Retire broad bans from Web Library facade

[richlander]

dotnet-inspect builds robust, capable .NET inspection features that provide
foundational capabilities or compelling experiences and are conventionally
sound, delightfully new or unique, or both.

Summary

• replace the Web Library facade's broad 108-entry internal API deny list with
  the narrow runtime platform-hazard list
• retain product ownership through the facade's existing typed
  EmbeddedLibraryInspection, AssemblyContextLibraryInspection, and
  LibraryInspectionOperation paths plus its exact positive project and
  compiled-assembly dependency ceilings
• pin the Library facade to the platform-hazard list and exclude it from the
  set of capability projects expected to consume the broad inventory
• document that internal API names are not part of this facade's compiler
  boundary

Design basis

Normative owner:
docs/design/library-inspection-document.md#browser-request-lowering — the
Browser adapter selects one exact Library, lowers an owner-issued typed plan,
and consumes detached bounds and Enablements values without constructing or
projecting Metadata contracts.

Supporting contracts:

• docs/design/inspection-layers.md#current-migration-state records the
  detached Library values and absence of Metadata assembly dependencies
• docs/dependency-policy.md#repository-policy records the exact positive
  project and assembly ceilings
• docs/design/artifact-acquisition-and-workspaces.md#embedded-managed-library-inspection
  owns the uploaded-image operation used by the other Library export

This changes no runtime behavior, wire contract, dependency graph, or Library
inspection result. It retires an open-ended source-level inventory from a
facade whose typed operation paths and positive dependency ceilings already
own its product semantics.

Validation

• dotnet build dotnet-inspect.slnx -c Release --nologo
  • 0 warnings, 0 errors
• dotnet run --project tests/DotnetInspect.Web.Tests -c Release --no-build -- --filter-class '*BrowserEngineLayeringTests'
  • 17 passed
• DOTNET_HOST_PATH="$(command -v dotnet)" dotnet run --project eng/DependencyPolicy.Tests -c Release --no-build
  • 44 passed
• DOTNET_HOST_PATH="$(command -v dotnet)" dotnet run --project eng/DependencyPolicy -c Release --no-build
  • 50 rules passed over 331 evaluated projects and 76 inspected assemblies
• npx markdownlint-cli docs/dependency-policy.md docs/design/inspection-layers.md docs/design/library-inspection-document.md
• git diff --check

Part of #8779.

---

Authored with GitHub Copilot CLI.

[richlander]

Round 1 is complete for PR #9922.

• Theme: Thin the Website host by replacing broad internal API inventories
  with typed host-neutral operations and positive dependency boundaries.
• Review model GPT-6 Luna was used for adversarial review.
• Design basis: normative owner
  docs/design/library-inspection-document.md#browser-request-lowering — the
  Browser adapter selects one exact Library, lowers the owner-issued typed
  plan, and consumes detached bounds and Enablements values without
  constructing or projecting Metadata contracts; supporting
  docs/design/inspection-layers.md#current-migration-state records the
  detached Library boundary,
  docs/dependency-policy.md#repository-policy owns the positive project and
  assembly ceilings, and
  docs/design/artifact-acquisition-and-workspaces.md#embedded-managed-library-inspection
  owns the uploaded-image operation.
• Review feedback is: clean.
• Round start: 2026-10-10T22:31:17Z.
• Round end: 2026-10-10T22:33:04Z.
• Round duration: 00:02.

Progress: 1 candidate, 1 usable review, 0 accepted findings.
Reviews: 1/1 clean — GPT-6 Luna returned CLEAN for exact head
e8507ba819107b23e09244d421d456eedf088da4.
Waiting: explicit merge authorization for PR #9922 at exact head
e8507ba819107b23e09244d421d456eedf088da4 on base ref main.
Recommendation: merge.

Resolution: no review-driven change is required. Current-head ci-required
passed. The reviewed base was
b16fe0c05271ef4f4d75ffbb1929abf028409084; main later advanced to
180823dd056007abc4d1d641716ff55b88a5054e by changing only
docs/design/fast-diff.md, which has no interaction with this slice, so the
locked-head review remains valid.

---

Authored with GitHub Copilot CLI.

[richlander]

Round 1 review evidence is invalidated by significant base interaction.

main advanced from the reviewed base
b16fe0c05271ef4f4d75ffbb1929abf028409084 to
2768de62758c22946cc44c6fc4f8f808be79e89c. The integrated range changes
src/DotnetInspect.Web.Interop.Library/BrowserLibraryDocumentOperation.cs,
replacing package scope opening with the new host-neutral
PackageLibraryInspectionDemandPlanner path. That file is part of this PR's
exact Library-facade boundary claim, so this is significant interaction even
though the local merge probe is clean.

I am removing review-clean, merging the effective base into the published
branch, and forming a fully validated Round 2 candidate. No merge authorization
was active and auto-merge is not armed.

---

Authored with GitHub Copilot CLI.

[richlander]

Round 2 candidate pushed after significant base interaction.

• Candidate head: 3ba6743a905e362d6a64144952a4fc2b943b53b4
• Effective base: 2768de62758c22946cc44c6fc4f8f808be79e89c
• Merge commit parents:
  e8507ba819107b23e09244d421d456eedf088da4 and
  2768de62758c22946cc44c6fc4f8f808be79e89c
• Interaction resolution: the new
  PackageLibraryInspectionDemandPlanner path remains an owner-issued typed
  operation inside the existing allowed DotnetInspector.Packages assembly
  ceiling. The PR's platform-hazard wiring and positive-boundary claim remain
  unchanged.

Validation:

• Release solution build: 0 warnings, 0 errors
• BrowserEngineLayeringTests: 17 passed
• LibraryDocument_*: 6 passed
• DependencyPolicy.Tests: 44 passed
• live dependency policy: 50 rules, 331 evaluated projects, 76 inspected
  assemblies
• changed Markdown lint and git diff --check: passed

The candidate is locked pending current-head CI and Round 2 review.

---

Authored with GitHub Copilot CLI.

[richlander]

Round 2 is complete for PR #9922.

• Theme: Thin the Website host by replacing broad internal API inventories
  with typed host-neutral operations and positive dependency boundaries.
• Review model GPT-6 Luna was used for adversarial review.
• Design basis: normative owner
  docs/design/library-inspection-document.md#browser-request-lowering — the
  Browser adapter selects one exact Library, lowers the owner-issued typed
  plan, and consumes detached bounds and Enablements values without
  constructing or projecting Metadata contracts; supporting
  docs/design/inspection-layers.md#current-migration-state records the
  detached Library boundary,
  docs/dependency-policy.md#repository-policy owns the positive project and
  assembly ceilings,
  docs/design/artifact-acquisition-and-workspaces.md#embedded-managed-library-inspection
  owns uploaded-image inspection, and current-main's
  PackageLibraryInspectionDemandPlanner supplies a typed package-demand plan
  consumed by the existing workspace owner.
• Review feedback is: clean.
• Round start: 2026-10-10T23:36:59Z.
• Round end: 2026-10-10T23:39:51Z.
• Round duration: 00:03.

Progress: 2 candidates, 2 usable reviews, 0 accepted findings.
Reviews: 1/1 clean — GPT-6 Luna returned CLEAN for exact head
3ba6743a905e362d6a64144952a4fc2b943b53b4.
Waiting: explicit merge authorization for PR #9922 at exact head
3ba6743a905e362d6a64144952a4fc2b943b53b4 on base ref main.
Recommendation: merge.

Resolution: the carried base-interaction obligation is resolved. The integrated
PackageLibraryInspectionDemandPlanner wraps the selected assembly ID in a
typed selector, creates the Library demand plan, and passes it to
BrowserPackageWorkspace.OpenLibraryScopeAsync; package realization remains
with the workspace owner and the facade neither constructs nor projects
Metadata values. No review-driven change is required. Current-head
ci-required passed and the base has not moved since candidate formation.

---

Authored with GitHub Copilot CLI.

[richlander]

No-interaction base movement after Round 2:

• unchanged candidate head:
  3ba6743a905e362d6a64144952a4fc2b943b53b4
• previously analyzed base tip:
  2768de62758c22946cc44c6fc4f8f808be79e89c
• newly analyzed main tip:
  d93cb58f8b5c44ecc831158db64cee502a7e63e6

The intervening commit changes only Decompiler harness and test evidence:

• tests/ILInspector.Decompiler.Tests/ClosureDiagnosticEvidenceTests.cs
• tools/DecompilerHarness/ClosureDiagnosticEvidence.cs
• tools/DecompilerHarness/corpus/real-world-baseline.json

Those files do not affect the Library facade project, its analyzer input,
positive dependency rules, owning design, focused gates, or runtime path.
Round 2 review and review-clean therefore carry forward unchanged.

The first people-wait safety check found no human activity, so automated
observation is stopping. The PR remains ready and waits for explicit merge
authorization or a human merge.

---

Authored with GitHub Copilot CLI.