[Wahbeh-Mohammad]

What and why

The design and implementation plan for phase 10 of the v1 roadmap (Cross-Cutting Invariants and Conformance), filed under docs/work/mvp/phase10/. The roadmap's phase 10 row links the design. Implementation is out of scope and follows in a separate issue.

Closes #99

• Design: docs/work/mvp/phase10/2026-10-13-phase10-cross-cutting-invariants-design.md
• Plan: docs/work/mvp/phase10/2026-10-13-phase10-cross-cutting-invariants.md

Shape

• One phase, no sub-phases (P10-1, open): all three suites need the same change to the kit's result model, appendix B spans both chapters, and the coverage script passes only once all 41 rows exist. Built as four stacked PRs, 42 tasks: (1) the kit contract and the invariant suite with its drivers and two RS0030 bans; (2) the codec suite; (3) the packaging suite and the NFR gates; (4) the appendix-B map and gate, scripts/ci/requirement-coverage.cs, the AOT smoke's CheckPhase10Async and close-out.
• New assertions: 28 invariant, 11 codec, 8 packaging (the 43 transport assertions are unchanged).
• Planned rows (41): 39 ✅ (10 split), NFR-16 ⏳ (phase 12), NFR-17 conditional on an admin adding required status checks (P10-16). No 🚫, no N/A, no new §10 entry.
• Appendix B (61 items): 17 suite, 8 restated, 36 by reference, 0 scoped out.

Requirements

XCUT-1–XCUT-24, NFR-1–NFR-17, appendix B. No code changes.

Verification

• Housekeeping probe clean (links, citations, full probe)
• Design and plan filed with housekeeping apply --delivery mvp --phase 10

Lead rulings

P10-1 to P10-30 at recommended defaults. Most worth a look: P10-1 (no sub-phases), P10-5 (the SEAM-2 allow-list admits the kit), P10-7 (TransportFace.None and ConformanceReport.Combine on the kit's public surface), P10-16 (required status checks on main, an admin action: main's ruleset has none today, so a red PR can merge), P10-21/-22 (Stryker.NET and benchmarks/ declined; Stryker refuses Microsoft.Testing.Platform projects), P10-23 to P10-25 (oversize error bodies truncated without a marker, HttpResponseException's public constructor accepting a 200, the never-thrown ServiceResponseException: routed, not fixed here).

[Wahbeh-Mohammad]

Review record

The design was written first, the plan against it, then the plan was validated against the design read-only, with every finding reproduced (a scratch build, a command run or a grep against the tree) before it was reported. The confirmed findings were then resolved in both documents; design changes are recorded in its Validation resolution (2026-10-13) section.

Confirmed findings (13, all resolved)

#	Sev.	Target	Finding	Resolution
F1	high	plan R7 / task 1.12, design §G	Banning the ConcurrentDictionary type flags 12 lines in BoundedMap.cs (a scratch build gave 12 RS0030 errors), not 3 or "one pragma"; the inner TryRemove disable/restore pair would re-enable the rule	Ban the seven constructor overloads only; the one site is line 49 under one scoped pragma
F2	high	tasks 1.3/1.4	AssertionCatalogueTests.Every_control_names_an_assertion_that_exists requires every control to name a transport assertion; the first invariant control breaks it and no task edited it	Task 1.3 compares against the union of all kit catalogues (KitCatalogues.All) plus a cross-suite name-uniqueness check
F3	high	V-conf, tasks 0.1–1.13	The Conformance filter ran on two test projects with no Conformance tests yet; Microsoft.Testing.Platform exits 8 on zero tests (reproduced)	V-conf defined per PR, adding Core.Tests from 1.10 and the STJ tests from 2.5
F4	medium	tasks 4.6/4.9/4.10	The coverage script reads docs/work/**, but the checklist was drafted in the inbox and filed last: 604 of 645, a red commit	The checklist is written at its filed path in 4.6; 4.9 depends on it
F5	medium	design §C/P10-4, plan R3/R13, XCUT-21	Inconsistent default for the cnonce hook; the core driver cannot reach the private _cnonceFactory; an output test cannot tell a CSPRNG from System.Random	The hook checks format and no-repeat only; the source clause is by reference to DigestComputationTests.The_cnonce_source_is_RandomNumberGenerator; controls fail on width and repetition; R17 added
F6	medium	design §D/P10-8, tasks 2.2–2.4	SERDE-4, -13, -18 judge core code, not the codec seam, so their controls cannot be built through CreateSerde	All three by reference; codec suite 14 → 11 assertions; appendix B 20/8/33 → 17/8/36
F7	medium	task 3.9 / R6, NFR-7	.editorconfig has three dotnet_code_quality.* lines (52, 155, 156); the waiver test would fail on two	All three named; consecutive settings share one comment; line 52 exempted by name as a hand-off rule
F8	medium	task 3.11, NFR-12	The red step flipped DeterministicSourcePaths on one pack only, so it differed even in one directory and proved nothing (four-way scratch pack matrix)	Flag on both packs: same-path baseline passes, cross-path fails, unflagged cross-path passes
F9	low	task 1.1	A body past AssertionTimeout is Failed, not Errored (pinned by an existing SuiteRunnerTests test)	Expect Failed
F10	low	task 1.1 vs R1	Edited existing tests while claiming none were	Edited tests listed; claim narrowed to "no existing test body edited"
F11	low	design P10-6/§C	Transport assertions were said to cite XCUT-13/XCUT-18; only XCUT-1, -2, -4, -22 are cited	Design corrected; those two cited by reference, transport catalogue unchanged
F12	low	design V12, §F/P10-11	43 #pragma warning disable lines in 31 files, not 19; the NFR-11 allow-list "under System" admitted its own negative control (System.Net.Http)	Counts corrected; explicit ban list adopted into the design
F13	low	tasks 3.5/3.8, 3.10	A shared test helper was created after its first user; the CI-workflow test missed if: always() on "Upload test results"	Helper created in 3.5; the step allowed

Rejected candidates

Appendix-B evidence paths (all 55 exist); the 60+ cited test names (all exist); the coverage, appendix-B and license-header counts (all reproduced); worktree packs breaking reproducibility (they were byte-identical); the GetBaseException ban ID being invalid (RS0030 fires on a probe); the NFR-11 scan flagging core; InternalsVisibleTo grants beyond <id>.Tests; owning rows lacking a legend mark; code assuming two TransportFace members; CA2007 in the new file-based scripts; the SEAM-2 red-first wording.

Plan readings

R1–R5, R8–R12 and R14–R16 accepted; R6, R7 and R13 fixed (F7, F1, F5); R17 added for XCUT-21. The plan writer's three claims against the design (V12 counts, the NFR-11 allow-list, the generic-runner wording) were upheld.

Checks

Housekeeping probe: no drift (links, citations and the full probe), after filing both documents and repointing the two links the move broke. No code changed; no build or test run is affected.