FlatFilers · obvious-autobuild-dev · Aug 24, 2026
diff --git a/.obvious/codebase-map.md b/.obvious/codebase-map.md
@@ -2,11 +2,14 @@
 
 | Directory | Purpose |
 |---|---|
-| `App_Start` | MVC startup configuration — bundling, filters, routes |
-| `Content` | Stylesheets — Bootstrap 3.4.1 and site-specific CSS |
-| `Controllers` | MVC controllers — HomeController (Index, About, Contact) |
-| `fonts` | Font files for Bootstrap theme |
-| `Properties` | Assembly metadata — AssemblyInfo.cs |
-| `Scripts` | Client-side JavaScript — jQuery, Bootstrap, Modernizr, jQuery Validate |
-| `Views` | Razor views — Home (Index, About, Contact), Shared (_Layout, Error) |
-| `.github/workflows` | CI pipeline — MSBuild + NuGet restore + Azure WebApp deploy |
+| `App_Start` | MVC startup configuration — bundling (`BundleConfig`), global filters (`FilterConfig`), routes (`RouteConfig`) |
+| `Controllers` | MVC controllers — `HomeController` (Index, About, Contact) |
+| `Views` | Razor views — `Home/` (Index, About, Contact), `Shared/` (_Layout, Error), `Web.config`, `_ViewStart.cshtml` |
+| `Content` | Stylesheets — Bootstrap 3.4.1 (+ maps, theme) and site CSS |
+| `Scripts` | Client-side JavaScript — jQuery 3.4.1, Bootstrap, Modernizr, jQuery Validate (+ unobtrusive) |
+| `fonts` | Bootstrap glyphicon font files |
+| `Properties` | Assembly metadata (`AssemblyInfo.cs`) and publish profiles |
+| `.github/workflows` | CI — `build.yml`: NuGet restore + MSBuild on `windows-latest`, folder publish, Azure WebApp deploy |
+| `.obvious` | Autobuild guidance — this contract (`obvious.md`, `config.yml`, `skills/local-dev/SKILL.md`) |
+
+Root files: `SimpleFrameworkApp.sln` / `SimpleFrameworkApp.csproj` (single net48 web project), `packages.config` (14 NuGet packages), `Web.config` (+ Debug/Release transforms), `Global.asax`, `README.md`.
diff --git a/.obvious/obvious.md b/.obvious/obvious.md
@@ -12,16 +12,33 @@ See `.obvious/codebase-map.md`.
 
 ## Repo Guidance for Autobuild
 
-This is a .NET Framework 4.8 ASP.NET MVC 5 web application. Key facts for agents:
+FlatFilers/SimpleFrameworkApp — sample ASP.NET MVC 5 web application demonstrating GitHub Actions CI for .NET Framework apps (from timheuer's blog post; fork of timheuer/SimpleFrameworkApp).
 
-- **Runtime:** .NET Framework 4.8 (Windows only, requires MSBuild from Visual Studio 2019+)
-- **Package manager:** NuGet (packages.config style, not PackageReference)
+- **Runtime:** .NET Framework 4.8 (`net48`), ASP.NET MVC 5.2.7, Razor 3 views
+- **Package manager:** NuGet, `packages.config` style (not PackageReference) — 14 packages
 - **Solution:** `SimpleFrameworkApp.sln` — single project `SimpleFrameworkApp.csproj`
-- **Restore:** `nuget restore SimpleFrameworkApp.sln`
-- **Build:** `msbuild SimpleFrameworkApp.sln /p:Configuration=Release`
-- **CI:** GitHub Actions (`.github/workflows/build.yml`) — runs on `windows-latest` with `microsoft/setup-msbuild` and `NuGet/setup-nuget`
-- **No test project** — no unit tests in this repo
-- **No AGENTS.md, CLAUDE.md, or CONTRIBUTING.md** found
+- **Front end:** Bootstrap 3.4.1, jQuery 3.4.1, Modernizr, jQuery Validate — served via MVC bundles (unminified while `debug="true"`)
+- **External services:** none — no database, no cache, no required env vars or secrets
+- **CI:** `.github/workflows/build.yml` — `windows-latest` with `microsoft/setup-msbuild` + `NuGet/setup-nuget`: restore → `msbuild /p:Configuration=Release` → folder publish → Azure WebApp deploy (needs `AZURE_WEBAPP_PUBLISH_PROFILE` secret)
+- **No test project**, no linter — the C# compile is the only static check
+
+### Commands
+
+Canonical (Windows / CI — from README and build.yml):
+
+| Task | Command |
+|---|---|
+| Restore | `nuget restore SimpleFrameworkApp.sln` |
+| Build | `msbuild SimpleFrameworkApp.sln /p:Configuration=Release` |
+| Run | Visual Studio / IIS Express (F5) — `https://localhost:44389/` per csproj |
+
+Sandbox-verified (Linux / Mono — full detail in `.obvious/skills/local-dev/SKILL.md`):
+
+| Task | Command |
+|---|---|
+| Restore + build | `bash ~/tools/build-sfa.sh` |
+| Run dev server | `xsp4 --port 8080 --nonstop` (from repo root) |
+| Health check | `curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080/` → `200` |
 
 ### Known Security Vulnerabilities (from NuGet restore audit)
 
@@ -31,30 +48,22 @@ This is a .NET Framework 4.8 ASP.NET MVC 5 web application. Key facts for agents
 | jQuery.Validation | 1.17.0 | High | GHSA-jxwx-85vp-gvwm |
 | Newtonsoft.Json | 12.0.2 | High | GHSA-5crp-9r3c-p9vr |
 
-## Local Verification
+## Local Verification Summary
 
-> **Warning:** Running full-repo typecheck, lint, or tests may OOM or timeout in the sandbox for large repos.
-> Use the scoped commands below when verifying changes.
+Verified on the repo sandbox (Mono 6.12 + xsp4, snapshot `q1o1drfyu78vckibf184:default`, 2026-08-24):
 
-### Verified Commands
-
-- **Restore:** `nuget restore SimpleFrameworkApp.sln` — verified working on sandbox
-- **Build:** NOT VERIFIED — MSBuild for .NET Framework 4.8 not available on sandbox (only MSBuild v4.0)
-- **Test:** NOT VERIFIED — no test project in repo
-
-### Scoped Workflow
-
-1. **Restore packages:** `nuget restore SimpleFrameworkApp.sln`
-2. **Build:** `msbuild SimpleFrameworkApp.sln /p:Configuration=Release` — requires Visual Studio 2019+ MSBuild, not available in sandbox
-3. **Test:** N/A — no test project
+- **Restore:** `mono ~/tools/nuget.exe restore SimpleFrameworkApp.sln` — exit 0, 14 packages into `packages/`. Prints a non-fatal `MSBUILD: error MSBUILD0004` warning (NuGet probing the deprecated xbuild shim); safe to ignore.
+- **Build:** `mcs` compiles all 6 C# files → `bin/SimpleFrameworkApp.dll` and stages 12 dependency DLLs + Roslyn compilers into `bin/`. Wrapped by `~/tools/build-sfa.sh`. (MSBuild for net48 does not exist on Linux.)
+- **Run:** `xsp4 --port 8080 --nonstop` serves the app from the repo root.
+- **Primary flows:** `GET /` → 200 (home), `GET /Home/About` → 200 (`<h2>About.</h2>`), `GET /Home/Contact` → 200 (`<h2>Contact.</h2>`); static assets (`/Content/bootstrap.css`, `/Scripts/jquery-3.4.1.js`) → 200; unknown action → 404.
+- **Browser check:** Chromium 151 + playwright-core (`node ~/tools/shots/shot.js`) — all three pages render, navbar clicks navigate Home → About → Contact, browser console clean (zero errors). Screenshots: `~/evidence/{home,about,contact,contact-after-nav}.png`.
+- **Tests / lint:** none exist in this repo — nothing to run.
 
 ## Sandbox Snapshot
 
-- **Snapshot ID:** N/A
-- **Captured:** N/A
-- **Dev stack healthy:** No — MSBuild for .NET Framework 4.8 not available on sandbox
-
-> **Note:** Snapshot skipped — dev stack not healthy. NuGet restore succeeded, but build and run require MSBuild from Visual Studio 2019+ which is not installed on the sandbox.
+- **Snapshot ID:** `q1o1drfyu78vckibf184:default`
+- **Captured:** 2026-08-24T17:18:30Z
+- **Dev stack healthy:** Yes — Mono 6.12 + xsp4 4.8 + NuGet CLI 7.9 + Chromium 151 installed; app builds, runs, and serves every primary flow on port 8080.
 
 ## Bibliography
 

diff --git a/.obvious/skills/local-dev/SKILL.md b/.obvious/skills/local-dev/SKILL.md
@@ -0,0 +1,53 @@
+---
+name: local-dev
+description: Build and run SimpleFrameworkApp (ASP.NET MVC 5 / .NET Framework 4.8) locally in the repo sandbox using Mono + xsp4
+---
+
+# Local Dev — SimpleFrameworkApp
+
+Durable record of the verified local dev environment (onboarded 2026-08-24, sandbox snapshot `q1o1drfyu78vckibf184:default`).
+
+## Environment (baked into the sandbox snapshot)
+
+- Debian 13 (trixie), Mono 6.12.0.199 (`mono`, `mcs`, `gacutil` via apt `mono-complete`)
+- xsp4 4.8 built from source (github.com/mono/xsp @ 3330ff0), installed to `/usr/local/bin/xsp4`, assemblies registered in the mono GAC
+- NuGet CLI 7.9.0 at `~/tools/nuget.exe`
+- Build script `~/tools/build-sfa.sh`
+- Chromium 151 + playwright-core at `~/tools/shots/` for browser verification
+
+## One-time setup (only when rebuilding the sandbox from scratch)
+
+1. `sudo apt-get install -y mono-complete libtool-bin autoconf automake libtool gettext pkg-config unzip chromium`
+2. Build xsp: `git clone --depth 1 https://github.com/mono/xsp /tmp/xsp && cd /tmp/xsp && ./autogen.sh --prefix=/usr/local && make -j4 && sudo make install`
+3. Register xsp in the mono GAC (without this xsp4 dies with `Could not load the file 'xsp4'`):
+   `sudo gacutil -i /usr/local/lib/mono/4.5/xsp4.exe && sudo gacutil -i /usr/local/lib/mono/4.5/Mono.WebServer2.dll`
+4. `mkdir -p ~/tools && curl -sSL -o ~/tools/nuget.exe https://dist.nuget.org/win-x86-commandline/latest/nuget.exe`
+
+## Daily workflow
+
+```bash
+bash ~/tools/build-sfa.sh                  # NuGet restore + mcs compile + stage bin/
+pgrep -x xsp4 | xargs -r kill              # stop any running server
+(nohup xsp4 --port 8080 --nonstop > /tmp/xsp4.log 2>&1 &)   # serve http://localhost:8080
+curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080/    # expect 200
+```
+
+What `~/tools/build-sfa.sh` does:
+
+1. `mono ~/tools/nuget.exe restore SimpleFrameworkApp.sln` → `packages/` (14 packages)
+2. `mcs -target:library` compiles `App_Start/*.cs`, `Controllers/HomeController.cs`, `Global.asax.cs`, `Properties/AssemblyInfo.cs` against the NuGet DLLs → `bin/SimpleFrameworkApp.dll`
+3. Copies the 12 runtime DLLs into `bin/` plus the Roslyn compilers into `bin/roslyn/` — the `system.codedom` DotNetCompilerPlatform provider in `Web.config` uses them at runtime to compile Razor views
+
+## Verification
+
+- Routes: `GET /`, `/Home/About`, `/Home/Contact` → 200 with expected `<h2>` content; static assets → 200; unknown action → 404
+- Browser: `cd ~/tools/shots && node shot.js` — loads all three pages, clicks navbar links (Home → About → Contact), asserts a clean console, writes screenshots to `~/evidence/`
+- No unit tests or linters exist in this repo; the `mcs` compile is the typecheck
+
+## Gotchas
+
+- `nuget restore` prints `MSBUILD: error MSBUILD0004: Too many project files specified` — non-fatal (NuGet probing the deprecated xbuild shim); restore exits 0 and installs all 14 packages
+- MSBuild for net48 does not exist on Linux — do not run `msbuild SimpleFrameworkApp.sln` here; the msbuild build only runs in CI (`windows-latest`)
+- `bin/` and `packages/` are gitignored — rebuild with `~/tools/build-sfa.sh` after cleaning or branch switches
+- `Web.config` keeps `debug="true"`, so MVC bundles render as unminified individual files (no WebGrease minification at runtime)
+- xsp4 must be started from the repo root (the app root is the working directory)