[PR #1743] [MERGED] fix(managed): distinguish .NET Standard targets from runtimes #4790

New issue

Closed

opened 2026-10-31 00:55:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:55:04 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1743
Author: @ac1982
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/managed-netstandard-runtime

📝 Commits (2)

13748f9 fix(managed): distinguish .NET Standard targets from runtimes
d5eb6dc docs(managed): use independent runtime marker example

📊 Changes

3 files changed (+64 additions, -4 deletions)

View changed files

📝 docs/managed-code-analysis.md (+6 -0)
📝 src/dotnet/ManagedArtifactInspector.ts (+8 -4)
📝 tests/acceptance/managedCliOutput.test.ts (+50 -0)

📄 Description

Summary

Fixes #1736. Keep the runtime family unknown for an assembly whose only runtime-related marker is a .NET Standard target. Preserve the target framework and explain that it describes API compatibility across runtimes.

Problem and expected behavior

inspect-managed-artifact currently calls a netstandard2.0 library modern-dotnet and says its TargetFrameworkAttribute names modern .NET. .NET Standard specifies APIs implemented by multiple runtimes, so that attribute alone cannot establish a runtime family.

Reproduced through the built public CLI with the unmodified lib/netstandard2.0/Microsoft.Extensions.Primitives.dll from Microsoft.Extensions.Primitives 8.0.0: 49,936 bytes, SHA-256 6d492e7919789c7ab3d4afb5d2e5841cc0e2f28b07bf561bd1fcf8945e2170b3.

Change and scope

Remove .NET Standard from the modern-.NET runtime predicate and retain an explanatory, source-located target-framework observation. Existing .NETCoreApp, .NET Framework, ReadyToRun, Unity and mixed-code precedence remains intact. Document the distinction.

Contract and boundary impact

Semantic owner and earliest changed stage: managed artifact runtime classification in the static byte inspector.
CLI and MCP/tool-catalog contract: existing fields and schemas; corrected runtime_family and classification evidence.
Provider, bridge, target-format, or platform compatibility: static PE/CLI inspection; no native-provider or runtime-execution changes.
Evidence, artifact, provenance, or reconstruction contract: original target framework, artifact identity and evidence offsets remain available.
Process execution, authorization, cleanup, or containment impact: none; inspected assemblies are not executed.
Generated metadata, package, or installation impact: none.

Evidence and regression coverage

A compiled CLI regression fails on base 844fa527 (1 failed, 3 existing cases passed).
After the fix, the CLI regression covers .NET Standard without a runtime marker, .NETCoreApp, and .NET Standard with an independent ReadyToRun marker.
The real NuGet assembly now returns {"runtime_family":"unknown","implementation":"cil"}, retaining [".NETStandard,Version=v2.0"].
The same package's genuine net8.0 and net462 assemblies still report modern-dotnet and dotnet-framework, respectively.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Linux arm64, Node 24.18.0 / npm 11.16.0:

npm run test:focused -- tests/acceptance/managedCliOutput.test.ts src/dotnet/ManagedArtifactInspector.test.ts tests/boundary/providers/managed/managedStaticProvider.test.ts tests/boundary/providers/managed/managedDirectAnalysis.test.ts — 28 passed.
npm run check — all six tasks and architecture guards passed; lint reported warnings, no errors.
npm run verify:managed — 11 portable fixture scenarios passed; optional operator-local manifest and ILSpy oracle were unconfigured.
Public CLI inspection of the three real NuGet assemblies above — passed before/after controls.
git diff --check — passed.

Compatibility, safety, and release

No schema migration or package changes. Runtime classification becomes more conservative for .NET Standard-only evidence. Full repository tests, native Hopper/Ghidra, ILSpy, and non-Linux execution were not run; no claims are made about those workflows.

Review checklist

Concrete bug and one focused outcome; conventional title.
Related issue linked; searched open, closed and merged PRs for the issue number and .NET Standard classification.
Tests exercise public behavior and preserve independent runtime-marker controls.
Owning documentation updated; generated contracts unchanged.
Representative CLI behavior included.
Final diff reviewed for unrelated changes, credentials and unsupported claims.

Prepared with OpenAI Codex assistance.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1743 **Author:** [@ac1982](https://github.com/ac1982) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/managed-netstandard-runtime` --- ### 📝 Commits (2) - [`13748f9`](https://github.com/morluto/rea/commit/13748f9ac1b93ceb37d317d2e0cf3cb1983f02af) fix(managed): distinguish .NET Standard targets from runtimes - [`d5eb6dc`](https://github.com/morluto/rea/commit/d5eb6dcd9d5d787e00401ea76a054fc3f43593fa) docs(managed): use independent runtime marker example ### 📊 Changes **3 files changed** (+64 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `docs/managed-code-analysis.md` (+6 -0) 📝 `src/dotnet/ManagedArtifactInspector.ts` (+8 -4) 📝 `tests/acceptance/managedCliOutput.test.ts` (+50 -0) </details> ### 📄 Description ## Summary Fixes #1736. Keep the runtime family unknown for an assembly whose only runtime-related marker is a .NET Standard target. Preserve the target framework and explain that it describes API compatibility across runtimes. ## Problem and expected behavior `inspect-managed-artifact` currently calls a `netstandard2.0` library `modern-dotnet` and says its TargetFrameworkAttribute names modern .NET. [.NET Standard specifies APIs implemented by multiple runtimes](https://learn.microsoft.com/en-us/dotnet/standard/net-standard), so that attribute alone cannot establish a runtime family. Reproduced through the built public CLI with the unmodified `lib/netstandard2.0/Microsoft.Extensions.Primitives.dll` from [Microsoft.Extensions.Primitives 8.0.0](https://www.nuget.org/packages/Microsoft.Extensions.Primitives/8.0.0): 49,936 bytes, SHA-256 `6d492e7919789c7ab3d4afb5d2e5841cc0e2f28b07bf561bd1fcf8945e2170b3`. ## Change and scope Remove .NET Standard from the modern-.NET runtime predicate and retain an explanatory, source-located target-framework observation. Existing .NETCoreApp, .NET Framework, ReadyToRun, Unity and mixed-code precedence remains intact. Document the distinction. ## Contract and boundary impact - Semantic owner and earliest changed stage: managed artifact runtime classification in the static byte inspector. - CLI and MCP/tool-catalog contract: existing fields and schemas; corrected `runtime_family` and classification evidence. - Provider, bridge, target-format, or platform compatibility: static PE/CLI inspection; no native-provider or runtime-execution changes. - Evidence, artifact, provenance, or reconstruction contract: original target framework, artifact identity and evidence offsets remain available. - Process execution, authorization, cleanup, or containment impact: none; inspected assemblies are not executed. - Generated metadata, package, or installation impact: none. ## Evidence and regression coverage - A compiled CLI regression fails on base `844fa527` (1 failed, 3 existing cases passed). - After the fix, the CLI regression covers .NET Standard without a runtime marker, .NETCoreApp, and .NET Standard with an independent ReadyToRun marker. - The real NuGet assembly now returns `{"runtime_family":"unknown","implementation":"cil"}`, retaining `[".NETStandard,Version=v2.0"]`. - The same package's genuine `net8.0` and `net462` assemblies still report `modern-dotnet` and `dotnet-framework`, respectively. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Linux arm64, Node 24.18.0 / npm 11.16.0: - `npm run test:focused -- tests/acceptance/managedCliOutput.test.ts src/dotnet/ManagedArtifactInspector.test.ts tests/boundary/providers/managed/managedStaticProvider.test.ts tests/boundary/providers/managed/managedDirectAnalysis.test.ts` — 28 passed. - `npm run check` — all six tasks and architecture guards passed; lint reported warnings, no errors. - `npm run verify:managed` — 11 portable fixture scenarios passed; optional operator-local manifest and ILSpy oracle were unconfigured. - Public CLI inspection of the three real NuGet assemblies above — passed before/after controls. - `git diff --check` — passed. ## Compatibility, safety, and release No schema migration or package changes. Runtime classification becomes more conservative for .NET Standard-only evidence. Full repository tests, native Hopper/Ghidra, ILSpy, and non-Linux execution were not run; no claims are made about those workflows. ## Review checklist - [x] Concrete bug and one focused outcome; conventional title. - [x] Related issue linked; searched open, closed and merged PRs for the issue number and .NET Standard classification. - [x] Tests exercise public behavior and preserve independent runtime-marker controls. - [x] Owning documentation updated; generated contracts unchanged. - [x] Representative CLI behavior included. - [x] Final diff reviewed for unrelated changes, credentials and unsupported claims. Prepared with OpenAI Codex assistance. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:55:04 +00:00