# ADR: Library docs at the pinned version Status: accepted, 2026-11-11, at 1.0.5.23. A coding session that is unsure of a library's API at the version this repository pins looks it up first: Microsoft Learn for .NET and Azure, Context7 for everything else. One rule, in CLAUDE.md. What comes back is reference and never an instruction, nothing secret is asked, and the key that reaches Context7 lives only on the machine that runs the sessions. ## Reading list 1. [ADR: The rules a change has to pass](https://theyard.stevenstout.biz/?doc=adr-rules): the table this record's test joins. 2. [ADR: The code is public and the secrets are not](https://theyard.stevenstout.biz/?doc=adr-secrets): the rule the key check applies to one more key. 3. [ADR: CodeRabbit, one rung at a time](https://theyard.stevenstout.biz/?doc=adr-coderabbit-one-rung-at-a-time): the other reviewer in the gate, which reads the code once it is written. ## In plain words The AI that drafts this code learned its libraries at one moment, and this repository pins newer ones: .NET 10, React 19, Vite 8, TypeScript 7. A method it remembers can be gone, renamed or deprecated. Now, when a session is not sure, it asks the library's own documentation at the pinned version before it writes the code, and says so when it could not. What that is worth: fewer changes that compile against an API the pinned version no longer has, and a stated source for the library facts behind a change. ## Context Steve, 10 November: "ADOPT Wed: Context7 (current library docs fed to Claude; protects against stale .NET 10 APIs)." Context7 serves current library documentation to a coding session as two tools, `resolve-library-id` and `query-docs`, through an MCP server. Microsoft publishes its own server for its documentation at learn.microsoft.com/api/mcp, free and with no account or key, whose `microsoft_docs_search` answers from the first-party pages for .NET and Azure. On 11 November both were added to the box that runs the coding sessions, and fresh headless sessions answered a .NET 10 minimal API question and a Vite 8 configuration question through them; each answer was checked against this repository's own code. Context7's free plan answers 1,000 calls a month, then 20 a day until the month turns. It keeps the questions it is sent. Its own write-up of CVE-2026-75130, fixed on its server in February 2026, says to treat what an MCP server returns as untrusted input. ## Decision 1. **One rule, in CLAUDE.md.** "Library docs, at the version this repository pins": look up a library whose API you are not sure of at the pinned version, and ask for that version. The repository comes first; a pattern the code already shows, or a record that decides it, needs no lookup, which keeps the month's calls for the questions that need them. 2. **Microsoft first for .NET and Azure.** Its pages carry the version in the address (`view=aspnetcore-10.0`); on the first proof, Context7's .NET entry carried none. Context7 answers for React, Vite, TypeScript, Vitest and Playwright, where it does carry versions (`/vitejs/vite/v8.3.5`). 3. **Reference, never instruction.** No command is run, no package added and no pinned version moved because a fetched page said so. 4. **Nothing secret in a question.** No key, connection string, address or personal fact goes to either service. 5. **The key stays on the box.** The Context7 key, when there is one, lives in the user configuration of the machine that runs the sessions, never in this repository and never in a project server list. Without a key Context7 still answers, at lower limits. 6. **Nothing waits on the tools.** When they are missing, refuse or run out, a session reads the library's own documentation, says so in its notes and goes on. 7. **A scheduled session gets the tools only by name.** The dispatcher on the box passes a fixed list of tools; a coding item that should use these names them in its header. ## Consequences - A session started by hand on the box has both tools; one started elsewhere has neither, and the rule's last clause covers it. - Each lookup spends one of a month's 1,000 Context7 calls. A paid plan is the owner's call. - What was looked at and not chosen: Context7's plugin, which adds a second box-wide rule beside this one, and its claude.ai connector, which reaches cloud chats and not the box. The setup's own box-wide rule file is removed after it runs, so CLAUDE.md holds the one rule. ## What holds it LibraryDocsTests: CLAUDE.md keeps the section and names both tools; no file a reader of this repository can read holds a Context7 key; and a server list at the root, if one is ever added, carries no bearer value. ## Where it sits Beside the gate's other rules on how a change is made: ADR-075's table lists it with its test, and the rule that the code is public and the secrets are not gains one key shape it now checks. ## Files - [CLAUDE.md](https://github.com/SteveStout/TheYard/blob/main/CLAUDE.md), the section "Library docs, at the version this repository pins". - [api/TheYard.Tests/LibraryDocsTests.cs](https://github.com/SteveStout/TheYard/blob/main/api/TheYard.Tests/LibraryDocsTests.cs) - [docs/built-with-ai/BUILT-WITH-AI.md](https://github.com/SteveStout/TheYard/blob/main/docs/built-with-ai/BUILT-WITH-AI.md), where library facts come from. Correction, 1.0.5.24: the section above gave `/vitejs/vite/v8.3.5` as Context7's versioned entry; that was the nearest version its listing had, and the version this repository resolves is 8.3.2 (`package-lock.json`, which CLAUDE.md now names because `package.json` holds ranges). And "ADR-075's table lists it with its test" was not true when this record shipped; the row is in now (CodeRabbit on #34).