diff --git a/.memory-bank/activeContext.md b/.memory-bank/activeContext.md index 7a62b21..d5351dd 100644 --- a/.memory-bank/activeContext.md +++ b/.memory-bank/activeContext.md @@ -1,6 +1,6 @@ --- status: current -last-verified: 2026-10-11 +last-verified: 2026-10-19 owner: active-agent source: current task evidence --- @@ -9,22 +9,20 @@ source: current task evidence ## Current focus -State at 2026-10-11 13:50 UTC: Handoff 5 (the coverage unknowns) is done -locally on `ai/coverage-unknowns`, from `origin/master` `6696f68`; the -maintainer pushed the branch at `2b97422`, and the later commits are local. -The report is `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md` with nine -CSV tables. rc7 (`fa0701b`) was measured at 3,198/3,649 sequence points. Three -defects are fixed test-first: two `tr-TR` comparisons (`419cfb3`; `0028ccd`, -`fbe0289`, `8a625c8`) and the piped `AppliesTo` that a path dropped (`93ed2c7`, -`9783d2a`: no default parameter set for Add and Remove of access and audit, -Decision 26); one defect is open (hard-link names under a root that is not the -volume root). 101 new `It` blocks; at `2112ee3` (product code built once at -`9783d2a`): 1,492 cases per configuration, 3,266/3,668 points. The final -package passed in the labs (first lab 245/0/1 per edition; the suite on the file -servers and the client, 16 configurations; the three cells 229/0/2 per -edition), every end state clean. Three independent reviews and two checks read -the work, with no Blocker. The maintainer decides whether the fixes and the -tests enter a new candidate. +State at 2026-10-19 12:30 UTC: Handoff 5 is integrated. The maintainer merged +pull request #125 (`ai/coverage-unknowns`, `17729d7`) and #124 (Dependabot: the +pinned `upload-artifact` and `download-artifact` actions, `354ce04`) into +`master`; CI is green on both. rc7 (`fa0701b`) is still the newest release and +the manifest still says `rc7`, but `master` is ahead of it by seven product +files (the culture comparisons of an identity and of `Get-ChildItem2 -Filter`, +and the piped `AppliesTo`, Decision 26). The stable build is accepted through +the last prerelease, so rc8 is mandatory. On 2026-10-19 the maintainer decided +the path to stable (Decision 21, "Closing the gate"): rc8 carries the fix of +the false "no access" of `Get-NTFSEffectiveAccess`; the hard-link names stay a +known limit in the release notes; the plain test gaps are closed in a +tests-only round until 2026-11-02; #34 waits for a tester until 2026-11-02; +Decisions 22 and 24 are accepted (23: option 3). His #34 follow-up went up on +2026-10-19 at 12:09 UTC; nobody has replied. Next: the fix and the test round. State at 2026-10-10 15:45 UTC: the maintainer integrated the release-gate stack into `master` (`6dd799f`, CI green): #116 (rc7, `8a6be9f`), #120 @@ -150,43 +148,44 @@ acceptance is the maintainer's. ## Next step -1. Gate 3 is done for the published rc7 (the record above). A changed binary - (rc8, or the build of 5.0.0) needs the same cells again; the release - procedure accepts the last prerelease for the stable build (his decision). +1. Gate 3 is done for the published rc7 (the record above). rc8 needs the same + acceptance (the matrix cells, the first lab, the suite on the file servers + and the client); the release procedure accepts the last prerelease for the + stable build (Decision 21, "Closing the gate"). Open: keep or replace the matrix VMs (about 60 GB) and the evaluation client (it shuts down every hour; `OSWin11E` is off), and a domain cell for Windows 11 26H1, whose client loses the secure channel to the Server 2025 domain controller. A kit script for the whole sequence would make the repetition one command (the driver is `Run-Gate3.ps1` in the evidence; not in the kit). -2. The change that sets the next version (rc8 or 5.0.0) adds `5.0.0-rc7` to - `$publishedVersions`; adding it earlier fails the reuse test (deployment - notes). Every release step is the maintainer's. -3. He decides the open items of the paths report: `FileSecurity` conversions, - `RemoveAll` account filters, lazy path overloads, abandoned +2. The rc8 pull request adds `5.0.0-rc7` to `$publishedVersions` (the list ends + at rc6; adding it earlier fails the reuse test, deployment notes), and the + stable pull request adds `5.0.0-rc8`. Every release step is the + maintainer's. +3. He decides the other open items of the paths report: `FileSecurity` + conversions, `RemoveAll` account filters, lazy path overloads, abandoned `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, the 17 owner-restore handlers without the later-command check, unused classes - (Decisions 21/22). He also confirms or changes the proposed Decisions 22 and - 24. -4. #34 stays open (Decision 23; no reply since 2026-10-06): the maintainer - chooses between waiting for a test of the published candidate on the - NetApp, EMC, and IBM ESS servers of the reporters (checklist: - `Tests/Lab/Non-Windows-File-Server-Test.md`) and accepting the untested - risk with a release-note caveat. No agent can accept it. -5. He decides the two LOW findings of the security review (record, Limits): - the swallowed initialization errors of `GetEffectiveAccess` (a false "no - access" instead of an error on an OS that refuses at initialization; fix: - record the exceptions in `authzException`, with a regression test and a - check of "the error stays" in the help and CHANGELOG), and the ACL of the - stage folders under `C:\` in the lab kit (they inherit Authenticated Users: + (Decisions 21/22). Decisions 22 and 24 are accepted (2026-10-19). +4. #34 waits for a tester until 2026-11-02 (Decision 23, option 3; the + follow-up went up on 2026-10-19, no reply yet; checklist: + `Tests/Lab/Non-Windows-File-Server-Test.md`). On that date the maintainer + chooses between waiting longer and accepting the untested risk with a + release-note caveat. No agent can accept it. +5. Of the two LOW findings of the security review (record, Limits), the + swallowed initialization errors of `GetEffectiveAccess` (a false "no + access" instead of an error on an OS that refuses at initialization) are + fixed in rc8 (decided 2026-10-19): record the exceptions in + `authzException`, with a regression test and a check of "the error stays" in + the help and CHANGELOG. He still decides the other: the ACL of the stage + folders under `C:\` in the lab kit (they inherit Authenticated Users: Modify; protecting them is a design change of the controller and needs a new acceptance). The help could also say that a local standard user who asks about a domain account still gets "Access is denied". -6. Handoff 5 is done (Evidence). The maintainer decides whether the fixes - (`419cfb3`, `0028ccd`, `fbe0289`, `8a625c8`, `93ed2c7`, `9783d2a`) and the - tests enter a new candidate (rc8), which needs the matrix cells and the - first lab on its own bytes, and he decides the open items of the report: - hard-link names under another root (a defect with a reproduction), the - silent default scope for a piped `AppliesTo` that PowerShell cannot convert - (a design change), 8 getters of pipeline parameters, the 51 partly closed - sets, and the audit paths. +6. Handoff 5 is done and merged (Evidence). Decided on 2026-10-19 (Decision + 21): the hard-link names under another root (a defect with a reproduction) + stay a known limit that the release notes list; the plain test items (68 + `budget` mentions in the 57 sets that are not closed) are closed in a + tests-only round until 2026-11-02. Still his: the silent default scope for a + piped `AppliesTo` that PowerShell cannot convert (a design change), the 8 + getters of pipeline parameters, and the audit paths. 7. Do not release stable 5.0.0 or equate a percentage with gate closure. diff --git a/.memory-bank/decisions/0021-quality-gate-before-5.0.0.md b/.memory-bank/decisions/0021-quality-gate-before-5.0.0.md index 5664903..caa7106 100644 --- a/.memory-bank/decisions/0021-quality-gate-before-5.0.0.md +++ b/.memory-bank/decisions/0021-quality-gate-before-5.0.0.md @@ -1,9 +1,9 @@ --- status: accepted date: 2026-10-08 -last-verified: 2026-10-08 +last-verified: 2026-10-19 owner: shared -source: maintainer decision of 2026-10-08 +source: maintainer decision of 2026-10-08; closing choices of 2026-10-19 --- # Decision 21: A quality gate before 5.0.0 @@ -35,3 +35,37 @@ source: maintainer decision of 2026-10-08 (Decision 16); so do the 244 lines of classes that no cmdlet calls, the operating systems of Phase 3, and how to cover file servers that aren't Windows (#34). + +## Closing the gate (maintainer, 2026-10-19) + +After Handoff 5 and the merges of #125 and #124 (`master` at `354ce04`), the +maintainer answered five questions, each time with the recommended option: + +- rc8 is the next prerelease and carries `master`, which is ahead of rc7 by the + seven product files of #125. Stable 5.0.0 is accepted through the last + prerelease (`Docs/Contributing/05-Releasing.md`), so rc8 is mandatory. +- Code before rc8: fix the false "no access" of `Get-NTFSEffectiveAccess` (the + swallowed initialization errors, a LOW finding of the security review), + test-first, with an independent review. The hard-link names under a root that + is not the volume root stay a known limit that the release notes list (the + exit criterion allows "fixed, or accepted and listed"). The other open items + of the paths report and of Handoff 5 are not decided yet. +- Test gaps: the plain test items that the ParameterSets table marks `budget` + (68 mentions in the 57 sets that are not closed) are closed in a round of + tests only, time-boxed to 2026-11-02; the report lists what is left. The + shipped DLL does not change by it. A defect that a test finds needs its own + decision and a new prerelease. +- #34: wait for a tester until 2026-11-02, then choose between waiting longer + and accepting the untested risk (Decision 23, option 3). +- Decisions 22 and 24 are accepted (their records). +- A tester's result on rc7 counts for rc8 only while no change of rc8 touches + the code that writes a section of a security descriptor (Decision 19). The + seven product files of #125 have no such line, and the fix of + `Get-NTFSEffectiveAccess` reads. +- Path to stable: the rc8 pull request (label `rc8`, `5.0.0-rc7` into + `$publishedVersions`, changelog), the tag, the acceptance of the published + rc8 (matrix cells, first lab, suite on the four machines), the stable pull + request (no `Prerelease`, `## [5.0.0] - `, `5.0.0-rc8` into + `$publishedVersions`), the tag. The maintainer checks the expiry of + `PSGALLERY_API_KEY` before the stable tag. After 5.0.0 the repository is + archived (Decision 18), so what ships stays. diff --git a/.memory-bank/decisions/0022-phase-2-behavior-changes.md b/.memory-bank/decisions/0022-phase-2-behavior-changes.md index d66e59f..eab762e 100644 --- a/.memory-bank/decisions/0022-phase-2-behavior-changes.md +++ b/.memory-bank/decisions/0022-phase-2-behavior-changes.md @@ -1,9 +1,9 @@ --- -status: proposed +status: accepted date: 2026-10-08 -last-verified: 2026-10-09 +last-verified: 2026-10-19 owner: shared -source: agent choices in autopilot on 2026-10-08, for the maintainer's review; confirmed by the agent under his delegation on 2026-10-09 +source: agent choices in autopilot on 2026-10-08, for the maintainer's review; confirmed by the agent under his delegation on 2026-10-09; accepted by the maintainer on 2026-10-19 --- # Decision 22: The behavior changes of Phase 2 @@ -51,8 +51,7 @@ source: agent choices in autopilot on 2026-10-08, for the maintainer's review; c (3); the conventions of .NET and PowerShell (4, 9); no implicit creation of folders (10; `Copy-Item` creates them for a folder, see the correction below). -- Open: the maintainer accepts or reverts each choice; then this record - becomes `accepted`. +- Accepted by the maintainer on 2026-10-19 (see the end of this record). ## Confirmed under delegation, 2026-10-09 @@ -104,4 +103,8 @@ source: agent choices in autopilot on 2026-10-08, for the maintainer's review; c the help from `Docs`, adjust the changelog and the cmdlet page, and run the four test configurations again; a later commit on the same page or test can conflict. -- Open: the maintainer confirms (`accepted`) or reverts each item. +- Accepted: on 2026-10-19 the maintainer answered "Confirm all ten" to the + question about these ten choices, which listed the ten and marked 7 and 8 as + breaking. The confirmation of 2026-10-09 under his delegation is superseded. + After 5.0.0 the changes are permanent, because the repository is archived + (Decision 18). diff --git a/.memory-bank/decisions/0023-non-windows-file-servers.md b/.memory-bank/decisions/0023-non-windows-file-servers.md index 71bfa2c..fd74655 100644 --- a/.memory-bank/decisions/0023-non-windows-file-servers.md +++ b/.memory-bank/decisions/0023-non-windows-file-servers.md @@ -1,9 +1,9 @@ --- -status: proposed +status: accepted date: 2026-10-09 -last-verified: 2026-10-09 +last-verified: 2026-10-19 owner: shared -source: agent assessment for the maintainer (Handoff 4), from #34 read on 2026-10-09 21:33 UTC +source: agent assessment for the maintainer (Handoff 4), from #34 read on 2026-10-09 21:33 UTC; option 3 chosen by the maintainer on 2026-10-19 --- # Decision 23: Non-Windows file servers before 5.0.0 (#34) @@ -58,8 +58,16 @@ source: agent assessment for the maintainer (Handoff 4), from #34 read on 2026-1 was tested on Windows file servers. NetApp, EMC, and IBM ESS file servers weren't available for 5.0.0. If a command still fails there with error 1307, tell us in #34. `icacls` is the fallback." -- Open: the maintainer's choice between the options, and the date. Until - then the gate of Decision 21 for #34 is open. +- Chosen (maintainer, 2026-10-19): option 3, with the decision date + 2026-11-02, 14 days after the follow-up. He posted a follow-up on #34 on + 2026-10-19 at 12:09 UTC, adapted from the draft below: it asks for the newest + prerelease (then rc7), links the checklist on `master`, and names no date. A + tester's result on rc7 counts for rc8 while no change of rc8 touches the + code that writes a section (Decision 21, "Closing the gate"). The gate of + Decision 21 for #34 stays open: no tester has reported, and no risk is + accepted. On 2026-11-02 the maintainer chooses between waiting longer + (option 1) and accepting the untested risk with the caveat below (option 2). + No answer keeps the gate open. - Tester checklist: `Tests/Lab/Non-Windows-File-Server-Test.md`. It uses a new folder that the tester controls and asks for sanitized evidence. - Draft comment for #34 (for the maintainer to post; the agent posts diff --git a/.memory-bank/decisions/0024-os-matrix-lab.md b/.memory-bank/decisions/0024-os-matrix-lab.md index b8fbdef..3e4f514 100644 --- a/.memory-bank/decisions/0024-os-matrix-lab.md +++ b/.memory-bank/decisions/0024-os-matrix-lab.md @@ -1,9 +1,9 @@ --- -status: proposed +status: accepted date: 2026-10-09 -last-verified: 2026-10-10 +last-verified: 2026-10-19 owner: shared -source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff 2); the scope follows Decision 21, phase 3 +source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff 2); the scope follows Decision 21, phase 3; confirmed by the maintainer on 2026-10-19 --- # Decision 24: The operating-system matrix lab @@ -141,12 +141,13 @@ source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff counts: the three cells (1,374 passed, 0 failed, 12 skipped), the suite in 24 runs, and the first lab with case 9 (245 / 0 / 1 per edition); see [its record](../../Tests/Lab/Acceptance-2026-10-10-published-rc7.md). -- Open: the maintainer confirms or changes the matrix and decides whether to - keep the VMs after 5.0.0. A stable 5.0.0 is a new build, so the release - procedure accepts the last prerelease; a changed binary needs the same cells - again. The newest Windows 11 build that can join a Server 2025 domain here is - 22H2; a domain cell with 26H1 needs a newer domain controller build or a fix - of the mismatch. All three module fixes went into rc7 (#119; `962887a` holds - two, `fdd7a8b` one, and they don't revert separately). The maintainer also - decides whether the evaluation client stays (it needs a start shortly before - every run) or is replaced by a client with a license that doesn't expire. +- Accepted: the maintainer confirmed the matrix as it is on 2026-10-19. Open: + whether to keep the VMs after 5.0.0. A stable 5.0.0 is a new build, so the + release procedure accepts the last prerelease; a changed binary needs the + same cells again. The newest Windows 11 build that can join a Server 2025 + domain here is 22H2; a domain cell with 26H1 needs a newer domain controller + build or a fix of the mismatch. All three module fixes went into rc7 (#119; + `962887a` holds two, `fdd7a8b` one, and they don't revert separately). The + maintainer also decides whether the evaluation client stays (it needs a start + shortly before every run) or is replaced by a client with a license that + doesn't expire. diff --git a/.memory-bank/progress.md b/.memory-bank/progress.md index 8a170c6..965126b 100644 --- a/.memory-bank/progress.md +++ b/.memory-bank/progress.md @@ -1,6 +1,6 @@ --- status: current -last-verified: 2026-10-11 +last-verified: 2026-10-19 owner: active-agent source: repository and validation evidence --- @@ -14,9 +14,11 @@ source: repository and validation evidence whole stack into `master` (CI green): #116 (rc7), #120 (it replaced #117, which GitHub closed unmerged when the branch deletion after #116 removed its base), #118 (the quality-gate paths), #119 (the operating-system matrix -with three module fixes, Decision 24 proposed), and #121 (the Memory Bank). The +with three module fixes, Decision 24), and #121 (the Memory Bank). The published rc7 passed its lab acceptance (gate 3) in the matrix and in the first -lab. Stable Gallery version: 4.2.6. +lab. On 2026-10-19 he merged #125 (Handoff 5) and #124 (Dependabot), and decided +the path to stable (Decision 21, "Closing the gate"). Stable Gallery version: +4.2.6. After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). ## Recent milestones @@ -48,14 +50,11 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). - 2026-10-09: release attempt 2 succeeded; rc6 GitHub prerelease and zip appeared at 07:01:34 UTC. #116 passed CI on `d25647d`. - 2026-10-09: autonomous follow-up on `ai/quality-gate-coverage` (#117, then - #120), through `3442194`: 202 cases above rc7 (deletion/owner failures, all - 13 scopes, inheritance transitions, enumeration, forced replacement, - descriptor failures, offline CI recovery); fixed rooted result paths and the - first-hidden-item omission; publication recovery verifies the exact SHA-512 - identity, not merely the version. Suite: 914 per configuration, zero + #120), through `3442194`: 202 cases above rc7; fixed rooted result paths and + the first-hidden-item omission; publication recovery verifies the exact + SHA-512 identity, not merely the version. Suite: 914 per configuration, zero failures; 2,641/3,559 sequence points (74.21%), 974/1,933 branches (50.39%). - Live comparison, 09:20 to 09:51 UTC: candidate 330 passed, 0 failed, 2 - expected skips; published rc6 only its four expected failures (`7594e0c`). + Live comparison: candidate 330 passed, 0 failed, 2 expected skips (`7594e0c`). - 2026-10-09: handoff 1 (#118): suite 914 to 1,310 per configuration, zero failures; 3,192/3,634 sequence points (87.84%), 1,273/1,978 branches; all 231 unvisited methods classified (223 explained, 8 open). Eleven defects fixed, @@ -75,11 +74,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). suite on every machine (24 runs), the live controller in three cells (1,374 passed, 0 failed, 12 skipped), and the first lab with case 9 (245 passed, 0 failed, 1 skipped per edition). The Server 2022 effective-access failures - were stale account state, not the module (a replay; the Windows mechanism is - unknown); the controller names the case-3 account anew (`1dec389`). Built-in - reviews: Minors corrected, one Major resolved by the replay, no Blocker; the - built-in security review found no exploitable vulnerability and two LOW items - left for the maintainer. Record: + were stale account state, not the module (the controller names the case-3 + account anew, `1dec389`). The built-in security review found no exploitable + vulnerability and two LOW items left for the maintainer. Record: `Tests/Lab/Acceptance-2026-10-10-os-matrix.md`. - 2026-10-10: the maintainer integrated the stack. His branch deletion after the merge of #116 (`8a6be9f`, 09:10:12Z) removed the base branch of #117, and @@ -99,9 +96,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). 9 245 / 0 / 1 per edition; every end state CLEAN. The counts equal those of the final local candidate. Record: `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`. -- 2026-10-10 to 2026-10-11: Handoff 5, the coverage unknowns (local, - `ai/coverage-unknowns`; the maintainer pushed `2b97422`, later commits are - local). rc7 measured at `fa0701b`: 3,198/3,649 sequence points; the live +- 2026-10-10 to 2026-10-11: Handoff 5, the coverage unknowns (branch + `ai/coverage-unknowns`, merged as #125 on 2026-10-19). rc7 measured at + `fa0701b`: 3,198/3,649 sequence points; the live suite and the suite on a domain member add 9 sequence and 4 explicit branch points (`fdd7a8b`); two `tr-TR` defects fixed test-first (`419cfb3`; `0028ccd`, `fbe0289`, `8a625c8`); 101 `It` blocks added. The piped @@ -115,6 +112,11 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). hard-link names under another root, the silent default scope of an unconvertible piped `AppliesTo`. Report: `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`. +- 2026-10-19: #125 (Handoff 5) and #124 merged, CI on `master` green. The + maintainer decided the path to stable (Decision 21): Decisions 22 and 24 + accepted, 23 option 3 with the decision date 2026-11-02 (the #34 follow-up + went up at 12:09 UTC), rc8 with the fix of `GetEffectiveAccess`, and a + tests-only round for the plain test gaps until 2026-11-02. ## Stable capabilities @@ -128,8 +130,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). ## Open work 1. Decision 21 gate: the published rc7 is accepted in the matrix and the first - lab (record); review Decision 22 and the open items below. Do not release - 5.0.0 until the remaining-path and OS-matrix gates close. Release steps: + lab (record); rc8 needs the same acceptance, and stable follows it + (Decision 21, "Closing the gate"). Do not release 5.0.0 until the other + gates close. Release steps: `Docs/Contributing/05-Releasing.md`; remove the prerelease label, date `[5.0.0]`, add the last prerelease to `$publishedVersions` (never the version of the manifest), tag through CI. @@ -143,7 +146,7 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). library-only RemoveAll account filters; rc5 unchecked Authz errors and lab-controller hardening; rc6 failed privilege-disable retry (not reproduced); rc7 audit missing-path error IDs declined in Decision 22. -4. Architecture/cmdlet design: Decision 22 remains proposed; two link +4. Architecture/cmdlet design: Decision 22 is accepted (2026-10-19); two link changes are breaking. Keep unused classes/helper overloads until a maintainer decision; do not remove them to improve coverage percentages. 5. ARM64 workstation: out of scope (maintainer, 2026-10-11, Decision 25). @@ -155,9 +158,8 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). (`Tests/Coverage`): 167 explained from source with evidence, 16 open (8: `FileSecurity` conversions, `RemoveAll` account filters; 8 getters of pipeline parameters that no test binds by property name). Other open - decisions: lazy path overloads, abandoned - `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, 17 - owner-restore handlers that do not pass on + decisions: lazy path overloads, abandoned `PrivilegeEnabler`, dot patterns + of `Get-ChildItem2 -Filter`, 17 owner-restore handlers that do not pass on what a later command raises (a rare combination), unused classes. No trigger for an audit write's ownership retry was found on a local volume or a Windows file server (probe of 48 calls) and no test reaches it. A @@ -167,9 +169,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). artifact SHA-512 verification; the original upload errors remain errors for missing, different, or unverifiable outcomes. The agent published nothing, so the recovery has never run against the Gallery. -9. Operating-system matrix (Decision 24, proposed): the lab and the cells exist - and the published rc7 passes them (record); the maintainer approves the - matrix. #34 has no new reply since 2026-10-06. +9. Operating-system matrix (Decision 24, accepted 2026-10-19): the lab and the + cells exist and the published rc7 passes them (record). #34: the follow-up + went up on 2026-10-19, no reply yet; the decision date is 2026-11-02. 10. Lab rollback evidence: new checkpoints report Standard even after a successful temporary ProductionOnly probe; original VM policy restored, no checkpoint restored. Don't represent them as verified Production snapshots. diff --git a/.memory-bank/systemPatterns.md b/.memory-bank/systemPatterns.md index fdfbfd2..8f7d292 100644 --- a/.memory-bank/systemPatterns.md +++ b/.memory-bank/systemPatterns.md @@ -1,6 +1,6 @@ --- status: current -last-verified: 2026-10-10 +last-verified: 2026-10-19 owner: active-agent source: repository and regression evidence --- @@ -46,9 +46,9 @@ Read only task-relevant records; the index controls routing. | 19 | [Cmdlets write only the sections that they change](decisions/0019-write-only-changed-sections.md) | | 20 | [Live tests in a lab live in Tests\Lab](decisions/0020-live-tests-in-tests-lab.md) | | 21 | [A quality gate before 5.0.0](decisions/0021-quality-gate-before-5.0.0.md) | -| 22 | [The behavior changes of Phase 2 (proposed)](decisions/0022-phase-2-behavior-changes.md) | -| 23 | [Non-Windows file servers before 5.0.0, #34 (proposed)](decisions/0023-non-windows-file-servers.md) | -| 24 | [The operating-system matrix lab (proposed)](decisions/0024-os-matrix-lab.md) | +| 22 | [The behavior changes of Phase 2](decisions/0022-phase-2-behavior-changes.md) | +| 23 | [Non-Windows file servers before 5.0.0, #34 (option 3; gate open)](decisions/0023-non-windows-file-servers.md) | +| 24 | [The operating-system matrix lab](decisions/0024-os-matrix-lab.md) | | 25 | [Four environments are out of scope for the tests](decisions/0025-out-of-scope-environments.md) | | 26 | [No default parameter set for Add and Remove (access, audit)](decisions/0026-no-default-parameter-set-add-remove.md) |