Deep Inspect

When to use this skill

Use Deep Inspect when an AI agent needs a reusable SKILL.md workflow for this job: Use when a dotnet-inspect change needs expensive evidence outside normal PR CI, or when preparing release certification; coordinate Deep Inspect lanes (full slow tests, cross-platform certification, IL round-trip sweep, corpus sensors, package discovery, validity scans, and analysis census).

When not to use it

Skip Deep Inspect when the task is outside the analysis category, or when a more specific skill in this directory already covers the same workflow with clearer triggers.

How to install

1. Personal install: create ~/.claude/skills/deep-inspect/SKILL.md (and any bundled scripts) so Claude Code, Claude Desktop, and compatible agents can load it in every project.
2. Project install: commit the same folder at .claude/skills/deep-inspect/ so teammates get the skill with the repo.
3. Restart the agent session after copying files so it re-scans the skills directory, then ask for the task in words that match the skill description.

Full install guide for Claude, Cursor, and Codex

What this skill does

# Deep Inspect

This is a repo-local maintainer skill (CI/certification harness), not a shipped end-user capability; it is not embedded in the dotnet-inspect binary.

Use this skill when a change needs expensive evidence outside normal PR CI. Deep Inspect is opt-in for risky PRs. Its `test`, `platform-test`, and decompiler-corpus jobs run daily to certify a commit for release. Publish consumes that certification evidence rather than rerunning the slow suites. The `authored-corpus` ratchet runs on a separate daily schedule as a regression gate rather than release-certification or publish evidence. The comprehensive Inspect Web lane is also daily regression evidence rather than release certification. Every lane can be dispatched on demand during the day.

## Lanes

| Lane | Use for | Runs | | ---- | ------- | ---- | | `test` | Daily/on-demand release certification or blocking proof before risky merges | Full decompiler tests, full analysis tests, vendored ILAssembler restore, full IL round-trip sweep. | | `platform-test` | Daily/on-demand release certification across Windows, macOS, and Ubuntu | Reduced cross-platform suite: CLI, CSharpText, artifact, fast decompiler, NuGetFetch offline, metadata, services, query, and Research tests, plus `ilasm`/`ildasm`/`mdv` setup. | | `census` | Observational broad signal and triage | Real-world corpus sensor, validity predicate scan, uncapped validity sweep, assertion scan, analysis corpus sensor, paydirt recall. | | `package-sweep` | Weekly/on-demand discovery over current top NuGet packages | Product-backed package acquisition plus bounded per-library fully-raised, validity, defect-class, and promotion-candidate reporting. | | `authored-corpus` | Daily/on-demand regression ratchet against checksum-verified authored source | Restores the pinned authored-source corpus and fails on quality regression or measurement-integrity loss. | | `inspect-web` | Daily/on-demand comprehensive Browser/Wasm regression evidence | Runs generated-facade version invariance, mutation controls, and Mono/CoreCLR multi-facade and managed-operation canaries. | | `nightly` | Opt-in next-SDK/compiler validation | Builds with the .NET daily SDK and checks opt-in compiler lowering drift; intentionally excluded from `all`. | | `all` | Release-candidate deep read | The `test`, `platform-test`, decompiler-corpus, `census`, `authored-corpus`, and `inspect-web` lanes. |

Run manually:

```bash gh workflow run deep-inspect.yml -f lane=test gh workflow run deep-inspect.yml -f lane=platform-test gh workflow run deep-inspect.yml -f lane=census gh workflow run deep-inspect.yml -f lane=package-sweep gh workflow run deep-inspect.yml -f lane=authored-corpus gh workflow run deep-inspect.yml -f lane=inspect-web gh workflow run deep-inspect.yml -f lane=nightly gh workflow run deep-inspect.yml -f lane=all ```

Inspect recent runs and artifacts:

```bash gh run list --workflow deep-inspect.yml --limit 10 gh run view <run-id> --log-failed gh run download <run-id> -D /tmp/deep-inspect-<run-id> ```

## Local equivalents

For the test lane:

```bash dotnet build dotnet-inspect.slnx -c Release dotnet run --project tests/DotnetInspect.Cli.Tests -c Release source eng/activate-iltools.sh dotnet run --project tests/ILInspector.Decompiler.Tests -c Release -- --gate no-corpus dotnet run --project tests/ILInspector.Analysis.Tests -c Release bash eng/restore-ilassembler.sh dotnet run --project tests/DotnetInspector.ILRoundtrip.Tests -c Release dotnet run --project tests/ILInspector.Decompiler.Tests -c Release -- --gate corpus ```

The corpus command runs as a separate workflow job and can take hours. Omit it only when intentionally reproducing the non-corpus `test` job rather than the complete dispatched `test` lane.

A successful daily or manually dispatched certification requires the `test`, `platform-test`, and decompiler-corpus jobs at one exact `main` SHA. Publish requires that certification run ID. Publishing a later descendant remains an explicit operator decision. Its exact main-push `ci-required` result must succeed, but main-push CI does not run the PR-only substantive test jobs, and the certification does not claim to cover intervening changes.

The `platform-test` lane is workflow-owned and runs the reduced cross-platform suite on Windows, macOS, and Ubuntu. When reproducing a platform-only break locally, mirror the exact project list and tool activation from `.github/workflows/deep-inspect.yml` for the affected platform.

For the census lane, prefer the workflow so artifacts are retained. If running locally, use the same scripts/baselines as `deep-inspect.yml` and preserve the generated snapshots/cards under `/tmp` or `artifacts/` for review.

The package sweep runs every Monday at 09:00 UTC and can also be dispatched manually. It is owned by `@richlander`, is discovery-only, and never gates a pull request. Each run resolves the latest stable versions for ranks 1-10, records exact package/version/TFM provenance, and samples at most 250 methods and 25 semantic-validity candidates per selected library. Promote a package to an existing pinned corpus only after a reported defect or unsupported shape is accepted for ongoing coverage.

## Reading results

- Treat `test`, `platform-test`, and decompiler-corpus failures as blockers: reproduce locally, identify the first failing proof, and fix it before certification can authorize publish. - Treat `census` output as triage signal unless a command exits nonzero by design. Compare snapshots against committed baselines and route meaningful drift to issues or follow-up PRs. - Treat `inspect-web` failures as Browser/Wasm regression blockers. Ordinary PRs run the fast boundary modes; changes to the facade generators, canaries, or managed bridge owners run the complete modes before merge. - Do not add broad/corpus-style tests to PR CI. Mark them `[Trait("Speed", "Slow")]` and keep them in Deep Inspect / full local runs.

Intended uses

• Use Deep Inspect when this documented workflow matches the task.