[ANcpLua]

What

First post-merge run of the AOT gate (#27) failed 22× CS0006 on both OS (run 28594231868): under PublishAot all 22 demos swap their generator ProjectReference for a literal artifacts/bin/…SourceGenerators/release Analyzer path, so the gate's --artifacts-path redirect guaranteed the DLL was never where the compiler looks. It "passed locally" only against a stale pre-populated artifacts/ — the exact shared-state failure class the flag was meant to fix.

Rewritten rather than patched around:

• --artifacts-path deleted (cargo-cult: runners execute jobs serially and per-ref workflow concurrency landed in ci: one live run per ref + job timeouts on the self-hosted lanes #29; the real cross-job leak was persistent build servers, which --disable-build-servers already kills).
• The gate now prebuilds the generator into the standard artifacts layout before the demo loop — the contract every other workflow satisfies incidentally via full-solution builds, made explicit.
• Workflow docs updated to the new truth; stale .claude/TASK-aot-publish-gate.md removed (task shipped; it also pinned the false "TASK.md is an active WIP" claim).

Verification

• Virgin clone (no artifacts/): prebuild → [PASS] clean Qyl.RealHttpClientDemo warning-clean → aot-publish-gate-ok — the exact condition that produced CS0006 before.
• Full 30-demo gate dispatched on this branch (workflow_dispatch) — results on both runners before merge.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 69e1a8dc-36b0-4f47-ae3b-9a5fab3b5d57

📥 Commits

Reviewing files that changed from the base of the PR and between 9a43866 and ace9172.

📒 Files selected for processing (3)

• .claude/TASK-aot-publish-gate.md
• .github/workflows/aot-publish-gate.yml
• tools/verify-aot-publish-gate.py

💤 Files with no reviewable changes (1)

• .claude/TASK-aot-publish-gate.md

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: copilot-pull-request-reviewer
• GitHub Check: aot-publish-gate (qyl-macos)

🧰 Additional context used

📓 Path-based instructions (2)

.github/workflows/**

⚙️ CodeRabbit configuration file

.github/workflows/**: Check event triggers, permissions, token scope, concurrency, and runtime cost —
smoketest/fixture workflows must stay bounded.

Files:

• .github/workflows/aot-publish-gate.yml

**

⚙️ CodeRabbit configuration file

**: # Qyl.OpenTelemetry.AutoInstrumentation agent rules

Mission

This repository is the runtime AOT auto-instrumentation lane for qyl, evolving into a
self-describing observability substrate. The foundation is unchanged: .NET 10
NativeAOT-compatible zero-code instrumentation through managed build assets, source generation,
DiagnosticListener consumption, and module-initializer boot. The direction is the North Star
below.

Keep this repository separate from:

• semantic-convention package generation (Qyl.OpenTelemetry.SemanticConventions is a referenced
  vocabulary package, not generated here),
• the old CLR-profiler/OpenTelemetry auto-instrumentation substrate.

North Star — declare and prove the whole stack

Every observability tool today is pull-by-observation: a backend learns what a service emits
by receiving samples over time, and never knows whether it has seen the whole surface. qyl has a
capability none of them have — because instrumentation is source-generated interceptors + a static
contract + a referenced semconv registry + (incrementally) DTO inference, the complete set of
telemetry a binary can ever produce is a compile-time-derivable fact, with provenance.

The substrate goal: every qyl binary ships a complete, machine-readable Telemetry Capability
Graph (TCG) — the full possible OpenTelemetry surface for that exact binary, each capability
tagged compile-time-owned vs runtime-valued — and proves it by self-hosting (instrumenting its
own pipeline with its own mechanism, zero extra code). Any external entity consumes the TCG to know
the entire stack before a span is sampled. The contract becomes the shared semantic graph; an OTLP
backend is just one consumer.

Three pillars:

1. Self-host (the proof). qyl instruments qyl with qyl — QylSelfTelemetry /
   SemConvConformanceProcessor are the seed; the binary observing itself is how "declared TCG ==
   runtime reality" is checked.
2. **Compile-time-complete TCG (the ar...

Files:

• tools/verify-aot-publish-gate.py

---

⚙️ CodeRabbit configuration file

**: Operating principles (solo-dev, agentic SDLC — reviews are advisory, agents act on them):

1. LAZY: one self-contained, correct review beats ten partial ones. Every finding is
   definitive — concrete evidence with file:line, a concrete fix, no "consider maybe",
   no open or ambiguous questions back to the author. If you cannot decide a point
   from the diff plus repo context, stay silent on it. Never cite a source, API, or
   version you have not verified; an unverifiable claim is a dropped claim.
2. IMPATIENT: never stall a PR. There are no compatibility obligations here — internal
   and dogfooding code has NO public-API contract; removing shims, breaking signatures,
   and deleting dead paths are normal, desirable changes. Do not flag backward
   compatibility, deprecation ceremony, or migration paths. (SemVer applies only to
   commercially sold libraries — this repo has none.)
3. EGO: hold the bar of the best reviewer on the market — flag real correctness,
   security, data-loss, and structural problems precisely; produce zero noise.

Files:

• tools/verify-aot-publish-gate.py

🪛 ast-grep (0.44.0)

tools/verify-aot-publish-gate.py

[error] 151-155: Command coming from incoming request
Context: subprocess.run(
["dotnet", "build", str(GENERATOR_PROJECT), "-c", "Release",
"--disable-build-servers", "-clp:NoSummary", "-v", "minimal"],
cwd=str(ROOT), env=env, text=True,
stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(subprocess-from-request)

🔇 Additional comments (2)

tools/verify-aot-publish-gate.py (1)

41-44: LGTM!

Also applies to: 110-141, 144-178, 214-230

.github/workflows/aot-publish-gate.yml (1)

10-13: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved the reliability of the AOT publish gate by validating required build components up front.
  • Simplified the publish isolation approach, reducing the chance of inconsistent results during gate runs.
  • Kept the existing pass/fail behavior for clean and warning-prone demos while making the checks more robust.

Walkthrough

Removes an empty stale task doc, updates a workflow comment describing generator prebuild and isolation strategy, and refactors tools/verify-aot-publish-gate.py to prebuild the source generator up front, dropping the temporary artifacts-directory redirect and the artifacts parameter from publish, check_clean, and check_warned.

Changes

AOT Publish Gate Refactor

Layer / File(s)	Summary
Generator prebuild step tools/verify-aot-publish-gate.py	Adds GENERATOR_PROJECT constant and prebuild_generator(env) that builds the generator and hard-fails on error; called before the demo loop in main().
Publish signature and temp-directory removal tools/verify-aot-publish-gate.py	Removes artifacts: Path from publish, check_clean, check_warned; drops --artifacts-path wiring and the tempfile/shutil try/finally cleanup, relying on the standard artifacts/ layout instead.
Workflow comment and stale doc removal .github/workflows/aot-publish-gate.yml, .claude/TASK-aot-publish-gate.md	Updates the workflow comment to describe generator prebuild, --disable-build-servers, and serial-runner isolation; deletes the emptied task document.

Estimated code review effort: 2 (Simple) | ~12 minutes

Possibly related PRs

• ANcpLua/Qyl.OpenTelemetry.AutoInstrumentation#27: Introduced the tools/verify-aot-publish-gate.py publish/check_clean/check_warned functions that this PR directly refactors.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: fixing the AOT gate by prebuilding the generator instead of redirecting artifacts.
Description check	✅ Passed	The description matches the PR and explains the analyzer-contract fix, generator prebuild, workflow docs update, and removed task file.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/aot-gate-fresh-workspace

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/aot-gate-fresh-workspace

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR fixes the NativeAOT publish gate so it satisfies the PublishAot analyzer consumption contract (source generator consumed from artifacts/bin/.../release) instead of redirecting artifacts output to a temporary location that causes CS0006 on fresh workspaces.

Changes:

• Remove --artifacts-path usage and instead prebuild the source generator into the standard artifacts/ layout before running the demo publish loop.
• Update the gate workflow documentation to reflect the new approach (prebuild + --disable-build-servers).
• Remove the now-stale .claude/TASK-aot-publish-gate.md task file.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tools/verify-aot-publish-gate.py	Removes artifacts redirection and adds a generator prebuild step to ensure demos can resolve the analyzer DLL under PublishAot.
.github/workflows/aot-publish-gate.yml	Updates workflow comments to match the new gate behavior.
.claude/TASK-aot-publish-gate.md	Deletes stale task documentation that no longer reflects current workflow state.