implementation-status.md

Implementation Status

This project currently implements every MVP diagnostic ID from the starter document plus the starter's first future-rule expansion through HCR084.

Implemented Rules

Rule	Analyzer	Code fix	Notes
HCR001	Yes	Partial	High-confidence new HttpClient() detection in request-path types, Minimal API endpoint and route-group lambdas, loops, using ownership patterns, and top-level loop/using statements, with resolved custom HttpClient types, visible lookalike Minimal API receivers, and obvious xUnit/NUnit/MSTest test and lifecycle contexts skipped; code fix uses an existing method, local function, or primary-constructor IHttpClientFactory parameter when one is already in scope.
HCR002	Yes	Yes	Static or singleton-owned manual field/property client initializers, direct assignments, and simple unreassigned local handoffs without PooledConnectionLifetime, including resolved custom client filtering, reassignment-aware recognition for configured handler locals/fields/properties and local handler property assignments before client creation, namespace-aware qualified singleton registrations, and visible singleton factory registrations that construct implementations; code fix is limited to safe parameterless field initializers.
HCR003	Yes	No	Factory-created clients cached through direct assignments, simple unreassigned local handoffs, or initializers into static HttpClient fields/properties or HttpClient fields/properties on known singleton services across the compilation, with namespace-aware and resolved member IHttpClientFactory receiver validation, qualified singleton registrations, unresolved provider-chain lookalike filtering, and visible singleton factory registrations that construct an implementation.
HCR004	Yes	Guide	Compilation-wide registration model for typed clients injected into singletons, including nullable and common wrapped constructor parameters, namespace-aware constructor and factory resolution matching, lambda or anonymous singleton factory service-provider resolutions, visible singleton factory registrations that construct an implementation, visible IServiceCollection receiver validation, typeof(...) singleton factory registrations, and namespace-aware matching for visible qualified singleton and typed-client type names.
HCR005	Yes	Yes	Duplicate typed-client registrations across the compilation, including visible IServiceCollection and minimal-hosting Services receiver validation, resolved namespace-aware matching for qualified and unqualified type names, unresolved builder lookalike filtering, typeof(...) standalone registrations, and visible factory registrations that construct the typed-client implementation.
HCR020	Yes	Guide	High-confidence request-scoped and known scoped service constructor dependencies, field captures, and property captures in direct or visibly inherited handler implementations, including visible IServiceCollection receiver validation, scoped factory registrations that construct implementations, common deferred/collection wrappers, namespace-aware qualified request/scoped service names, nullable scoped service names, resolved custom request-type lookalike filtering, plus resolved or qualified handler-base lookalike filtering.
HCR040	Yes	Yes	Duplicate standard resilience handlers and same-name custom resilience handlers with literal or constant names in one fluent AddHttpClient/IHttpClientBuilder chain, plus repeated standard handlers on the same visible unreassigned builder receiver, with AddHttpClient builder-return validation and namespace-aware lookalike custom builders skipped.
HCR041	Yes	Yes	Standard resilience handlers with visible unsafe typed-client or named-client calls across the compilation, including service-collection and minimal-hosting Services chain validation, unresolved builder lookalike filtering, unreassigned split IHttpClientBuilder locals, resolved namespace-aware typed-client matching, one- or two-generic typed-client registrations, constant named-client names, and unsafe HttpRequestMessage Send/SendAsync shapes with literal or constant custom methods including CONNECT; validates namespace-aware typed-client HttpClient and named-client factory receivers including this.-qualified fields/properties, follows named-client and request-message locals until reassignment, and skips disabled retries and safe-method-only retry predicates.
HCR060	Yes	Yes	Awaited ResponseHeadersRead HTTP response ownership and disposal for local declarations and assignments, with resolved HttpClient receiver, HttpCompletionOption member, and response-return validation, using, same-block using-declaration transfer, reassignment-aware direct block-level Dispose() and finally disposal recognition, conditional-dispose filtering, task-local filtering, and returned response/wrapper constructor or initializer transfer heuristics; the code fix is limited to simple declarations.
HCR061	Yes	Guide	Response content reads before visible status handling on awaited HttpClient response locals, including common HttpContent read methods, EnsureSuccessStatusCode(), IsSuccessStatusCode, and StatusCode recognition, reassignment-aware local tracking, returned-response filtering, and resolved custom-client or response-like type filtering.
HCR062	Yes	Guide	Shared HttpClient.DefaultRequestHeaders mutation detection, including direct mutating methods, nested header collection mutations, property assignments, real HttpClient receiver validation, read-only access filtering, request-scoped HttpRequestMessage.Headers exclusions, and resolved custom-client filtering.
HCR063	Yes	Guide	Sync-over-async detection for .Result, .Wait(), and .GetAwaiter().GetResult() on visible HttpClient async calls, visible task locals initialized from those calls before reassignment, and common HttpContent async read methods, with awaited-call, arbitrary-task, and resolved custom-client filtering.
HCR064	Yes	Guide	Cancellation-aware HTTP API detection for visible HttpClient async calls and common HttpContent async reads that omit an available CancellationToken, including method/lambda parameter and prior-local token discovery, token overload validation, existing-token argument recognition, no-visible-token filtering, and resolved custom-client filtering.
HCR080	Yes	Guide	Obvious unbounded Task.WhenAll HTTP fan-out with inline or visible unreassigned local LINQ Select(...) task sequences, BCL Task, and resolved HttpClient receiver validation; skips symbol-equivalent or visibly declared same-receiver SemaphoreSlim gates, bounded Parallel.ForEachAsync, reassignment-aware local/member clients backed by real SocketsHttpHandler.MaxConnectionsPerServer evidence including this.-qualified members and shared handler fields, and resolved custom clients, lookalike async methods, custom Select(...) methods, or lookalike handler limit properties.
HCR081	Yes	Guide	HTTP stream ownership detection for streams materialized from HttpClient.GetStreamAsync(...) or HttpContent.ReadAsStreamAsync(...), including local declarations and assignments, direct dispose or dispose-async recognition, using statement/declaration ownership, return and returned-wrapper ownership transfer, reassignment checks, and resolved custom-client filtering.
HCR082	Yes	Guide	Per-request Polly.ResiliencePipelineBuilder.Build() detection inside obvious request paths, including controller/service-style type suffixes and Minimal API endpoint lambdas, visible builder-local tracking, fluent builder chains, static-field/startup/test-context filtering, and resolved custom-builder filtering.
HCR083	Yes	Guide	Typed-client relative URL detection for registered AddHttpClient<T>() and AddHttpClient<TService,TImplementation>() clients without visible BaseAddress configuration, including direct AddHttpClient(..., client => client.BaseAddress = ...) and chained ConfigureHttpClient(...) filtering, resolved real HttpClient receiver validation, absolute URL filtering, and custom-client filtering.
HCR084	Yes	Guide	Named-client literal duplication detection between visible string-literal AddHttpClient("name") registrations and matching string-literal IHttpClientFactory.CreateClient("name") use sites, including obvious service-collection and factory receiver validation, shared-constant filtering, and custom factory or registration lookalike filtering.

Current Limitations

• Cross-file DI graph analysis is intentionally lightweight; it matches direct IServiceCollection-shaped registration calls across syntax trees but does not expand arbitrary custom wrapper semantics beyond visible calls.
• HCR041 models visible typed-client and named-client call sites across syntax trees, including string literals and compile-time constants for named clients and custom HttpMethod string names, but it does not trace values through mutable variables or configuration.
• HCR060 uses local ownership heuristics rather than full control-flow analysis.
• HCR080 is intentionally suggestion-level and heuristic.
• HCR081 tracks local stream ownership heuristically rather than full interprocedural ownership flow.
• HCR082 intentionally limits request-path evidence to visible type names and Minimal API shapes; it does not infer arbitrary framework dispatch conventions.
• HCR083 follows visible typed-client registrations and simple string URL constants; it does not evaluate configuration-driven base addresses.
• HCR084 intentionally reports duplicated string literals, not constant-backed names or configuration-provided names.