[kubaflo]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

Description of Change

Adds maintainer-only /issue replicate, recovery and public Azure execution; DevDiv /review is unchanged. Definition313 is a credential-free canary, not production.

Current source: 3415662131153c0cbcff5310f26368ce143cf563. Evidence:2026-10-09. Production off; external trust gates open. All entries below this current summary are immutable historical observations, not current-head clearance.

Source-bound recovery; no six-case completion claim

bcfab/db5289 add painted-fill guidance, bounded cold WDA readiness and scoped/restored owned-iOS HEADLESS.332a adds preloaded bounded concurrent process capture, current/net10 screenshot-prerequisite veto and bounded literal Shell DataTemplate traversal.42a pairs a retained first result with its first candidate when revision exports no result; malformed/missing selected pairs still fail.341 removes post-body Diagnostics reloads. No OS evidence-isolation claim.

Four unchanged suites:269passed/0failed; AST/YAML checks passed. No new pipeline tests. Static source reviews are not hosted/native/authorization proof. Actual maui-pr1629618 binds341/merge59717; completed/succeeded2026-10-09T14:27Z, not native evidence.

**Older admitted trials only:**a443/9f8d 38452 strictly repeats the same candidate assertion; 39220 has matching raw crashes but unproven original phase/control/repeat.7b3f/c070 39210 repeats4pt/iOS26.0 overlap, not author26.2/glyph clipping; 39215 passes width-only proxy despite absent painted fill. c3c/4e52 39202 compiles but stalls before body; 39061 fails cold WDA before candidate execution. No full-video correspondence claim.

Held fork952f differs7/33 reviewed paths;0 accepted runs. Actual HTTP422 dispatch refusal remains unresolved despite enabled:true readback; no retry/bypass. Dedicated publisher absent; manual comments are not automatic publication. Existing reports unchanged; no75/current-head confirmed bug claim.

Historical c766 NUnit producer contract

Review5443085557 was reproduced. VSTestSetting supplies NUnit.TestOutputXml, bound to TRX adapter/fixture/test/timestamps/message/stack/counters. Exception/lifecycle/separate-stack/confirmation guards remain. Prose never qualifies; XML is not external attestation.

SDK26454.107 (10.0.113), NUnit4.0.1/adapter4.5.0/Test.Sdk17.6.0: dotnet test ProducerProbe.csproj --filter 'FullyQualifiedName~Issue12345' --logger 'trx;LogFileName=before.trx' --results-directory before --nologo --verbosity quiet -- NUnit.TestOutputXml=<bounded-output>: expected failure; TRX Inconclusive before, bound XML AssertionFailed after. Seven runs: sync/async assertions, four exception/lifecycle negatives, matching identities; nine binding negatives rejected. Body-ending stacks/async aggregates retained. Native POST/PATCH loopbacks preserved four exact bodies/one report, not hosted publication.

Earlier source correction (2026-10-07): f243b2fbbdbc772382df72a5b131e07fa5997660. The latest review correction checks incomplete media/candidate warnings throughout legacy report bodies, including closed sections, so pending checkpoints cannot win completed-report reconciliation. The compact AI-attributed verdict and initially closed narrative/code/video/provenance behavior introduced in ba4 remain unchanged. All three native trials remain terminal and unconfirmed; production stays off and the three external trust findings remain unresolved.

Historical legacy pending-report correction and source-bound validation - click to expand

Both legacy-compatible collapsed media and candidate warnings qualified as completed before the correction; both are now rejected with LF and CRLF. Genuine legacy completed reports, explicit completion footers and exclusion of modern pending headings retain their existing behavior. The guide documents the full-body legacy check. The same four existing runtime suites passed 269/269, zero failed/skipped on f243 after the final edits; the exact existing-suite command is preserved under Validation below. Scoped PowerShell formatting, syntax, analyzer-error checks and git diff --check passed. No new pipeline/configuration cases, native/XCTest runs, media uploads or live issue-comment mutations were added. Normal coauthored push, exact live PR/remote source and clean worktree were verified. Finding4206037173 received one correction reply and was resolved.

Automatic maui-pr1626276, definition302, binds actual trigger f243b2fbbdbc772382df72a5b131e07fa5997660 to merge f5f7f0ef9331a37db38a21b7b52190e0d0106e42 and is queued/notStarted in the post-push snapshot. Source-bound PowerShell Script Tests37611652798 is in progress in that snapshot, not terminal CI clearance. The ba4 hosted failures and earlier outcomes below remain explicitly prior-source evidence, not current f243 results. No additional queue or CI observer was created. No production-boundary enforcement or native confirmation is claimed.

The following ba4, e105 and older sections preserve dated history. Their "current", status and feedback labels apply to those snapshots, not current sourcef243 or its latest review correction above.

Previous source: ba4c1650af1a76a60062648d385798991e7ed7fa. Updated evidence: 2026-10-07. Reports now show only explicit AI-generated issue replication attempt attribution and a compact Reproduction / Test quality / Evidence confidence verdict initially. Detailed analysis, code, videos, provenance badges and caveats remain available in initially closed expandable sections. Final publication reconciles recognized completed reports to one current visible report per issue, minimizing superseded reports as OUTDATED without deleting their evidence or unrelated discussion. All three native trials remain terminal and unconfirmed. Production remains off and the three external trust findings remain unresolved.

Compact reports, safe reconciliation and current-source validation - click to expand

The normal publisher and Azure fallback use shared trusted owned-comment publication and final reconciliation. Run-specific and supported historical completed reports participate; explicitly marked independent reports require both the first-line <!-- issue-replicate-independent-report --> marker and final <!-- issue-replicate-report-complete --> marker. Pending notices, patch continuations, unrelated discussion and unrecognized authors are excluded. The newest visible completed comment ID wins. Before each minimization, fresh reads verify the replacement and older report's issue, repository, author, body and visibility; a final read verifies exactly one current report. Errors and concurrent changes fail explicitly and preserve unprocessed evidence. Hidden reports are never unminimized or resurrected by retries. Media checkpoints, upload receipts, patch bounds and authorization checks remain intact.

The existing 0/25/75% rubric is unchanged: these are evidence scores, not statistical probabilities. Passing, inconclusive and unrun tests explicitly do not rule out the original issue; repeated generated failures still do not establish original-app causality. Scope/validated MAUI Commit badges and full attribution now live inside closed Report provenance, not the initial verdict. The validated pinned framework revision remains distinct from the workflow and author-sample revisions.

The same four existing runtime suites passed 269/269, zero failed/skipped after the final changes. Existing layout assertions and GitHub fixtures were updated; no new pipeline/configuration test cases were added. Scoped PowerShell formatting, syntax, repository analyzer-error checks, Azure YAML parsing, all nine actual inline PowerShell blocks and git diff --check passed. The exact existing-suite command and its passing result are preserved under Validation below. GitHub's actual Markdown renderer verified the original 25% Android diagnostic has five closed details sections and only the compact verdict initially visible. A real read-only reconciliation selected current Android report6027318489 and planned to minimize historical6026994441; no minimization mutation was executed by this session. No live #38821 comment was modified, no new native/XCTest run was made, and no media was uploaded for this change. The normal coauthored push, exact live PR/remote source and clean worktree were verified.

Current hosted PowerShell Script Tests37609549219, actual artifact11476871678/XML, completed 2,807passed / three failed / zero skipped / 2,810total. Every full failure name and full message hash exactly matches the sealed prior-source/immutable-mainf753 comparison preserved below. The actual checkout log proves merge 9e2e5bf13fa7bca10676773caf0f38a9c5a8b473 tested ba4 into main 84b1fb39ad56e22a51d29d4bbf141b03b02e4648. This is not all-green hosted CI or a new full current-main baseline. Automatic maui-pr1626255, definition302, binds actual trigger ba4 to that same merge and is queued/notStarted in this snapshot, not terminal clearance. No additional Azure queue or CI observer was created.

Fresh complete feedback traversal verifies 53threads /106inline comments with unchanged bodies, authors, associations, timestamps and resolutions. Only mutable commit/line mappings changed after the push; there is no new actionable inline finding. The three existing production trust roots remain unresolved. No duplicate reply, resolution, production deployment or protected-resource change was made.

The following e105 and older sections preserve dated history. Their "current", status and layout labels apply to those snapshots, not current sourceba4 or its compact renderer/reconciliation above.

Previous source: e105e211ed43428ead0c2b21d574c142fcce90a7. Updated evidence: 2026-10-07. Issue-replication reports now match the reference report's attribution blockquote and flat-square Scope/Commit badge row, explicitly stating AI-generated issue replication attempt instead of mentioning an author. The Commit badge is the validated pinned MAUI framework revision, not the workflow or author-sample commit. The existing two Android report headers were updated without changing their evidence, outcomes, patches, warnings or recordings. All three native trials remain terminal and unconfirmed. Production remains off and the three external trust findings remain unresolved.

Current report styling and source-bound validation - click to expand

A shared trusted header renderer is used for final reports, pending-media/pending-candidate notices, patch continuations and the Azure fallback notice. Ownership markers remain first; continuation headings, warning/receipt contracts, expandable analysis/patch/recording/follow-up sections and publication bounds are preserved. No revision is invented when no validated intake snapshot exists. The workflow guide documents the same attribution and provenance rules.

The format-only updates to historical Android report6026994441 and current unconfirmed Android report6027318489 were independently read back exactly. Everything after each original heading is an unchanged evidence suffix. Both correctly show pinned MAUI f7530d0, not current workflow sourcee105 or author sample28af. The historical reset-readiness warning and current25%/missing-confirmation diagnostic remain explicit. No new issue comment, media upload or native queue was made.

The existing four runtime suites passed 269/269, zero failed/skipped. Only the obsolete no-badges alternative in one existing assertion was adjusted; no new pipeline/configuration test cases were added. Scoped PowerShell formatting, syntax, repository analyzer-error checks, Azure YAML/inline PowerShell parsing and git diff --check passed. GitHub's actual Markdown renderer retained both badges, AI attribution and paired expandable sections. The normal coauthored push and exact live PR source were verified.

Automatic maui-pr1626225, definition302, binds actual trigger e105e211ed43428ead0c2b21d574c142fcce90a7 to merge 238e141695dc658f45c0dda16821ad9956d515bd; it started10:11:13Z and is in progress, not terminal CI clearance. Current hosted PowerShell Script Tests37605650737 is also in progress. Earlier a193/other-source outcomes are not current-source validation. No additional Azure queue or CI observer was created for this formatting change.

The following a193 and older sections preserve dated history. Their "current", pending/terminal status and observer labels apply to those snapshots, not current sourcee105 or subsequent provider states.

Previous source: a193026e3e08eed798241fbcf0428ca90de851a0. Updated evidence: 2026-10-07. The latest review correction rejects recognized assertion-exception implementation references in generated candidates. All three native trials below remain terminal and unconfirmed; no new native queue, recording upload or issue publication was made for this correction. Production activation remains off and the three external trust findings remain unresolved.

Latest review correction: assertion APIs, not constructed assertion exceptions - click to expand

The reviewed throw new NUnit.Framework.AssertionException(...) example passed the previous real candidate validator without calling an assertion. It is now rejected before execution. The intentionally conservative supported-source policy applies to all candidate kinds and rejects every normalized reference to recognized assertion-exception implementation names, including aliases, factories, target-typed construction, catches, comments and literals. Ordinary assertion APIs and setup exceptions remain supported. Identifier normalization handles Unicode escapes, formatting characters and verbatim identifiers; XAML entities are decoded before this check. The generator instructions and workflow guide describe the same restriction.

The admission guard and TRX classifier share the existing recognized exception-name list; assertion eligibility and the recording, identity, fresh-confirmation, patch and publication gates are unchanged. Both actual imported iOS candidate JSON inputs remain accepted and byte-identical. This conservative reference restriction is not an OS-isolation or evidence-authenticity boundary and does not resolve the same-user evidence-tampering finding.

The existing four runtime suites passed 269 / 269, zero failed/skipped after the final edits; PowerShell parsing, isolated helper formatting and git diff --check passed. No new pipeline/configuration tests were added. The normal coauthored push, live PR/remote source and clean worktree were verified. The new inline finding received exactly one reply and was resolved; fresh complete feedback traversal confirms only the three unchanged production trust roots remain unresolved.

Latest source-bound hosted results and pending ordinary CI - click to expand

• Current a193 hosted: PowerShell Script Tests37576849156 completed failure05:35:18Z. Actual artifact11462614799/XML contains 2,810total /2,807passed / three failed / zero skipped. The actual checkout log proves merge a6f0e63767f55b0e0f2674da8b578facf7d1c4f7 tested a193 into main 7d38fd06d059c4875bd81690c360a196aae26a26. Every full failure name and full message exactly matches sealed cd94/e2 and their targeted immutable-mainf753 comparison. This is not full hosted-main clearance or all checks green; the three full failure names and baseline scope remain preserved below.
• Current a193 ordinary CI: maui-pr1625939, definition302 / actual triggera193 / merge a6f0e63767f55b0e0f2674da8b578facf7d1c4f7, started05:33:22Z and is in progress, not terminal clearance. Exactly one responsive observer owns this automatic build. No additional Azure queue was issued.
• Superseded cd94 ordinary CI: maui-pr1625924, merge 820ae87d4de1bca40bdb75ce37fae3a84fc5e9fe, actually completed canceled05:34:06Z. Its observer exited and was not restarted. Cancellation is not success or current-source proof.
• Prior e2 ordinary CI: the complete succeeded1625874 evidence remains preserved below, explicitly scoped to e2. Neither that result nor the unchanged native outcomes substitute for current a193 CI, native qualification or production-boundary enforcement.

The first long observer-start request failed without an ID; a fresh complete inventory proved it created no observer before one bounded shorter retry. The complete69-entry inventory then confirmed only the requested continuous feedback watch and the sole responsive current1625939 owner were running. Consumed native observers/readers and queues were not revived. The existing three production findings remain unresolved, activation stays unset/off, and no merge, protected-resource change or production deployment was made.

The snapshots below are preserved dated history. Their "current", pending-status and observer labels apply to those earlier snapshots, not current a193 or the provider states above. The latest three-case native outcomes remain unchanged.

Current source: cd94dd2f87e91de65b2934ea13f6b13186a586e4. Updated evidence: 2026-10-07. All three cases in the latest native batch have reached terminal outcomes; zero confirmed reproductions. The latest three-file correction preserves the actual selected TRX error when a valid result does not qualify as an issue assertion, rather than replacing a precondition timeout with generic recording-marker text. It strips logging directives/control characters, bounds the retained message to500characters and the combined recording diagnostic to1,000characters, and retains Native recording failed: feedback. Any separate recording failure stays explicit. Assertion, identity, recording-window, fresh-confirmation, clip-discard, patch and publication gates are unchanged. These diagnostics were corrected; no new native success is claimed and no new native retry was dispatched.

Latest three-case native outcomes - click to expand

Case	Immutable run	Actual outcome	Qualification limit
Android WebView #38452	1625050, sourceee3	Terminal failed; first named body observed control112.0 versus short WebView0.0. The existing expandable diagnostic/video6027318489 remains unchanged	Unconfirmed25% diagnostic, not a verified patch or strict publication. Fresh confirmation could not enter its body because SDK/emulator setup failed
iOS CollectionView #38276	1625889, sourcee2; completed failed04:39:18Z	Author sample built and actual named test ran. One-item native height29 was established, but the ten-item state still measured29 with status Items: 10; replacement: 2; native diagnostic XML independently confirms that geometry	Timed out establishing expansion before the ten-to-one shrink assertion. Controller captured22,409bytes, then unqualified TRX discarded the clip. No eligible exported recording, patch, assertion confirmation or publication packet
iOS singleton modal #38361	1625773, immutable source2e; completed failed04:46:15Z	Author sample built and actual named test ran. Fresh transient-control readiness returned ready=True at15.185s; the next observation exhausted the26-second body budget	Failed before singleton dismissal/reopening assertion; do not infer a definitively blank transient modal. Recording window also failed. Source2e does not inherit e2's Stop-before-retrieval correction. No eligible exported recording, patch or assertion confirmation

Each final iOS timeline has 92unique terminal records / six realized jobs. Confirmation was skipped, and actual Report87 rejected missing qualified completed candidate execution after rendering the requested four-section expandable0% preview. Neither exported publication fields or artifacts. The original imported results remain byte-identical and inconclusive; testExecuted=false here means no qualified outcome, not that the named NUnit runner never entered its body. No clip, TRX, strict packet or result was reconstructed, promoted or borrowed from another run. Both native observers and the preceding ordinary-CI observer exited0 and were consumed, not restarted.

Latest source-bound validation and CI - click to expand

• Currentcd94: PowerShell parsing, git diff --check and the same four unchanged runtime suites passed 269/269, zero failed/skipped, with credentials removed. The normal coauthored push, exact live PR/remote head and clean worktree were independently verified. No new pipeline/configuration tests or workflow changes were added for this correction.
• Currentcd94 hosted: PowerShell Script Tests37573905863, actual artifact11461709275, contains 2,810total /2,807passed / three failed / zero skipped. Every full failure name and full message exactly matches the sealed prior sourcee2 result and its targeted immutable-mainf753 comparison below. This is not full hosted-main clearance or all checks green.
• Currentcd94 ordinary CI: maui-pr1625924, actual triggercd94 / merge 820ae87d4de1bca40bdb75ce37fae3a84fc5e9fe, started04:57:26Z and is still in progress in this update. Exactly one new responsive observer owns that build. Earlier sourcee2 success is not borrowed as current-source proof.
• Priore2 ordinary CI: maui-pr1625874 actually completed succeeded04:49:09Z. Complete uncapped inventory: 1,037unique terminal records /26successful jobs, no adverse results or structured record errors. Exact-Build Helix evidence verifies36assembly executions plus four controllers, all actual Finished/integerExit0; Windows/macOS CategoryBuild integration logs1008/1017 each report 99passed /0failed /0skipped. This is prior-source ordinary CI, not native qualification or production readiness.

The three external production trust findings remain unresolved and activation remains off/unset. This update does not approve merging, deploy a production definition, provision protected resources, or claim that manual canaries exercised automatic production publication.

Everything below is preserved dated history. Its "current" and pending-status labels apply to those earlier snapshots, not the latest source or terminal native outcomes above.

Current source: e2ce53574beedffbaa214e4a264a52df00ad8f5b. Updated evidence: 2026-10-07 02:27Z. The latest three-file correction captures the conservative 30-second recording deadline when the named Stop marker arrives, before bounded recording retrieval. Retrieval latency is no longer counted as continued test execution. Startup, missing/repeated-marker, TRX, recording-size, fresh-confirmation and evidence gates remain unchanged.

The CollectionView candidate first qualifies source status, native geometry and visible item identities from one full accessibility snapshot, then stabilizes using bound native collection/status elements and collection-scoped visible-item queries instead of repeatedly rebuilding the full hierarchy. Three matching samples, stability intervals, six-second phase windows, the 24-second body budget, original height thresholds, HostApp and author/framework pins remain unchanged. This is a correction to observation/controller behavior, not yet a proven native timing fix or reproduction.

Actual Collection1625278/source69 entered its named body and failed the initial one-item control, before the ten-to-one shrink assertion. The original immutable result remains inconclusive with testExecuted=false, assertionFailed=false, observedAssertion=false; no recording fields or clip were exported. Its post-failure native diagnostic shows the expected one-item status, a 335x29 collection and visible Appointment1; that diagnostic's source request took 3,203ms. This does not establish every earlier body read's latency or prove retrieval latency caused its recording rejection. The whole run still awaits forwarding/Report. No corrected Collection queue is issued while it remains active.

Corrected modal1625773/source2e started01:46:28Z and passed Intake01:47:07Z; Sample/native phases remain pending. It is immutable2e and does not inherit this new recording correction. The already published Android manual diagnostic/video is unchanged and remains unconfirmed25%; fresh confirmation is still blocked by its terminal SDK installation failure. Zero confirmed reproductions; no new issue comment, upload or borrowed media.

Source	Current evidence	Qualification limit
Currente2	maui-pr1625874, actuale2 trigger/merge a44af0e6c88580471174e3f0acc4e29599c05479, started02:18:34Z	In progress, not terminal CI clearance
Currente2	PowerShell Script Tests37561316089, actual checkout mergea44/e2 into main7d38; 2,807 passed / three failed / zero skipped; 2,810 total, completed02:21:00Z	Every full failure name/message matches sealed prior2e/targeted immutable mainf753 evidence; not full hosted-main clearance or all checks green
Prior2e	maui-pr1625738, completed succeeded01:51:35Z; complete1,037-record terminal inventory/all26 jobs succeeded/no adverse records	Windows/macOS Build integration each99pass/0fail/0skip; complete exact-Build Helix evidence36assembly executions plus4controllers/allintegerExit0. Not currente2 or native qualification

Currente2 validation: the exact modified candidate compiled against the repository's real UITest.Appium/Core interfaces with NUnit4.0.1, zero warnings/errors; only inherited fixture/category metadata was stubbed. Host SDK11 compiled a net10 probe, not a pinned native run. Targeted formatting, credential-cleared nonincremental rebuild, PowerShell parsing, actual maintained Candidate guards, git diff --check and the unchanged four runtime suites 269passed/0failed/0skipped passed. Normal coauthored push/live PR head/clean worktree were verified. No new pipeline/configuration tests were added.

The actual currente2 Collection configuration preview returned id-1 / one stage / seven exact jobs / zero credential groups, pinned to the new candidate bytes and unchanged HostApp/manifest. It queued no build. Exactly one responsive new observer owns automatic ordinary CI1625874; the existing two native owners remain separate. Retry still requires a genuinely terminal previous run, fresh source/access/command/preview checks, a complete all-active-status/no-same-case inventory and an exclusive attempt receipt. The separate production activation and all three external trust-boundary findings below remain blocked/off.

Earlier dated evidence is preserved below; its "current2e" labels refer to the 00:34Z source2e snapshot, not the latest source or provider state.

Prior source: 2e1b16db701ced97f76c982a23ba9c31310d109f. That two-file correction changes only the publisher and its guide: an executed but inconclusive generated test no longer says "No test outcome is available." Missing verification/confirmation and any recording failure remain explicit. An observed first assertion still scores 25% (not a probability) and exports no verified failing patch. The actual current Android diagnostic below exercises this corrected renderer against original same-run inputs and recording bytes.

The preceding7aa correction changes the modal candidate's readiness boundary and its guide. A completed, ready native snapshot is no longer discarded solely because its RPC crossed the three-second readiness retry window. The absolute 26-second body budget is rechecked before acceptance; the retry window still limits scheduling another snapshot. A crossing logs actual readiness and elapsed body time. The 30-second recording limit, full three-second reopened-content observation, two fresh-instance controls, singleton-identity checks, actual native swipe dismissals and original assertion are unchanged.

This boundary defect was independently reproduced with the exact previous candidate: a synthetic 3,100ms first read containing valid home controls raised the same initial-home precondition exception. The corrected exact candidate accepts that read and completes all nine snapshots, four taps and three swipe calls. A disabled late control remains a setup timeout with zero actions; an expired overall budget still rejects additional actions. These are isolated compiler/scenario controls, not native timing or proof that this defect caused the latest hosted failure. Corrected native execution remains required. No HostApp, framework/author pin, credential scope or production boundary changed.

The preceding source69 correction makes the filtered Appium diagnostic reader scan backwards in 8KiB os.pread chunks, retaining the newest 80 eligible rows and stopping after an 81st proves omitted context. It preserves chronological output, newline/blank-row handling, 2,000-byte row prefixes, the syslog-marker filter, 64MiB scan window, output bounds, regular-file/no-symlink/nonblocking guards and hard process deadlines. Short reads fail explicitly; whole-file/unfiltered-tail behavior is unchanged. Replaying the completed source772 diagnostic log selected the actual frontend session, not its WDA proxy UUID, in 0.1124047s within the unchanged four-second bound. That is offline parser timing, not live recording success, an atomic log snapshot or proof of the original deadline's cause.

Source-bound CI evidence: current2e hosted result assessed; Azure snapshot 2026-10-07 00:34Z

Source	Run	Actual result	Limit
Current2e	maui-pr1625738, merge 96d51c0520b0cdb0db15f873476c2c07a8800ac1	Actual trigger pr.sourceSha matches2e; uncapped live timeline has1,030 records,19/26 jobs completed succeeded and seven active, with no adverse records or structured record errors	In progress at00:34Z; this is not terminal CI clearance
Current2e	PowerShell Script Tests37546951870, checkout merge 96d51c0520b0cdb0db15f873476c2c07a8800ac1	2,807 passed / three failed / zero skipped; 2,810 total, completed failure23:33:14Z	Three full failure names/messages match targeted local mainf753; not all checks green
Prior7aa	maui-pr1625487, merge db74a4ae935928ec52300beec263c5875aee2c5c	Completed succeeded22:53:13Z; actual trigger pr.sourceSha matches7aa	Does not validate2e or corrected native execution
Prior69	maui-pr1625201, merge 460b3c5069220329a616f8d7c5807bc67a4ba2f8	Completed succeeded20:03:17Z	Prior source
Prior69	PowerShell Script Tests37502718937	2,798 passed / three failed / zero skipped; all eight diagnostic-reader cases passed	Three inherited failures remain; not all checks green

The four actual current1625738-bound Helix unit jobs independently finished. Complete canonical job/work-item inventories verify 36 assembly executions plus four controller rows, all Finished with integer exit0; each job has nine assembly items plus one controller. These are not40 individual tests, overall CI clearance or native-canary qualification. The provider's capped100-record timeline and null work-item states were not accepted as complete evidence; canonical uncapped inventories supplied the missing fields.

The terminal1625487 canonical uncapped timeline contains 1,037 root records / four stages / 26 realized jobs, all completed succeeded, with no failed/canceled/abandoned/succeeded-with-issues root records or structured record errors. Its four prior source-bound Helix unit jobs independently finished with integer exit0: 36 assembly work-item executions plus four controller rows, not40 individual tests. The prior1625201 also completed with1,037 records/all26 jobs/all four stages succeeded and all18 integration tasks successful. These are prior source-bound ordinary CI results, not current2e/native qualification or production readiness.

Actual current2e artifact11450573445/XML contains 2,810 cases / 2,807 passed / three failed / zero skipped. The actual checkout log proves merge 96d51c0520b0cdb0db15f873476c2c07a8800ac1 tested current source 2e1b16db701ced97f76c982a23ba9c31310d109f into main 7d38fd06d059c4875bd81690c360a196aae26a26; run-head metadata alone was not treated as checkout proof. All three full failure names and full messages exactly match the actual targeted local baseline on immutable main f7530d0af403055a37cc945904905aacb94a63ef. This is local targeted main evidence, not full hosted main CI or all-green current-head clearance. No cause is inferred for the nine additional cases versus the preceding hosted run. Prior artifact11430972240/source69 and 7aa hosted37525745226 each record 2,798 passed / three identical baseline failures / zero skipped; they remain prior-source results.

Three-case native evidence: current Android diagnostic/video actually published; zero confirmed reproductions as of 2026-10-07 00:34Z

Case	Actual execution	Qualification limit
Android WebView #38452: 1625050, exactee3	Completed failed00:09:37Z. Original first named body failed the intended parent-scroll assertion: ordinary-label control112.0, short WebView0.0, expected greater than20. Original81,746byte clip/all60 audited frames and current diagnostic6027318489 remain unchanged	Fresh confirmation failed Emulator ZIP installation before its body; forwarding and final Report rejected missing completed confirmation. Original manual result stays inconclusive/25%; final Report's separate0% preview has no validated forwarded result. No verified patch, strict packet or automatic publication
iOS singleton modal #38361: old 1625075, exactee3; corrected 1625773, exact2e	Old run completed failed00:09:27Z after the initial-home precondition failed, not singleton reopening. Its24,136 captured bytes were discarded by the inconclusive-TRX gate. Corrected run queued exactly once00:15:48Z and independently source/ref/case/definition-bound	Old Report rejected missing completed execution/0%; no exported clip or strict packet. Corrected run remains notStarted in this snapshot: no new native body, singleton assertion, confirmation or recording yet
iOS CollectionView #38276: 1625278, exact69	Author project actually built; reviewed Candidate job completed. Complete actual50-record live timeline still has Verify1First pending at00:30Z	No native body, recording or successful packet; changed reader's live native behavior remains unverified

Android's executed current candidate checks loaded/measurable/non-overflowing WebView content, a positive ordinary-label gesture control, finite numeric reset readiness abs(offset)<=0.5, and full viewport containment before the final assertion. The reported112.0/0.0 are app scroll values, not an asserted pixel unit. Original task outputs were recovered through the authenticated own-plan Task API and imported with maintained transport; they are not a reconstructed CANARY_PUBLICATION packet. The original inconclusive result was not mutated. First evidence cannot substitute for fresh confirmation. All60 actual decoded frames preserve source PTS/PNG hashes: control scroll to112, reset zero, stationary final short HTML; no pointer trace establishes gesture origin. The current8.53-second480x854 MP4, exact reviewed comment, real rendered video player and downloaded hosted bytes were independently verified.

The original Android result and current owned diagnostic/video were independently rechecked byte-identical after the terminal failure. Its complete131-record/seven-job timeline and all adverse task/job/phase logs bind the Emulator Error on ZipFile unknown archive/E2105/MSB3073 to SDK setup, before fresh test execution. Build Analysis has no known-issue match; no outage, current-target failure match, safe automatic retry or SDK-version workaround is asserted. Forwarding and Report failed closed; the full Report contains zero publication fields and the actual artifact inventory is empty. This does not erase or promote the separately recovered first-task diagnostic.

The old modal failure occurs at RequireHome(null), before any transient/singleton interaction. Its complete92-record terminal timeline and all adverse Report logs verify the strict missing-execution rejection, zero publication fields and empty artifact inventory. Captured bytes were never exported. The discard is an inconclusive-verdict gate, not a demonstrated TRX-duration defect. Wrapper job success is routing, not a passing NUnit test. No assertion, budget, sample prerequisite or qualification gate was relaxed to obtain a report. The author's reference recordings and released-version comparisons were not reused or claimed as our own tests.

The two active native cases each have exactly one responsive owned observer; observers for the terminal Android/old modal runs were consumed, not restarted. Corrected modal1625773 was queued exactly once only after independently terminal1625075, exact clean/live2e source, current write access, original command, immutable preview and a complete all-active-status/no-same-case inventory were checked. An exclusive fsynced attempt receipt preceded the single POST; independent full Build readback binds source/ref/case/definition313. The queue helper has executed and must not be rerun. Collection1625278 was likewise queued exactly once after its previous run became terminal; the actual Azure expansion selected one stage / seven jobs / zero credential groups, immutable Input/Candidate guards passed, and its exclusive durable attempt preceded one POST. Existing pins and both candidates are unchanged. No duplicate run, SDK/cache/pool change or repeated comment/upload was made.

Prior CollectionView1624931/exact772 completed failed18:13:58Z. Its complete92-record timeline has six executed jobs; confirmation was skipped. Actual Report87 rendered an expandable inconclusive / not verified / 0% evidence preview with the complete unverified draft, then rejected publication: The canary did not verify a completed candidate execution. It exported zero publication fields; the actual artifact inventory is empty. First TRX says native recording did not start and the body was not executed. There is no shrink assertion or eligible clip. The hard diagnostic-reader deadline is recorded; WDA startup slowness is context, not a proven cause.

Historical Android1624918/exact9cb completed with two matching assertions and a genuine strict packet. Its selected81,293byte MP4 decoded to53 actual frames, all audited. Because that source lacked052's corrected numeric reset-readiness guard, historical diagnostic6026994441 explicitly reports 0% confirmed evidence, the reset defect and unvalidated other execution. Its distinct historical recording is not current-candidate proof and was not reused for the current report. Historical modal1624847/exact97 entered its body, returned home after the first transient dismissal, then exhausted its26-second observation budget. No singleton-reopening assertion qualified; the expired clip was discarded, confirmation skipped and strict Report87 rejected publication.

Historical maui-pr1625034, ee3 trigger/merge b38adb7d7c7d2f9559c2c2e8315892574a41034e, was canceled17:21:58Z and deleted by the provider. Final timeline/logs are unavailable. The preserved990-record pre-cancel snapshot is partial; four recovered exact-Build-bound Helix unit jobs show36 assembly executions plus four controller rows finished/exit0, not overall CI clearance. No obsolete CI retry is queued. Actual ee3 hosted37485479681 records2,798pass/three identical main-baseline failures/zero skip.

Production activation remains blocked and defaults off

ISSUE_REPLICATE_ENABLED remains unset and the separate production definition is undeployed. Three findings remain unresolved:

• Evidence authenticity: generated code/detached writers share the native controller's OS user and can tamper with TRX/log/job-output evidence. Fresh agents, hashes, parent-memory export, method checks and acknowledgement do not establish OS isolation.
• Historical YAML/current-main enforcement: protected credential resources need a mandatory live current-main check outside the selected YAML, before credentials are released. In-YAML checks cannot secure historical versions.
• Activation-off direct queues: GitHub's activation variable does not prevent direct Azure queues or credential release. External resource checks must enforce live activation before protected groups are released.

No production credential resources, external checks or queue permissions were provisioned or validated. Keep the separate production definition disabled and activation unset. Do not disable existing definition313. The blocked deployment checklist is in the workflow guide. Local/static review, a passing helper suite and successful manual canaries are not overall pipeline approval or production-boundary proof.

Execution and evidence contract

Author-owned public GitHub repros are pinned and bounded. Intake re-fetches the open issue/original command, validates current repository write access, binds platform/ref and checks the current trusted infrastructure revision. Dispatch explicitly supplies the Azure self-repository version. Publication repeats authorization/revision checks before importing data or fallback. Copilot/read/comment credentials use distinct job-scoped groups; sample/native execution receives no Copilot or issue-comment credential and does not repurpose checkout credentials.

The unchanged author sample is built, not driven through the reported interaction. GPT drafts with executable tools disabled, including after a completed bounded author-build failure. Such a draft is explicitly uncompiled/unexecuted/unverified; native verification still requires the unchanged sample to build. At most one feedback-driven revision is permitted. Generate2 directly depends on Sample and imports the same validated bounded build context as Generate1. GitHub publication requires explicit allowed -GitHubRepository, never a silent fork default.

Each verification attempt uses a separate fresh hosted agent. Only two matching executed assertion failures, bound to identical candidate bytes, test, normalized diagnostic and candidate source frame, qualify as a verified failing test candidate. Every failed result must belong to the intended candidate; mixed unrelated/prefix-colliding failures stay inconclusive with no promotable identities. Passing/unsupported/non-assertion outcomes skip second-attempt provisioning. A credential-free Linux job forwards completed evidence without replacing two native executions with one. No issue run changes framework source or opens a fix PR. Repeated candidate failures are not original-issue confirmation.

Comments-only output and native media

Production/fork dispatch uploads no workflow run artifacts, including cross-job transfer. Named bounded gzip/base64 outputs carry allowlisted data, not scripts/build trees; imports verify hashes, decompression bounds and destination ownership. Samples, SDKs, compiled apps, TRX and patches remain in disposable workspaces; public execution logs remain on the run page. A successful strict native-canary Report exposes a bounded build/SHA-bound CANARY_PUBLICATION_ packet for an authorized local publisher. Report itself uploads nothing and posts no issue comment.

Comments match the requested expandable reference: collapsed Reproduction analysis contains short emoji-labelled Reproduction, Test, Evidence verdicts and expected/actual values when available. Nested Verified failing test patch or Unverified test draft and Native recording sections contain the complete readable diff and playable attachment. Follow-up is separate and collapsed. Build blockers are expandable; unsupported/missing drafts omit empty code sections. No visible technical boolean table, checksum or encoded block. The header adds explicit AI-generated attribution and flat-square Scope/validated MAUI Commit badges matching the supplied report-layout reference; absent validated intake omits the Commit badge. Original repro links and exact UTF-8 recovery remain available through readable source/hidden metadata; oversized patches use bounded continuations, not truncation or artifacts.

No operational run/log links appear in issue reports or queued/failed/media-pending/partial-patch notices. Percentages are evidence scores, not probabilities:0% unassessed/blocked/unsupported/first-pass;25% unconfirmed executed assertion, including a passing/inconclusive fresh confirmation;75% two matching independent failures. A Confirmation warning distinguishes completed fresh named execution from setup/recording/result failure. Zero does not invalidate the issue; no100% certainty or original-app causality is inferred.

UI recordings are bounded to 30seconds, no audio,512KiB MP4, uploaded as GitHub user attachments inside Native recording. Attachments outlive workflow artifacts and are not automatically deleted. A clip is candidate context, not independent authenticity/original-interaction proof. The controller selects the live loopback Appium frontend from incoming HTTP commands/top-level creation entries, never a distinct UiAutomator2/WDA proxy UUID or backend-discovery fallback. Wrong/multiple methods, repeated markers or stale/missing TRX discard the clip. Validation rejects fixture lifecycle/reset references and extra NUnit setup/teardown attributes, including escaped identifiers/comments/literals. Framework-owned successful setup-session recovery restarts recording only on a changed session ID; recorder failure cannot export a verified patch/video.

Recording startup is synchronous: a trusted assembly-level NUnit action runs after one-time setup and blocks before per-test setup/body. Its nonce/operation-bound readiness waits25seconds for acknowledgement; the controller starts recording before acknowledging. Failed/missing acknowledgement blocks body. Original named Start/Stop/fresh TRX remain mandatory; expired clips are discarded. Acknowledgement reads are bounded128characters, owned temporary state is cleaned, and environment restored. Same-user code can still tamper with IPC/evidence. Session-recreation recording is asynchronously observed, not newly proven synchronous. Acknowledgement/decoding do not prove initiating-interaction coverage: every actual selected frame must be audited before upload.

The filtered selector scans at most64MiB/retains80 non-syslog rows; its unchanged four-second process deadline leaves room for the20-second recording HTTP request within25-second acknowledgement. Missing/out-of-window frontend evidence fails explicitly. Heavy pure-syslog scans/host load can still hit a deadline. Publication checkpoints an owned pending report before upload, then the approved URL immediately after upload, before final reporting/continuations. Retries reuse matching run/video receipts. If upload may have started but its URL was not persisted, retries fail closed instead of uploading again or overwriting pending state. Writes are not atomic; failed publication does not claim playable media. Read-only preview uploads nothing. Receipt reconciliation uses supported paginated gh api --jq, not --slurp with --jq.

Historical source-bound corrections and useful published reports

Earlier97 fixes finite nullable Android parsing;7a selects the outer WebView through its native HTML subtree;9cb corrects Report wording without changing predicates;772 uses coherent CollectionView snapshots;052 replaces substring reset readiness with finite numeric abs(offset)<=0.5;f845 uses coherent modal snapshots;ee3 clarifies caller waits do not cancel issued Appium requests.335 fixes mixed-failed-TRX classification.3c/3e preserve first-attempt evidence through inconclusive/passing confirmation without promoting it to verified.312 introduces synchronous recording acknowledgement;ae39 fixes frontend evidence lost behind marked iOS syslog. Earlier ca/f6/498 pin simulator selection and WDA preparation; a2 adds at most three fresh owned checkout attempts with transfer integrity and pinned clean staging.2500adc normally merges mainf753, without rewriting history. These changes and their historical validations are not relabelled current7aa/native proof.

Immutable run	Published result	Evidence limit
CarouselView1622599, exact541	Report5980454010, matching Current2/Current0 assertions and native video	Predates later recording/lifecycle guards
CarouselView1622652, exact6f	Report5982232008, two matching recorded assertions, exact patch/video	Repeated candidate error, not original-app causality
ScrollView1622652, exact6f	Report5982017462, passing test, full unverified passing draft, video showing Padding0 to40	Does not reproduce the reported error or prove sensitivity
RefreshView1622978, exactae39	Report5990947149, two recorded assertions, exact patch and video	All53 selected frames audited; author app built, not driven
Shell1623866, exacta2	Report6005514049, two root-disconnection/pop assertions, exact patch and video	All126 selected frames audited; authorized retry reused the same report/attachment

The RefreshView selected22,033byte MP4 hashes to 50e1ed2b638319c5a12d867dbccb6170cac9d1a287eea9736600ff0230c2b21a;53 actual frames show baseline, downward movement and result. Shell's selected55,335byte MP4 hashes to 9aac6e2c870dc22af78b8173097a0cb3f1de43c2fb2b4aa1ba0400524ffd9928;126 actual frames show connected root, ordinary push/pop control, modal dismissal/navigation and empty disconnected root/pops1. Downloaded hosted bytes, recovered exact patches, live owned comments and receipts match. Neither proves original-app causality or automatic production posting.

Withheld recordings remain withheld: source498 iOS clip began at the latched failure rather than the initiating gesture; source312 CarouselView decoded to only two already-failed frames. Sparse/repeated frames are not motion. Successful acknowledgement is not universal WDA/encoder reliability. Several earlier iOS trials failed WDA startup, fresh fixture setup, recording HTTP500 or frontend selection; strict Report rejected partial execution instead of borrowing a first clip. Source312's iOS fresh recording hook blocked setup/body despite a first assertion;ae39's real-I/O syslog fixture reproduced the selection loss before the later successful native trial. #38909's unchanged net10.0-ios27.0 author build is incompatible with pinned iOS26 (NETSDK1140); its published draft is uncompiled/unexecuted, not verified. #33444 failed before meaningful native execution. Neither was redispatched to hide a prerequisite.

Validation

Current2e: the existing four runtime suites passed 269/269, zero failed/skipped with credentials removed from the test process. PowerShell parsing, PSScriptAnalyzer formatting of the edited range and git diff --check passed. The original same-run Android Input/Sample/Candidate/result and all60 frame hashes passed the maintained read-only publisher; its source result stayed byte-identical and inconclusive. Actual publication was independently checked against the reviewed body, owned comment, four expandable sections, GitHub's rendered video player and byte-identical downloaded media; full demux-time-base decoding passed. Normal coauthored push, exact live remote/PR head and clean worktree were verified. No tests or pipeline/configuration fixtures were added.

The actual current2e Azure modal configuration preview returned id-1 / one stage / seven jobs / zero credential groups, with unchanged immutable HostApp/Candidate/manifest hashes and the same expanded YAML hash as7aa. The preview itself queued no build. After the prior run became terminal and all source/access/duplicate/attempt guards passed, the separate source-bound helper executed exactly once and queued1625773; its durable attempt prevents repetition. This is queue/configuration proof, not corrected native execution. No readiness, assertion, recording or evidence gate was relaxed.

Prior7aa: the full exact modal candidate compiled with nullable warnings treated as errors and zero diagnostics. All 20 isolated scenario controls passed, using actual source97 home XML with explicitly synthetic modal states/latencies. The unchanged nominal simulated2,209ms-read/250ms-action scenario completes21.673s with9 snapshots/4 taps/3 swipes; the new3,100ms valid first-read control completes3.107s. Disabled late home remains a3.209s setup timeout/zero actions; slow overall execution times out26.110s and schedules no post-expiry action. Missing/hidden/duplicate controls, wrong identities, DTD and invalid/nonfinite/insufficient geometry remain setup/protocol failures, not bug assertions. This does not measure actual full native latency or prove current hosted success.

Prior7aa's existing four runtime suites passed 269/269, zero failed/skipped; no new pipeline/configuration tests or committed fixtures were added. Exact command and result:

pwsh -NoProfile -Command '$ErrorActionPreference="Stop"; $config=New-PesterConfiguration; $config.Run.Path=@(".github/scripts/IssueReplicate.Tests.ps1", ".github/scripts/IssueReplicate.Recording.Tests.ps1", ".github/scripts/IssueReplicate.Diagnostics.Tests.ps1", ".github/scripts/IssueReplicate.CanaryData.Tests.ps1"); $config.Run.PassThru=$true; $config.Output.Verbosity="None"; $result=Invoke-Pester -Configuration $config; $result | Select-Object TotalCount,PassedCount,FailedCount,SkippedCount | ConvertTo-Json; if($result.FailedCount -ne 0){exit 1}'

Result: Total269 / Passed269 / Failed0 / Skipped0, exit0. dotnet format whitespace .github/issue-replicate-canary/ios-modal-singleton --folder --include Tests.cs --verbosity quiet and git diff --check both passed. Actual immutable Input/Candidate preparation through IssueReplicate.Canary.ps1 passed. The normal coauthored commit/push, exact remote equality and clean worktree were verified. These prior validations are separate from the still-required corrected native run and current2e CI.

Prior69:269 runtime cases, PowerShell parsing, isolated embedded-Python AST parsing and diff checks passed; actual hosted XML confirms2,798pass/three inherited failures/zero skip/all eight diagnostic cases passed. Existing suites cover large/syslog-heavy files, oversized rows, scan/output bounds, FIFO/symlink/nonregular files and hard reader deadlines. No new configuration/Pester/regex/YAML snapshot tests were introduced for8KiB/81st-row/concurrent-short-read paths. Actual parser replay is not recording-start proof. Prior f845's18 synthetic controls/zero compiler diagnostics and hosted 374850800022,798pass/three inherited failures remain historical, not current7aa validation.

The three full inherited failure names are Copilot reviewer base branch allowlist.Copilot model policy.pins the local test reviewer instead of accepting an environment override; Copilot reviewer configuration.pins the local test reviewer to GPT-5.6 Sol with long context; Review tests workflow contract.uses one skill and one comment without a competing format or visual publisher. Full source69 failure-message hashes match exact-mainf753's targeted local baseline: first two 753855b649809048d58b2db197694319737d0edcce8e0a12a7bb02563a18ddf0, third 2aa5f639a30b73b0bf9cd37a1be1e219625401d5b08844667ea64e5759077447. Existing expectations use GPT-5.6 while reviewer/workflow uses GPT-6.1. No failure was hidden/skipped/patched or represented as green hosted CI; this is not a full main-suite baseline.

Live production authorization/OIDC dispatch/recovery, externally protected credential release, live GPT generation/revision, production Post, original-app causal/alignment controls, universal initiating-interaction coverage, net11 provisioning, native unit/XAML candidates and physical devices remain unverified. Recovery remains disabled; no mocked dispatcher/configuration tests were added under the user's constraint. Manual local reports do not prove automatic production publication. Enforce and exercise the three external production boundaries before activation.

Issues Fixed

No framework issue is closed by this infrastructure PR. #37323, #36129, #39080, #38821, #38909, #33444, #37360, #38452, #38361 and #38276 are public canaries only.

Terminal current a193 CI and exact-parent baseline - 2026-10-07 07:59Z - click to expand

Current ordinary CI failed; it is not cleared. This terminal update supersedes every earlier pending/in-progress label above. The complete expandable current-source investigation preserves the actual failures, baseline comparison and binlog limits.

maui-pr1625939 completed failed07:59:26Z, with actual definition302/triggera193/merge a6f0e63767f55b0e0f2674da8b578facf7d1c4f7. The complete uncapped 1,037unique terminal-record /26-job inventory has 24successful jobs and two failed jobs. Every adverse record and all seven available adverse logs were inspected.

• Windows Release: MSB4024 sharing violation importing .buildtasks/Microsoft.Maui.Core.After.targets in the Android Embedding sample. The failing job's own artifact/binlog confirms the error and32recorded writes from unchanged Core.csproj/_CopyToBuildTasksDir/Copy. All observed path-activity pages were read, but the historical lock holder/overlap is not proved. All five latest completed main/definition302 Release legs passed; no known-issue match was found. This remains unmatched / needs investigation, not established infrastructure, a safe retry, or a proven PR cause.
• Windows Build integration: actual current log/result is 98pass /1fail /0skip /99total. The exact ReportsTruncatedAssemblyGuidWithoutReplacingBuildFailure(guidBytes: 15) case, full message/stack and60-second fixture process timeout match latest completed main1625190. That particular failure is pre-existing; it does not dismiss the separate Release failure. Inaccurate run-level failed-count summaries were not trusted.
• Current Helix: all four exact-build jobs are finished. Complete actual sets verify 36assembly executions plus four controllers, every row Finished/integerExit0, with nine initial assemblies plus the controller per job. These are not40individual tests. Actual current macOS Build integration is 99pass /0fail /0skip. No earlier-source result was borrowed.
• Stronger PowerShell baseline: the complete unchanged six-selector Pester5.9.0 gate on actual hosted main parent 7d38fd06d059c4875bd81690c360a196aae26a26 passed 2,538 /2,541, with three failures /zero skipped. Every full failure name/message exactly equals current hosted a193's 2,807pass /2,810total /three failures /zero skipped. This is a full local gate baseline, not full hosted-main CI or all-green current-source clearance. The269count difference is arithmetic only; differing parameterized display order prevents an exact raw case-name-subset claim.

The sole current CI observer and attached kernel wait both finished; the requested continuous feedback watch remains running. No new source edit, queue, native retry, media upload or issue publication was made. The three native results remain unconfirmed, the three production trust findings remain unresolved, and production remains off. The Windows Release failure prevents ordinary-CI clearance.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 38807

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 38807"

[Copilot]

Copilot review overview

🟡 Changes recommended

Untrusted marker handling, incomplete candidate validation, and unbounded artifact publication can suppress runs or publish unverified data.

Review effort: Balanced
Findings: 5 · 2

Open (7)

• Regex accepts unconditional Assert.True(false) failures · New
• Unit candidates can verify files from the wrong project · New
• Untrusted users can forge result idempotency markers · New
• Untrusted users can forge recovery start markers · New
• Untrusted users can forge durable command markers · New
• Publishing exposes unbounded workspace build output · New
• Generated tests can create unbounded published artifacts · New

What changed in this PR

Adds a maintainer-triggered public pipeline for generating and verifying issue reproduction tests. The title and description match the implementation.

Changes:

• Adds GitHub trigger and missed-webhook recovery workflows.
• Adds isolated Azure jobs for sample building, candidate generation, verification, and reporting.
• Adds validation, Pester coverage, and deployment documentation.

File	Description
eng/​pipelines/​common/​provision.yml	Supports isolated repro provisioning.
eng/​pipelines/​common/​issue-replicate-verify-job.yml	Defines credential-free verification jobs.
eng/​pipelines/​ci-issue-replicate.yml	Orchestrates the public repro pipeline.
.github/​workflows/​powershell-script-tests.yml	Includes new pipeline assets in test triggers.
.github/​workflows/​issue-replicate-trigger.yml	Authorizes and queues repro commands.
.github/​workflows/​issue-replicate-recovery.yml	Recovers missed commands.
.github/​scripts/​IssueReplicate.Verify.ps1	Executes and validates generated tests.
.github/​scripts/​IssueReplicate.Tests.ps1	Adds targeted Pester coverage.
.github/​scripts/​IssueReplicate.Sample.ps1	Builds submitted samples.
.github/​scripts/​IssueReplicate.Recover.ps1	Finds missed commands.
.github/​scripts/​IssueReplicate.Post.ps1	Publishes bounded outcomes.
.github/​scripts/​IssueReplicate.Intake.ps1	Pins and bounds repro inputs.
.github/​scripts/​IssueReplicate.Generate.ps1	Generates tool-free test candidates.
.github/​scripts/​IssueReplicate.Core.ps1	Provides shared validation logic.
.github/​scripts/​IssueReplicate.Checkout.ps1	Fetches pinned public source.
.github/​docs/​trigger-azdo-pipeline-setup.md	Documents public pipeline setup.
.github/​docs/​issue-replicate.md	Documents usage and isolation.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Verification can export uncompiled or mutated candidate code, and its unconditional-failure guard is bypassable.

Review effort: Balanced
Findings: 5 · 2

Open (7)

• Untrusted users can forge durable command markers
• Untrusted users can forge recovery start markers
• Untrusted users can forge result idempotency markers
• Unit candidates can verify files from the wrong project
• Regex accepts unconditional Assert.True(false) failures
• Generated tests can create unbounded published artifacts
• Publishing exposes unbounded workspace build output

Previously missed (1)

In code that hasn't changed since last review

Verify all unit files belong to the same test project

.github/​scripts/​IssueReplicate.Verify.ps1:61

Unit candidates may contain files from several test projects, but verification chooses a project solely from files[0]. Files under the other allowed roots are therefore exported in the “verified” patch without ever being compiled or executed. Require every unit file to belong to the same test project before selecting it.

This issue also appears on line 130 of the same file.

[PureWeen]

Adversarial review

An independent reviewer panel found these non-duplicative issues at f0e51ca078bab1fe6f9e73ce58ceb74a05c6c3b9:

• ❌ Integrity — the published patch is not bound to the executed candidate. IssueReplicate.Verify.ps1 writes the candidate files, runs them twice in the writable checkout, and only then builds test.patch from those paths. A generated test can overwrite its own source after compilation and before patch creation, so the public patch can contain bytes that neither verification attempt executed. Snapshot the candidate patch/hash before execution, then export that snapshot or reject post-run changes. Consensus: 2/3 reviewers.
• ❌ Reliability — a pre-queue reservation permanently blocks recovery. The trigger writes issue-replicate-start:<comment>:pending before Azure has accepted the queue request, while both trigger deduplication and scheduled recovery treat every such marker as terminal. Cancellation after reservation, or a timeout with an unknown Azure outcome, leaves a command stuck forever; issuing a new command can also duplicate an already accepted request. Make pending reservations leases and reconcile them with a trusted run identifier before retrying. Consensus: 2/3 reviewers.
• ❌ Reliability — recovery's eyes reaction is a permanent terminal latch. Recovery adds the reaction before dispatching the workflow and clears it only when the dispatch command itself fails. If the accepted workflow later fails before creating a start marker or rocket reaction, every future recovery scan skips the original command. Use an expiring reservation or remove eyes until downstream acknowledgement succeeds. Consensus: 2/3 reviewers.

The Pester suite does not simulate candidate-source mutation, a cancellation/unknown response after reservation, or a dispatched recovery workflow failing before acknowledgement. Existing review feedback covers unrelated marker-provenance, assertion-filter, and mixed-project concerns, so those were not repeated.

Methodology: 3 independent reviewers with adversarial consensus.

Scope: code review only. CI/check status and merge readiness were not evaluated; use the repository's CI-analysis workflow for that assessment.

[Copilot]

Copilot review overview

🟡 Changes recommended

Candidate verification can publish unexecuted patch content and does not reliably confirm matching assertion failures.

Review effort: Balanced
Findings: 6 · 2

Open (8)

• Capture the immutable patch before executing generated tests · New
• Untrusted users can forge durable command markers
• Untrusted users can forge recovery start markers
• Untrusted users can forge result idempotency markers
• Unit candidates can verify files from the wrong project
• Regex accepts unconditional Assert.True(false) failures
• Generated tests can create unbounded published artifacts
• Publishing exposes unbounded workspace build output

Previously missed (1)

In code that hasn't changed since last review

Compare stable signatures for matching assertion failures

.github/​scripts/​IssueReplicate.Verify.ps1:126

This does not establish two matching assertion failures. Get-IssueReplicateTrxVerdict returns the names of all test results, including passing tests, so the same class can fail in different test methods—or at different assertions in one method—on the two attempts and still be marked candidate-failed. Compare stable signatures for the actual failed assertions before publishing the verified-candidate verdict.

[PureWeen]

Adversarial review

An independent reviewer panel found these non-duplicative issues at f08d3dcd4e338ba7333730c9e9318ee26e51cbd1:

• ⚠️ Regression — UI verification is not portable to every advertised target branch. IssueReplicate.Verify.ps1 assumes the current BuildAndRunHostApp.ps1 emits CustomAgentLogsTmp/UITests/TestResults/FullyQualifiedName_<Issue>.trx. A pinned servicing branch can use a runner that does not produce that TRX path, so a valid /issue replicate --branch netN.0 UI test is always classified as inconclusive even after execution. Obtain the result path from a runner-owned contract (or require the runner to place a TRX at an explicit supplied destination) and fail explicitly when the pinned runner cannot provide it. Consensus: 2/3 reviewers.
• ⚠️ Reliability — Generate2 runs after a verification job fails before testing. Its custom condition checks only verify.verdict == inconclusive, which replaces the normal success guard; the freeze step exports that value even when provisioning or emulator startup prevented IssueReplicate.Verify.ps1 from running. The revision job then spends a Copilot invocation before failing on a missing/partial test log, obscuring the original infrastructure error. Gate on successful Verify1 plus a verified feedback artifact, and distinguish not-run from genuinely inconclusive test execution. Consensus: 2/3 reviewers.

The panel did not repeat existing feedback on marker provenance, candidate/project validation, assertion filtering, bounded artifacts, candidate patch provenance, or failure-identity matching.

Methodology: 3 independent reviewers with adversarial consensus.

Scope: code review only. CI/check status and merge readiness were not evaluated; use the repository's CI-analysis workflow for that assessment.

[Copilot]

🔵 Needs a closer look

Evidence authenticity and external credential-release enforcement remain unvalidated and require human security review before production activation.

8 open issues

• Azure pipeline bypasses activation gate and exposes credentials
• Bind pipeline intake and publication to the current trusted main SHA
• Untrusted tests can forge trusted evidence files
• Compare full Xcode versions when enforcing minimum requirements
• Add Android recording budget assertions
• Add parser regression tests for supported metadata declarations
• Add tests for the recording transcoding and byte-cap path
• Add tests for author SDK and runtime provisioning paths

1 file not reviewed

• .github/issue-replicate-cli/package-lock.json: Generated file

_{Review effort: Balanced}

[github-actions]

Skill Validation Results

@kubaflo — new skill validation results are available based on this last commit: 72ab0d6.
To request a fresh validation after new comments or commits, comment /evaluate-skills.

⚠️ Skill Validation Results — 72ab0d6 · Add public /issue replicate pipeline for issue repros · 2026-11-02T10:24:25Z

✅ Static Checks Passed

Skills: 28 | Eval specs linted: 17

Full lint output

── .github/skills/agentic-labeler/tests/eval.vally.yaml
npm warn deprecated @opentelemetry/sdk-trace-node@2.12.0: Use @opentelemetry/sdk-trace package
npm warn deprecated @opentelemetry/sdk-trace-base@2.12.0: Use @opentelemetry/sdk-trace package
Vally collects pseudonymous usage telemetry (command name, version, outcome, duration, persistent device identifier (when available), and coarse OS/runtime info) to improve the product. No prompts, datasets, file paths, or arguments are collected.
Opt out any time by setting VALLY_TELEMETRY_OPTOUT=1 or DO_NOT_TRACK=1.
Learn more: https://aka.ms/vally/telemetry
✔ .github/skills/agentic-labeler/tests/eval.vally.yaml is valid
── .github/skills/analyze-sessions/tests/eval.vally.yaml
✔ .github/skills/analyze-sessions/tests/eval.vally.yaml is valid
── .github/skills/ci-fix/tests/eval.ownership.vally.yaml
✔ .github/skills/ci-fix/tests/eval.ownership.vally.yaml is valid
── .github/skills/ci-fix/tests/eval.vally.yaml
✔ .github/skills/ci-fix/tests/eval.vally.yaml is valid
── .github/skills/code-review/tests/eval.inline-findings.vally.yaml
✔ .github/skills/code-review/tests/eval.inline-findings.vally.yaml is valid
── .github/skills/code-review/tests/eval.producer-trace.vally.yaml
✔ .github/skills/code-review/tests/eval.producer-trace.vally.yaml is valid
── .github/skills/code-review/tests/eval.trim-aot.vally.yaml
✔ .github/skills/code-review/tests/eval.trim-aot.vally.yaml is valid
── .github/skills/code-review/tests/eval.vally.yaml
✔ .github/skills/code-review/tests/eval.vally.yaml is valid
── .github/skills/code-review/tests/hermeticity.vally.yaml
✔ .github/skills/code-review/tests/hermeticity.vally.yaml is valid
── .github/skills/code-review/tests/soak.capability.vally.yaml
✔ .github/skills/code-review/tests/soak.capability.vally.yaml is valid
── .github/skills/evaluate-pr-tests/tests/eval.vally.yaml
✔ .github/skills/evaluate-pr-tests/tests/eval.vally.yaml is valid
── .github/skills/pr-review/tests/eval.gh-auth.vally.yaml
✔ .github/skills/pr-review/tests/eval.gh-auth.vally.yaml is valid
── .github/skills/review-test-failures/tests/eval.vally.yaml
✔ .github/skills/review-test-failures/tests/eval.vally.yaml is valid
── .github/skills/try-fix/tests/eval.restore.vally.yaml
✔ .github/skills/try-fix/tests/eval.restore.vally.yaml is valid
── .github/skills/try-fix/tests/eval.vally.yaml
✔ .github/skills/try-fix/tests/eval.vally.yaml is valid
── .github/skills/verify-tests-fail-without-fix/tests/eval.protocol.vally.yaml
✔ .github/skills/verify-tests-fail-without-fix/tests/eval.protocol.vally.yaml is valid
── .github/skills/verify-tests-fail-without-fix/tests/eval.vally.yaml
✔ .github/skills/verify-tests-fail-without-fix/tests/eval.vally.yaml is valid

⚠️ LLM Evaluation Incomplete

No valid JUnit suite results were found for: verify-tests-fail-without-fix.

🔍 Full results and investigation steps

[kubaflo]

Current-source correction: pushed cf6f8f5 as a normal fast-forward update. This status supersedes the historical “current” labels in the long-running investigation above; it is not an all-green or native-runtime verdict.

An actual verifier run exposed a baseline-binding bug: dot-sourcing EstablishBrokenBaseline.ps1 reset the caller’s explicit BaseBranch parameter, losing the frozen full SHA and falling back to live PR metadata. The one-line correction passes the saved SHA into that import. No assertion, failure classification, credential boundary, or test-execution policy was relaxed.

The corrected actual verifier completed nine fresh minimal managed-only source fixtures on SDK 10.0.113, using the existing GC-helper methods and eight existing cases from #38822, without copying its production fix into this PR. All five controls were measured 3/3: baseline 6 passed / 2 exact stale-reference failures; single-line trigger removed 8 passed; fixed 8 passed; verifier-owned fix reversal 6 passed / 2 failed; exact-source restoration 8 passed. Baseline failure-only gates returned VERIFICATION PASSED; trigger-removed negative controls correctly returned VERIFICATION FAILED; full gates returned VERIFICATION PASSED. Actual TRX case counts/hashes, all nine explicit frozen-SHA markers, source restoration, and clean fixture status were checked. PowerShell syntax and git diff --check passed. No new pipeline/configuration tests were written.

Boundary: these are deterministic virtual-WeakReference managed controls, not causal proof for actual SwipeView/Gesture device failures. Historical device build 1649204 still has an unmatched SwipeViewTests.ItemsDoNotLeak failure; its exact-main comparison passed that case. The GC-helper fix remains owned by #38822.

Existing automatic maui-pr 1649455 is queued for this exact head and merge 91643dcb55cc2451bf71ce942127d9d880f4f888 (parents main 4781afbd5588e2ba5d3ade0aa50d028bef3420b0 plus the published head). Earlier 8ed6bf58 CI is historical, not certification of this new head. No additional /azp dispatch or retry was issued; native and production-activation holds remain.

[Copilot]

🔵 Needs a closer look

The cross-service execution and publication design needs human security review of the documented unresolved evidence-authenticity and external credential-release boundaries.

8 open issues

• Azure pipeline bypasses activation gate and exposes credentials
• Bind pipeline intake and publication to the current trusted main SHA
• Untrusted tests can forge trusted evidence files
• Compare full Xcode versions when enforcing minimum requirements
• Add Android recording budget assertions
• Add parser regression tests for supported metadata declarations
• Add tests for the recording transcoding and byte-cap path
• Add tests for author SDK and runtime provisioning paths

1 file not reviewed

• .github/issue-replicate-cli/package-lock.json: Generated file

_{Review effort: Balanced}

[PureWeen]

Adversarial review

Agent-written independent reviewer assessment of exact head cf6f8f5e415702d3f4f120720c71a612e58e32d3. One new finding survived causal validation and prior-feedback suppression.

Warning: assertion aliases bypass constant-only candidate rejection

In IssueReplicate.Core.ps1:614-622, the literal-expression checks require a call spelled Assert.*. A generated xUnit test using using A = Xunit.Assert; ... A.True(false);, or using static Xunit.Assert; ... True(false);, therefore passes admission even though the equivalent Assert.True(false) is rejected.

These calls still execute the real xUnit assertion API. The assertion/body classifier and repeat-identity check can consequently promote this constant-only test to candidate-failed, and the publisher can attach the useless patch as a 75% verified failing candidate. This wastes verification capacity and defeats the documented constant-only admission restriction. It does not establish a false claim that the original issue was reproduced: the report correctly retains its human-fidelity-review caveat.

Please resolve assertion aliases/static imports when applying the literal-expression check, and add admission negatives for both spellings alongside a positive control using an aliased assertion on an observed value. This is a remaining call-target spelling gap in the guard added for the earlier constant-assertion report, not a repeat of its directly spelled examples or the separate assertion-exception-type report.

Supported by 2/3 reviewers after dispute.

Evidence and coverage: An isolated probe of the exact-head, inspected pure validator functions rejected the direct literal assertion and admitted both alias/static-import variants; an observed-value alias remained admitted. Downstream promotion/publication was source-traced, not executed. The review used the authoritative 66-file GitHub diff (61 added, five modified), complete prior feedback (232 reviews, 32 issue comments, 142 inline comments/replies), full-source reads and relevant consumer traces. Existing admission negatives cover direct spellings but not these variants. The title matches the implementation; previously reported source-stale description metadata was not raised again.

Method and limits: 3 independent reviewers with adversarial consensus. The third reviewer completed its source/feedback coverage gaps, but consumer-trace depth was not uniform across the panel. No generated C#, downloaded repro, native-device test or hosted pipeline was executed. Existing-thread resolution status is unknown; no thread state was changed.

Scope: code review only. CI/check status and merge readiness were not evaluated; use the repository's CI-analysis workflow for that assessment.

[Copilot]

🔵 Needs a closer look

The Xcode selector discards the required patch version, reproducibly allowing Xcode 26.0 when the SDK requires 26.0.1 and passing that incompatible selection to author provisioning and framework verification.

8 open issues

• Azure pipeline bypasses activation gate and exposes credentials
• Bind pipeline intake and publication to the current trusted main SHA
• Untrusted tests can forge trusted evidence files
• Compare full Xcode versions when enforcing minimum requirements
• Add Android recording budget assertions
• Add parser regression tests for supported metadata declarations
• Add tests for the recording transcoding and byte-cap path
• Add tests for author SDK and runtime provisioning paths

1 file not reviewed

• .github/issue-replicate-cli/package-lock.json: Generated file

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Production safety depends on external credential-release and evidence-isolation controls that this snapshot cannot validate, while end-to-end authorization, native execution, and automatic publication still require independent verification.

8 open issues

• Azure pipeline bypasses activation gate and exposes credentials
• Bind pipeline intake and publication to the current trusted main SHA
• Untrusted tests can forge trusted evidence files
• Compare full Xcode versions when enforcing minimum requirements
• Add Android recording budget assertions
• Add parser regression tests for supported metadata declarations
• Add tests for the recording transcoding and byte-cap path
• Add tests for author SDK and runtime provisioning paths

1 file not reviewed

• .github/issue-replicate-cli/package-lock.json: Generated file

_{Review effort: Balanced}