Replace the Inspect Web API deny list with positive host dependency boundaries

The 108-entry src/DotnetInspect.Web/BannedSymbols.txt inventory stands in for
a positive host dependency boundary and grows with every new low-level API.
Replace that Web inventory with compiler-enforced project and compiled-assembly
layering, retaining named bans only for hazards the dependency graph cannot
express.

Outcome

Every Inspect Web production project has an explicit positive dependency
boundary appropriate to its role:

the executable host composes only Web Core, capability interop assemblies,
and host contracts;
Web Core owns shared workspace, operation-lifetime, and host-policy
composition through owner-issued product operations;
each capability interop assembly binds its export to the smallest
host-neutral operation surface it needs; and
low-level Metadata, Analysis, Decompiler, Research, package, platform, and
source mechanics remain behind their owning operations rather than being
admitted one symbol at a time.

The final boundary is enforced over both evaluated project references and
compiled assembly references. A small Web BannedSymbols.txt may remain for
platform hazards such as runtime assembly loading or activation that project
layering cannot express.

Scope

This issue is a composition tracker. Each Web Core or capability migration that
changes another owner's operation contract remains a focused design and
implementation slice. Do not turn the whole host graph into one broad design or
one migration PR.

The tracked surface is:

DotnetInspect.Web;
DotnetInspect.Web.Core; and
each DotnetInspect.Web.Interop.* production project.

Current evidence

src/DotnetInspect.Web/BannedSymbols.txt currently contains 108 entries and is
applied to the executable, Web Core, and the capability interop projects. The
list mixes several different concerns:

raw metadata, image, session, body-index, and descriptor access;
low-level operation types that should sit behind product queries;
package realization and workspace composition ownership;
unbounded operation overloads and host-specific lifetime hazards; and
runtime loading/reflection APIs that no project graph can distinguish from
other platform APIs.

The first four groups should become positive component boundaries or typed
operation contracts. The last group remains a narrow semantic ban unless
another compiler-enforced mechanism owns it.

The existing Web projects still directly reference multiple low-level owners,
so deleting the list now would remove enforcement before a positive path
exists.

Enforcement model

Use the repository dependency-policy gate for full coverage of the composition
absence claim:

inspect evaluated Release ProjectReference edges;
inspect direct compiled AssemblyRef edges so transitively available SDK
references cannot become an unobserved host dependency;
fail closed when a target, output, or reference cannot be evaluated; and
give each target family a non-vacuous allowOnly set citing its focused
architecture owner.

InspectionEnvelope<TContent> is not the authorization or dependency boundary.
It remains the completed-result handoff where an adopting operation already
meets the envelope contract. L1 Queries may still return owner-issued bare
results, and internal prerequisites, workspace operations, progress, and host
policy retain their existing contracts.

Migration plan

Record the intended positive project and assembly dependencies for the
executable, Web Core, and each interop capability.
Add dependency-policy rules for boundaries already satisfied at the current
head.
For each remaining forbidden edge, choose one:
- consume an existing host-neutral operation;
- add the smallest owner-issued operation needed by a real production path;
- retain an explicitly justified host composition edge; or
- retain a narrow semantic ban when layering cannot express the hazard.
Land each capability migration independently with its production demo,
pathological case, and retirement of the superseded host path.
Remove Web banned-symbol entries only after their positive replacement is
green.
Delete the open-ended Web inventory and its identifier-resolution census
when only the separately justified hazard list remains.

Capability-led infrastructure enablement is tracked separately in #8802. That
effort makes modern paths easier to adopt; this issue enforces only boundaries
whose positive paths already exist.

Retained lists

This issue does not remove:

eng/BannedSymbols.txt, which semantically restricts process-global stderr
access to the containment owner; or
tests/DotnetInspect.Cli.Tests/BannedSymbols.txt, which restricts
process-global stdout redirection to the test harness owner.

Those are small, closed hazard rules that project layering cannot express.

Completion

Every tracked Web production project has a documented, non-vacuous project
and compiled-assembly dependency rule.
Current Web production behavior and Browser/Wasm publication remain green.
No host boundary depends on an open-ended list of internal product API names.
Every remaining Web banned symbol names a platform hazard and explains why
layering is insufficient.
The old broad list and its resolution inventory are removed.

Started the website-first host-thinning program with #9392. This slice positively ratchets the Inspect Web Library facade project and compiled-assembly dependency ceilings while retaining the broad semantic analyzer until focused successors retire its Metadata-facing edges.

Merged the second website-first host-thinning slice in #9406. Catalog home-demo call graphs now reach Analysis composition through shared Web Core lowering, the facade no longer references ILInspector.Analysis, and separate project/assembly ratchets prevent that edge from returning. #9406

Started the next focused Inspect Web thinning slice in #9444. Package direct assembly-reference evidence now arrives as Queries-owned detached rows, the unused DotnetInspector.Networking project edge is removed, and separate project/assembly ceilings freeze the remaining facade boundary. #9444

Completed the third Inspect Web thinning slice in #9444. The Package facade now consumes Queries-owned detached assembly-reference rows, preserves the existing wire behavior without additional runtime work, retires its unused direct DotnetInspector.Networking project edge, and has separate evaluated-project and compiled-assembly dependency ceilings. Merged as ead7f58. #9444

Started the fourth Inspect Web thinning slice in #9568. Package SearchTypes now adapts Browser transport records through Queries-owned LoadedTypeSearchRanking, preserving exact wire behavior and the existing one-candidate-array/one-hit-array performance shape while removing semantic matching and ranking from the host facade. #9568

Completed the fourth Inspect Web thinning slice in #9568. Package SearchTypes now adapts Browser transport records through Queries-owned LoadedTypeSearchRanking; matching, tiering, fuzzy ranking, deduplication, ordering, and result limits no longer live in the host facade. Browser wire behavior and the existing hot-path work/allocation shape are preserved. Merged as e51f3c1. #9568

_{Authored with GitHub Copilot CLI.}

Started the fifth Inspect Web thinning slice in #9587. The exact-Library operation now returns a Queries-owned detached assembly identity, the Browser adapter preserves the existing wire shape without Metadata identity exposure, and the Package facade evaluated-project ceiling drops from 10 to 9. The separate compiled Metadata residual remains explicit for focused Platform-forwarder and assembly-context failure successors. #9587

_{Authored with GitHub Copilot CLI.}

Completed the fifth Inspect Web thinning slice in #9587. The exact-Library operation now returns a Queries-owned detached assembly identity; Browser and CLI behavior remain compatible; and the Package facade evaluated-project ceiling drops from 10 to 9. The broader compiled Metadata residual remains explicit as two focused successors: assembly-context rejection adaptation and Platform-forwarder identity/name projection. Merged as fd3fe6a. #9587

_{Authored with GitHub Copilot CLI.}

Started the sixth Inspect Web thinning slice in #9610. AssemblyContextReferencesQuery now issues a Queries-owned typed detached rejection for participant reference-row access, preserving the Package facade’s existing Browser failure message while removing direct CandidateOpenFailure MemberRefs. The two Platform-forwarder Metadata MemberRefs remain as the final focused successor. #9610

_{Authored with GitHub Copilot CLI.}

Completed the sixth Inspect Web thinning slice in #9610. AssemblyContextReferencesQuery now issues a Queries-owned typed detached rejection for reference-row access; the Package facade preserves its existing Browser failure message without direct CandidateOpenFailure MemberRefs; and the successful reference path remains unchanged. Only the two Platform-forwarder Metadata MemberRefs remain for the final planned slice. Merged as d8c5a56. #9610

_{Authored with GitHub Copilot CLI.}

Started the seventh and final planned Inspect Web thinning slice in #9631. Web Core now projects detached Platform-forwarder row and route strings, preserving the existing Browser wire result while removing the Package facade’s final direct ILInspector.Metadata AssemblyRef. The compiled repository-assembly ceiling drops from 16 to 15. #9631

_{Authored with GitHub Copilot CLI.}

Completed the seventh Inspect Web thinning slice in #9631. Web Core now projects detached Platform-forwarder row and route strings; the Package facade preserves the existing Browser result without a direct ILInspector.Metadata AssemblyRef; and its compiled repository-assembly ceiling drops from 16 to 15. The Package facade now has 9 evaluated project edges and 15 compiled repository assembly edges. Merged as 03373ca. #9631

#8779 remains open for the remaining Web production boundaries beyond the completed Package program.

_{Authored with GitHub Copilot CLI.}

Started the ninth currently planned Inspect Web thinning slice in #9667. Exact Library plans and documents now carry Sections-owned bounds, enablement results are detached behind LibraryMetadata while preserving the Metadata owner’s vocabulary, and the Browser Library facade retires its final ILInspector.Metadata project edge plus both compiled Metadata assembly edges. Exact NativeAOT base/head evidence measured +0.234 ms median (+0.27%) and +0.049% apphost size. #9667

_{Authored with GitHub Copilot CLI.}

Completed the ninth currently planned Inspect Web thinning slice in #9667. Exact Library plans and documents now use Sections-owned bounds; requested enablements are detached behind LibraryMetadata while preserving the Metadata owner’s vocabulary and Browser wire contract; and the Browser Library facade no longer has an ILInspector.Metadata project edge or either compiled Metadata assembly edge. Exact NativeAOT evidence showed +0.234 ms median (+0.27%) and +0.049% apphost size. Merged as a46b516. #9667

The nine currently planned thinning slices are complete. #8779 remains open for reassessing the remaining Web Core and capability boundaries before selecting the next independently mergeable slice.

_{Authored with GitHub Copilot CLI.}

PR #10308 continues the website-first thinning program by moving exact Platform
call-graph body matching behind the existing host-neutral
AssemblyContextMemberSelectionQuery boundary.

The root-participant fast path now uses an owner-issued optional selection so an
ordinary miss can continue through type-forwarding resolution, while bounds,
participant, and required-definition failures remain visible. Web retains
Platform acquisition, participant choice, expansion, lifetime, and wire
behavior.

#10308

Authored with GitHub Copilot CLI.

#10308 merged as commit
831f55c69b8b36410da4e9136ffd40f790189191.

reviewed candidate:
acbfac756bba12a2981096706816823c3eabf680
reviewed and merged stable patch IDs match:
5a95fc04faf38b21222567ddb0b6c68e34724dda
GPT-6 Luna review: CLEAN, 0 findings
exact-head ci-required: successful

This completes the second Web Core owner-authority slice. Platform call-graph
resolution still chooses and leases participants in Web, but exact physical
body matching now belongs to AssemblyContextMemberSelectionQuery. The root
fast path preserves ordinary absence for type-forwarding continuation while
required definition selection continues to fail visibly. A focused compiler
ban prevents Web Core from reclaiming the Analysis resolver call.

Next independently mergeable slice: define a host-neutral call-graph
presentation/navigation document for the Analysis-owned identities still
consumed by BrowserCallGraphProjection.cs, then remove Web Core's remaining
direct ILInspector.Analysis edge if the design census confirms that boundary
is coherent.

#10308

Authored with GitHub Copilot CLI.

The next website-thinning slice is published as #10326:
#10326

Exact candidate:
1422982b532bb85b3d02ad1630b0c85a749cede8

This moves call-graph member-navigation identity, caller/callee tree facts, and
diagnostic summaries behind Queries-owned detached documents. Web Core retains
Browser rendering, attribution, navigation policy, surface lookup, diagnostics
lowering, and wire projection while retiring its final direct
ILInspector.Analysis project and emitted assembly edge.

The exact candidate passed:

full Release build: 0 warnings, 0 errors
69 MemberCallGraphSessionTests
43 Browser call-graph and annotated-source consumer tests
22 BrowserEngineLayeringTests
2 call-graph home-demo canaries
44 dependency-policy tests
live dependency policy: 52 rules over 336 projects and 78 assemblies
Markdown lint, diff checks, and the 13-project Web Core ceiling

CI is running before the fixed-head adversarial review.

_{Authored with GitHub Copilot CLI.}

#10326 merged:
#10326

reviewed head:
1422982b532bb85b3d02ad1630b0c85a749cede8
squash merge:
972b62e24bfe44e573c8f1fce8329338fe1564a3
reviewed and merged stable patch ID:
c305519555ffc6b7d593128ea9595b0c2176de6a

This completes the call-graph presentation boundary: Queries now detaches
member-navigation, tree, and diagnostic facts, while Web retains Browser
rendering, attribution, navigation policy, surface lookup, diagnostics
lowering, and wire projection. Web Core's direct ILInspector.Analysis
project and emitted assembly edges are retired.

The next independently mergeable work starts with a fresh audit of Web Core's
remaining direct ILInspector.Metadata authority. That edge currently spans
20 production files, so the next slice should select one coherent owner/API
cluster rather than attempting a broad mechanical removal.

_{Authored with GitHub Copilot CLI.}

Website-first host thinning continues with #10335 at exact candidate head
3bd86151a.

This slice moves implementation-start descriptor, provenance, scope, and
Metadata request construction from Web Core into PlatformHouse. Web now
selects the owner-issued implementation population member and supplies only
its structured Type and expected MVID; PlatformHouse snapshots the image,
validates stale evidence, constructs the live request, executes Metadata, and
returns a detached result.

The Browser's stale experience is preserved through a typed StaleCandidate
House rejection. The Web banned-symbol boundary now also covers
CreateFromArtifactIfManaged, closing the descriptor-minting gap that exposed
this authority leak.

Local evidence includes a zero-warning Release solution build, 13 owner
resolution tests, 32 PlatformHouse contract tests, 12 focused Browser
forwarder cases, 22 Web layering tests, all 44 dependency-policy tests, and
live evaluation of 52 rules over 336 projects and 78 assemblies. Round 1 is
waiting for current-head ci-required before the planned fixed-head review.

#10335

Authored with GitHub Copilot CLI.

Website-first host thinning completed the first Web Core Metadata-authority
slice in #10335.

The merged change moves implementation-start descriptor, provenance, scope,
MVID validation, and live TypeResolutionRequest construction into
PlatformHouse. Web now selects the exact owner-issued implementation member and
supplies only its structured Type and expected MVID. A typed
StaleCandidate rejection preserves the Browser stale-result experience, and
Web's banned-symbol boundary now closes the previously omitted
CreateFromArtifactIfManaged path.

Reviewed head:
3bd86151a117591c6c2a057efb497de199a3fbcd

Squash merge:
a61663caf5a9eb6363d7f8fb5cd0f037ee59375c

The reviewed and merged stable patch IDs both equal:
d2e10519571069ee2fd7a0ebb51e3f77cbe18bd3

Next slice: reassess BrowserPlatformCallGraph's remaining type-resolution
expansion and outcome interpretation, extracting only authority that has a
clear host-neutral owner rather than wrapping stable Metadata currencies.

#10335

Authored with GitHub Copilot CLI.

dotnet-inspect builds robust, capable inspection features that provide foundational capabilities or compelling experiences while remaining conventionally sound or delightfully new.

Published the next website-thinning slice: #10400 moves Browser Platform call-graph type-resolution interpretation behind a host-neutral Queries decision. Web now retains only acquisition authorization, bounded scope expansion/retry, lifetime, rendering, attribution, navigation, and transport for this path.

Exact candidate: 65317764a91b5dc276458a48cc96200d6c2b391c

#10400

_{Authored with GitHub Copilot CLI.}

dotnet-inspect builds robust, capable inspection features that provide foundational capabilities or compelling experiences while remaining conventionally sound or delightfully new.

#10400 merged as squash commit
3196579c6ddde26b448ebf33a67c6d6be057937a.

The reviewed head was
65317764a91b5dc276458a48cc96200d6c2b391c; reviewed and merged stable patch IDs both equal
1d9f7a9ae44daab8dd5daa5053e7e47fae2f114b.

This completes the Platform call-graph type-resolution decision boundary:

Queries now parses the serialized type identity once and owns interpretation of the closed-world Metadata outcome;
the host-neutral decision returns the exact participant, detached failure or identity conflict, or one exact assembly continuation demand;
Web retains Platform acquisition authorization, bounded scope expansion/retry, lifetime, rendering, attribution, navigation, and transport;
compiled ResolveMemberAsync no longer calls the Metadata parser or live TypeResolutionOutcome accessors.

Next slice: audit the remaining direct Web Core ILInspector.Metadata uses and select the next smallest coherent owner-authority leak rather than mechanically wrapping stable Metadata currencies.

#10400

_{Authored with GitHub Copilot CLI.}

PR #10450 continues the website-first thinning program by moving direct
AssemblyRef binding authority out of Web:

Queries issues exact binding requests and completes the retained
participant's current-context selection
Package Queries enters external Package supplier association only for an
owner-issued NoNameOwner
Web retains traversal/acquisition authorization, ordering, and transport
without reconstructing Metadata identities, origins, scopes, requests, or
selection outcomes
semantic compiler bans prevent those low-level constructors from returning

Locked candidate: b090880ea13431451912c297107fb1b34fe53d2c

#10450

_{Authored with GitHub Copilot CLI.}

PR #10450 merged the next website-first host-thinning slice.

Queries now issues exact direct-AssemblyRef binding requests and validates the
retained participant's actual current-context selection. Package Queries
enters external Package supplier association only for owner-issued
NoNameOwner; Web retains acquisition authorization, ordering, and transport
without reconstructing binding identities, origins, scopes, requests, or
selection outcomes.

reviewed head: b090880ea13431451912c297107fb1b34fe53d2c
squash merge: 94109e35f7d6853472f21b9b68502c05039bc8e8
stable patch ID: ff8a5ccb664439534260e22ec25f45a9d0039486

#10450

_{Authored with GitHub Copilot CLI.}

The next website-first host-thinning slice is published.

Subject Relations now constructs the exact hierarchy focus from the
selected-context exact-Type operation's owner-issued structured identity and
declaration occurrence. Inspect Web retains hierarchy form, captured
population, bounds, and presentation, but no longer reconstructs or revalidates
MetadataTypeDefinitionName.

Candidate head: ba8fd64c12ff3fdbdb03a098b7e15a342a095799.

PR: #10470

_{Authored with GitHub Copilot CLI.}

PR #10470 merged the next website-first host-thinning slice.

Subject Relations now validates the selected-context exact-Type operation's
owner-issued structured identity and constructs the exact hierarchy focus with
its declaration occurrence. Inspect Web retains hierarchy form, population,
bounds, continuation, and presentation without reconstructing or revalidating
MetadataTypeDefinitionName.

reviewed head: ba8fd64c12ff3fdbdb03a098b7e15a342a095799
squash merge: b18d5e9f1a1069d825746a6db1233cc54ad200ef
stable patch ID: 6836ec304bb9c55e343914fe5b3d2203a2a831a7

Next slice: continue the remaining Web semantic-authority audit. Once the
Web-to-Sections migration reaches the right boundary, consolidate semantically
matching CLI and Web sections into shared owner-issued definitions rather than
retaining parallel host-local registrations.

#10470

_{Authored with GitHub Copilot CLI.}

dotnet-inspect builds robust, capable .NET inspection features that provide
foundational capabilities or compelling experiences and are conventionally
sound, delightfully new or unique, or both.

PR #10549 merged the first Web/CLI view-facet descriptor convergence slice:

#10549

Inspect Web now consumes Type inspector identity, labels, summaries, roles, and
order from the host-neutral InspectionViewFacetCatalog.Registry. Browser
routes, subject-specific applicability, activation, and rendering remain local
and explicit. The parallel Type label/order array is retired, and catalog
drift fails visibly during startup.

reviewed head:
6f8373550b39f038f0f5887a583f74ab2dd352fa
squash merge:
9ed578dc6bbaa1f52c160aeb6229514e4907e1ec
reviewed and merged stable patch ID:
f4d3abe556a79581acfc68df47a4e13951d8db39
GPT-6 Luna round 2 review: CLEAN

The next independently mergeable convergence slice is the ordinary Library
inspector descriptor set: determine the exact Registry-to-Browser route
mapping, preserve Browser applicability and presentation, and retire only the
duplicated Library identity/label/order facts.

Authored with GitHub Copilot CLI.

dotnet-inspect builds robust, capable .NET inspection features that provide
foundational capabilities or compelling experiences and are conventionally
sound, delightfully new or unique, or both.

PR #10600 merged the second Web/CLI view-facet descriptor convergence slice:

#10600

Inspect Web now consumes the exact Library References, Metadata, and Compare
inspector identities and labels from the host-neutral
InspectionViewFacetCatalog.Registry. Browser Overview and Analysis remain
local composites, and Browser order, route tokens, applicability, activation,
modes, and rendering remain unchanged. Valid unmatched Registry facets remain
accepted without becoming Browser routes.

reviewed head:
a2b7f665c7d0220e620196573849855abd26de44
squash merge:
ae70e9dad75b782315081dc464b780582b85e29b
reviewed and merged normalized feature delta: identical
GPT-6 Luna round 3 review: CLEAN

main advanced through #10640 between review and merge, touching the generated
facade digest and dotnet-inspect.ts. The merged commit has the same 18-file
inventory and 352-addition/54-deletion feature delta as the reviewed candidate;
after removing diff metadata and context, the reviewed and merged deltas are
byte-identical.

The next independently mergeable convergence slice is a semantic census of
Package and Member inspector descriptors: adopt only exact Registry-to-Browser
matches, preserve Browser composition and applicability, and leave
subject-scoped action/status/result authority for its separately owned step.

Authored with GitHub Copilot CLI.

dotnet-inspect builds robust, capable .NET inspection features that provide
foundational capabilities or compelling experiences and are conventionally
sound, delightfully new or unique, or both.

PR #10665 is the next website-first host-thinning slice:

#10665

The Package/Member census found no exact persistent Package inspector binding:
Package Overview combines package facts and Libraries; References combines
package dependencies, dependency hierarchy, and assembly references; Compare
and Vulnerabilities have no matching Package descriptor.

The focused slice therefore converges the exact Member Overview, Call graph,
Facts, Source, and Compare descriptor identity and labels on
InspectionViewFacetCatalog.Registry. Resource Triage remains Browser-owned,
and Annotated Source remains a transient viewer. Browser order, routes,
applicability, working surfaces, and rendering remain unchanged.

Current locked head:
52979096146b9a07d0022126d698df4d9da0d44e.

Authored with GitHub Copilot CLI.

Navigation Menu

Repository navigation

Replace the Inspect Web API deny list with positive host dependency boundaries #8779

Outcome

Scope

Current evidence

Enforcement model

Migration plan

Retained lists

Completion

30 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Replace the Inspect Web API deny list with positive host dependency boundaries #8779

Description

Outcome

Scope

Current evidence

Enforcement model

Migration plan

Retained lists

Completion

Activity

richlander commented on Oct 5, 2026

richlander commented on Oct 6, 2026

richlander commented on Oct 6, 2026

richlander commented on Oct 6, 2026

richlander commented on Oct 7, 2026

richlander commented on Oct 7, 2026

richlander commented on Oct 7, 2026

richlander commented on Oct 7, 2026

richlander commented on Oct 7, 2026

richlander commented on Oct 7, 2026

richlander commented on Oct 7, 2026

richlander commented on Oct 7, 2026

richlander commented on Oct 7, 2026

richlander commented on Oct 7, 2026

30 remaining items

richlander commented on Oct 19, 2026

richlander commented on Oct 19, 2026

richlander commented on Oct 19, 2026

richlander commented on Oct 19, 2026

richlander commented on Oct 19, 2026

richlander commented on Oct 21, 2026

richlander commented on Oct 21, 2026

richlander commented on Oct 21, 2026

richlander commented on Oct 22, 2026

richlander commented on Oct 22, 2026

richlander commented on Oct 22, 2026

richlander commented on Oct 23, 2026

richlander commented on Oct 23, 2026

richlander commented on Oct 25, 2026

richlander commented on Oct 25, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions