Acquire API coordinate matches through PackageHouse

[richlander]

dotnet-inspect builds robust, capable inspection features that provide foundational capabilities or compelling experiences and are conventionally sound, delightfully new or unique, or both.

Closes #9941.

Design basis

docs/design/package-house.md owns exact package source authority, payload acquisition, target realization, and producer correspondence.

Standalone API coordinate matching now declares one exact compile realization per distinct endpoint, consumes the House-issued compile-selection receipt, and leaves cache, ranged-entry, and complete-fallback policy with the host. Destination realization remains constrained to the typed producer identity selected for the source.

Changes

• replace the host-neutral raw-payload provider boundary with a typed PackageHouse execution boundary;
• request exact compile-surface realization for each endpoint;
• preserve same-endpoint reuse, target-default behavior, source selection, forwarders, correspondence, cancellation, and envelope output;
• reject settlements produced for a different request instance;
• compose the CLI host with ranged House acquisition and operation-local authority-scoped stores that do not retain a redundant second copy of ranged entries; and
• retain the existing unconstrained source-authorization path for other House callers.

Evidence

• .NET SDK 11.0.100-rc.1.26425.128
• full Release solution build: 0 warnings, 0 errors
• ApiCoordinateMatchInspectionTests: 13/13 passed
• focused production CLI/source-policy tests: 4/4 passed
• real NuGet.org Avalonia forwarder smoke passed
• npx markdownlint-cli docs/design/package-house.md
• git diff --check

The deterministic loopback NuGet V3 receipt preserved byte-identical CLI output for:

Avalonia.Data.MultiBinding
Avalonia@11.3.14..12.1.2
net8.0
Avalonia.Markup -> Avalonia.Base

The previous path downloaded two complete archives totaling 23,113,820 bytes. The final House path uses 11 206 reads totaling 4,333,573 bytes: 18,780,247 fewer transferred bytes, an 81.251% reduction, for the same semantic result.

NativeAOT performance

Exact base d93cb58f8b5c44ecc831158db64cee502a7e63e6 and exact head 8920eea9c7b55226be36aa6da9bf2334abe567ef were published with SDK 11.0.100-rc.1.26425.128 for linux-x64 and measured on approved host dotnet-inspect-perf through perf-guard.

The deterministic loopback feed served the same Avalonia scenario above. After one unmeasured prime per binary, ten measured invocations per revision used unique isolated product state and alternating base/head order.

Revision	Median elapsed	Mean elapsed	Range	Median CPU	Median max RSS
Base	0.55 s	0.548 s	0.54-0.56 s	0.56 s	286,938 KiB
Head	0.57 s	0.567 s	0.56-0.58 s	0.58 s	275,284 KiB
Delta	+3.6%	+3.5%		+3.6%	-4.1%

The first candidate eagerly ranged both reference and separate implementation populations and retained a duplicate operation-local entry-cache copy. It measured +30.8% median elapsed and +21.8% median max RSS. Coordinate correspondence consumes API declarations, assembly identities, references, and type forwarders from the selected compile surface; it does not inspect implementation bodies. The repaired candidate requests Surface, and packages without a separate reference surface already use lib/ as their surface. Removing redundant entry persistence and the unconsumed implementation population recovers near-neutral latency, lowers peak RSS, and increases the byte reduction from 62.059% to 81.251%.

Two complete ApiCoordinateMatchCommandTests verbosity/envelope cases and seven ConfiguredPayloadAcquisitionTests local-feed assertions fail identically on the exact base; focused gates covering this change pass.

Scope

This does not migrate Browser coordinate controls, portable Workspace coordinate replacement, exact-Library selection, or the deprecated PackageAssemblyQuery adapter tracked for retirement by #6797 after #6795.

[richlander]

Round 1 is complete for PR #9945.

• Theme: migrate durable host-neutral package APIs to PackageHouse-owned acquisition while preserving their product semantics.
• Review model GPT-6 Sol was used for adversarial review.
• Design basis: normative owner docs/design/package-house.md#package-source-operation-lease — standalone API coordinate matching declares exact compile realization, consumes House receipts, and preserves destination producer affinity; supporting ApiCoordinateMatchQuery owns correspondence semantics and the CLI composition owns desktop source/store/transport policy.
• Review feedback is: clean.
• Round start: 2026-10-11T00:40:04Z.
• Round end: 2026-10-11T00:44:22Z.
• Round duration: 00:04.

Progress: 1 pushed candidate, 1 usable review, 0 accepted findings.
Reviews: 1/1 clean — GPT-6 Sol reported CLEAN for exact head b441a10079c08b3ce053e0be8fed3d2bd6ad8fd2.
Waiting: exact base/head NativeAOT timing evidence must be published in this PR and the visible agent session before merge readiness.
Recommendation: continue — collect and publish that evidence without changing the locked candidate.

Resolution: no code changes; the review found no qualifying correctness, security, reliability, or contract defects. The existing transfer-volume receipt remains explanatory evidence, not a runtime-performance claim.

— Authored with GitHub Copilot CLI

[richlander]

Exact base/head NativeAOT evidence is now available from approved host dotnet-inspect-perf, with every measured invocation run through perf-guard.

Revision	Median elapsed	Mean elapsed	Range	Median CPU	Median max RSS
Base d93cb58f8	0.52 s	0.523 s	0.52-0.54 s	0.53 s	293,784 KiB
Head b441a1007	0.68 s	0.681 s	0.67-0.70 s	0.69 s	357,728 KiB
Delta	+30.8%	+30.2%		+30.2%	+21.8%

Protocol: SDK 11.0.100-rc.1.26425.128, linux-x64 NativeAOT, deterministic loopback feed, one unmeasured prime per binary, ten measured invocations per revision with unique isolated product state, alternating base/head order.

The candidate is not performance-neutral for this cold product-cache scenario. It transfers 62.059% fewer package bytes but materially increases latency and peak RSS. Per the performance gate, this stops merge readiness pending operator direction; I am not seeking a second host merely to reconfirm the miss.

— Authored with GitHub Copilot CLI

[richlander]

Round 2 is complete for PR #9945.

• Theme: migrate durable host-neutral package APIs to PackageHouse-owned acquisition while preserving product semantics and avoiding unconsumed work.
• Review model GPT-6 Sol was used for adversarial review.
• Design basis: normative owner docs/design/package-house.md#package-source-operation-lease — standalone API coordinate matching declares exact compile-surface realization, consumes House receipts, preserves destination producer affinity, and leaves source/store/transport lifetime with the host; supporting ApiCoordinateMatchQuery owns correspondence semantics and CLI composition owns desktop policy.
• Review feedback is: clean.
• Round start: 2026-10-12T22:04:04Z.
• Round end: 2026-10-12T22:06:23Z.
• Round duration: 00:02.

Progress: 2 pushed candidates, 2 usable reviews, 0 accepted findings.
Reviews: 1/1 clean — GPT-6 Sol reported CLEAN for exact head 8920eea9c7b55226be36aa6da9bf2334abe567ef.
Waiting: explicit merge authorization for exact head 8920eea9c7b55226be36aa6da9bf2334abe567ef against base main.
Recommendation: merge after live exact-head/base preflight and explicit authorization.

Resolution: round 1 remained clean; its NativeAOT obligation is resolved. Candidate 2 removes redundant ranged-entry persistence and narrows demand to the compile surface actually consumed by coordinate correspondence. Exact NativeAOT evidence is +3.6% median elapsed, -4.1% median max RSS, and -81.251% transferred bytes versus base, with all semantic gates and current-head CI green.

— Authored with GitHub Copilot CLI