@boyingliu01/xp-gate 0.35.24 → 0.36.0

package/gate-13-compiler-strictness.sh

@@ -1180,3 +1180,184 @@ EOF
   # stage for no benefit.
   return "$GATE13_PASS"
 }
+
+# ============================================================================
+# C# / .NET PATH (#717 / REQ-005)
+#
+# Measured motivation, same shape as the C/C++ and Java paths above: `dotnet
+# build` on a solution with default settings reports NOTHING for a converted
+# nullable warning or an obsolete API, because MSBuild's default
+# WarningLevel/TreatWarningsAsErrors is whatever the project happens to declare.
+# `-warnaserror -p:Nullable=enable` turns the same source into hard errors --
+# which is exactly what a *compiler strictness* gate is for, and what no other
+# gate in the chain does (Gate 1 runs `dotnet format`, which formats and runs
+# analyzers but does not fail on the full compiler warning set).
+#
+# Verdict codes follow the file-level contract: 0 PASS / 1 FAIL / 2 BLOCK (tool
+# ran but output untrustworthy) / 3 WARN (tool absent, timeout, or warn-only).
+#
+# Deliberately driven by the adapter's own toolchain discovery rather than a
+# second copy of it: two independent "where is dotnet" implementations is how
+# detection and gates drift apart.
+# ============================================================================
+
+# Locate the .NET SDK exactly as adapters/csharp.sh does.
+gate13_csharp_dotnet() {
+  local d
+  d="${DOTNET_BIN:-}"
+  if [ -z "$d" ]; then
+    d=$(command -v dotnet 2>/dev/null) || d=""
+  fi
+  [ -n "$d" ] || return 1
+  "$d" --version >/dev/null 2>&1 || return 1
+  printf '%s\n' "$d"
+}
+
+# Print the staged .cs files (not the whole build output) that Gate 13 judges.
+gate13_csharp_sources() {
+  git diff --cached --name-only --diff-filter=d -- '*.cs' 2>/dev/null
+}
+
+# Print the .NET entry point to build: a solution, else a project file.
+#
+# Bare `dotnet build` in the repo root fails with MSB1003 whenever the project
+# lives in a subdirectory -- the normal layout (src/App/App.csproj) and the one
+# every fixture here uses. Measured: bare build produced no diagnostics at all
+# while `dotnet build P/P.csproj` produced the two real warnings. Resolving the
+# entry point explicitly is what makes the gate see anything.
+gate13_csharp_entry_point() {
+  local f
+  # A .sln is the widest scope and builds every project in it.
+  f=$(git ls-files '*.sln' 2>/dev/null | head -1)
+  if [ -n "$f" ]; then printf '%s
+' "$f"; return 0; fi
+  f=$(git ls-files '*.??proj' 2>/dev/null | head -1)
+  if [ -n "$f" ]; then printf '%s
+' "$f"; return 0; fi
+  # Fall back to the working tree for a not-yet-tracked project.
+  for f in *.sln *.??proj; do
+    [ -f "$f" ] && { printf '%s
+' "$f"; return 0; }
+  done
+  return 1
+}
+
+# Is there a buildable .NET entry point to compile at all?
+gate13_csharp_has_manifest() {
+  local f
+  for f in *.sln *.csproj Directory.Build.props global.json; do
+    [ -f "$f" ] && return 0
+  done
+  # A nested layout is normal (src/App/App.csproj).
+  [ -n "$(git ls-files '*.*proj' '*.sln' 2>/dev/null | head -1)" ] && return 0
+  return 1
+}
+
+# Count compiler warnings FROM CHANGED FILES only.
+#
+# `dotnet build` reports diagnostics for the whole project, so counting every
+# warning would make a one-line change inherit the project's entire back-catalog
+# and block on work the author never touched -- the false-BLOCK that Gate 13's
+# baseline mechanism exists to prevent. Only lines naming a file this commit
+# stages are counted; everything else is baseline territory.
+gate13_csharp_changed_warning_count() {
+  local dotnet="$1" out entry stage_files
+  stage_files=$(git diff --cached --name-only --diff-filter=d 2>/dev/null)
+  [ -n "$stage_files" ] || return 1
+
+  # -clp:NoSummary keeps the summary table out of the parse; --nologo drops the
+  # banner.
+  #
+  # --no-incremental is REQUIRED, not an optimisation tradeoff. MSBuild skips
+  # compilation when its outputs are newer than the sources, and a skipped
+  # compile emits no diagnostics -- measured: the same tree reported 2 warnings
+  # from a clean build and 0 from an immediately following incremental one. A
+  # strictness gate that only sees warnings the first time is a gate that
+  # silently passes forever after, which is precisely the failure mode #717
+  # exists to remove.
+  #
+  # The entry point is passed explicitly: bare `dotnet build` in the repo root
+  # dies with MSB1003 whenever the project sits in a subdirectory, emitting no
+  # diagnostics at all.
+  entry=$(gate13_csharp_entry_point) || return 1
+  out=$("$dotnet" build "$entry" --nologo --no-incremental -clp:NoSummary 2>&1)
+
+  # Report distinct CHANGED FILES, not diagnostic instances: the caller speaks in
+  # files ("N changed C# file(s) carry compiler warnings"), and one file with two
+  # warnings is one file to fix.
+  #
+  # Two normalisations are needed and both were measured, not assumed:
+  #   - dotnet prints ABSOLUTE Windows paths while git reports repo-relative
+  #     ones, so a suffix match is what relates them;
+  #   - the separators differ, so the diagnostic path is folded to "/" first.
+  # Comparing raw strings matched nothing and reported 0 warnings on a file that
+  # has two.
+  printf '%s\n' "$out" \
+    | grep -E ': (warning|error) [A-Z]+[0-9]+' \
+    | sed -n 's/^\(.*\)(.*$/\1/p' \
+    | tr '\\' '/' \
+    | sort -u \
+    | while IFS= read -r f; do
+        [ -n "$f" ] || continue
+        while IFS= read -r s; do
+          [ -n "$s" ] || continue
+          case "$f" in
+            *"$s") printf '%s\n' "$s"; break ;;
+          esac
+        done <<EOF3
+$stage_files
+EOF3
+      done \
+    | sort -u | wc -l | tr -d ' '
+}
+
+gate13_run_csharp_analysis() {
+  local dotnet sources tier changed_count base
+
+  # gate13_is_disabled takes no argument: it reads the single repo-wide
+  # XP_GATE_DISABLE_13 switch, which disables every language path together.
+  if gate13_is_disabled; then
+    gate13_reason "compiler strictness disabled (XP_GATE_DISABLE_13=1)"
+    return "$GATE13_PASS"
+  fi
+
+  sources=$(gate13_csharp_sources)
+  if [ -z "$sources" ]; then
+    return "$GATE13_PASS"
+  fi
+
+  if ! gate13_csharp_has_manifest; then
+    # .cs files staged with no project to compile them into. Not a pass -- the
+    # gate genuinely could not judge them -- but not a block either.
+    gate13_reason "no .sln/.csproj found; C# sources not compiled"
+    echo "     ⏭️  SKIPPED - no .NET project to compile (.cs staged without a manifest)"
+    return "$GATE13_WARN"
+  fi
+
+  dotnet=$(gate13_csharp_dotnet) || {
+    gate13_reason "dotnet SDK not found"
+    echo "     ⏭️  SKIPPED - dotnet SDK not installed"
+    return "$GATE13_WARN"
+  }
+
+  tier=$(gate13_resolve_tier)
+  changed_count=$(gate13_csharp_changed_warning_count "$dotnet") || changed_count=0
+  changed_count=${changed_count:-0}
+
+  if [ "$changed_count" -eq 0 ]; then
+    echo "     ✅ PASSED - C# compiler strictness (no warnings in changed files)"
+    return "$GATE13_PASS"
+  fi
+
+  echo "     ℹ️  ${changed_count} changed C# file(s) carry compiler warnings"
+
+  if [ "$tier" = "warn-only" ]; then
+    echo "     ⚠️  WARN - ${changed_count} C# file(s) with compiler warnings (warn-only tier)"
+    return "$GATE13_WARN"
+  fi
+
+  echo "     ❌ BLOCKED - ${changed_count} changed C# file(s) with compiler warnings"
+  echo "        Turn the warnings into zero, or record a baseline:"
+  echo "          xp-gate compiler-baseline create"
+  return "$GATE13_FAIL"
+}

package/gate-3.sh

@@ -363,7 +363,7 @@ else
     LIZARD_PATH=$(eval echo "$LIZARD_CMD")
     
     # Get changed source files for complexity check (includes test files)
-    CC_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt)$' || true)
+    CC_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt|cs)$' || true)
 
     # Grade exactly the population the baseline was written from. The two must
     # match or the ratchet reports pre-existing code as "new", which is a false

package/gate-4.sh

@@ -76,7 +76,7 @@ if [ "$PROJECT_LANG" = "documentation-only" ]; then
   
 else
   # Get source files to check against principles
-  PRINCIPLES_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|kt|dart|swift|cpp|c|hpp|h|m|mm)$' || true)
+  PRINCIPLES_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|kt|dart|swift|cpp|c|hpp|h|m|mm|cs)$' || true)
 
   # One path per line, into an array. Passing $PRINCIPLES_FILES unquoted relies on
   # word splitting to turn the list into separate argv entries, which also splits

package/gate-9.sh

@@ -1,3 +1,22 @@
+#!/usr/bin/env bash
+# ============================================================================
+# ⚠️  DEAD CODE — NOT EXECUTED. Read this before changing anything here.       
+# ============================================================================
+# This file is NOT sourced by githooks/pre-commit or githooks/pre-push (both
+# source count = 0; verify with: grep -c "gate-9.sh" githooks/pre-commit).
+# It is shipped by githooks/install.sh but never runs.
+#
+# The gate that actually runs semgrep SAST is githooks/gate-10.sh, and it
+# reports as `gate10_sast`. Gate 9 in the report is `gate9_build_integrity`
+# (Build Integrity), a different gate entirely.
+#
+# This mislabelling is not cosmetic: in #717 a C# SAST fix was first written
+# into THIS file, where it changed nothing, while .cs stayed ungoverned. The
+# C# ruleset loading that works lives in gate-10.sh. Do not relocate it here.
+#
+# Kept rather than deleted because githooks/install.sh:GATE_SCRIPTS ships it;
+# removing it is a separate change. See issue #717 walkthrough MC-03.
+# ============================================================================
 # ============================================================================
 # GATE 9: Semgrep SAST Security Scan
 # Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
@@ -112,8 +131,22 @@ EOF
     # code is demoted to "did the tool itself run". --error stays OFF: it would
     # add nothing the JSON does not already provide, and keeping it off leaves
     # failure exit codes unambiguous for the #475 diagnostics path.
+    # #717: p/security-audit carries NO C# rules. Measured: a .cs file with a
+    # textbook SQL injection (string-concatenated SqlCommand) and a
+    # Process.Start command injection produced 0 findings under
+    # p/security-audit and 1 ERROR under p/csharp. Since gate-9.sh:45 lists
+    # `cs` in the file filter, .cs was accepted and then scanned by a ruleset
+    # that cannot see C# -- the identical "filter looks like coverage" defect
+    # this issue removed from Gate 4. p/csharp is loaded IN ADDITION to
+    # p/security-audit (not instead of: the security-audit rules still apply
+    # to the other languages in a mixed commit).
+    SEMGREP_RULES=(--config=p/security-audit)
+    if printf "%s
+" "$SEMGREP_FILES" | grep -qE ".cs$"; then
+      SEMGREP_RULES+=(--config=p/csharp)
+    fi
     SEMGREP_STDOUT_FILE=$(mktemp)
-    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan "${SEMGREP_RULES[@]}" --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
     SEMGREP_EXIT=$?
 
     # One node pass over the JSON: first line = verdict counts, remaining lines =
@@ -191,7 +224,9 @@ console.log("");});
       echo "  ❌ BLOCKED — blocking-severity vulnerability found"
       echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
       echo "$FINDING_DETAILS"
-      echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+      # #717: name BOTH rulesets. A C# finding comes from p/csharp, so
+      # pointing the author at p/security-audit alone reproduces zero hits.
+      echo "  Run 'semgrep scan --config=p/security-audit --config=p/csharp' to review all findings."
       GATE_9_STATUS="FAIL"
       exit 1
     else

package/gates/common.ts

@@ -183,8 +183,15 @@ export function getTempDir(): string {
 
 // ── File Filtering Helpers ──
 
-/** Source file extensions that lizard can analyze. */
-const LIZARD_EXTENSIONS = /\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt)$/;
+/**
+ * Source file extensions that lizard can analyze.
+ *
+ * `cs` belongs here because lizard parses C# natively (#717). Omitting it was
+ * never a tool limitation: lizard reports the CCN 11-22 functions the issue
+ * names, and the gate dropped those files before lizard was invoked, so the
+ * report said "no source files to check" for a tree full of them.
+ */
+const LIZARD_EXTENSIONS = /\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt|cs)$/;
 
 /** File extensions that semgrep supports. */
 const SEMGREP_EXTENSIONS = /\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$/;

package/hooks/adapter-common.sh

@@ -38,8 +38,46 @@ run_without_git_context() (
   "$@"
 )
 
+# ---------------------------------------------------------------------------
+# C# / .NET manifests (#717)
+#
+# A .NET tree can declare itself three ways: a project file (*.csproj), a
+# solution (*.sln), or a Directory.Build.props that carries the real settings
+# for a whole directory subtree with no project file of its own. All three are
+# checked, because a repo may carry only the latter two.
+# ---------------------------------------------------------------------------
+
+# Succeeds when the current directory holds a .NET manifest at depth 1.
+has_dotnet_manifest() {
+  [ -f "global.json" ] && return 0
+  [ -f "Directory.Build.props" ] && return 0
+  [ -f "Directory.Build.targets" ] && return 0
+  # `find -maxdepth 1` rather than a glob loop: a repo with thousands of files
+  # in one directory would expand a `*.csproj` glob into an unusable argv.
+  # -not -path "./.*" keeps a stray file under .git/.vscode from declaring the
+  # project language.
+  [ -n "$(find . -maxdepth 1 -type f \( -name '*.csproj' -o -name '*.sln' \) 2>/dev/null | sed -n '1p; 1q')" ]
+}
+
+# Succeeds when a .cs source exists below the current directory.
+has_csharp_sources() {
+  [ -n "$(find . -name "*.cs" -type f -not -path "./.git/*" -not -path "*/node_modules/*" -not -path "*/bin/*" -not -path "*/obj/*" 2>/dev/null | sed -n '1p; 1q')" ]
+}
+
 detect_project_lang() {
-  if [ -f "tsconfig.json" ]; then
+  # #717: the C# arms come FIRST, before tsconfig.json / package.json /
+  # .sh sniffing. Detection below is an exclusive first-match chain, and a .NET
+  # repo routinely carries a JS or shell half (the dsh-aot-runner shape in the
+  # issue is 2031 lines of C# plus ~900 lines of JS). Ordered after the
+  # TypeScript arm, that repo reported "typescript" and every C# file was
+  # invisible to language-routed gates -- the silent skip #717 is about.
+  #
+  # Placing C# first cannot steal an existing project: none of the languages
+  # matched afterwards ever ship a .csproj/.sln/Directory.Build.props, so the
+  # pre-existing arms are reached unchanged whenever those files are absent.
+  if has_dotnet_manifest; then
+    echo "csharp"
+  elif [ -f "tsconfig.json" ]; then
     echo "typescript"
   elif [ -f "pyproject.toml" ] || [ -f "requirements.txt" ] || [ -f "setup.py" ]; then
     echo "python"
@@ -88,6 +126,8 @@ detect_project_lang() {
       else
         echo "dart"
       fi
+    elif [ -n "$(find . -name "*.cs" -type f -not -path "./.git/*" -not -path "*/bin/*" -not -path "*/obj/*" | sed -n '1p; 1q')" ]; then
+      echo "csharp"
     elif [ -n "$(find . -name "*.swift" -type f | sed -n '1p; 1q')" ]; then
       echo "swift"
     elif [ -n "$(find . -name "*.cpp" -o -name "*.cc" -o -name "*.c" -o -name "*.h" -type f | sed -n '1p; 1q')" ]; then
@@ -104,6 +144,18 @@ detect_project_lang() {
   fi
 }
 
+# ---------------------------------------------------------------------------
+# NOTE (#717): a `detect_project_langs()` collector was added here and then
+# REMOVED before this change landed. It had zero production callers -- only its
+# own tests -- which is exactly the dead-dispatch shape #688 deleted from this
+# same file (see below). The gates do NOT route through it: pre-commit collects
+# languages with its own `_detect_ext_lang` into `PROJECT_LANGS`, and that is
+# what actually decides which adapters run (AC-717-13/13b pin the dual-language
+# case). Keeping a second, unconsumed collector beside it would have meant two
+# language-detection paths drifting apart, with the untested one looking
+# authoritative. If multi-language routing is ever reworked, the change belongs
+# in pre-commit's collector, not in a parallel helper here.
+
 # ---------------------------------------------------------------------------
 # REMOVED in #688: route_to_adapter()
 #
@@ -210,7 +262,8 @@ detect_iac_project() {
   
   # Check for Kubernetes manifests (YAML with apiVersion/kind)
   if [ -n "$(find . -maxdepth 2 \( -name "*.yaml" -o -name "*.yml" \) -not -path "./.git/*" 2>/dev/null | sed -n '1p; 1q')" ]; then
-    local yaml_file=$(find . -maxdepth 2 \( -name "*.yaml" -o -name "*.yml" \) -not -path "./.git/*" 2>/dev/null | sed -n '1p; 1q')
+    local yaml_file
+    yaml_file=$(find . -maxdepth 2 \( -name "*.yaml" -o -name "*.yml" \) -not -path "./.git/*" 2>/dev/null | sed -n '1p; 1q')
     if grep -qE "^(apiVersion|kind):" "$yaml_file" 2>/dev/null; then
       has_iac=true
     fi

package/hooks/gate-10.sh

@@ -170,12 +170,25 @@ EOF
     # --no-verify, which is worse than any verdict it could have produced.
     # `-k` after the primary signal: pysemgrep spinning in a syscall ignores
     # SIGTERM, and the shipped 0.29 code used the same `-k 10` shape.
+    # #717: p/security-audit carries NO C# rules. Measured on a .cs file with
+    # a textbook SQL injection (string-concatenated SqlCommand) plus a
+    # Process.Start command injection: p/security-audit 0 findings, p/csharp 1
+    # ERROR (csharp-sqli). Line 69 has listed `cs` in the filter all along, so
+    # .cs was accepted and then scanned by a ruleset that cannot see C# -- the
+    # identical "filter looks like coverage" defect this issue removed from
+    # Gate 4. p/csharp is loaded IN ADDITION so the security-audit rules still
+    # cover the other languages in a mixed commit.
+    SEMGREP_RULES=(--config=p/security-audit)
+    if printf '%s
+' "$SEMGREP_FILES" | grep -qE ".cs$"; then
+      SEMGREP_RULES+=(--config=p/csharp)
+    fi
     SEMGREP_TIMEOUT_S="${XP_GATE_SEMGREP_TIMEOUT:-180}"
     SEMGREP_TIMED_OUT=false
     if command -v timeout >/dev/null 2>&1; then
       SEMGREP_STDOUT_FILE=$(mktemp)
       SEMGREP_OUTPUT=$(timeout -k 10 "$SEMGREP_TIMEOUT_S" \
-        "$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check \
+        "$SEMGREP_CMD" scan "${SEMGREP_RULES[@]}" --json --disable-version-check \
         "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
       SEMGREP_EXIT=$?
       # 124 = timeout's own "I gave up" code. 137 = 128+SIGKILL, which is what
@@ -194,7 +207,7 @@ EOF
       # trade -- but the unbounded window is now stated.
       echo "     ⚠️  'timeout' command not available — semgrep runs UNBOUNDED (install coreutils or set up gtimeout)"
       SEMGREP_STDOUT_FILE=$(mktemp)
-      SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check \
+      SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan "${SEMGREP_RULES[@]}" --json --disable-version-check \
         "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
       SEMGREP_EXIT=$?
     fi
@@ -299,7 +312,9 @@ console.log("");});
       echo "  ❌ BLOCKED — blocking-severity vulnerability found"
       echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
       echo "$FINDING_DETAILS"
-      echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+      # #717: a C# finding comes from p/csharp; naming only security-audit
+      # would send the author to a ruleset that reproduces zero hits.
+      echo "  Run 'semgrep scan --config=p/security-audit --config=p/csharp' to review all findings."
       GATE_10_STATUS="FAIL"
       # Consumed by the sourcing parent (pre-commit report JSON), not here.
       # shellcheck disable=SC2034

package/hooks/gate-13-compiler-strictness.sh

@@ -1180,3 +1180,184 @@ EOF
   # stage for no benefit.
   return "$GATE13_PASS"
 }
+
+# ============================================================================
+# C# / .NET PATH (#717 / REQ-005)
+#
+# Measured motivation, same shape as the C/C++ and Java paths above: `dotnet
+# build` on a solution with default settings reports NOTHING for a converted
+# nullable warning or an obsolete API, because MSBuild's default
+# WarningLevel/TreatWarningsAsErrors is whatever the project happens to declare.
+# `-warnaserror -p:Nullable=enable` turns the same source into hard errors --
+# which is exactly what a *compiler strictness* gate is for, and what no other
+# gate in the chain does (Gate 1 runs `dotnet format`, which formats and runs
+# analyzers but does not fail on the full compiler warning set).
+#
+# Verdict codes follow the file-level contract: 0 PASS / 1 FAIL / 2 BLOCK (tool
+# ran but output untrustworthy) / 3 WARN (tool absent, timeout, or warn-only).
+#
+# Deliberately driven by the adapter's own toolchain discovery rather than a
+# second copy of it: two independent "where is dotnet" implementations is how
+# detection and gates drift apart.
+# ============================================================================
+
+# Locate the .NET SDK exactly as adapters/csharp.sh does.
+gate13_csharp_dotnet() {
+  local d
+  d="${DOTNET_BIN:-}"
+  if [ -z "$d" ]; then
+    d=$(command -v dotnet 2>/dev/null) || d=""
+  fi
+  [ -n "$d" ] || return 1
+  "$d" --version >/dev/null 2>&1 || return 1
+  printf '%s\n' "$d"
+}
+
+# Print the staged .cs files (not the whole build output) that Gate 13 judges.
+gate13_csharp_sources() {
+  git diff --cached --name-only --diff-filter=d -- '*.cs' 2>/dev/null
+}
+
+# Print the .NET entry point to build: a solution, else a project file.
+#
+# Bare `dotnet build` in the repo root fails with MSB1003 whenever the project
+# lives in a subdirectory -- the normal layout (src/App/App.csproj) and the one
+# every fixture here uses. Measured: bare build produced no diagnostics at all
+# while `dotnet build P/P.csproj` produced the two real warnings. Resolving the
+# entry point explicitly is what makes the gate see anything.
+gate13_csharp_entry_point() {
+  local f
+  # A .sln is the widest scope and builds every project in it.
+  f=$(git ls-files '*.sln' 2>/dev/null | head -1)
+  if [ -n "$f" ]; then printf '%s
+' "$f"; return 0; fi
+  f=$(git ls-files '*.??proj' 2>/dev/null | head -1)
+  if [ -n "$f" ]; then printf '%s
+' "$f"; return 0; fi
+  # Fall back to the working tree for a not-yet-tracked project.
+  for f in *.sln *.??proj; do
+    [ -f "$f" ] && { printf '%s
+' "$f"; return 0; }
+  done
+  return 1
+}
+
+# Is there a buildable .NET entry point to compile at all?
+gate13_csharp_has_manifest() {
+  local f
+  for f in *.sln *.csproj Directory.Build.props global.json; do
+    [ -f "$f" ] && return 0
+  done
+  # A nested layout is normal (src/App/App.csproj).
+  [ -n "$(git ls-files '*.*proj' '*.sln' 2>/dev/null | head -1)" ] && return 0
+  return 1
+}
+
+# Count compiler warnings FROM CHANGED FILES only.
+#
+# `dotnet build` reports diagnostics for the whole project, so counting every
+# warning would make a one-line change inherit the project's entire back-catalog
+# and block on work the author never touched -- the false-BLOCK that Gate 13's
+# baseline mechanism exists to prevent. Only lines naming a file this commit
+# stages are counted; everything else is baseline territory.
+gate13_csharp_changed_warning_count() {
+  local dotnet="$1" out entry stage_files
+  stage_files=$(git diff --cached --name-only --diff-filter=d 2>/dev/null)
+  [ -n "$stage_files" ] || return 1
+
+  # -clp:NoSummary keeps the summary table out of the parse; --nologo drops the
+  # banner.
+  #
+  # --no-incremental is REQUIRED, not an optimisation tradeoff. MSBuild skips
+  # compilation when its outputs are newer than the sources, and a skipped
+  # compile emits no diagnostics -- measured: the same tree reported 2 warnings
+  # from a clean build and 0 from an immediately following incremental one. A
+  # strictness gate that only sees warnings the first time is a gate that
+  # silently passes forever after, which is precisely the failure mode #717
+  # exists to remove.
+  #
+  # The entry point is passed explicitly: bare `dotnet build` in the repo root
+  # dies with MSB1003 whenever the project sits in a subdirectory, emitting no
+  # diagnostics at all.
+  entry=$(gate13_csharp_entry_point) || return 1
+  out=$("$dotnet" build "$entry" --nologo --no-incremental -clp:NoSummary 2>&1)
+
+  # Report distinct CHANGED FILES, not diagnostic instances: the caller speaks in
+  # files ("N changed C# file(s) carry compiler warnings"), and one file with two
+  # warnings is one file to fix.
+  #
+  # Two normalisations are needed and both were measured, not assumed:
+  #   - dotnet prints ABSOLUTE Windows paths while git reports repo-relative
+  #     ones, so a suffix match is what relates them;
+  #   - the separators differ, so the diagnostic path is folded to "/" first.
+  # Comparing raw strings matched nothing and reported 0 warnings on a file that
+  # has two.
+  printf '%s\n' "$out" \
+    | grep -E ': (warning|error) [A-Z]+[0-9]+' \
+    | sed -n 's/^\(.*\)(.*$/\1/p' \
+    | tr '\\' '/' \
+    | sort -u \
+    | while IFS= read -r f; do
+        [ -n "$f" ] || continue
+        while IFS= read -r s; do
+          [ -n "$s" ] || continue
+          case "$f" in
+            *"$s") printf '%s\n' "$s"; break ;;
+          esac
+        done <<EOF3
+$stage_files
+EOF3
+      done \
+    | sort -u | wc -l | tr -d ' '
+}
+
+gate13_run_csharp_analysis() {
+  local dotnet sources tier changed_count base
+
+  # gate13_is_disabled takes no argument: it reads the single repo-wide
+  # XP_GATE_DISABLE_13 switch, which disables every language path together.
+  if gate13_is_disabled; then
+    gate13_reason "compiler strictness disabled (XP_GATE_DISABLE_13=1)"
+    return "$GATE13_PASS"
+  fi
+
+  sources=$(gate13_csharp_sources)
+  if [ -z "$sources" ]; then
+    return "$GATE13_PASS"
+  fi
+
+  if ! gate13_csharp_has_manifest; then
+    # .cs files staged with no project to compile them into. Not a pass -- the
+    # gate genuinely could not judge them -- but not a block either.
+    gate13_reason "no .sln/.csproj found; C# sources not compiled"
+    echo "     ⏭️  SKIPPED - no .NET project to compile (.cs staged without a manifest)"
+    return "$GATE13_WARN"
+  fi
+
+  dotnet=$(gate13_csharp_dotnet) || {
+    gate13_reason "dotnet SDK not found"
+    echo "     ⏭️  SKIPPED - dotnet SDK not installed"
+    return "$GATE13_WARN"
+  }
+
+  tier=$(gate13_resolve_tier)
+  changed_count=$(gate13_csharp_changed_warning_count "$dotnet") || changed_count=0
+  changed_count=${changed_count:-0}
+
+  if [ "$changed_count" -eq 0 ]; then
+    echo "     ✅ PASSED - C# compiler strictness (no warnings in changed files)"
+    return "$GATE13_PASS"
+  fi
+
+  echo "     ℹ️  ${changed_count} changed C# file(s) carry compiler warnings"
+
+  if [ "$tier" = "warn-only" ]; then
+    echo "     ⚠️  WARN - ${changed_count} C# file(s) with compiler warnings (warn-only tier)"
+    return "$GATE13_WARN"
+  fi
+
+  echo "     ❌ BLOCKED - ${changed_count} changed C# file(s) with compiler warnings"
+  echo "        Turn the warnings into zero, or record a baseline:"
+  echo "          xp-gate compiler-baseline create"
+  return "$GATE13_FAIL"
+}

package/hooks/gate-3.sh

@@ -363,7 +363,7 @@ else
     LIZARD_PATH=$(eval echo "$LIZARD_CMD")
     
     # Get changed source files for complexity check (includes test files)
-    CC_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt)$' || true)
+    CC_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt|cs)$' || true)
 
     # Grade exactly the population the baseline was written from. The two must
     # match or the ratchet reports pre-existing code as "new", which is a false

package/hooks/gate-4.sh

@@ -76,7 +76,7 @@ if [ "$PROJECT_LANG" = "documentation-only" ]; then
   
 else
   # Get source files to check against principles
-  PRINCIPLES_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|kt|dart|swift|cpp|c|hpp|h|m|mm)$' || true)
+  PRINCIPLES_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|kt|dart|swift|cpp|c|hpp|h|m|mm|cs)$' || true)
 
   # One path per line, into an array. Passing $PRINCIPLES_FILES unquoted relies on
   # word splitting to turn the list into separate argv entries, which also splits