
+
+namespace DragoAnt.MSBuildKit.Manager.Cli;
+
+/// <summary>The tool's name and version.</summary>
+public static class ToolInfo
+{
+    /// <summary>The command a user types.</summary>
+    public const string CommandName = "mskit-manager";
+
+    /// <summary>The package version, without build metadata.</summary>
+    public static string Version { get; } = ReadVersion();
+
+    private static string ReadVersion()
+    {
+        var assembly = typeof(ToolInfo).Assembly;
+        var informational = assembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion;
+        if (informational is not null)
+            return informational.Split('+')[0];
+
+        var version = assembly.GetName().Version;
+        return version is null ? "0.0.0" : $"{version.Major}.{version.Minor}.{version.Build}";
+    }
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/DragoAnt.MSBuildKit.Manager.csproj b/manager/src/DragoAnt.MSBuildKit.Manager/DragoAnt.MSBuildKit.Manager.csproj
new file mode 100644
index 0000000..659e5c3
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/DragoAnt.MSBuildKit.Manager.csproj
@@ -0,0 +1,22 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <PackAsTool>true</PackAsTool>
+    <ToolCommandName>mskit-manager</ToolCommandName>
+    <RollForward>Major</RollForward>
+    <SatelliteResourceLanguages>en</SatelliteResourceLanguages>
+    <Description>A .NET tool that installs, updates and migrates DragoAnt.MSBuildKit in a repository.</Description>
+    <PackageTags>msbuild;dotnet-tool;build;nuget;props;targets</PackageTags>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
+    <PackageReference Include="Microsoft.Extensions.Logging" />
+    <PackageReference Include="Serilog.Extensions.Logging" />
+    <PackageReference Include="Serilog.Formatting.Compact" />
+    <PackageReference Include="Serilog.Sinks.File" />
+    <PackageReference Include="Spectre.Console.Cli" />
+  </ItemGroup>
+
+</Project>
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/DependencyInjectionTypeRegistrar.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/DependencyInjectionTypeRegistrar.cs
new file mode 100644
index 0000000..19abdfa
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/DependencyInjectionTypeRegistrar.cs
@@ -0,0 +1,32 @@
+using Microsoft.Extensions.DependencyInjection;
+using Spectre.Console.Cli;
+
+namespace DragoAnt.MSBuildKit.Manager.Infrastructure;
+
+/// <summary>Lets <see cref="CommandApp"/> resolve commands from an <see cref="IServiceCollection"/>; everything is a singleton.</summary>
+public sealed class DependencyInjectionTypeRegistrar(IServiceCollection _services) : ITypeRegistrar
+{
+    /// <inheritdoc />
+    public ITypeResolver Build() => new DependencyInjectionTypeResolver(_services.BuildServiceProvider());
+
+    /// <inheritdoc />
+    public void Register(Type service, Type implementation) => _services.AddSingleton(service, implementation);
+
+    /// <inheritdoc />
+    public void RegisterInstance(Type service, object implementation) => _services.AddSingleton(service, implementation);
+
+    /// <inheritdoc />
+    public void RegisterLazy(Type service, Func<object> factory)
+    {
+        ArgumentNullException.ThrowIfNull(factory);
+        _services.AddSingleton(service, _ => factory());
+    }
+}
+
+internal sealed class DependencyInjectionTypeResolver(ServiceProvider _provider) : ITypeResolver, IDisposable
+{
+    // Spectre expects null for an unregistered type; throwing reads as a crashed resolver.
+    public object? Resolve(Type? type) => type is null ? null : _provider.GetService(type);
+
+    public void Dispose() => _provider.Dispose();
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/IProcessRunner.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/IProcessRunner.cs
new file mode 100644
index 0000000..0bf6068
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/IProcessRunner.cs
@@ -0,0 +1,23 @@
+namespace DragoAnt.MSBuildKit.Manager.Infrastructure;
+
+/// <summary>Starts child processes; the seam tests replace.</summary>
+public interface IProcessRunner
+{
+    /// <summary>Starts <paramref name="fileName"/>, captures both output streams and awaits exit.</summary>
+    /// <param name="fileName">Executable to launch, resolved through <c>PATH</c>.</param>
+    /// <param name="arguments">Command-line arguments for the child.</param>
+    /// <param name="workingDirectory">Working directory of the child; the current directory when null.</param>
+    /// <param name="ct">Cancels the wait.</param>
+    Task<ProcessResult> RunAsync(string fileName, string arguments, string? workingDirectory = null, CancellationToken ct = default);
+
+    /// <summary>As <see cref="RunAsync"/>, also invoking a callback per output line as it arrives.</summary>
+    /// <remarks>Callbacks run on thread-pool threads; one that throws is ignored so the streams keep draining.</remarks>
+    /// <param name="fileName">Executable to launch, resolved through <c>PATH</c>.</param>
+    /// <param name="arguments">Command-line arguments for the child.</param>
+    /// <param name="workingDirectory">Working directory of the child; the current directory when null.</param>
+    /// <param name="onStdout">Called once per standard-output line.</param>
+    /// <param name="onStderr">Called once per standard-error line.</param>
+    /// <param name="ct">Cancels the wait.</param>
+    Task<ProcessResult> RunWithCallbacksAsync(string fileName, string arguments, string? workingDirectory,
+        Action<string> onStdout, Action<string> onStderr, CancellationToken ct = default);
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/PathUtils.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/PathUtils.cs
new file mode 100644
index 0000000..d7dcfbc
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/PathUtils.cs
@@ -0,0 +1,17 @@
+namespace DragoAnt.MSBuildKit.Manager.Infrastructure;
+
+/// <summary>Cross-platform path helpers.</summary>
+public static class PathUtils
+{
+    /// <summary>Forward slashes, no leading slash — the shape of a path inside a package.</summary>
+    public static string NormalizePath(string path) => path.Replace('\\', '/').TrimStart('/');
+
+    /// <summary>True when <paramref name="path"/> resolves to <paramref name="rootPath"/> or a path beneath it.</summary>
+    public static bool IsPathUnderRoot(string path, string rootPath)
+    {
+        var relative = Path.GetRelativePath(Path.GetFullPath(rootPath), Path.GetFullPath(path));
+        return !Path.IsPathRooted(relative)
+               && relative != ".."
+               && !relative.StartsWith(".." + Path.DirectorySeparatorChar, StringComparison.Ordinal);
+    }
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/ProcessResult.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/ProcessResult.cs
new file mode 100644
index 0000000..e09bf5e
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/ProcessResult.cs
@@ -0,0 +1,49 @@
+namespace DragoAnt.MSBuildKit.Manager.Infrastructure;
+
+/// <summary>Captured outcome of a child-process run.</summary>
+public sealed class ProcessResult
+{
+    /// <summary>Process exit code reported by the OS.</summary>
+    public int ExitCode { get; init; }
+
+    /// <summary>Captured standard output, trailing whitespace trimmed.</summary>
+    public string StdOut { get; init; } = "";
+
+    /// <summary>Captured standard error, trailing whitespace trimmed.</summary>
+    public string StdErr { get; init; } = "";
+
+    /// <summary>True when <see cref="ExitCode"/> is zero.</summary>
+    public bool Success => ExitCode == 0;
+
+    /// <summary><see cref="ExitCode"/> rendered for a reader, naming the POSIX signal behind it where there is one.</summary>
+    public string ExitDescription => DescribeExitCode(ExitCode);
+
+    /// <summary>Renders <paramref name="exitCode"/>, expanding the 128+N range into the signal that produced it.</summary>
+    /// <remarks>A child killed by a signal leaves only 128 + the signal number and nothing on stderr. A script can return
+    /// that number on its own, so the signal is named as the shape of the code, not asserted as what happened.</remarks>
+    public static string DescribeExitCode(int exitCode) => DescribeExitCode(exitCode, OperatingSystem.IsWindows());
+
+    internal static string DescribeExitCode(int exitCode, bool isWindows)
+    {
+        if (isWindows || exitCode <= 128 || exitCode > 128 + 64)
+            return $"exit {exitCode}";
+
+        var signal = exitCode - 128;
+        var name = signal switch
+        {
+            1 => "SIGHUP",
+            2 => "SIGINT",
+            3 => "SIGQUIT",
+            4 => "SIGILL",
+            6 => "SIGABRT",
+            8 => "SIGFPE",
+            9 => "SIGKILL",
+            11 => "SIGSEGV",
+            13 => "SIGPIPE",
+            15 => "SIGTERM",
+            _ => $"signal {signal}",
+        };
+
+        return $"exit {exitCode} — 128+{signal}, the shape of a child killed by {name}";
+    }
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/ProcessRunner.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/ProcessRunner.cs
new file mode 100644
index 0000000..62d96dc
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Infrastructure/ProcessRunner.cs
@@ -0,0 +1,78 @@
+using System.Diagnostics;
+using System.Text;
+
+namespace DragoAnt.MSBuildKit.Manager.Infrastructure;
+
+/// <summary>Runs <c>dotnet</c>, <c>git</c> and other children through <see cref="Process"/>, stdin closed.</summary>
+public sealed class ProcessRunner : IProcessRunner
+{
+    /// <inheritdoc />
+    public Task<ProcessResult> RunAsync(string fileName, string arguments, string? workingDirectory = null, CancellationToken ct = default) =>
+        RunWithCallbacksAsync(fileName, arguments, workingDirectory, static _ => { }, static _ => { }, ct);
+
+    /// <inheritdoc />
+    public async Task<ProcessResult> RunWithCallbacksAsync(string fileName, string arguments, string? workingDirectory,
+        Action<string> onStdout, Action<string> onStderr, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(onStdout);
+        ArgumentNullException.ThrowIfNull(onStderr);
+
+        using var process = new Process
+        {
+            StartInfo = new ProcessStartInfo
+            {
+                FileName = fileName,
+                Arguments = arguments,
+                WorkingDirectory = workingDirectory ?? Directory.GetCurrentDirectory(),
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                // A child that reads stdin would otherwise block on the shared console and never exit.
+                RedirectStandardInput = true,
+                UseShellExecute = false,
+                CreateNoWindow = true,
+            },
+        };
+        var stdout = new StringBuilder();
+        var stderr = new StringBuilder();
+        process.OutputDataReceived += (_, e) => Collect(e.Data, stdout, onStdout);
+        process.ErrorDataReceived += (_, e) => Collect(e.Data, stderr, onStderr);
+
+        process.Start();
+        try
+        {
+            process.StandardInput.Close();
+        }
+        catch (IOException)
+        {
+        }
+
+        process.BeginOutputReadLine();
+        process.BeginErrorReadLine();
+        await process.WaitForExitAsync(ct);
+
+        return new ProcessResult
+        {
+            ExitCode = process.ExitCode,
+            StdOut = stdout.ToString().TrimEnd(),
+            StdErr = stderr.ToString().TrimEnd(),
+        };
+    }
+
+    private static void Collect(string? line, StringBuilder buffer, Action<string> callback)
+    {
+        if (line is null)
+            return;
+
+        lock (buffer)
+            buffer.AppendLine(line);
+
+        try
+        {
+            callback(line);
+        }
+        catch (Exception)
+        {
+            // The streams must keep draining or the child blocks on a full pipe.
+        }
+    }
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Logging/CommandLogInterceptor.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Logging/CommandLogInterceptor.cs
new file mode 100644
index 0000000..31dc58f
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Logging/CommandLogInterceptor.cs
@@ -0,0 +1,9 @@
+using Spectre.Console.Cli;
+
+namespace DragoAnt.MSBuildKit.Manager.Logging;
+
+/// <summary>Names the log file after the command the parser chose, so a new command needs no registration here.</summary>
+internal sealed class CommandLogInterceptor(LogSession _session) : ICommandInterceptor
+{
+    public void Intercept(CommandContext context, CommandSettings settings) => _session.Open(context.Name);
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Logging/LogSession.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Logging/LogSession.cs
new file mode 100644
index 0000000..96d5002
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Logging/LogSession.cs
@@ -0,0 +1,172 @@
+using System.Globalization;
+using Microsoft.Extensions.Logging;
+using Serilog;
+using Serilog.Core;
+using Serilog.Events;
+using Serilog.Formatting.Compact;
+using Serilog.Formatting.Display;
+
+namespace DragoAnt.MSBuildKit.Manager.Logging;
+
+/// <summary>The run's log: one CompactJson file per invocation, named after the parsed command, newest
+/// <see cref="KeptFiles"/> kept. Events logged before the command is known are held and written on <see cref="Open"/>.</summary>
+public sealed class LogSession : IDisposable
+{
+    /// <summary>How many log files the folder keeps, the new one included.</summary>
+    public const int KeptFiles = 20;
+
+    private const string FallbackCommand = "tool";
+
+    private readonly string _directory;
+    private readonly DeferredFileSink _file = new();
+    private readonly Logger _logger;
+
+    private LogSession(string directory, LogLevel consoleLevel, TextWriter? consoleWriter)
+    {
+        _directory = directory;
+        var config = new LoggerConfiguration()
+            .MinimumLevel.Verbose()
+            .Enrich.FromLogContext()
+            .WriteTo.Sink(_file);
+        if (consoleWriter is not null)
+            config = config.WriteTo.Sink(new TextWriterSink(consoleWriter), ToSerilogLevel(consoleLevel));
+        _logger = config.CreateLogger();
+    }
+
+    /// <summary>The default folder: <c>&lt;system temp&gt;/mskit-manager/logs</c>.</summary>
+    public static string DefaultDirectory => Path.Combine(Path.GetTempPath(), "mskit-manager", "logs");
+
+    /// <summary>The process logger.</summary>
+    public Serilog.ILogger Logger => _logger;
+
+    /// <summary>The log file, or null until <see cref="Open"/>.</summary>
+    public string? FilePath => _file.Path;
+
+    /// <summary>Starts a session; nothing touches the disk until <see cref="Open"/>.</summary>
+    /// <param name="logDirectory">Folder for the log files.</param>
+    /// <param name="consoleLevel">Minimum level mirrored to <paramref name="consoleWriter"/>.</param>
+    /// <param name="consoleWriter">Mirror of the log for <c>--log-to-console</c>; null for none.</param>
+    public static LogSession Create(string logDirectory, LogLevel consoleLevel, TextWriter? consoleWriter) =>
+        new(logDirectory, consoleLevel, consoleWriter);
+
+    /// <summary>Creates the file for <paramref name="commandName"/> and writes the held events; later calls do nothing.</summary>
+    public void Open(string commandName) => _file.Open(_directory, commandName);
+
+    /// <summary>The log file path, opening it under the fallback name when no command was parsed.</summary>
+    public string EnsureOpen()
+    {
+        _file.Open(_directory, FallbackCommand);
+        return _file.Path!;
+    }
+
+    /// <summary>Tells the user where the log of a failed run is.</summary>
+    public static void WriteFailureFooter(TextWriter error, string logFilePath)
+    {
+        error.WriteLine();
+        error.WriteLine($"mskit-manager failed — see {logFilePath}");
+    }
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        _logger.Dispose();
+        _file.Dispose();
+    }
+
+    private static LogEventLevel ToSerilogLevel(LogLevel level) => level switch
+    {
+        LogLevel.Trace => LogEventLevel.Verbose,
+        LogLevel.Debug => LogEventLevel.Debug,
+        LogLevel.Information => LogEventLevel.Information,
+        LogLevel.Warning => LogEventLevel.Warning,
+        LogLevel.Error => LogEventLevel.Error,
+        _ => LogEventLevel.Fatal,
+    };
+
+    private sealed class TextWriterSink(TextWriter _writer) : ILogEventSink
+    {
+        private readonly MessageTemplateTextFormatter _formatter = new("{Message:lj}{NewLine}{Exception}", CultureInfo.InvariantCulture);
+
+        public void Emit(LogEvent logEvent)
+        {
+            lock (_writer)
+                _formatter.Format(logEvent, _writer);
+        }
+    }
+
+    private sealed class DeferredFileSink : ILogEventSink, IDisposable
+    {
+        private readonly object _gate = new();
+        private readonly List<LogEvent> _pending = [];
+        private Logger? _file;
+
+        public string? Path { get; private set; }
+
+        public void Emit(LogEvent logEvent)
+        {
+            lock (_gate)
+            {
+                if (_file is null)
+                    _pending.Add(logEvent);
+                else
+                    _file.Write(logEvent);
+            }
+        }
+
+        public void Open(string directory, string commandName)
+        {
+            lock (_gate)
+            {
+                if (_file is not null)
+                    return;
+
+                Directory.CreateDirectory(directory);
+                Prune(directory);
+                Path = NewFilePath(directory, string.IsNullOrWhiteSpace(commandName) ? FallbackCommand : commandName);
+                _file = new LoggerConfiguration()
+                    .MinimumLevel.Verbose()
+                    .WriteTo.File(new CompactJsonFormatter(), Path)
+                    .CreateLogger();
+                foreach (var pending in _pending)
+                    _file.Write(pending);
+                _pending.Clear();
+            }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+                _file?.Dispose();
+        }
+
+        private static string NewFilePath(string directory, string commandName)
+        {
+            var stamp = DateTime.UtcNow.ToString("yyyyMMdd-HHmmss-fff", CultureInfo.InvariantCulture);
+            var path = System.IO.Path.Combine(directory, $"{stamp}-{commandName}.log");
+            for (var n = 2; File.Exists(path); n++)
+                path = System.IO.Path.Combine(directory, $"{stamp}-{commandName}-{n}.log");
+            return path;
+        }
+
+        private static void Prune(string directory)
+        {
+            var stale = Directory.GetFiles(directory, "*.log")
+                .OrderByDescending(System.IO.Path.GetFileName, StringComparer.Ordinal)
+                .Skip(KeptFiles - 1);
+            foreach (var file in stale)
+            {
+                try
+                {
+                    File.Delete(file);
+                }
+                catch (IOException)
+                {
+                    // Another run still writes it; the next run prunes it.
+                }
+                catch (UnauthorizedAccessException)
+                {
+                }
+            }
+        }
+    }
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/Program.cs b/manager/src/DragoAnt.MSBuildKit.Manager/Program.cs
new file mode 100644
index 0000000..7fd5a96
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/Program.cs
@@ -0,0 +1,84 @@
+using System.Text;
+using DragoAnt.MSBuildKit.Manager.Cli;
+using DragoAnt.MSBuildKit.Manager.Cli.Commands;
+using DragoAnt.MSBuildKit.Manager.Infrastructure;
+using DragoAnt.MSBuildKit.Manager.Logging;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Serilog;
+using Spectre.Console;
+using Spectre.Console.Cli;
+
+namespace DragoAnt.MSBuildKit.Manager;
+
+/// <summary>The <c>mskit-manager</c> host: logo, log, services and the command app.</summary>
+public static class Program
+{
+    /// <summary>Exit code of a usage error: an unknown command or option, a bad value.</summary>
+    public const int UsageError = 2;
+
+    /// <summary>Runs the command line and exits with its code.</summary>
+    public static int Main(string[] args)
+    {
+        Console.OutputEncoding = Encoding.UTF8;
+        var exitCode = Run(args, ToolConsole.System, LogSession.DefaultDirectory);
+        Console.Out.Flush();
+        Console.Error.Flush();
+        // With a real console attached, a console-input thread can outlive the work and keep the process alive.
+        Environment.Exit(exitCode);
+        return exitCode;
+    }
+
+    internal static int Run(string[] args, ToolConsole console, string logDirectory)
+    {
+        var (options, commandArgs) = GlobalOptions.Parse(args);
+        if (Logo.ShouldWrite(options, console.ErrorIsTerminal))
+            Logo.Write(console.Error, ToolInfo.Version, color: !options.NoColor);
+
+        using var session = LogSession.Create(logDirectory,
+            options.Diagnostic ? LogLevel.Debug : LogLevel.Information,
+            options.LogToConsole ? console.Error : null);
+
+        var services = new ServiceCollection();
+        services.AddLogging(builder => builder.SetMinimumLevel(LogLevel.Trace).AddSerilog(session.Logger));
+        services.AddSingleton(console);
+        services.AddSingleton<IProcessRunner, ProcessRunner>();
+
+        var app = new CommandApp(new DependencyInjectionTypeRegistrar(services));
+        app.Configure(config =>
+        {
+            config.SetApplicationName(ToolInfo.CommandName);
+            config.SetApplicationVersion(ToolInfo.Version);
+            config.ConfigureConsole(CreateAnsiConsole(console.Out, options.NoColor));
+            config.SetInterceptor(new CommandLogInterceptor(session));
+            config.SetExceptionHandler((exception, _) => HandleException(exception, console, session));
+
+            config.AddCommand<StatusCommand>("status")
+                .WithDescription("Show the tool version.");
+        });
+
+        return app.Run(commandArgs);
+    }
+
+    private static int HandleException(Exception exception, ToolConsole console, LogSession session)
+    {
+        if (exception is CommandAppException)
+        {
+            console.Error.WriteLine($"error: {exception.Message}");
+            return UsageError;
+        }
+
+        session.Logger.Fatal(exception, "{Tool} failed", ToolInfo.CommandName);
+        LogSession.WriteFailureFooter(console.Error, session.EnsureOpen());
+        return 1;
+    }
+
+    private static IAnsiConsole CreateAnsiConsole(TextWriter output, bool noColor) =>
+        AnsiConsole.Create(new AnsiConsoleSettings
+        {
+            Out = new AnsiConsoleOutput(output),
+            Ansi = noColor ? AnsiSupport.No : AnsiSupport.Detect,
+            ColorSystem = noColor ? ColorSystemSupport.NoColors : ColorSystemSupport.Detect,
+            Interactive = InteractionSupport.No,
+        });
+}
diff --git a/manager/src/DragoAnt.MSBuildKit.Manager/package.readme.md b/manager/src/DragoAnt.MSBuildKit.Manager/package.readme.md
new file mode 100644
index 0000000..5e26dae
--- /dev/null
+++ b/manager/src/DragoAnt.MSBuildKit.Manager/package.readme.md
@@ -0,0 +1,21 @@
+# DragoAnt.MSBuildKit.Manager
+
+`mskit-manager` is the .NET tool behind [DragoAnt.MSBuildKit](https://github.com/DragoAnt/MSBuildKit): it installs, updates and migrates the kit in a repository.
+
+## Install
+
+```sh
+dotnet new tool-manifest
+dotnet tool install DragoAnt.MSBuildKit.Manager
+dotnet mskit-manager status --json
+```
+
+## Commands
+
+| Command | Does |
+| --- | --- |
+| `status [--json]` | prints the tool version |
+
+Global options: `--no-logo`, `--diagnostic`, `--log-to-console`, `--no-color`. The logo and progress go to stderr; stdout carries only results.
+
+This is an early build: the install, update and migrate commands arrive in later releases.
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Cli/GlobalOptionsTests.cs b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Cli/GlobalOptionsTests.cs
new file mode 100644
index 0000000..3fadb22
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Cli/GlobalOptionsTests.cs
@@ -0,0 +1,33 @@
+using DragoAnt.MSBuildKit.Manager.Cli;
+
+namespace DragoAnt.MSBuildKit.Manager.Tests.Cli;
+
+public sealed class GlobalOptionsTests
+{
+    [Fact]
+    public void Parse_ReadsEveryFlagAndLeavesTheRestForTheCommands()
+    {
+        var (options, remaining) = GlobalOptions.Parse(["--no-logo", "status", "--diagnostic", "--json", "--log-to-console", "--no-color"]);
+
+        options.Should().Be(new GlobalOptions(NoLogo: true, Diagnostic: true, LogToConsole: true, NoColor: true));
+        remaining.Should().Equal("status", "--json");
+    }
+
+    [Fact]
+    public void Parse_IsCaseInsensitiveAndRemovesEveryOccurrence()
+    {
+        var (options, remaining) = GlobalOptions.Parse(["--NO-LOGO", "status", "--no-logo"]);
+
+        options.NoLogo.Should().BeTrue();
+        remaining.Should().Equal("status");
+    }
+
+    [Fact]
+    public void Parse_KeepsAValueThatOnlyContainsAFlag()
+    {
+        var (options, remaining) = GlobalOptions.Parse(["status", "--name=--no-logo"]);
+
+        options.NoLogo.Should().BeFalse();
+        remaining.Should().Equal("status", "--name=--no-logo");
+    }
+}
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Cli/LogoTests.cs b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Cli/LogoTests.cs
new file mode 100644
index 0000000..d8f0f00
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Cli/LogoTests.cs
@@ -0,0 +1,33 @@
+using DragoAnt.MSBuildKit.Manager.Cli;
+
+namespace DragoAnt.MSBuildKit.Manager.Tests.Cli;
+
+public sealed class LogoTests
+{
+    [Theory]
+    [InlineData(false, true, true)]
+    [InlineData(true, true, false)]
+    [InlineData(false, false, false)]
+    public void ShouldWrite_OnlyOnATerminalWithoutNoLogo(bool noLogo, bool errorIsTerminal, bool expected) =>
+        Logo.ShouldWrite(new GlobalOptions(NoLogo: noLogo), errorIsTerminal).Should().Be(expected);
+
+    [Fact]
+    public void Write_NamesTheToolAndVersion_WithoutColorWhenAsked()
+    {
+        var error = new StringWriter();
+
+        Logo.Write(error, "1.2.3", color: false);
+
+        error.ToString().Should().Contain("mskit-manager 1.2.3").And.Contain("MSBuildKit").And.NotContain("\x1b[");
+    }
+
+    [Fact]
+    public void Write_WithColor_ResetsTheTerminalAtTheEnd()
+    {
+        var error = new StringWriter();
+
+        Logo.Write(error, "1.2.3", color: true);
+
+        error.ToString().TrimEnd().Should().EndWith("\x1b[0m");
+    }
+}
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/DragoAnt.MSBuildKit.Manager.Tests.csproj b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/DragoAnt.MSBuildKit.Manager.Tests.csproj
new file mode 100644
index 0000000..07a1f30
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/DragoAnt.MSBuildKit.Manager.Tests.csproj
@@ -0,0 +1,11 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <ItemGroup>
+    <ProjectReference Include="../../src/DragoAnt.MSBuildKit.Manager/DragoAnt.MSBuildKit.Manager.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Spectre.Console.Testing" />
+  </ItemGroup>
+
+</Project>
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/DependencyInjectionTypeRegistrarTests.cs b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/DependencyInjectionTypeRegistrarTests.cs
new file mode 100644
index 0000000..41fb7b3
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/DependencyInjectionTypeRegistrarTests.cs
@@ -0,0 +1,27 @@
+using DragoAnt.MSBuildKit.Manager.Infrastructure;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace DragoAnt.MSBuildKit.Manager.Tests.Infrastructure;
+
+public sealed class DependencyInjectionTypeRegistrarTests
+{
+    [Fact]
+    public void Build_ResolvesRegisteredTypesAndServicesAddedBefore()
+    {
+        var services = new ServiceCollection();
+        services.AddSingleton("added before");
+        var registrar = new DependencyInjectionTypeRegistrar(services);
+        registrar.Register(typeof(IProcessRunner), typeof(ProcessRunner));
+        registrar.RegisterLazy(typeof(Uri), () => new Uri("https://example.org/"));
+
+        var resolver = registrar.Build();
+
+        resolver.Resolve(typeof(IProcessRunner)).Should().BeOfType<ProcessRunner>();
+        resolver.Resolve(typeof(Uri)).Should().Be(new Uri("https://example.org/"));
+        resolver.Resolve(typeof(string)).Should().Be("added before");
+    }
+
+    [Fact]
+    public void Resolve_WhenTypeIsNotRegistered_ReturnsNull() =>
+        new DependencyInjectionTypeRegistrar(new ServiceCollection()).Build().Resolve(typeof(IProcessRunner)).Should().BeNull();
+}
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/PathUtilsTests.cs b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/PathUtilsTests.cs
new file mode 100644
index 0000000..b682068
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/PathUtilsTests.cs
@@ -0,0 +1,33 @@
+using DragoAnt.MSBuildKit.Manager.Infrastructure;
+
+namespace DragoAnt.MSBuildKit.Manager.Tests.Infrastructure;
+
+public sealed class PathUtilsTests
+{
+    private static readonly string Root = Path.Combine(Path.GetTempPath(), "mskit-root");
+
+    [Theory]
+    [InlineData("a/b.txt", true)]
+    [InlineData(".", true)]
+    [InlineData("../mskit-root-sibling/x.txt", false)]
+    [InlineData("../x.txt", false)]
+    [InlineData("a/../../x.txt", false)]
+    public void IsPathUnderRoot_ComparesTheResolvedPath(string relative, bool expected) =>
+        PathUtils.IsPathUnderRoot(Path.Combine(Root, relative), Root).Should().Be(expected);
+
+    [Fact]
+    public void IsPathUnderRoot_WhenOnAnotherDrive_IsFalse()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "drive letters exist only on Windows");
+        var drive = char.ToUpperInvariant(Path.GetPathRoot(Root)![0]) == 'Z' ? 'Y' : 'Z';
+
+        PathUtils.IsPathUnderRoot($@"{drive}:\elsewhere\x.txt", Root).Should().BeFalse();
+    }
+
+    [Theory]
+    [InlineData(@"\msbuild\a.props", "msbuild/a.props")]
+    [InlineData("/msbuild/a.props", "msbuild/a.props")]
+    [InlineData("msbuild/a.props", "msbuild/a.props")]
+    public void NormalizePath_UsesForwardSlashesWithoutLeadingSlash(string input, string expected) =>
+        PathUtils.NormalizePath(input).Should().Be(expected);
+}
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/ProcessResultExitDescriptionTests.cs b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/ProcessResultExitDescriptionTests.cs
new file mode 100644
index 0000000..7cd8c26
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/ProcessResultExitDescriptionTests.cs
@@ -0,0 +1,40 @@
+using DragoAnt.MSBuildKit.Manager.Infrastructure;
+
+namespace DragoAnt.MSBuildKit.Manager.Tests.Infrastructure;
+
+public sealed class ProcessResultExitDescriptionTests
+{
+    [Theory]
+    [InlineData(139, "SIGSEGV")]
+    [InlineData(137, "SIGKILL")]
+    [InlineData(143, "SIGTERM")]
+    [InlineData(134, "SIGABRT")]
+    [InlineData(141, "SIGPIPE")]
+    public void DescribeExitCode_WhenUnixSignalRange_NamesTheSignal(int exitCode, string signal)
+    {
+        var described = ProcessResult.DescribeExitCode(exitCode, isWindows: false);
+
+        described.Should().Contain(exitCode.ToString()).And.Contain(signal);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(3)]
+    [InlineData(128)]
+    [InlineData(255)]
+    public void DescribeExitCode_WhenOutsideSignalRange_StaysPlainExitCode(int exitCode) =>
+        ProcessResult.DescribeExitCode(exitCode, isWindows: false).Should().Be($"exit {exitCode}");
+
+    [Fact]
+    public void DescribeExitCode_WhenSignalUnmapped_StillReportsTheSignalNumber() =>
+        ProcessResult.DescribeExitCode(128 + 31, isWindows: false).Should().Contain("signal 31");
+
+    [Fact]
+    public void DescribeExitCode_OnWindows_NeverReadsASignal() =>
+        ProcessResult.DescribeExitCode(139, isWindows: true).Should().Be("exit 139");
+
+    [Fact]
+    public void ExitDescription_ReportsTheInstanceExitCode() =>
+        new ProcessResult { ExitCode = 0 }.ExitDescription.Should().Be("exit 0");
+}
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/ProcessRunnerTests.cs b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/ProcessRunnerTests.cs
new file mode 100644
index 0000000..71f55e4
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Infrastructure/ProcessRunnerTests.cs
@@ -0,0 +1,36 @@
+using DragoAnt.MSBuildKit.Manager.Infrastructure;
+
+namespace DragoAnt.MSBuildKit.Manager.Tests.Infrastructure;
+
+public sealed class ProcessRunnerTests
+{
+    [Fact]
+    public async Task RunAsync_WhenChildSucceeds_CapturesStdOutAndExitCode()
+    {
+        var result = await new ProcessRunner().RunAsync("dotnet", "--version", ct: TestContext.Current.CancellationToken);
+
+        result.Success.Should().BeTrue(result.StdErr);
+        result.StdOut.Should().MatchRegex(@"^\d+\.\d+\.\d+");
+    }
+
+    [Fact]
+    public async Task RunWithCallbacksAsync_StreamsEveryLineAndStillCapturesIt()
+    {
+        var lines = new List<string>();
+
+        var result = await new ProcessRunner().RunWithCallbacksAsync(
+            "dotnet", "--version", null, line => { lock (lines) lines.Add(line); }, _ => { },
+            TestContext.Current.CancellationToken);
+
+        lines.Should().ContainSingle().Which.Should().Be(result.StdOut);
+    }
+
+    [Fact]
+    public async Task RunAsync_WhenChildFails_ReportsItsExitCode()
+    {
+        var result = await new ProcessRunner().RunAsync("dotnet", "no-such-command-xyz", ct: TestContext.Current.CancellationToken);
+
+        result.Success.Should().BeFalse();
+        result.ExitCode.Should().NotBe(0);
+    }
+}
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Logging/LogSessionTests.cs b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Logging/LogSessionTests.cs
new file mode 100644
index 0000000..42f7b70
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/Logging/LogSessionTests.cs
@@ -0,0 +1,108 @@
+using DragoAnt.MSBuildKit.Manager.Logging;
+using Microsoft.Extensions.Logging;
+
+namespace DragoAnt.MSBuildKit.Manager.Tests.Logging;
+
+public sealed class LogSessionTests
+{
+    [Fact]
+    public void Open_NamesTheFileAfterTheCommand()
+    {
+        using var dir = new TempDirectory();
+        string path;
+        using (var session = LogSession.Create(dir.Path, LogLevel.Information, consoleWriter: null))
+        {
+            session.Open("status");
+            path = session.FilePath!;
+        }
+
+        Path.GetDirectoryName(path).Should().Be(dir.Path);
+        Path.GetFileName(path).Should().MatchRegex(@"^\d{8}-\d{6}-\d{3}-status\.log$");
+    }
+
+    [Fact]
+    public void Open_KeepsTheNewestTwentyFiles()
+    {
+        using var dir = new TempDirectory();
+        for (var i = 0; i < 25; i++)
+            File.WriteAllText(Path.Combine(dir.Path, $"20200101-0000{i:00}-000-old.log"), "x");
+        File.WriteAllText(Path.Combine(dir.Path, "notes.txt"), "not a log");
+
+        using (var session = LogSession.Create(dir.Path, LogLevel.Information, consoleWriter: null))
+            session.Open("status");
+
+        var logs = Directory.GetFiles(dir.Path, "*.log").Select(Path.GetFileName).ToList();
+        logs.Should().HaveCount(LogSession.KeptFiles);
+        logs.Should().Contain(f => f!.EndsWith("-status.log"));
+        logs.Should().NotContain("20200101-000000-000-old.log");
+        File.Exists(Path.Combine(dir.Path, "notes.txt")).Should().BeTrue();
+    }
+
+    [Fact]
+    public void Events_LoggedBeforeOpen_ReachTheFile()
+    {
+        using var dir = new TempDirectory();
+        string path;
+        using (var session = LogSession.Create(dir.Path, LogLevel.Information, consoleWriter: null))
+        {
+            session.Logger.Information("early event");
+            session.Open("status");
+            session.Logger.Information("late event");
+            path = session.FilePath!;
+        }
+
+        File.ReadAllText(path).Should().Contain("early event").And.Contain("late event");
+    }
+
+    [Fact]
+    public void EnsureOpen_WhenNoCommandWasParsed_FallsBackToTool()
+    {
+        using var dir = new TempDirectory();
+        using var session = LogSession.Create(dir.Path, LogLevel.Information, consoleWriter: null);
+
+        Path.GetFileName(session.EnsureOpen()).Should().EndWith("-tool.log");
+    }
+
+    [Fact]
+    public void File_TakesEveryLevel_WithoutAConsoleSink()
+    {
+        using var dir = new TempDirectory();
+        string path;
+        using (var session = LogSession.Create(dir.Path, LogLevel.Information, consoleWriter: null))
+        {
+            session.Open("status");
+            session.Logger.Debug("debug for the file");
+            path = session.FilePath!;
+        }
+
+        File.ReadAllText(path).Should().Contain("debug for the file");
+    }
+
+    [Theory]
+    [InlineData(LogLevel.Debug, true)]
+    [InlineData(LogLevel.Information, false)]
+    public void Console_WhenEnabled_IsGatedByItsLevel(LogLevel consoleLevel, bool debugVisible)
+    {
+        using var dir = new TempDirectory();
+        var console = new StringWriter();
+        using (var session = LogSession.Create(dir.Path, consoleLevel, console))
+        {
+            session.Open("status");
+            session.Logger.Information("info line");
+            session.Logger.Debug("debug line");
+        }
+
+        console.ToString().Should().Contain("info line");
+        console.ToString().Contains("debug line").Should().Be(debugVisible);
+    }
+
+    [Fact]
+    public void WriteFailureFooter_NamesTheLogFile()
+    {
+        var error = new StringWriter();
+
+        LogSession.WriteFailureFooter(error, "/logs/x-status.log");
+
+        error.ToString().Should().Contain("/logs/x-status.log").And.Contain("failed");
+    }
+}
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/ProgramTests.cs b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/ProgramTests.cs
new file mode 100644
index 0000000..be3431e
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/ProgramTests.cs
@@ -0,0 +1,99 @@
+using System.Text.Json;
+using DragoAnt.MSBuildKit.Manager.Cli;
+
+namespace DragoAnt.MSBuildKit.Manager.Tests;
+
+public sealed class ProgramTests
+{
+    private sealed record Run(int ExitCode, string Out, string Error);
+
+    private static Run Invoke(TempDirectory logs, bool errorIsTerminal, params string[] args)
+    {
+        var console = new ToolConsole(new StringWriter(), new StringWriter(), errorIsTerminal);
+        var exitCode = Program.Run(args, console, logs.Path);
+        return new Run(exitCode, console.Out.ToString()!, console.Error.ToString()!);
+    }
+
+    [Fact]
+    public void StatusJson_OnATerminal_KeepsTheLogoOffStdout()
+    {
+        using var logs = new TempDirectory();
+
+        var run = Invoke(logs, errorIsTerminal: true, "status", "--json");
+
+        run.ExitCode.Should().Be(0, run.Error);
+        using var json = JsonDocument.Parse(run.Out);
+        var tool = json.RootElement.GetProperty("tool");
+        tool.GetProperty("name").GetString().Should().Be("mskit-manager");
+        tool.GetProperty("version").GetString().Should().Be(ToolInfo.Version);
+        run.Error.Should().Contain("mskit-manager " + ToolInfo.Version);
+    }
+
+    [Fact]
+    public void Logo_IsSkippedWithNoLogo()
+    {
+        using var logs = new TempDirectory();
+
+        var run = Invoke(logs, errorIsTerminal: true, "--no-logo", "status", "--json");
+
+        run.ExitCode.Should().Be(0, run.Error);
+        run.Error.Should().BeEmpty();
+    }
+
+    [Fact]
+    public void Logo_IsSkippedWhenStderrIsRedirected()
+    {
+        using var logs = new TempDirectory();
+
+        var run = Invoke(logs, errorIsTerminal: false, "status", "--json");
+
+        run.ExitCode.Should().Be(0, run.Error);
+        run.Error.Should().BeEmpty();
+    }
+
+    [Fact]
+    public void Status_WithoutJson_PrintsTheVersionLine()
+    {
+        using var logs = new TempDirectory();
+
+        var run = Invoke(logs, errorIsTerminal: false, "status");
+
+        run.ExitCode.Should().Be(0, run.Error);
+        run.Out.Trim().Should().Be("mskit-manager " + ToolInfo.Version);
+    }
+
+    [Fact]
+    public void LogFile_IsNamedAfterTheParsedCommand_AndRecordsTheRun()
+    {
+        using var logs = new TempDirectory();
+
+        Invoke(logs, errorIsTerminal: false, "--diagnostic", "status", "--json");
+
+        var file = Directory.GetFiles(logs.Path, "*.log").Should().ContainSingle().Subject;
+        Path.GetFileName(file).Should().EndWith("-status.log");
+        File.ReadAllText(file).Should().Contain(ToolInfo.Version);
+    }
+
+    [Fact]
+    public void Help_ListsTheStatusCommand()
+    {
+        using var logs = new TempDirectory();
+
+        var run = Invoke(logs, errorIsTerminal: false, "--help");
+
+        run.ExitCode.Should().Be(0, run.Error);
+        run.Out.Should().Contain("status");
+    }
+
+    [Fact]
+    public void UnknownCommand_IsAUsageErrorWithExitCode2()
+    {
+        using var logs = new TempDirectory();
+
+        var run = Invoke(logs, errorIsTerminal: false, "no-such-command");
+
+        run.ExitCode.Should().Be(2);
+        run.Error.Should().Contain("no-such-command");
+        run.Out.Should().BeEmpty();
+    }
+}
diff --git a/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/TempDirectory.cs b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/TempDirectory.cs
new file mode 100644
index 0000000..9ed0c7e
--- /dev/null
+++ b/manager/tests/DragoAnt.MSBuildKit.Manager.Tests/TempDirectory.cs
@@ -0,0 +1,21 @@
+namespace DragoAnt.MSBuildKit.Manager.Tests;
+
+internal sealed class TempDirectory : IDisposable
+{
+    public string Path { get; } = Directory.CreateDirectory(
+        System.IO.Path.Combine(System.IO.Path.GetTempPath(), "mskit-manager-tests", Guid.NewGuid().ToString("N"))).FullName;
+
+    public void Dispose()
+    {
+        try
+        {
+            Directory.Delete(Path, recursive: true);
+        }
+        catch (IOException)
+        {
+        }
+        catch (UnauthorizedAccessException)
+        {
+        }
+    }
+}