From 0d8e5da702c43ef47416e5c7ea99da5d4c1eb4f8 Mon Sep 17 00:00:00 2001
From: Chrison Simtian <chris.simon@myfoodbag.co.nz>
Date: Thu, 23 Jul 2026 15:57:38 +1200
Subject: [PATCH] =?UTF-8?q?build:=20consume=20*Sharp=20clients=20from=20nu?=
 =?UTF-8?q?get.org=20(Chrison.*)=20=E2=80=94=20org-migration=20P6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Repoint the engine + PowerOrchestrator from the Chrison-dev GitHub-Packages feed
to the public nuget.org Chrison.* packages (published via Trusted Publishing from
the *Sharp repos). Decouples the NuGet feed from the GitHub org — P6 of the
Chrison-dev → Chrison-Homelab migration (#282), and removes the last cross-org
GitHub-Packages coupling.

- Homelab.Infrastructure.csproj: ProxmoxSharp 0.2.0-preview.31 → Chrison.ProxmoxSharp
  0.2.0-preview.5; UnifiSharp 0.1.0-preview.27 → Chrison.UnifiSharp 0.1.0-preview.2.
- PowerOrchestrator.Core.csproj: same IDs (ProxmoxSharp pinned; UnifiSharp stays -preview.*).
- nuget.config: drop the Chrison-dev GitHub-Packages feed + its credentials/mapping.
  Chrison.* now resolves from nuget.org (the old bare-ID collision workaround is moot —
  our IDs carry the Chrison.* prefix). Fallout-build feed unchanged (still PAT-auth).
- Docs/comments: CLAUDE.md install cmd → Chrison.ProxmoxSharp.Cli; build/README + the
  discover-drift note updated (packages are public on nuget.org now).

Assembly names/namespaces are unchanged (ProxmoxSharp/UnifiSharp), so no code edits.
Verified locally: restore + Release build of the engine and the PowerOrchestrator
solution both succeed (0 errors) against the nuget.org packages.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/discover-drift.yml          |  7 +++---
 CLAUDE.md                                     |  2 +-
 .../engine/Homelab.Infrastructure.csproj      | 20 ++++++++---------
 build/README.md                               |  4 ++--
 nuget.config                                  | 22 +++++--------------
 .../PowerOrchestrator.Core.csproj             | 13 ++++++-----
 6 files changed, 29 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/discover-drift.yml b/.github/workflows/discover-drift.yml
index efd2cb3..a31e5c7 100644
--- a/.github/workflows/discover-drift.yml
+++ b/.github/workflows/discover-drift.yml
@@ -9,10 +9,9 @@ name: discover-drift
 # CF-Access-gated `proxmox.chrison.dev` hostname. This sidesteps the Cloudflare WAF
 # (which 403s datacenter/runner IPs) that blocked GitHub-hosted runners before.
 #
-# Package restore uses the built-in GITHUB_TOKEN — no PAT needed (the engine only
-# restores same-org ProxmoxSharp*; the cross-org Fallout feed is build/-only). The
-# ProxmoxSharp + ProxmoxSharp.Api packages must grant this repo read access:
-# each package → Package settings → Manage Actions access → add Chrison-dev/Homelab (Read).
+# Package restore uses the built-in GITHUB_TOKEN — no PAT needed (the engine restores
+# Chrison.ProxmoxSharp/Chrison.UnifiSharp from nuget.org, public/no-auth; the cross-org
+# Fallout feed is build/-only and not touched here).
 #
 # Cluster-reach secrets are shared with _deploy-stack.yml (PROXMOX_BASE_URL points
 # at the LAN, PROXMOX_VERIFY_TLS=false for the self-signed direct cert):
diff --git a/CLAUDE.md b/CLAUDE.md
index abbb451..2b58383 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -32,7 +32,7 @@ setup that is NOT in this repo** — most notably **Cloudflare** (account + the
 ## Proxmox access: prefer the `proxmoxsharp` CLI
 
 For Proxmox read/discovery tasks, **use our own `proxmoxsharp` CLI first** (our
-dogfooded client, `vendor/ProxmoxSharp` → installed via `dotnet tool install -g ProxmoxSharp.Cli`).
+dogfooded client, `vendor/ProxmoxSharp` → installed via `dotnet tool install -g Chrison.ProxmoxSharp.Cli`).
 The `pve` MCP is a **fallback** (use it if the CLI is unavailable or for an
 endpoint the CLI doesn't expose yet).
 
diff --git a/Infrastructure/engine/Homelab.Infrastructure.csproj b/Infrastructure/engine/Homelab.Infrastructure.csproj
index 8fed044..1e2f8d7 100644
--- a/Infrastructure/engine/Homelab.Infrastructure.csproj
+++ b/Infrastructure/engine/Homelab.Infrastructure.csproj
@@ -16,17 +16,17 @@
   </ItemGroup>
 
   <ItemGroup>
-    <!-- Consume the published ProxmoxSharp package from GitHub Packages. Pinned to an
-         exact prerelease for deterministic restores: the `0.2.0-preview.*` float is
-         non-deterministic across runners (a stale NuGet cache resolves an older preview),
-         so bump this explicitly when adopting new ProxmoxSharp code. preview.31 = the LXC
-         lifecycle write path (PctWriter, #149). -->
-    <PackageReference Include="ProxmoxSharp" Version="0.2.0-preview.31" />
+    <!-- Consume the published Chrison.ProxmoxSharp package from nuget.org (public;
+         Chrison.* prefix — the bare ProxmoxSharp ID is taken there by an unrelated
+         project). Assembly name/namespace are unchanged (ProxmoxSharp). Pinned to an
+         exact prerelease for deterministic restores; bump explicitly when adopting new
+         code. Carries the LXC lifecycle write path (PctWriter, #149). -->
+    <PackageReference Include="Chrison.ProxmoxSharp" Version="0.2.0-preview.5" />
     <!-- UniFi discover surface + the legacy write adapter (UnifiSharp.Legacy:
-         port-forwards/firewall/networks). Pinned exactly (like ProxmoxSharp) so a
-         GitHub-Packages index lag can't silently resolve an older preview without
-         the Legacy namespace. preview.27 = the session-auth legacy write client. -->
-    <PackageReference Include="UnifiSharp" Version="0.1.0-preview.27" />
+         port-forwards/firewall/networks). From nuget.org (Chrison.* prefix); assembly/
+         namespace unchanged (UnifiSharp). Pinned exactly (like Chrison.ProxmoxSharp).
+         Carries the session-auth legacy write client. -->
+    <PackageReference Include="Chrison.UnifiSharp" Version="0.1.0-preview.2" />
     <!-- YAML parsing for homelab/v1 shapes (BL-010 converge). -->
     <PackageReference Include="YamlDotNet" Version="16.*" />
     <!-- JSON Schema (draft-2020-12) validation of homelab/v1 shapes against
diff --git a/build/README.md b/build/README.md
index 99b8852..0b4edf1 100644
--- a/build/README.md
+++ b/build/README.md
@@ -38,8 +38,8 @@ wiring is the `deploy/deploy.sh` "sugar" the `Deploy` target shells out to.
 
 Requires the .NET 10 SDK (see `../global.json`) and `GITHUB_PACKAGES_PAT` in the
 environment — Fallout restores from the Fallout-build GitHub Packages edge feed
-(`../nuget.config`), and the engine restores ProxmoxSharp/UnifiSharp from the
-chrison-dev feed. A live `Deploy` also needs Proxmox API creds, `CF_API_TOKEN`,
+(`../nuget.config`); the engine restores `Chrison.ProxmoxSharp`/`Chrison.UnifiSharp`
+from nuget.org (public, no auth). A live `Deploy` also needs Proxmox API creds, `CF_API_TOKEN`,
 and SSH to the target node (all per `secrets.env`).
 
 ## CI
diff --git a/nuget.config b/nuget.config
index af2d0ff..3072b61 100644
--- a/nuget.config
+++ b/nuget.config
@@ -3,39 +3,29 @@
   <packageSources>
     <clear />
     <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
-    <!-- ProxmoxSharp / SynoSharp / UnifiSharp (+ their .Api/.Cli) are published here. -->
-    <add key="github" value="https://nuget.pkg.github.com/Chrison-dev/index.json" />
     <!-- Fallout (build system, NUKE successor) ships its edge channel here —
          date-stamped 2026.x prereleases (the 11.0.x line was unlisted; NuGet.org
          no longer serves it). Consumed by the deploy pipeline under build/. -->
     <add key="fallout" value="https://nuget.pkg.github.com/Fallout-build/index.json" />
   </packageSources>
   <packageSourceCredentials>
-    <github>
-      <add key="Username" value="ChrisonSimtian" />
-      <!-- Token comes from the GITHUB_PACKAGES_PAT env var (fine-grained PAT with
-           read:packages). Never hard-coded; %VAR% is expanded by NuGet at restore. -->
-      <add key="ClearTextPassword" value="%GITHUB_PACKAGES_PAT%" />
-    </github>
-    <!-- Same PAT (read:packages also covers the Fallout-build org — verified). -->
+    <!-- Fallout-build GitHub Packages needs auth (read:packages). Token comes from
+         the GITHUB_PACKAGES_PAT env var; never hard-coded — %VAR% is expanded by
+         NuGet at restore. Our own *Sharp clients are now on nuget.org (public,
+         Chrison.* prefix), so the Chrison-dev GitHub-Packages feed is no longer used. -->
     <fallout>
       <add key="Username" value="ChrisonSimtian" />
       <add key="ClearTextPassword" value="%GITHUB_PACKAGES_PAT%" />
     </fallout>
   </packageSourceCredentials>
-  <!-- An unrelated 'ProxmoxSharp' exists on nuget.org. Route OUR packages
-       EXCLUSIVELY to the github feed so a name collision can never resolve. -->
   <packageSourceMapping>
-    <packageSource key="github">
-      <package pattern="ProxmoxSharp*" />
-      <package pattern="SynoSharp*" />
-      <package pattern="UnifiSharp*" />
-    </packageSource>
     <!-- Route all Fallout.* exclusively to the Fallout-build edge feed (a longer,
          more-specific pattern than the nuget.org '*' catch-all, so it wins). -->
     <packageSource key="fallout">
       <package pattern="Fallout.*" />
     </packageSource>
+    <!-- Everything else — Chrison.ProxmoxSharp / Chrison.UnifiSharp (+ transitive
+         .Api), YamlDotNet, JsonSchema.Net, … — resolves from nuget.org. -->
     <packageSource key="nuget.org">
       <package pattern="*" />
     </packageSource>
diff --git a/tools/PowerOrchestrator/src/PowerOrchestrator.Core/PowerOrchestrator.Core.csproj b/tools/PowerOrchestrator/src/PowerOrchestrator.Core/PowerOrchestrator.Core.csproj
index 1c1a407..65c3ee7 100644
--- a/tools/PowerOrchestrator/src/PowerOrchestrator.Core/PowerOrchestrator.Core.csproj
+++ b/tools/PowerOrchestrator/src/PowerOrchestrator.Core/PowerOrchestrator.Core.csproj
@@ -9,12 +9,13 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <!-- Dogfood our own clients. Pins mirror Infrastructure/engine: ProxmoxSharp is
-         pinned exact (the `0.2.0-preview.*` float is non-deterministic across NuGet
-         caches); preview.31 carries the LXC/VM lifecycle write path (PctWriter/QemuWriter)
-         we use to gracefully stop guests before a host poweroff. -->
-    <PackageReference Include="ProxmoxSharp" Version="0.2.0-preview.31" />
-    <PackageReference Include="UnifiSharp" Version="0.1.0-preview.*" />
+    <!-- Dogfood our own clients, now from nuget.org (Chrison.* prefix; assembly names
+         and namespaces unchanged). Pins mirror Infrastructure/engine: Chrison.ProxmoxSharp
+         pinned exact (the `-preview.*` float is non-deterministic across NuGet caches) —
+         carries the LXC/VM lifecycle write path (PctWriter/QemuWriter) we use to gracefully
+         stop guests before a host poweroff. -->
+    <PackageReference Include="Chrison.ProxmoxSharp" Version="0.2.0-preview.5" />
+    <PackageReference Include="Chrison.UnifiSharp" Version="0.1.0-preview.*" />
     <!-- ILogger only (Abstractions) — the concrete logger is wired by the host. -->
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="9.*" />
   </ItemGroup>