NTFSSecurity/.memory-bank/progress.md

---
status: current
last-verified: 2026-10-06
owner: active-agent
source: repository evidence
---

# Progress

## Current status

5.0.0-rc3 is on the PowerShell Gallery and in the GitHub releases,
published by CI from the tag `5.0.0-rc3` on `master` (`914e8da`, the merge
of #112) on 2026-10-06 (Decision 12). It adds to 5.0.0-rc2 the fix of #34
and of the copied inherited entries: the cmdlets write only the sections
that they change (Decision 19). The stable Gallery version is still 4.2.6.
NTFSSecurity will be archived soon; its users move to WindowsAccessControl
(Decision 18).

## Recent milestones

- 2026-10-02 to 2026-10-04: #91 to #97 aligned the docs with the code,
  shipped the help file, kept the docs on GitHub, set version 5.0.0, moved
  CI and a wiki generated from `Docs` to GitHub Actions, and completed the
  version history (Decisions 6 to 11).
- 2026-10-04: #98 (`e0f5366`) added releases on a version tag through CI
  (Decision 12). The tag `5.0.0-rc1` published to the Gallery and created
  the GitHub prerelease; the installed module passed the full suite.
- 2026-10-05, overnight run: the 24 code defects of work package 5 and the
  issues #3, #4, #5, #17, #74, #82, #86, and #88 fixed with regression
  tests, plus what one security review per PR found; the 37 open issues
  triaged; `Docs/FAQ.md`, Dependabot for the actions, and the label `rc2`.
  #5 and #82 are breaking changes, like the change of Decision 13.
- 2026-10-05: the first CI runs of the eight PRs found a defect that the
  workstation had skipped, fixed in `629f4e7` (audit inheritance of an item
  without a SACL). The PRs #99 to #106 were merged in order with merge
  commits, CI on `master` passed, and the tag `5.0.0-rc2` published the
  prerelease; GitHub's Actions outage that day cancelled the first two
  attempts of the release run before they started. Repository hardening is
  optional (Decision 14); the merge rule and the maintainer's rule for
  fixes are Decisions 15 and 16.
- 2026-10-06: the issues got their labels (Decision 17). The maintainer
  decided to publish 5.0.0-rc3 before 5.0.0 and to archive the project in
  favor of WindowsAccessControl (Decision 18); the README, the docs home,
  and the changelog announce it.
- 2026-10-06: 5.0.0-rc3 (#112): the access and audit cmdlets write only
  the section that they change, which fixes #34 and the inherited entries
  that elevated sessions copied as explicit ones (Decision 19). #67 has its
  cause outside the module (a share root over UNC can't re-inherit), is
  explained in `Docs/FAQ.md`, and was closed as not planned. One
  `security-reviewer` pass approved the branch. The PR description said
  "fixes #34", so the merge closed #34; it was reopened for a tester.

## Stable capabilities

- 36 cmdlets: access (7), audit (5), inheritance (6), owner and security
  descriptor (4), privileges (3), long-path items (6), links, hash, and
  disk space (5).
- Works in Windows PowerShell 5.1 and PowerShell 7. In PowerShell 7,
  `Get-FileHash2` lacks `RIPEMD160` and `MACTripleDES`, which .NET lacks.
- Pester tests in `Tests\` run in `$env:TEMP` sandboxes through
  `Tests\TestHelpers.psm1`; tests that need privileges skip without them
  and run in CI, whose runners are elevated.

## Open work

1. Release 5.0.0 through CI (Decision 12) when the maintainer decides:
   remove the label, date `[Unreleased]` as `[5.0.0]`, add `5.0.0-rc3` to
   `$publishedVersions`, and tag `5.0.0` (steps in
   `Docs/Contributing/05-Releasing.md`). #34 stays open with Bug and Help
   Wanted until a tester with a file server that refuses the owner
   confirms the fix, or until 5.0.0 ships.
2. Issues: the open issues got their replies on 2026-10-05. Follow-up
   issues for the open Minor review findings: #107 (relative path forms),
   #108 (`Copy-Item2` and `Move-Item2`), #109 (error messages), #110
   (tests), and #111 (small items); #68 tracks `-WhatIf` and `-Confirm` for
   every cmdlet that changes security. The labels follow Decision 17; #16,
   #21, #45, and #89 wait for their reporters (Needs Info). Not planned for
   5.0.0: #41 (a drive root reads the device object), #90 (a trailing space
   in a folder name), and the enhancements #22, #49, #68, #77, #87.
3. Review findings of rc3, not filed: an extra DACL read and four SDDL
   snapshots on read paths, and a duplicate SACL check. Older:
   `Remove-NTFSAudit` fails for an item without a SACL;
   `FileSystemSecurity2.Write(FileSystemInfo)` and `Write(string)` write
   every section; the owner retry of `Set-NTFSSecurityDescriptor` lacks a
   `finally`; `RemoveFileSystemAccessRuleAll` and
   `RemoveFileSystemAuditRuleAll` ignore their accounts filter, which no
   cmdlet passes.
4. `pwsh` 7.6.1 crashed three times during test runs on the ARM64
   workstation (x64 emulation), without module frames; none of the CI runs
   on native x64 on 2026-10-05 crashed.
5. Optional for the maintainer: delete the AppVeyor project and revoke its
   GitHub authorization, restrict wiki editing to collaborators, ask
   `Sup3rlativ3` to delete the Read the Docs project, and delete the branch
   `test/transfer`. The branch `fix/#34` is superseded by #112.