fix(ci): assert McpServer packageType + embedded .mcp/server.json in packed nupkg

.github/workflows/publish-nuget.yml

@@ -56,6 +56,28 @@ jobs:
           Write-Host "Package: $($nupkg.Name) ($([math]::Round($nupkg.Length / 1MB, 2)) MB)"
           Write-Host "Symbols: $($snupkg.Name) ($([math]::Round($snupkg.Length / 1MB, 2)) MB)"
 
+          # A .nupkg is a ZIP. Unzip it and assert the two MCP-gallery-critical bits the size
+          # check can't see: a csproj regression dropping <PackageType>McpServer</PackageType> or
+          # the .mcp/server.json embed would still pass size + push a tool-only package on green
+          # CI, silently delisting us from the NuGet MCP gallery. Fail closed on either miss.
+          Add-Type -AssemblyName System.IO.Compression.FileSystem
+          $zip = [System.IO.Compression.ZipFile]::OpenRead($nupkg.FullName)
+          try {
+            $nuspecEntry = $zip.Entries | Where-Object { $_.FullName -like "*.nuspec" } | Select-Object -First 1
+            if (-not $nuspecEntry) { throw "No .nuspec found inside $($nupkg.Name)" }
+            $reader = New-Object System.IO.StreamReader($nuspecEntry.Open())
+            try { $nuspec = $reader.ReadToEnd() } finally { $reader.Dispose() }
+            if ($nuspec -notmatch '<packageType\s+name="McpServer"') {
+              throw "nuspec is missing <packageType name=`"McpServer`" /> — csproj regression dropped <PackageType>McpServer</PackageType>; package would NOT list on the NuGet MCP gallery."
+            }
+            if (-not ($zip.Entries | Where-Object { $_.FullName -eq '.mcp/server.json' })) {
+              throw "Package is missing the .mcp/server.json embed — csproj regression dropped the <None Include> pack item; the NuGet MCP gallery 'MCP Server' tab would not render."
+            }
+            Write-Host "Verified: McpServer packageType + .mcp/server.json embed present."
+          } finally {
+            $zip.Dispose()
+          }
+
       - name: Push to NuGet
         if: ${{ github.event_name == 'release' || github.event_name == 'push' || inputs.dry_run != 'true' }}
         shell: pwsh

ai_docs/backlog.md

@@ -3,7 +3,7 @@
 <!-- purpose: Open work only. Slim-index format — triage in the table, implementation detail in items/<id>.md. Sync rows on ship. -->
 <!-- scope: in-repo -->
 
-**updated_at:** 2026-06-20T02:56:16Z
+**updated_at:** 2026-06-20T03:21:19Z
 
 ## Agent contract
 
@@ -55,7 +55,6 @@
 | `promotion-tier-execution-batch` | Medium | — | **Promotion-tier execution batch** — re-run the promotion scorecard against the current v2.3.x surface (canonical snapshot is v1.38.1), then ship experimental→stable promotions in bounded batches via `/promote-tier`. Catalog hotspot; sweep-shaped → `/backlog-sweep:prepare`. [type: ops] | L | items/promotion-tier-execution-batch.md |
 | `audit-21-analyzer-load-decision` | Medium | — | **AUDIT-21 analyzer-load decision** — execute the dormant IDE/CA analyzer-parity Draft plan via `/backlog-sweep:prepare`, OR re-status it superseded/parked with the product trigger; fix the plan's stale §13 row citation. Blocked-on product decision (full analyzer parity required?). | M | items/audit-21-analyzer-load-decision.md |
 | `compilation-cache-adoption-read-side` | Medium | — | **Compilation-cache read-side adoption** — batches 1–2 shipped (#913/#936; ~10/24 sites); split the remaining site groups (incl. forked-solution hazard) into bounded child batches at `/backlog-sweep:prepare`. [type: refactor] | L | items/compilation-cache-adoption-read-side.md |
-| `publish-nuget-verify-package-types` | Medium | — | **Assert McpServer type + embedded manifest in the packed nupkg** — `publish-nuget.yml`'s "Verify package contents" step only size-checks the `.nupkg`, so a csproj regression dropping `<PackageType>McpServer</PackageType>` or the `.mcp/server.json` embed would ship a tool-only package on green CI (silent gallery delisting). Unzip + assert both. [type: ci] [source: 2026-06-19 top-n code-quality review] | S | items/publish-nuget-verify-package-types.md |
 | `nuget-version-checker-timeout-test-wallclock-race` | Medium | — | **Flaky NuGetVersionChecker timeout test** — `GetLatestVersion_OnTimeout_...` throws `TimeoutException` under runner load: `WaitForCompletionAsync`'s 5 s wall-clock `WaitAsync` races the checker's internal bounded timeout and expires first. Recurrence after `nuget-version-checker-test-wallclock-poll`; runs in `verify-release.ps1` (gates ubuntu publish). Make the wait event-driven / bound > internal timeout. [type: test] [source: 2026-06-19 top-n PR #986 CI flake] | S | items/nuget-version-checker-timeout-test-wallclock-race.md |
 
 ## Low

changelog.d/publish-nuget-verify-package-types.md

@@ -0,0 +1,5 @@
+---
+category: Maintenance
+---
+
+- **Maintenance:** The `publish-nuget.yml` "Verify package contents" step now unzips the packed `.nupkg` and fails the release unless the nuspec carries `<packageType name="McpServer" />` **and** the archive embeds `.mcp/server.json` — so a csproj regression dropping either would no longer ship a tool-only package on green CI and silently delist from the NuGet MCP gallery. Previously the step only size-checked the package (`publish-nuget-verify-package-types`).