Deep Inspect
This is a repo-local maintainer skill (CI/certification harness), not a
shipped end-user capability; it is not embedded in the dotnet-inspect binary.
Use this skill when a change needs expensive evidence outside normal PR CI.
Deep Inspect is opt-in for risky PRs. Its test, platform-test,
and decompiler-corpus jobs run daily to certify a commit for release. Publish
consumes that certification evidence rather than rerunning the slow suites.
The authored-corpus ratchet runs on a separate daily schedule as a regression
gate rather than release-certification or publish evidence. The comprehensive
Inspect Web lane is also daily regression evidence rather than release
certification. Every lane can be dispatched on demand during the day.
Lanes
| Lane |
Use for |
Runs |
test |
Daily/on-demand release certification or blocking proof before risky merges |
Full decompiler tests, full analysis tests, vendored ILAssembler restore, full IL round-trip sweep. |
platform-test |
Daily/on-demand release certification across Windows, macOS, and Ubuntu |
Reduced cross-platform suite: CLI, CSharpText, artifact, fast decompiler, NuGetFetch offline, metadata, services, query, and Research tests, plus ilasm/ildasm/mdv setup. |
census |
Observational broad signal and triage |
Real-world corpus sensor, validity predicate scan, uncapped validity sweep, assertion scan, analysis corpus sensor, paydirt recall. |
package-sweep |
Weekly/on-demand discovery over current top NuGet packages |
Product-backed package acquisition plus bounded per-library fully-raised, validity, defect-class, and promotion-candidate reporting. |
authored-corpus |
Daily/on-demand regression ratchet against checksum-verified authored source |
Restores the pinned authored-source corpus and fails on quality regression or measurement-integrity loss. |
inspect-web |
Daily/on-demand comprehensive Browser/Wasm regression evidence |
Runs generated-facade version invariance, mutation controls, and Mono/CoreCLR multi-facade and managed-operation canaries. |
nightly |
Opt-in next-SDK/compiler validation |
Builds with the .NET daily SDK and checks opt-in compiler lowering drift; intentionally excluded from all. |
all |
Release-candidate deep read |
The test, platform-test, decompiler-corpus, census, authored-corpus, and inspect-web lanes. |
Run manually:
gh workflow run deep-inspect.yml -f lane=test
gh workflow run deep-inspect.yml -f lane=platform-test
gh workflow run deep-inspect.yml -f lane=census
gh workflow run deep-inspect.yml -f lane=package-sweep
gh workflow run deep-inspect.yml -f lane=authored-corpus
gh workflow run deep-inspect.yml -f lane=inspect-web
gh workflow run deep-inspect.yml -f lane=nightly
gh workflow run deep-inspect.yml -f lane=all
Inspect recent runs and artifacts:
gh run list --workflow deep-inspect.yml --limit 10
gh run view <run-id> --log-failed
gh run download <run-id> -D /tmp/deep-inspect-<run-id>
Local equivalents
For the test lane:
dotnet build dotnet-inspect.slnx -c Release
dotnet run --project src/dotnet-inspect.Tests -c Release
source eng/activate-iltools.sh
dotnet run --project tests/ILInspector.Decompiler.Tests -c Release -- --gate no-corpus
dotnet run --project tests/ILInspector.Analysis.Tests -c Release
bash eng/restore-ilassembler.sh
dotnet run --project tests/DotnetInspector.ILRoundtrip.Tests -c Release
dotnet run --project tests/ILInspector.Decompiler.Tests -c Release -- --gate corpus
The corpus command runs as a separate workflow job and can take hours. Omit it
only when intentionally reproducing the non-corpus test job rather than the
complete dispatched test lane.
A successful daily or manually dispatched certification requires the test,
platform-test, and decompiler-corpus jobs at one exact main SHA. Publish
requires that certification run ID. Publishing a later descendant remains an
explicit operator decision. Its exact main-push ci-required result must
succeed, but main-push CI does not run the PR-only substantive test jobs, and
the certification does not claim to cover intervening changes.
The platform-test lane is workflow-owned and runs the reduced
cross-platform suite on Windows, macOS, and Ubuntu. When reproducing a
platform-only break locally, mirror the exact project list and tool activation
from .github/workflows/deep-inspect.yml for the affected platform.
For the census lane, prefer the workflow so artifacts are retained. If running
locally, use the same scripts/baselines as deep-inspect.yml and preserve the
generated snapshots/cards under /tmp or artifacts/ for review.
The package sweep runs every Monday at 09:00 UTC and can also be dispatched
manually. It is owned by @richlander, is discovery-only, and never gates a
pull request. Each run resolves the latest stable versions for ranks 1-10,
records exact package/version/TFM provenance, and samples at most 250 methods
and 25 semantic-validity candidates per selected library. Promote a package to
an existing pinned corpus only after a reported defect or unsupported shape is
accepted for ongoing coverage.
Reading results
- Treat
test, platform-test, and decompiler-corpus failures as blockers:
reproduce locally, identify the first failing proof, and fix it before
certification can authorize publish.
- Treat
census output as triage signal unless a command exits nonzero by
design. Compare snapshots against committed baselines and route meaningful
drift to issues or follow-up PRs.
- Treat
inspect-web failures as Browser/Wasm regression blockers. Ordinary
PRs run the fast boundary modes; changes to the facade generators, canaries,
or managed bridge owners run the complete modes before merge.
- Do not add broad/corpus-style tests to PR CI. Mark them
[Trait("Speed", "Slow")] and keep them in Deep Inspect / full local runs.
1---2name: deep-inspect3description: Use when a dotnet-inspect change needs expensive evidence outside normal PR CI, or when preparing release certification; coordinate Deep Inspect lanes (full slow tests, cross-platform certification, IL round-trip sweep, corpus sensors, package discovery, validity scans, and analysis census).4---56# Deep Inspect78This is a repo-local maintainer skill (CI/certification harness), not a9shipped end-user capability; it is not embedded in the dotnet-inspect binary.1011Use this skill when a change needs expensive evidence outside normal PR CI.12Deep Inspect is opt-in for risky PRs. Its `test`, `platform-test`,13and decompiler-corpus jobs run daily to certify a commit for release. Publish14consumes that certification evidence rather than rerunning the slow suites.15The `authored-corpus` ratchet runs on a separate daily schedule as a regression16gate rather than release-certification or publish evidence. The comprehensive17Inspect Web lane is also daily regression evidence rather than release18certification. Every lane can be dispatched on demand during the day.1920## Lanes2122| Lane | Use for | Runs |23| ---- | ------- | ---- |24| `test` | Daily/on-demand release certification or blocking proof before risky merges | Full decompiler tests, full analysis tests, vendored ILAssembler restore, full IL round-trip sweep. |25| `platform-test` | Daily/on-demand release certification across Windows, macOS, and Ubuntu | Reduced cross-platform suite: CLI, CSharpText, artifact, fast decompiler, NuGetFetch offline, metadata, services, query, and Research tests, plus `ilasm`/`ildasm`/`mdv` setup. |26| `census` | Observational broad signal and triage | Real-world corpus sensor, validity predicate scan, uncapped validity sweep, assertion scan, analysis corpus sensor, paydirt recall. |27| `package-sweep` | Weekly/on-demand discovery over current top NuGet packages | Product-backed package acquisition plus bounded per-library fully-raised, validity, defect-class, and promotion-candidate reporting. |28| `authored-corpus` | Daily/on-demand regression ratchet against checksum-verified authored source | Restores the pinned authored-source corpus and fails on quality regression or measurement-integrity loss. |29| `inspect-web` | Daily/on-demand comprehensive Browser/Wasm regression evidence | Runs generated-facade version invariance, mutation controls, and Mono/CoreCLR multi-facade and managed-operation canaries. |30| `nightly` | Opt-in next-SDK/compiler validation | Builds with the .NET daily SDK and checks opt-in compiler lowering drift; intentionally excluded from `all`. |31| `all` | Release-candidate deep read | The `test`, `platform-test`, decompiler-corpus, `census`, `authored-corpus`, and `inspect-web` lanes. |3233Run manually:3435```bash36gh workflow run deep-inspect.yml -f lane=test37gh workflow run deep-inspect.yml -f lane=platform-test38gh workflow run deep-inspect.yml -f lane=census39gh workflow run deep-inspect.yml -f lane=package-sweep40gh workflow run deep-inspect.yml -f lane=authored-corpus41gh workflow run deep-inspect.yml -f lane=inspect-web42gh workflow run deep-inspect.yml -f lane=nightly43gh workflow run deep-inspect.yml -f lane=all44```4546Inspect recent runs and artifacts:4748```bash49gh run list --workflow deep-inspect.yml --limit 1050gh run view <run-id> --log-failed51gh run download <run-id> -D /tmp/deep-inspect-<run-id>52```5354## Local equivalents5556For the test lane:5758```bash59dotnet build dotnet-inspect.slnx -c Release60dotnet run --project src/dotnet-inspect.Tests -c Release61source eng/activate-iltools.sh62dotnet run --project tests/ILInspector.Decompiler.Tests -c Release -- --gate no-corpus63dotnet run --project tests/ILInspector.Analysis.Tests -c Release64bash eng/restore-ilassembler.sh65dotnet run --project tests/DotnetInspector.ILRoundtrip.Tests -c Release66dotnet run --project tests/ILInspector.Decompiler.Tests -c Release -- --gate corpus67```6869The corpus command runs as a separate workflow job and can take hours. Omit it70only when intentionally reproducing the non-corpus `test` job rather than the71complete dispatched `test` lane.7273A successful daily or manually dispatched certification requires the `test`,74`platform-test`, and decompiler-corpus jobs at one exact `main` SHA. Publish75requires that certification run ID. Publishing a later descendant remains an76explicit operator decision. Its exact main-push `ci-required` result must77succeed, but main-push CI does not run the PR-only substantive test jobs, and78the certification does not claim to cover intervening changes.7980The `platform-test` lane is workflow-owned and runs the reduced81cross-platform suite on Windows, macOS, and Ubuntu. When reproducing a82platform-only break locally, mirror the exact project list and tool activation83from `.github/workflows/deep-inspect.yml` for the affected platform.8485For the census lane, prefer the workflow so artifacts are retained. If running86locally, use the same scripts/baselines as `deep-inspect.yml` and preserve the87generated snapshots/cards under `/tmp` or `artifacts/` for review.8889The package sweep runs every Monday at 09:00 UTC and can also be dispatched90manually. It is owned by `@richlander`, is discovery-only, and never gates a91pull request. Each run resolves the latest stable versions for ranks 1-10,92records exact package/version/TFM provenance, and samples at most 250 methods93and 25 semantic-validity candidates per selected library. Promote a package to94an existing pinned corpus only after a reported defect or unsupported shape is95accepted for ongoing coverage.9697## Reading results9899- Treat `test`, `platform-test`, and decompiler-corpus failures as blockers:100 reproduce locally, identify the first failing proof, and fix it before101 certification can authorize publish.102- Treat `census` output as triage signal unless a command exits nonzero by103 design. Compare snapshots against committed baselines and route meaningful104 drift to issues or follow-up PRs.105- Treat `inspect-web` failures as Browser/Wasm regression blockers. Ordinary106 PRs run the fast boundary modes; changes to the facade generators, canaries,107 or managed bridge owners run the complete modes before merge.108- Do not add broad/corpus-style tests to PR CI. Mark them109 `[Trait("Speed", "Slow")]` and keep them in Deep Inspect / full local runs.
richlander