feat: BWFC013/014 analyzers, architecture guide, CI docs (#487)

* feat: Add BWFC013/014 analyzers, architecture guide, and CI docs

Analyzer Expansion:
- BWFC013: Detects Response.Write/WriteFile/Clear/Flush/End usage
- BWFC014: Detects Request.Form/Cookies/Headers/Files/QueryString access
- Both produce WARNING diagnostics with guidance-only code fixes (TODO comments)
- 21 new tests (111 total, all passing)

Documentation:
- dev-docs/ANALYZER-ARCHITECTURE.md: Contributor guide for building analyzers
- docs/Migration/Analyzers.md: BWFC013/014 entries, CI/CD integration section,
  .editorconfig severity tuning, prioritization guide

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(ai-team): Analyzer sprint 1 complete  orchestration & decision logs merged

Session: 2026-03-20T14-18-05Z-analyzer-sprint1
Requested by: Scribe

Changes:
- Orchestration logs for Cyclops (BWFC013/014 analyzers, 6 files, 111 tests) and Beast (architecture guide, 579 lines)
- Session log for analyzer sprint 1 execution
- Merged 10 decision inbox files  decisions.md (BWFC013/014 IDs, analyzer docs, deprecation guidance, ASHX/AXD middleware, RouteData fix, component audit, navigation UX, sample pages, middleware testing)
- Deleted all inbox files after merge
- Appended team updates to Cyclops, Beast, Forge, Jubilee, Rogue history.md files
- PR #487 opened on upstream targeting dev branch

* feat: bundle analyzers in main NuGet + add -Prescan switch to L1 script

Task 1: Added ProjectReference from BlazorWebFormsComponents to
BlazorWebFormsComponents.Analyzers with OutputItemType=Analyzer so
consumers get Roslyn analyzers automatically via the main NuGet package.

Task 2: Added -Prescan switch to bwfc-migrate.ps1 that scans source
.cs files for 9 BWFC analyzer patterns (BWFC001-005, 011-014) and
outputs a JSON summary report without performing any migration.
Includes human-readable breakdown via Write-Host.

Build: 0 errors, 111 analyzer tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: add Roslyn analyzer tests to build and squad-ci workflows

- build.yml: restore, build, run, upload, and publish analyzer test results
- squad-ci.yml: replace placeholder with dotnet restore/build/test for both suites
- Add setup-dotnet step to squad-ci.yml for .NET 10.0.x

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: use DetectEndOfLine() for cross-platform CI compatibility

All 4 code fix providers (BWFC001, BWFC004, BWFC013, BWFC014) used
hardcoded \r\n in SyntaxFactory.EndOfLine(), causing test failures
on Linux CI where source strings use \n.

- Add SyntaxExtensions.DetectEndOfLine() helper that reads line
  endings from the existing syntax tree
- Replace hardcoded \r\n with root.DetectEndOfLine() in all 4
  code fix providers
- Replace foreach+if with LINQ .Where() (CodeQL suggestion)

All 111 analyzer tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: use DetectEndOfLine() in MissingParameterAttributeCodeFixProvider

The using directive insertion used SyntaxFactory.CarriageReturnLineFeed
which hardcodes CRLF, failing on Linux CI where source uses LF.

Replace with newRoot.DetectEndOfLine() for cross-platform compatibility.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: csharpfritz

.github/workflows/build.yml

@@ -42,6 +42,7 @@ jobs:
           dotnet restore src/BlazorWebFormsComponents/BlazorWebFormsComponents.csproj
           dotnet restore src/BlazorWebFormsComponents.Test/BlazorWebFormsComponents.Test.csproj
           dotnet restore samples/AfterBlazorServerSide/AfterBlazorServerSide.csproj
+          dotnet restore src/BlazorWebFormsComponents.Analyzers.Test/BlazorWebFormsComponents.Analyzers.Test.csproj
           dotnet restore scripts/GenerateHealthSnapshot/GenerateHealthSnapshot.csproj
 
       - name: Build library
@@ -50,12 +51,18 @@ jobs:
       - name: Build test project
         run: dotnet build src/BlazorWebFormsComponents.Test/BlazorWebFormsComponents.Test.csproj --configuration Release --no-restore
 
+      - name: Build analyzer tests
+        run: dotnet build src/BlazorWebFormsComponents.Analyzers.Test/BlazorWebFormsComponents.Analyzers.Test.csproj --configuration Release --no-restore
+
       - name: Build server-side sample
         run: dotnet build samples/AfterBlazorServerSide/AfterBlazorServerSide.csproj --configuration Release --no-restore
 
       - name: Run tests
         run: dotnet test src/BlazorWebFormsComponents.Test/BlazorWebFormsComponents.Test.csproj --configuration Release --no-build --verbosity normal --logger "trx;LogFileName=test-results.trx" --results-directory src/BlazorWebFormsComponents.Test/TestResults
 
+      - name: Run analyzer tests
+        run: dotnet test src/BlazorWebFormsComponents.Analyzers.Test/BlazorWebFormsComponents.Analyzers.Test.csproj --configuration Release --no-build --verbosity normal --logger "trx;LogFileName=analyzer-test-results.trx" --results-directory src/BlazorWebFormsComponents.Analyzers.Test/TestResults
+
       - name: Generate health snapshot
         run: dotnet run --project scripts/GenerateHealthSnapshot/GenerateHealthSnapshot.csproj --configuration Release -- ${{ github.workspace }} ${{ github.workspace }}/health-snapshot.json
 
@@ -73,6 +80,13 @@ jobs:
           name: test-results
           path: src/BlazorWebFormsComponents.Test/TestResults/*.trx
 
+      - name: Upload analyzer test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: analyzer-test-results
+          path: src/BlazorWebFormsComponents.Analyzers.Test/TestResults/*.trx
+
       - name: Publish test results
         uses: dorny/test-reporter@v2
         if: always()
@@ -81,3 +95,12 @@ jobs:
           path: src/BlazorWebFormsComponents.Test/TestResults/*.trx
           reporter: dotnet-trx
           fail-on-error: true
+
+      - name: Publish analyzer test results
+        uses: dorny/test-reporter@v2
+        if: always()
+        with:
+          name: Analyzer Test Results
+          path: src/BlazorWebFormsComponents.Analyzers.Test/TestResults/*.trx
+          reporter: dotnet-trx
+          fail-on-error: true

.github/workflows/squad-ci.yml

@@ -17,12 +17,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
       - name: Build and test
         run: |
-          # TODO: Add your dotnet build/test commands here
-          # Go:            go test ./...
-          # Python:        pip install -r requirements.txt && pytest
-          # .NET:          dotnet test
-          # Java (Maven):  mvn test
-          # Java (Gradle): ./gradlew test
-          echo "No build commands configured — update squad-ci.yml"
+          dotnet restore
+          dotnet build --configuration Release --no-restore
+          dotnet test src/BlazorWebFormsComponents.Test/BlazorWebFormsComponents.Test.csproj --configuration Release --no-build --verbosity normal
+          dotnet test src/BlazorWebFormsComponents.Analyzers.Test/BlazorWebFormsComponents.Analyzers.Test.csproj --configuration Release --no-build --verbosity normal

.squad/agents/beast/history.md

@@ -497,3 +497,69 @@ Updated `.squad/skills/migration-standards/SKILL.md` to add new section at end:
 - Created docs/ValidationControls/BaseValidator.md 
 - Created docs/ValidationControls/BaseCompareValidator.md
 - Updated mkdocs.yml (Validation Controls section)
+
+### Analyzer Architecture & Expansion Documentation (Feature/analyzer-sprint1)
+
+**Delivered:** Comprehensive analyzer contributor guide and expanded rule documentation for BWFC013 and BWFC014 rules.
+
+**Files created/updated:**
+1. **dev-docs/ANALYZER-ARCHITECTURE.md** (18.7 KB, new)  Contributor guide for developing new Roslyn analyzers
+2. **docs/Migration/Analyzers.md** (updated)  Added BWFC013 (Response Object Usage) and BWFC014 (Request Object Usage) rule documentation
+
+**ANALYZER-ARCHITECTURE.md content:**
+- **Project Layout**  File naming convention, rule ID assignment, directory structure (Analyzers/ and Analyzers.Test/)
+- **DiagnosticAnalyzer anatomy**  Minimum viable structure with DiagnosticDescriptor, Initialize(), SyntaxKind callbacks, SeverityLevels (Hidden/Info/Warning/Error)
+- **CodeFixProvider anatomy**  BatchFixer pattern, RegisterCodeFixesAsync, trivia preservation, async best practices
+- **Testing strategy**  CSharpAnalyzerTest/CSharpCodeFixTest patterns, stub types for external dependencies ({|#N:code|} markers), positive/negative/edge cases
+- **Common pitfalls**  Trivia handling (EndOfLine between comment/semicolon), null guards on ancestor traversal, SyntaxKind selection mistakes, string comparisons vs syntax API, message format arguments
+- **PR checklist**  Analyzer implementation (7 items), CodeFixProvider (8 items), Testing (6 items), Documentation (5 items), Integration (3 items)
+- **Reference implementation**  Points to ResponseRedirectAnalyzer as working example
+- **Build/test commands**  dotnet build, test, pack workflows
+
+**Analyzers.md updates:**
+- **Updated summary table**  Added BWFC013 and BWFC014 to rule matrix
+- **BWFC013: Response Object Usage**  Detects Response.Write(), WriteFile(), Clear(), Flush(), End()
+  - Mapping table: Web Forms method  Blazor equivalent (markup rendering, FileResult, not needed, not needed, early return)
+  - Before/after example: HTML export page  markup-based rendering
+  - Recommended patterns: component state + markup for write, minimal API endpoint with FileResult for writeFile
+- **BWFC014: Request Object Usage**  Detects Request.Form[], Cookies[], Headers[], Files, QueryString[], ServerVariables[]
+  - Mapping table: Request collection  Blazor equivalent (form binding, HttpContextAccessor, InputFile, nav params, etc.)
+  - Before/after example: Page_Load with multiple Request accesses  component with recommended patterns
+  - Recommended patterns: route parameters (QueryString), @bind (Form), HttpContextAccessor (Cookies/Headers for Blazor Server), InputFile (Files)
+- **"Using Analyzers in CI/CD" section** (new)  .editorconfig per-rule severity settings, dotnet build integration, grep for violations in CI scripts
+- **"Prioritization Guide: Which Rules to Fix First"** (new)  Phase 1 (Blocking: BWFC001, BWFC003, BWFC004, BWFC011), Phase 2 (Data: BWFC002, BWFC005, BWFC014), Phase 3 (Output: BWFC013, BWFC012, BWFC010)
+
+**Format & style:**
+- Analyzer guide written for experienced C# developers contributing new rules (Cyclops' audience)
+- Analyzers.md entries written for Web Forms developers learning to interpret/fix violations
+- All code examples are complete and compilable (test-driven)
+- Admonitions (!!! note, !!! warning, !!! tip) for actionable insights
+- Before/After pairs show real Web Forms patterns and Blazor migrations
+- Tables for quick reference (SyntaxKind callbacks, mapping tables, phase priorities)
+- Consistent with existing BWFC doc style (Deprecation Guidance, MigratingAshxHandlers)
+
+**MkDocs verification:**
+- Ran python -m mkdocs build --strict  0 errors, 54.08s build time
+- Unshipped analyzer notes already present in AnalyzerReleases.Unshipped.md (BWFC013, BWFC014 added by Cyclops in advance)
+- No documentation links or cross-references broken
+
+**Design decisions:**
+- ANALYZER-ARCHITECTURE.md placed in dev-docs/ (developer-only, not end-user docs) vs docs/ (migration user-facing)
+- Prioritization guide ordered by business impact (blocking patterns first) vs alphabetical, with rationale for each phase
+- CI/CD section emphasizes dotnet build + .editorconfig as the primary integration point, with note that detailed CI templates are "available separately"
+- Request.Form[]  @bind example is the most direct mapping; QueryString examples show both route parameters and NavigationManager.Uri approaches
+
+**Audience understanding:**
+- Analyzer rules address code-behind patterns (BWFC001BWFC005: property/state/event patterns; BWFC010BWFC014: specific object usage)
+- Developers see these rules in Visual Studio's Error List after L1 migration script + L2 Copilot transforms
+- Rules guide developers from "code compiles but behaves wrong" (blindspots) to "code compiles and works correctly" (full migration)
+- Prioritization guide helps developers allocate effort, fixing high-impact rules first to unblock testing/UAT
+
+**Branch:** eature/analyzer-sprint1  
+**Tests:** All analyzer tests in Analyzers.Test/ pass (no new analyzer implementations in this doc-only sprint)  
+**Verified:** MkDocs build passes strict mode, no broken links or syntax errors in markdown
+
+
+
+ **Team update (2026-03-20):** Analyzer architecture guide (579 lines) + expanded Analyzers.md (+363 lines). Deprecation Guidance docs (#438, 32 KB). BaseValidator/BaseCompareValidator base class docs. MkDocs strict build clean. PR #487 opened on upstream.  decided by Beast
+

.squad/agents/cyclops/history.md

@@ -468,3 +468,35 @@ Team update: ModalPopupExtender and CollapsiblePanelExtender implemented by Cycl
 3. **CS1503** in GridView/Selection.razor — SelectedIndexChanged handler took int but component expects EventCallback<GridViewSelectEventArgs>. Changed handler (and code example) to accept GridViewSelectEventArgs.
 
 **Key insight:** Always check the base class parameter types — ImageButton inherits OnClick from ButtonBaseComponent which uses EventArgs, not MouseEventArgs. GridView's SelectedIndexChanged was recently changed to GridViewSelectEventArgs (matching Web Forms behavior).
+
+### BWFC013 + BWFC014 Analyzer Implementation (2026-03-20)
+
+**Summary:** Implemented two new Roslyn analyzers following established patterns (ResponseRedirect/Session as templates).
+
+- **BWFC013 ResponseObjectUsageAnalyzer:** Detects Response.Write(), WriteFile(), Clear(), Flush(), End() via InvocationExpression + ImmutableHashSet method matching. Code fix replaces with TODO comment.
+- **BWFC014 RequestObjectUsageAnalyzer:** Detects Request.Form/Cookies/Headers/QueryString/ServerVariables["key"] via ElementAccessExpression, and Request.Files via SimpleMemberAccessExpression. Code fix replaces with TODO comment.
+- Both analyzers use xpressionText.EndsWith(".Response") / .EndsWith(".Request") pattern to match 	his.Response, HttpContext.Current.Response, and any *.Response prefix.
+- 21 new tests (10 for BWFC013, 11 for BWFC014): 5+6 positive, 3+3 negative, 2+2 code fix tests.
+- Updated AllAnalyzersIntegrationTests ExpectedIds and analyzer count (810).
+- Updated AnalyzerReleases.Unshipped.md with both rules.
+- All 111 tests pass (90 existing + 21 new).
+
+**Key patterns:** Code fix uses EmptyStatement with SyntaxFactory.EndOfLine("\r\n") between comment trivia and semicolon. BWFC014 registers for both ElementAccessExpression (indexed properties) and SimpleMemberAccessExpression (direct properties like Files), with parent-check to avoid double-reporting.
+
+
+ **Team update (2026-03-20):** BWFC013/BWFC014 analyzers + architecture (6 files, 21 tests, 111 passing, commit b267b854). PR #487 opened on upstream. Next analyzer ID: BWFC015.  decided by Cyclops
+
+### NuGet Analyzer Integration + L1 Prescan Switch (2026-03-20)
+
+**Summary:** Two tasks completed on feature/analyzer-sprint1:
+
+1. **NuGet Analyzer Integration** — Added ProjectReference from BlazorWebFormsComponents.csproj to BlazorWebFormsComponents.Analyzers.csproj with `PrivateAssets="all" ReferenceOutputAssembly="false" OutputItemType="Analyzer"`. Consumers now get Roslyn analyzers automatically when referencing the main NuGet package.
+
+2. **L1/L2 Pipeline Pre-Scan** — Added `-Prescan` switch to `bwfc-migrate.ps1`. Scans source .cs files for 9 BWFC analyzer patterns (BWFC001-005, 011-014) and outputs JSON summary with file-level detail + human-readable breakdown. Early return — no migration transforms executed.
+
+**Verification:** Build succeeds (0 errors), all 111 analyzer tests pass, prescan tested against src/ (1,092 matches across 176 files).
+
+
+### CI Workflow: Analyzer Tests Added (2026-03-20)
+
+**Summary:** Updated .github/workflows/build.yml to restore, build, run, upload, and publish analyzer test results alongside the existing unit tests. Also replaced the squad-ci.yml placeholder with real dotnet restore/build/test commands covering both test suites, including setup-dotnet for .NET 10. YAML validated with Python yaml parser.

.squad/agents/forge/history.md

@@ -430,3 +430,7 @@ Jeff directed a design pivot: replace custom `[HandlerRoute]` attribute + `MapBl
 **Impact:** ~100 fewer lines of production code (400 vs 500). One fewer file (`HandlerRouteAttribute.cs` gone). Issue 2 (routing) shrinks from Size S to XS. Estimated timeline: 2-3 weeks (was 3-4). Adapter layer (`HttpHandlerContext`, `HttpHandlerResponse`, `HttpHandlerServer`) completely unchanged.
 
 **Learning:** Original §7.3 rejected Minimal API because "they require completely different code structure." Wrong framing — Jeff's insight is to use Minimal API as *registration and dispatch infrastructure* while keeping the `HttpHandlerBase` class structure intact. The handler code developers write is nearly identical. Only the plumbing underneath changes.
+
+
+ **Team update (2026-03-20):** Component audit recommendations merged (March 2026 prioritization guide). 52/54 components at 100% health (96.3%). Tier 1 quick wins identified: FileUpload properties, infrastructure docs, View docs, ScriptManager decision.  decided by Forge
+

.squad/agents/jubilee/history.md

@@ -205,3 +205,7 @@
 - **Build verified:** 0 errors.
 
 
+
+
+ **Team update (2026-03-20):** Navigation UX improvements (alphabetical sort, AJAX collapse on desktop) + standalone sample pages for Content, ContentPlaceHolder, View. ComponentCatalog updated.  decided by Jubilee
+

.squad/agents/rogue/history.md

@@ -304,3 +304,7 @@ Test file: `src/BlazorWebFormsComponents.Test/UpdatePanel/ContentTemplateTests.r
 - Tests: src/BlazorWebFormsComponents.Test/Handlers/*.cs (5 test files)
 - Build: dotnet build src\BlazorWebFormsComponents.Test\BlazorWebFormsComponents.Test.csproj validates all
 - Run handler tests: dotnet test --filter "FullyQualifiedName~Handlers"
+
+
+ **Team update (2026-03-20):** Middleware integration testing pattern established (TestServer + AspxRewriteMiddlewareTests.cs, 46 tests). Microsoft.AspNetCore.TestHost added to test dependencies.  decided by Rogue
+