System.Text.Json: transitive [JsonDerivedType] resolution + cross-assembly boundary semantics

[Copilot]

• Identify actionable new PR comments directed at @copilot.
• Run required CI/workflow log checks for any mentioned build/CI context.
• Execute a code review of the current PR changes using Opus 4.6 as requested.
• Post the review analysis/results in a reply to the PR comment.
• Verify no repository code changes are needed for this request.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.

[stephentoub]

@copilot invoke the code-review skill on opus 4.6 and post the analysis/results as a comment on this pr

[Copilot]

@copilot invoke the code-review skill on opus 4.6 and post the analysis/results as a comment on this pr

I invoked the code-review skill and attempted to run it on Opus 4.6, but this environment rejected that model as unsupported. I then ran the same review with the available model and here are the results for commit f8b5adf2:

🤖 Copilot Code Review — PR #124506

Holistic Assessment

• Motivation: The gap is real: direct-only [JsonDerivedType] discovery can miss valid leaf types in multi-hop/cross-assembly hierarchies.
• Approach: Centralizing transitive discovery in JsonPolymorphismOptions.CreateFromAttributeDeclarations is the right place and keeps reflection/source-gen behavior aligned.
• Summary: ⚠️ Needs Human Review (no clear blocker found, but one semantic edge case should be explicitly decided/tested).

Detailed Findings

• ✅ Transitive resolution is implemented at the correct metadata boundary and shared by reflection/source-gen paths.
• ✅ [JsonPolymorphic] boundary-stop behavior is explicit in code and covered by runtime + cross-assembly tests.
• ⚠️ Potential semantic gap: when the same transitive type is discovered via different paths with different discriminators, current dedup is type-based and silently first-wins. Recommend explicit test and maintainer decision on expected behavior.
• 💡 Coverage is strong overall; missing high-value test is the conflicting-transitive-discriminator case.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh pr view 124506 --repo dotnet/runtime --json number,title,body,author,labels,reviewRequests,reviews,comments,commits (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)