dotnet-inspect: Deep Inspect

Use this skill when a change needs expensive evidence outside normal PR CI.
Deep Inspect is opt-in for risky PRs. Its test and decompiler-corpus jobs also
run daily to certify a commit for release, and can be dispatched on demand
during the day. Publish consumes that evidence rather than rerunning the slow
suites.

Lanes

Lane	Use for	Runs
test	Daily/on-demand release certification or blocking proof before risky merges	Full decompiler tests, full analysis tests, vendored ILAssembler restore, full IL round-trip sweep.
census	Observational broad signal and triage	Real-world corpus sensor, validity predicate scan, uncapped validity sweep, assertion scan, analysis corpus sensor, paydirt recall.
package-sweep	Weekly/on-demand discovery over current top NuGet packages	Product-backed package acquisition plus bounded per-library fully-raised, validity, defect-class, and promotion-candidate reporting.
authored-corpus	Regression ratchet against checksum-verified authored source	Restores the pinned authored-source corpus and fails on quality regression or measurement-integrity loss.
nightly	Opt-in next-SDK/compiler validation	Builds with the .NET daily SDK and checks opt-in compiler lowering drift; intentionally excluded from all.
all	Release-candidate deep read	The test, decompiler-corpus, census, and authored-corpus lanes.

Run manually:

gh workflow run deep-inspect.yml -f lane=test
gh workflow run deep-inspect.yml -f lane=census
gh workflow run deep-inspect.yml -f lane=package-sweep
gh workflow run deep-inspect.yml -f lane=authored-corpus
gh workflow run deep-inspect.yml -f lane=nightly
gh workflow run deep-inspect.yml -f lane=all

Inspect recent runs and artifacts:

gh run list --workflow deep-inspect.yml --limit 10
gh run view <run-id> --log-failed
gh run download <run-id> -D /tmp/deep-inspect-<run-id>

Local equivalents

For the test lane:

dotnet build dotnet-inspect.slnx -c Release
dotnet run --project src/dotnet-inspect.Tests -c Release
source eng/activate-iltools.sh
dotnet run --project src/ILInspector.Decompiler.Tests -c Release -- --gate no-corpus
dotnet run --project src/ILInspector.Analysis.Tests -c Release
bash eng/restore-ilassembler.sh
dotnet run --project tests/DotnetInspector.ILRoundtrip.Tests -c Release
dotnet run --project src/ILInspector.Decompiler.Tests -c Release -- --gate corpus

The corpus command runs as a separate workflow job and can take hours. Omit it
only when intentionally reproducing the non-corpus test job rather than the
complete dispatched test lane.

A successful daily or manually dispatched test run certifies its exact
main SHA for 36 hours. Publish requires the certification run ID. Publishing
a later descendant remains an explicit operator decision. Its exact main-push
ci-required result must succeed, but main-push CI does not run the PR-only
substantive test jobs, and the certification does not claim to cover
intervening changes.

For the census lane, prefer the workflow so artifacts are retained. If running
locally, use the same scripts/baselines as deep-inspect.yml and preserve the
generated snapshots/cards under /tmp or artifacts/ for review.

The package sweep runs every Monday at 09:00 UTC and can also be dispatched
manually. It is owned by @richlander, is discovery-only, and never gates a
pull request. Each run resolves the latest stable versions for ranks 1-10,
records exact package/version/TFM provenance, and samples at most 250 methods
and 25 semantic-validity candidates per selected library. Promote a package to
an existing pinned corpus only after a reported defect or unsupported shape is
accepted for ongoing coverage.

Reading results

• Treat test failures as blockers: reproduce locally, identify the first
  failing proof, and fix it before certification can authorize publish.
• Treat census output as triage signal unless a command exits nonzero by
  design. Compare snapshots against committed baselines and route meaningful
  drift to issues or follow-up PRs.
• Do not add broad/corpus-style tests to PR CI. Mark them
  [Trait("Speed", "Slow")] and keep them in Deep Inspect / full local runs.