A C# compiler is reachable from deployment data in the Monitor process

Problem

PropertyExpressionEvaluator calls CSharpScript.EvaluateAsync on any property value prefixed fn:. That is a C# compiler, invoked on deployment data, inside the process that holds both deployment credential pairs in memory.

Provenance containment already removed the path a request could take to it. What remains is the compiler itself: a class of weakness kept alive for a capability the estate does not use.

What the estate actually uses

An inventory of live property values returned 11 distinct expressions across 133 values, every one of a single shape:

fn:"<literal>" [ .ToLower() | .ToUpper() | .Replace("<a>","<b>") ]*

One expression — fn:"$EnvironmentName$".Replace(" ","_") — accounts for 101 of the 133. No loops, reflection, assembly references, type construction or I/O.

A parser is sufficient. A compiler is not required and should not remain reachable.

Residual to contain

Secure ConfigValues are encrypted at rest and could not be inspected by query, but they do reach the evaluator. So the grammar must fail closed: an expression it cannot parse is an error, never a fallback to compilation.

Weakness

W-1 — completing what provenance containment began.

Acceptance

• A differential test evaluates every inventoried expression shape under both implementations and asserts identical results.
• An unparseable expression fails with a clear error and does not fall back.
• The scripting-compiler package is absent from the assembly's dependencies.

Start at PropertyExpressionEvaluator and trace the CSharpScript.EvaluateAsync path and its assembly dependency. Use the inventoried expression shapes for a differential test under both implementations, then verify unparseable input fails without fallback and the scripting-compiler package is absent from the assembly dependencies.