Qualify complete analyzer coverage independently in Linux CI

Reuse the frozen native Aspire collector,54-source inventory and unchanged80/70/90 thresholds. Require the original complete passing TRX and retain its source/counters/hash receipt alongside raw coverage and source manifest. Governance, YAML/actionlint workflow validation, native Prepare and the real original388-test receipt check passed; full actionlint retains its unrelated existing SC2129 style warning. Actual new-source Linux coverage and complete runtime gates remain open.

Author: KSemenenko

.github/workflows/ci.yml

@@ -41,8 +41,53 @@ jobs:
         run: |
           dotnet build src/KeyLoad.AppHost --no-restore --configuration Release
           dotnet build tests/KeyLoad.Analyzers.Tests --no-restore --configuration Release
+      - name: Prepare source-bound analyzer coverage
+        shell: pwsh
+        run: |
+          $root = $env:GITHUB_WORKSPACE
+          $evidence = Join-Path $root 'artifacts/code-quality/analyzer-coverage'
+          New-Item -ItemType Directory -Path $evidence -Force | Out-Null
+          Copy-Item scripts/Features/CodeQuality/site-analyzer-coverage.settings.xml (Join-Path $evidence 'coverage.config.xml')
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/site-analyzer-coverage.ps1 `
+            -Mode Prepare -Repository $root `
+            -Contract (Join-Path $root 'scripts/Features/CodeQuality/site-analyzer-coverage.contract.json') `
+            -EvidenceRoot $evidence
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       - name: Run analyzer tests
-        run: dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=analyzers --KeyLoadTests:ReportTrx=true
+        id: analyzers
+        run: |
+          dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=analyzers --KeyLoadTests:ResultsDirectory=TestResults/analyzers --KeyLoadTests:ReportTrx=true "--KeyLoadTests:CoverageSettings=$GITHUB_WORKSPACE/artifacts/code-quality/analyzer-coverage/coverage.config.xml" "--KeyLoadTests:CoverageOutput=$GITHUB_WORKSPACE/artifacts/code-quality/analyzer-coverage/coverage.cobertura.xml"
+      - name: Verify every analyzer test passed
+        if: ${{ !cancelled() && steps.analyzers.outcome != 'skipped' }}
+        shell: pwsh
+        run: |
+          $root = $env:GITHUB_WORKSPACE
+          $files = @(Get-ChildItem -LiteralPath (Join-Path $root 'TestResults/analyzers') -Filter '*.trx' -File)
+          if ($files.Count -ne 1) { throw 'Expected exactly one analyzer TRX receipt' }
+          [xml]$document = Get-Content -LiteralPath $files[0].FullName -Raw
+          $counts = $document.TestRun.ResultSummary.Counters
+          if ([int]$counts.total -le 0 -or [int]$counts.executed -ne [int]$counts.total -or
+              [int]$counts.passed -ne [int]$counts.total) {
+            throw 'Incomplete or failing analyzer qualification; skipped tests cannot pass'
+          }
+          [ordered]@{
+            sourceRevision = $env:GITHUB_SHA
+            total = [int]$counts.total
+            executed = [int]$counts.executed
+            passed = [int]$counts.passed
+            sha256 = (Get-FileHash -LiteralPath $files[0].FullName -Algorithm SHA256).Hash.ToLowerInvariant()
+          } | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $root 'artifacts/code-quality/analyzer-coverage/test-receipt.json') -Encoding utf8NoBOM
+      - name: Verify source-bound analyzer coverage
+        if: ${{ !cancelled() && steps.analyzers.outcome != 'skipped' }}
+        shell: pwsh
+        run: |
+          $root = $env:GITHUB_WORKSPACE
+          $evidence = Join-Path $root 'artifacts/code-quality/analyzer-coverage'
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/site-analyzer-coverage.ps1 `
+            -Mode Verify -Repository $root `
+            -Contract (Join-Path $root 'scripts/Features/CodeQuality/site-analyzer-coverage.contract.json') `
+            -EvidenceRoot $evidence -CoverageReport (Join-Path $evidence 'coverage.cobertura.xml')
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       - name: Save analyzer test results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()

docs/ADR/ADR-113-centralized-runtime-options.md

@@ -595,3 +595,31 @@ dependency replacement is introduced. The focused native118/118 runtime run,
 full Release build are retained as local development evidence. Full native
 unit/scalar/recovery/RF3, source-bound functional coverage and delivered Linux
 acceptance remain mandatory and open.
+
+### Independent delivered-source analyzer coverage join
+
+TASK-CQ-GENERAL-CI-001 maps REQ-CQ-006/012/013 and AC-CQ-009/033..038 to the
+existing Linux `analyzer-rules` job in `.github/workflows/ci.yml`. Prepare the
+unchanged 54-source analyzer inventory and exact settings copy after the native
+Release build, run the complete analyzer suite through the existing Aspire
+entry with the native Cobertura collector, then verify the original report
+against its prepared source hashes. Preserve the existing 80 percent module
+line, 70 percent module branch and 90 percent critical pipeline thresholds.
+
+The ordered implementation is this contract, the workflow preparation/collection/
+verification join, static governance review, exact-source Linux execution and
+original artifact review. Root owns workflow/docs/status integration; a read-only
+reviewer checks native caller arguments, source identity and failure paths.
+Collection failure remains a failed test step; verification also runs after that
+failure and writes its original failure evidence. Always retain reports, settings,
+manifest, raw coverage and derived gate evidence in the existing analyzer artifact.
+Require exactly one original analyzer TRX with a positive total, all tests
+executed and all tests passed; retain its counters, source SHA and original file
+hash in a derived receipt. Skipped tests cannot qualify this full-suite gate.
+
+This executes the same gate independently of benchmark producer selection while
+retaining the existing website coverage gate. No dependency, product contract,
+storage migration, threshold, source inventory or required runtime suite changes.
+Rollback restores this workflow join together with its documentation. Only a
+completed successful original collector report and source-bound verification
+qualify coverage; unit/scalar/recovery/RF3 acceptance remains separately required.

docs/Features/CodeQuality.md

@@ -1353,3 +1353,21 @@ RF3, recovery and every existing no-decrease/80/70/90 gate remain mandatory.
 ## Controlled time ownership, 2026-10-06
 
 [ResourceExecution TimeProvider](ResourceExecution/TimeProvider.md) and [ADR-115](../ADR/ADR-115-time-provider.md) extend KLD0022 to native Stopwatch timing and Environment.TickCount/TickCount64, with exact-span real-compiler positive/negative/generated fixtures. Explicit provider/default composition boundaries remain allowed. Native provider timers and real clock-controlled engine/replica workflows are required; source migration alone is not qualification.
+
+### Independent Linux analyzer coverage
+
+TASK-CQ-GENERAL-CI-001 under [ADR-113](../ADR/ADR-113-centralized-runtime-options.md)
+maps REQ-CQ-006/012/013 and AC-CQ-009/033..038 to the existing Linux analyzer job.
+After its Release build, prepare the frozen source/settings manifest, collect the
+complete native Aspire analyzer suite and verify the original Cobertura integers
+against the captured source SHA. Retain all 54 sources, 45 executable files,
+9 declarations and unchanged 80/70/90 module/critical thresholds. Missing, stale,
+empty, malformed or insufficient native evidence fails; diagnostic suite failures
+remain failures even if coverage thresholds pass. Verification runs after a failed
+collection to preserve failure evidence, and the existing artifact upload retains
+original reports, settings, manifest, raw coverage and gate report. This additional
+CI join executes independently of benchmark producer selection and preserves the
+website gate and every unit/scalar/recovery/RF3 qualification requirement.
+Require exactly one original analyzer TRX, a positive total, executed equal to
+total and passed equal to total. Preserve those counters, source SHA and original
+TRX hash in the retained receipt; missing, skipped or failed tests fail the job.

docs/implementation/status.json

@@ -4909,7 +4909,7 @@
     "feature": "docs/Features/CodeQuality.md",
     "decision": "docs/ADR/ADR-113-centralized-runtime-options.md",
     "sourceStage": "runtime_options_literals_locks_phase_health_semantics_native_test_admission_and_manifest_input_fix_complete_runtime_gates_in_progress",
-    "canonicalBuildPassed": false,
+    "canonicalBuildPassed": true,
     "runtimeQualified": false,
     "fullTaskComplete": false,
     "remaining": [
@@ -5359,8 +5359,45 @@
         "compiledReceipt": "keyload-general-options-compiled-inventory-audit-v38.log:19projects_3190inputs_mismatches_empty",
         "nativeRegression": "unit_v34_AcScale016CancellationStopsAndJoinsTheOwnedNativeProbe_passed_5296.189ms_in_original_4133test_report",
         "qualification": "prior successful local full-build snapshot and genuine child cancellation case; complete suite originally failed72other_tests; unrelated subsequent CLI_telemetry_coverage_source_changes_require_fresh_build_and_reports"
+      },
+      "deliveredLinuxA130": {
+        "headSha": "a1309f6b6115790d012977aff3eb7db26ab22146",
+        "run": "https://github.com/managedcode/KeyLoad/actions/runs/37449460526",
+        "canonicalBuild": "passed_in_main_verify_and_RF3_jobs",
+        "repositoryRules": "passed",
+        "analyzerJob": "passed_original_report_review_pending",
+        "rf3Prerequisite": "failed_native_Release_DLL_PDB_source_binding_KeyLoad_Abstractions_missingSourceCount120_before_topology_and_tests",
+        "rf3Job": "https://github.com/managedcode/KeyLoad/actions/runs/37449460526/job/112222193881",
+        "mainVerify": "format_step_in_progress_at_observation",
+        "qualification": "immutable Linux source; successful builds are not complete runtime or source-bound coverage qualification"
+      },
+      "independentAnalyzerCoverageCiJoin": {
+        "task": "TASK-CQ-GENERAL-CI-001",
+        "scope": ".github/workflows/ci.yml:analyzer-rules",
+        "nativeCaller": "existing_full_Aspire_analyzers_with_original_TRX_and_Cobertura",
+        "inventory": {
+          "sources": 54,
+          "executable": 45,
+          "declarationOnly": 9,
+          "configuration": 8
+        },
+        "thresholds": {
+          "moduleLinePercent": 80,
+          "moduleBranchPercent": 70,
+          "criticalPipelineLinePercent": 90
+        },
+        "staticChecks": {
+          "governance": "passed",
+          "yamlParse": "passed",
+          "actionlintWorkflowValidation": "passed",
+          "fullActionlint": "one_preexisting_SC2129_shellcheck_style_finding_in_unchanged_RF3_environment_export_block_confirmed_same_on_HEAD"
+        },
+        "nativePrepare": "passed_original_54source_8configuration_manifest_with_frozen_settings_hash",
+        "originalTrxReceiptCheck": "passed_against_retained_original_Linux702_receipt_total388_executed388_passed388_SHA256b464ebaedff25a6e59c2bb3db74864afa01ecee858a450422339811b67261800",
+        "review": "read_only_reviewer_verified_native_settings_source_SHA_binding_failure_paths_original_upload_and_no_skip_receipt_join",
+        "qualification": "new_workflow_requires_actual_exact_source_Linux_collection_and_80_70_90_verification_no_coverage_pass_claim"
       }
     },
-    "verificationStage": "Linux702_repository_rules_and388analyzers_pass_build_blocked_by_seven_native_cancellation_helper_diagnostics_reviewed_exact_byte_repairs_joined_remaining_full_runtime_coverage_gates_open"
+    "verificationStage": "Linuxa130_full_Release_builds_pass_RF3_stopped_at_native_PDB_source_binding_independent_complete_analyzer_CI_coverage_join_reviewed_and_static_checked_remaining_exact_source_full_runtime_and_numeric_coverage_gates_open"
   }
 }