Nico77600 · Oct 9, 2026 · Oct 9, 2026
diff --git a/.github/codeql/.gitignore b/.github/codeql/.gitignore
@@ -0,0 +1 @@
+out/
diff --git a/.github/codeql/Production.proj b/.github/codeql/Production.proj
@@ -0,0 +1,28 @@
+<Project DefaultTargets="Build">
+  <UsingTask TaskName="Microsoft.CodeAnalysis.BuildTasks.Csc"
+             AssemblyFile="$(MSBuildToolsPath)\Roslyn\Microsoft.Build.Tasks.CodeAnalysis.dll" />
+  <PropertyGroup>
+    <RepositoryRoot>$([System.IO.Path]::GetFullPath('$(MSBuildThisFileDirectory)..\..'))</RepositoryRoot>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(RepositoryRoot)\$(ProductionSourceRoot)\**\*.cs" />
+    <Reference Include="$(PowerShellHome)\ref\*.dll" />
+    <Reference Include="$(PowerShellHome)\System.Management.Automation.dll" Condition="'$(RequiresPowerShell)' == 'true'" />
+    <Reference Include="$(RepositoryRoot)\package\lib\sqlite\*.dll" Condition="'$(RequiresSqlite)' == 'true'" />
+  </ItemGroup>
+  <Target Name="Build">
+    <Error Condition="'$(ProductionSourceRoot)' == '' or '$(OutputDirectory)' == '' or '$(PowerShellHome)' == ''"
+           Text="ProductionSourceRoot, OutputDirectory and PowerShellHome are required." />
+    <Error Condition="'@(Compile)' == ''" Text="No production C# sources were selected." />
+    <Error Condition="'@(Reference)' == ''" Text="PowerShell reference assemblies are unavailable." />
+    <MakeDir Directories="$(OutputDirectory)" />
+    <Csc Sources="@(Compile)" References="@(Reference)"
+         OutputAssembly="$(OutputDirectory)\Production.Analysis.dll"
+         TargetType="Library" NoStandardLib="true" NoConfig="true"
+         UseSharedCompilation="false" Deterministic="true" Optimize="false" />
+    <WriteLinesToFile File="$(OutputDirectory)\compiled-sources.txt"
+                      Lines="@(Compile->'%(FullPath)')" Overwrite="true" Encoding="UTF-8" />
+    <WriteLinesToFile File="$(OutputDirectory)\compiler-references.txt"
+                      Lines="@(Reference->'%(FullPath)')" Overwrite="true" Encoding="UTF-8" />
+  </Target>
+</Project>
diff --git a/.github/codeql/build.json b/.github/codeql/build.json
@@ -0,0 +1,5 @@
+{
+  "productionSourceRoot": "package\\src",
+  "requiresSqlite": true,
+  "requiresPowerShell": false
+}
diff --git a/.github/scripts/Build-CodeQLProduction.ps1 b/.github/scripts/Build-CodeQLProduction.ps1
@@ -0,0 +1,90 @@
+#Requires -Version 7.4
+[CmdletBinding()]
+param([string]$OutputDirectory)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+$root = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\..'))
+$configuration = Get-Content (Join-Path $root '.github\codeql\build.json') -Raw | ConvertFrom-Json
+$sourceRoot = [IO.Path]::GetFullPath((Join-Path $root $configuration.productionSourceRoot))
+if ($sourceRoot -notin @((Join-Path $root 'package\src'), (Join-Path $root 'src'))) {
+    throw 'Only the production src directory is supported.'
+}
+if (-not $OutputDirectory) { $OutputDirectory = Join-Path $root '.github\codeql\out' }
+$OutputDirectory = [IO.Path]::GetFullPath($OutputDirectory)
+if ($OutputDirectory.StartsWith($root + '\', [StringComparison]::OrdinalIgnoreCase) -and
+    -not $OutputDirectory.StartsWith((Join-Path $root '.github\codeql\out') + '\', [StringComparison]::OrdinalIgnoreCase) -and
+    $OutputDirectory -ne (Join-Path $root '.github\codeql\out')) {
+    throw 'Analysis outputs must not enter the runtime package.'
+}
+[void][IO.Directory]::CreateDirectory($OutputDirectory)
+$sources = @(Get-ChildItem $sourceRoot -Recurse -File -Filter '*.cs' | Sort-Object FullName)
+if (-not $sources.Count) { throw 'No production C# sources found.' }
+$tracked = @(& git -C $root ls-files -- '*.cs')
+if ($LASTEXITCODE) { throw 'Cannot inspect the tracked C# inventory.' }
+$runtimeTracked = @($tracked | Where-Object { $_ -notmatch '^(tests|tools|\.github|lib)/' -and $_ -notmatch '^package/lib/' })
+foreach ($relative in $runtimeTracked) {
+    if ([IO.Path]::GetFullPath((Join-Path $root $relative)) -notin $sources.FullName) {
+        throw "Production C# source omitted by the build: $relative"
+    }
+}
+$references = @(Get-ChildItem (Join-Path $PSHOME 'ref') -File -Filter '*.dll' | Sort-Object Name)
+if (-not $references.Count) { throw 'This PowerShell installation has no reference assemblies.' }
+if ($configuration.requiresPowerShell) {
+    $references += Get-Item (Join-Path $PSHOME 'System.Management.Automation.dll')
+}
+if ($configuration.requiresSqlite) {
+    foreach ($name in 'Microsoft.Data.Sqlite', 'SQLitePCLRaw.core', 'SQLitePCLRaw.provider.e_sqlite3', 'SQLitePCLRaw.batteries_v2') {
+        $references += Get-Item (Join-Path $root "package\lib\sqlite\$name.dll")
+    }
+}
+function Get-FileEvidence($File) {
+    [ordered]@{
+        file = $File.FullName.Substring($root.Length + 1)
+        sha256 = (Get-FileHash $File.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
+    }
+}
+$sourceEvidence = @($sources | ForEach-Object { Get-FileEvidence $_ })
+$referenceEvidence = @($references | ForEach-Object {
+    $assembly = [Reflection.AssemblyName]::GetAssemblyName($_.FullName)
+    [ordered]@{
+        name = $assembly.Name; version = $assembly.Version.ToString()
+        path = $_.FullName; sha256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
+    }
+})
+$sdk = (& dotnet --version).Trim()
+if ($LASTEXITCODE) { throw 'A .NET SDK is required for the existing Roslyn compiler task.' }
+$manifest = [ordered]@{
+    purpose = 'Analysis-only compilation; no runtime loading, restore, deployment or package changes.'
+    powerShell = $PSVersionTable.PSVersion.ToString()
+    framework = [Runtime.InteropServices.RuntimeInformation]::FrameworkDescription
+    sdk = $sdk; sources = $sourceEvidence; references = $referenceEvidence
+    compiledCount = 0; extractionProof = 'PENDING hosted CodeQL tracer and database validation.'
+}
+$manifest | ConvertTo-Json -Depth 8 | Set-Content (Join-Path $OutputDirectory 'build-manifest.json') -Encoding utf8
+$arguments = @(
+    'msbuild', (Join-Path $root '.github\codeql\Production.proj'), '-nologo', '-verbosity:minimal',
+    "-property:ProductionSourceRoot=$($configuration.productionSourceRoot)",
+    "-property:PowerShellHome=$PSHOME",
+    "-property:RequiresPowerShell=$($configuration.requiresPowerShell.ToString().ToLowerInvariant())",
+    "-property:RequiresSqlite=$($configuration.requiresSqlite.ToString().ToLowerInvariant())",
+    "-property:OutputDirectory=$OutputDirectory"
+)
+& dotnet @arguments
+if ($LASTEXITCODE) { throw "Analysis-only compilation failed with exit code $LASTEXITCODE." }
+$compiled = @(Get-Content (Join-Path $OutputDirectory 'compiled-sources.txt') | Where-Object { $_ })
+if (@(Compare-Object $sources.FullName $compiled).Count -ne 0) {
+    throw 'Compiler source inventory does not equal the production inventory.'
+}
+$compiledReferences = @(Get-Content (Join-Path $OutputDirectory 'compiler-references.txt') | Where-Object { $_ })
+if (@(Compare-Object $references.FullName $compiledReferences).Count -ne 0) {
+    throw 'Compiler references do not equal the runtime reference inventory.'
+}
+$after = @($sources | ForEach-Object { Get-FileEvidence $_ })
+if (($sourceEvidence | ConvertTo-Json -Compress) -ne ($after | ConvertTo-Json -Compress)) {
+    throw 'Production source changed during analysis compilation.'
+}
+$manifest.compiledCount = $compiled.Count
+$manifest['assemblySha256'] = (Get-FileHash (Join-Path $OutputDirectory 'Production.Analysis.dll')).Hash.ToLowerInvariant()
+$manifest | ConvertTo-Json -Depth 8 | Set-Content (Join-Path $OutputDirectory 'build-manifest.json') -Encoding utf8
+Write-Output "Compiled $($compiled.Count) production C# files against exact runtime references; hosted extraction proof remains pending."
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -1,89 +1,107 @@
-{
-  "name": "CodeQL (advisory)",
-  "on": {
-    "pull_request": {
-      "branches": ["main"]
-    },
-    "push": {
-      "branches": ["main"]
-    },
-    "schedule": [
-      {
-        "cron": "41 5 * * 3"
-      }
-    ],
-    "workflow_dispatch": {}
-  },
-  "permissions": {},
-  "concurrency": {
-    "group": "codeql-${{ github.workflow }}-${{ github.ref }}",
-    "cancel-in-progress": true
-  },
-  "jobs": {
-    "analyze": {
-      "name": "CodeQL ${{ matrix.language }} (advisory)",
-      "if": "${{ contains(fromJSON('[\"Nico77600/ExchangeLogReport\",\"Nico77600/MailboxMessageReport\",\"Nico77600/MeetingCleanup\",\"Nico77600/MeetingCleanupOnPrem\",\"Nico77600/MessageTraceReport\",\"Nico77600/PurviewDlpReport\",\"Nico77600/PurviewDlpReport-Fabric\",\"Nico77600/RecipientLimitReport\"]'), github.repository) && (github.event_name == 'pull_request' || github.ref == 'refs/heads/main') }}",
-      "runs-on": "${{ matrix.runner }}",
-      "timeout-minutes": 25,
-      "permissions": {
-        "contents": "read",
-        "security-events": "write"
-      },
-      "strategy": {
-        "fail-fast": false,
-        "max-parallel": 2,
-        "matrix": {
-          "include": [
-            {
-              "language": "actions",
-              "runner": "ubuntu-latest",
-              "config": {
-                "name": "GitHub Actions workflows",
-                "paths": [".github/workflows"]
-              }
-            },
-            {
-              "language": "csharp",
-              "runner": "windows-2022",
-              "config": {
-                "name": "Production C# loose-source pilot",
-                "paths": ["package/src"],
-                "paths-ignore": ["tests", "package/lib", "tools"]
-              }
-            }
-          ]
-        }
-      },
-      "steps": [
-        {
-          "name": "Check out event revision",
-          "uses": "actions/checkout@11d5960a326750d5838078e36cf38b85af677262",
-          "with": {
-            "persist-credentials": false
-          }
-        },
-        {
-          "name": "Initialize source-only analysis",
-          "uses": "github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d",
-          "with": {
-            "languages": "${{ matrix.language }}",
-            "build-mode": "none",
-            "threads": 2,
-            "dependency-caching": "false",
-            "config": "${{ toJson(matrix.config) }}"
-          }
-        },
-        {
-          "name": "Analyze and upload advisory results",
-          "uses": "github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d",
-          "with": {
-            "category": "/language:${{ matrix.language }}",
-            "upload": "always",
-            "upload-database": "false",
-            "wait-for-processing": "true"
-          }
-        }
-      ]
-    }
-  }
-}
+{
+  "name": "CodeQL (advisory)",
+  "on": {
+    "pull_request": {
+      "branches": ["main"]
+    },
+    "push": {
+      "branches": ["main"]
+    },
+    "schedule": [
+      {
+        "cron": "41 5 * * 3"
+      }
+    ],
+    "workflow_dispatch": {}
+  },
+  "permissions": {},
+  "concurrency": {
+    "group": "codeql-${{ github.workflow }}-${{ github.ref }}",
+    "cancel-in-progress": true
+  },
+  "jobs": {
+    "analyze": {
+      "name": "CodeQL ${{ matrix.language }} (advisory)",
+      "if": "${{ contains(fromJSON('[\"Nico77600/ExchangeLogReport\",\"Nico77600/MailboxMessageReport\",\"Nico77600/MeetingCleanup\",\"Nico77600/MeetingCleanupOnPrem\",\"Nico77600/MessageTraceReport\",\"Nico77600/PurviewDlpReport\",\"Nico77600/PurviewDlpReport-Fabric\",\"Nico77600/RecipientLimitReport\"]'), github.repository) && (github.event_name == 'pull_request' || github.ref == 'refs/heads/main') }}",
+      "runs-on": "${{ matrix.runner }}",
+      "timeout-minutes": 25,
+      "permissions": {
+        "contents": "read",
+        "security-events": "write"
+      },
+      "strategy": {
+        "fail-fast": false,
+        "max-parallel": 2,
+        "matrix": {
+          "include": [
+            {
+              "language": "actions",
+              "build-mode": "none",
+              "runner": "ubuntu-latest",
+              "config": {
+                "name": "GitHub Actions workflows",
+                "paths": [".github/workflows"]
+              }
+            },
+            {
+              "language": "csharp",
+              "build-mode": "manual",
+              "runner": "windows-2022",
+              "config": {
+                "name": "Production C# with exact runtime references"
+              }
+            }
+          ]
+        }
+      },
+      "steps": [
+        {
+          "name": "Check out event revision",
+          "uses": "actions/checkout@11d5960a326750d5838078e36cf38b85af677262",
+          "with": {
+            "persist-credentials": false
+          }
+        },
+        {
+          "name": "Initialize language-specific analysis",
+          "uses": "github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d",
+          "with": {
+            "languages": "${{ matrix.language }}",
+            "build-mode": "${{ matrix.build-mode }}",
+            "threads": 2,
+            "dependency-caching": "false",
+            "config": "${{ toJson(matrix.config) }}"
+          }
+        },
+        {
+          "name": "Compile all production C# without runtime execution",
+          "if": "${{ matrix.language == 'csharp' }}",
+          "shell": "pwsh",
+          "run": "& .\\.github\\scripts\\Build-CodeQLProduction.ps1"
+        },
+        {
+          "name": "Analyze and upload advisory results",
+          "uses": "github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d",
+          "with": {
+            "category": "/language:${{ matrix.language }}",
+            "upload": "always",
+            "upload-database": "false",
+            "wait-for-processing": "true"
+          }
+        },
+        {
+          "name": "Preserve C# compilation inventory",
+          "if": "${{ always() && matrix.language == 'csharp' }}",
+          "uses": "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02",
+          "with": {
+            "name": "codeql-production-build",
+            "path": ".github/codeql/out/build-manifest.json\n.github/codeql/out/compiled-sources.txt\n.github/codeql/out/compiler-references.txt",
+            "if-no-files-found": "warn",
+            "include-hidden-files": true,
+            "retention-days": 14
+          }
+        }
+      ]
+    }
+  }
+}