Unify the .NET symbol catalog and isolate development tooling

[Quim Muntal (qmuntal)]

Summary

• Replace the separate .NET inventory with one compact catalog containing all extracted API declarations and tests, including unreviewed/unpaired entries. Preserve extraction provenance and existing assessments and test pairs.
• Add explicit in-place catalog refresh to the extractor, including offline cached input. Keep normal stdout as raw extraction metadata; refresh preserves assessments and fails closed on ambiguous identities or invalid provenance. Refresh requires exclusive access to the catalog; concurrent updates or editor writes are unsupported. The final re-read is a best-effort safeguard, not an atomic compare-and-swap.
• Store method return types once in declaration keys. Remove verbose declaration objects, redundant mapped notes, review records, and Go-test bookkeeping. Simplify receiver-based method examples.
• Isolate the catalog, both CLIs, and their shared packages in an independent nested module. Its module boundary excludes development data and tooling from SDK module downloads; the underscore prefix alone is not relied upon for ZIP exclusion. There is no new SDK dependency on the catalog module or SDK runtime change.
• Update documentation, lookup instructions, CI tests/lint/CodeQL, Dependabot, and the three affected agentic workflows. Regenerate workflow locks with the existing pinned compiler without changing runtime, model, or security manifests.
• Validate every API assembly hash and require test metadata for every stored test assembly when extraction metadata exists. Reject selected-package refreshes that drop or replace recorded assemblies. Require all recorded owning packages when refreshing a package-owned assembly, preventing local or foreign-package inputs from leaving stale NuGet provenance. Unselected packages and unowned local assembly refreshes remain supported.

Preservation and scope

Based on main at 21528e2a869036953b37da872dd8f21d4481515c. Preserve all 49 intentional FileStore assessments merged in #1258 in the relocated compact format.

The unified catalog retains 1,908 extracted API declarations, 920 assessed leaves, 1,100 unreviewed leaves, and 112 assessments outside extraction scope. All 786 method keys include return types. All 6,750 .NET tests and 413 unique direct-port test pairs are preserved; 6,337 remain unpaired. SDK test names are unchanged. Structural validation is not a behavioral-parity certification.

Review follow-ups leave catalog bytes, SDK source, dependency files, and workflows unchanged. Concurrent editing is outside the intended contract; no file lock or locking dependency is added. The latest ownership-guard follow-up changes only the merger, its existing component tests, and the two guides.

Validation

• Complete catalog-module unit suites with shuffled execution on Go 1.26.1 and 1.27.0: all 535 test/subtest events pass on each toolchain; catalog vet and builds pass on both.
• The original Go 1.27 CI failures were reproduced before fixing two malformed-JSON assertions that depended on standard-library error wording. Rejection, empty stdout, and unchanged destination checks remain enforced.
• Hash, missing test metadata, package assembly removal/replacement, and local/foreign-package ownership regressions were verified failing before their production fixes, then passing. Positive controls retain consistent owner-package refreshes, unowned local refreshes, and unselected package preservation.
• Both-module builds and read-only tidy checks; gofmt/gofumpt checks on tooling Go sources.
• golangci-lint 2.14.0 passes using CI's Linux source selection; final follow-up catalog lint reports zero issues.
• Strict API and test-pair reconciliation: no unresolved declarations or invalid targets; all declaration and pair counts preserved.
• Real SDK module ZIP excludes the catalog and both CLIs, retains SDK source and the example verifier, and passes underscore-only/nested-module controls. Verifier tests pass from the extracted ZIP.
• Cached raw package extraction refresh is byte-idempotent on an external copy of the final catalog, with no lock file created.
• Three workflows compile strictly and reproducibly with gh-aw v0.89.21, zero warnings. Runtime/security manifests, action/image pins, model selections, and weekly Go/GOROOT bootstrap are preserved; review follow-ups do not modify workflows.
• Whitespace, obsolete-path/import, staged-artifact, and exact source-tree checks pass.

No .NET tests, local SDK E2E/replay tests, or benchmarks were run. Hosted CI passed at the preceding head 461cdca2; new checks will run for the ownership-guard follow-up.

[Copilot]

Copilot review overview

🟡 Changes recommended

Catalog replacement has a concurrent-edit race, and validation gaps can admit invalid provenance or silently omit stored test pairs.

Review effort: Balanced
Findings: 1 · 2

Open (3)

• Serialize catalog updates to prevent TOCTOU overwrites · New
• Validate API assembly hashes before merging · New
• Reject test assemblies missing from metadata · New

What changed in this PR

This PR consolidates .NET declarations, assessments, and test mappings into an isolated catalog module without changing SDK runtime behavior.

Changes:

• Adds the unified compact catalog model, refresh support, and relocated tooling.
• Removes tooling-only dependencies from the SDK module.
• Updates CI, lookup guidance, Dependabot, and regenerated agentic workflows.

File	Description
go.mod	Removes catalog tooling dependencies.
go.sum	Removes corresponding checksums.
cmd/​symbolmap/​testmapping.go	Removes the old test-mapping implementation.
cmd/​dotnetsymbols/​README.md	Removes documentation from the old location.
cmd/​dotnetsymbols/​model.go	Removes the old extractor model.
_catalog/​go.mod	Defines the isolated tooling module.
_catalog/​go.sum	Pins tooling dependencies.
_catalog/​cmd/​symbolmap/​main.go	Implements relocated CLI dispatch and filtering.
_catalog/​cmd/​symbolmap/​report.go	Updates compact mapping reports.
_catalog/​cmd/​symbolmap/​reconcile.go	Reconciles against unified declarations.
_catalog/​cmd/​symbolmap/​testmapping.go	Reads compact test pairs.
_catalog/​cmd/​symbolmap/​testreport.go	Updates test reconciliation.
_catalog/​cmd/​symbolmap/​gotests.go	Adds static Go test discovery.
_catalog/​cmd/​symbolmap/​goindex.go	Adds offline SDK API indexing.
_catalog/​cmd/​symbolmap/​gochanges.go	Compares structural Go APIs.
_catalog/​cmd/​symbolmap/​goexample.go	Uses shared example parsing.
_catalog/​cmd/​symbolmap/​goonly.go	Supports note-only Go-specific assessments.
_catalog/​cmd/​internal/​testinventory/​inventory.go	Defines shared test metadata.
_catalog/​cmd/​internal/​symbolcatalog/​model.go	Defines the unified catalog schema.
_catalog/​cmd/​internal/​symbolcatalog/​catalog.go	Validates catalogs and mappings.
_catalog/​cmd/​internal/​symbolcatalog/​declarations.go	Projects compact declarations.
_catalog/​cmd/​internal/​symbolcatalog/​merge.go	Preserves assessments during refresh.
_catalog/​cmd/​internal/​symbolcatalog/​update.go	Performs in-place catalog replacement.
_catalog/​cmd/​internal/​symbolcatalog/​names.go	Resolves compact .NET labels.
_catalog/​cmd/​internal/​symbolcatalog/​tests.go	Validates compact test mappings.
_catalog/​cmd/​dotnetsymbols/​main.go	Adds cached input and catalog refresh modes.
_catalog/​cmd/​dotnetsymbols/​release.go	Uses shared extraction models.
_catalog/​cmd/​dotnetsymbols/​signatures.go	Emits shared parameter identities.
_catalog/​cmd/​dotnetsymbols/​tests.go	Uses shared test metadata.
_catalog/​cmd/​dotnetsymbols/​attributes.go	Uses shared attribute metadata.
.github/​workflows/​test.yml	Tests both Go modules.
.github/​workflows/​linter.yml	Lints both Go modules.
.github/​workflows/​codeql.yml	Builds both modules for CodeQL.
.github/​workflows/​symbolmap-maintenance-weekly.md	Migrates maintenance to the catalog module.
.github/​workflows/​symbolmap-maintenance-weekly.lock.yml	Regenerates the maintenance workflow.
.github/​workflows/​dotnet-port-api-nightly.md	Reads unified catalog gaps.
.github/​workflows/​dotnet-port-api-nightly.lock.yml	Regenerates the API-port workflow.
.github/​workflows/​dotnet-port-fixes-nightly.md	Prepares catalog tooling.
.github/​workflows/​dotnet-port-fixes-nightly.lock.yml	Regenerates the fixes workflow.
.github/​skills/​dotnet-symbols/​SKILL.md	Documents unified lookup and refresh semantics.
.github/​dependabot.yml	Enables nested-module dependency updates.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Package-owned assemblies can be refreshed without updating their package provenance, leaving the unified catalog internally misleading.

Review effort: Balanced
Findings: 1

Open (1)

• Prevent assembly updates from corrupting package provenance · New

Resolved since last review (3)

• Serialize catalog updates to prevent TOCTOU overwrites
• Reject test assemblies missing from metadata
• Validate API assembly hashes before merging

[github-actions]

API consistency review

Result	Scope
out of scope	internal-only

This PR only refactors internal development tooling (cmd/dotnetsymbols, cmd/symbolmap → _catalog/cmd/..., the new _catalog nested module, CI/workflow lockfiles, Dependabot config, and docs/dotnet-go-sdk-feature-comparison.md) plus indirect go.mod/go.sum entries. No public Go packages (agent, message, provider/*, workflow, etc.) or examples/ were changed, so there is no user-visible behavior to compare against the upstream .NET/Python implementations.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by Go API Consistency Review Agent for #1264 · copilot · auto · 28.5 AIC · ⌖ 7.93 AIC · ⊞ 13.9K · ◷