From 90e04c6081182fa18c0199171350b566a7acdcf4 Mon Sep 17 00:00:00 2001 From: Raimund Andree Date: Wed, 21 Oct 2026 17:19:59 +0000 Subject: [PATCH] docs(memory-bank): close out the rc9 work with the head, the final suite, and the open work Record that the branch ai/rc9 is complete at de67883 (32 commits over d0cb57c, 2,116 cases per configuration, 0 failed), what the two review rounds found, that the maintainer chose to reject a list for -AccessType and -AppliesTo, and what is left before the stable pull request (push, pull request, merge, and tag of rc9 by the maintainer, then the lab acceptance of the published bytes). Lessons for the next agent: PowerShell combines the numbers of a list for an enumeration that is not a flags enumeration bit by bit, and code that opens a one-element collection needs a depth limit. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant --- .memory-bank/activeContext.md | 266 +++++++----------- .memory-bank/debugging-insights.md | 16 ++ .../decisions/0027-open-items-before-5.0.0.md | 24 ++ .memory-bank/progress.md | 90 +++--- .memory-bank/systemPatterns.md | 38 +-- .memory-bank/techContext.md | 6 +- 6 files changed, 204 insertions(+), 236 deletions(-) diff --git a/.memory-bank/activeContext.md b/.memory-bank/activeContext.md index a1590e4..2e06b75 100644 --- a/.memory-bank/activeContext.md +++ b/.memory-bank/activeContext.md @@ -9,30 +9,53 @@ source: current task evidence ## Current focus -State at 2026-10-21: 5.0.0-rc8 is published and accepted. The -maintainer merged #126 (the decisions of 2026-10-19) and #127 (`c719197`: the -fix of the false "no access" of `Get-NTFSEffectiveAccess`, the known limit of -the hard-link cmdlets in the pages and the CHANGELOG, and the label `rc8`) and -tagged `5.0.0-rc8` at about 10:28Z. The CI run `39408140862` passed, and the -Gallery has rc8 since 10:40:58Z, GitHub since 10:41:07Z. The identity check -passed. The lab acceptance of the published bytes passed in one detached driver -(68 minutes, 10:38 to 11:47Z): three cells 1,374/0/12, the suite in 24 runs on -six machine classes, the first lab 245/0/1 per edition, every end state CLEAN -(record `Tests/Lab/Acceptance-2026-10-20-published-rc8.md`, #128). The boundary -of the new error, a computer name of 32,718 characters, holds on Server 2019, -2022, 2025, and Windows 11 26H1. He merged the record, #128, on 2026-10-21 at -05:48Z, the tests-only round for the plain gaps (#129, 08:24Z; Next step 6), -and this Memory Bank (#130, 08:47Z); `master` is `d0cb57c`. The new tests gave -the same counts on the runner (three CI runs) and on six machine classes of the -labs (24 runs, 0 failed). A probe found that a typo in a piped `AccessType` -silently creates an Allow entry. He decided (Decision 27) that rc9 fixes that -family and the items 3 to 7 of its sheet, with a review, and chose the -designs. Four work items run in worktrees under `C:\Temp\ntfs-rc9` (branch -`ai/rc9-before-stable`; specs in the session folder `files\rc9\specs`). Open -before the stable pull request: rc9 (integration, validation, review, -acceptance of about 70 minutes), his decision on #34 on 2026-11-02, and his -check of `PSGALLERY_API_KEY`. The stable change then touches only the label, -the CHANGELOG, and `$publishedVersions`. +State at 2026-10-21: 5.0.0-rc8 is published and accepted (tag `c719197`, CI run +`39408140862`, Gallery 2026-10-20 10:40:58Z, GitHub 10:41:07Z, identity check +passed; lab acceptance of the published bytes 10:38 to 11:47Z, record +`Tests/Lab/Acceptance-2026-10-20-published-rc8.md`, #128). `master` is +`d0cb57c`: the maintainer merged #128 (2026-10-21 05:48Z), the tests-only round +#129 (08:24Z), and the Memory Bank #130 (08:47Z). + +The last prerelease before the stable 5.0.0 is rc9 (Decision 27). The branch +`ai/rc9` (base `d0cb57c`, 32 commits, head `de67883`) is complete and +validated; it is local until the maintainer pushes it, opens the pull request +(body: `C:\Temp\ntfs-rc9\final-msgs\pr-rc9-body.md`, temporary), merges it, and +tags `5.0.0-rc9`. It contains: the five piped parameters of `Add-` and +`Remove-NTFSAccess` and `-NTFSAudit` are `object`, converted in the cmdlet +(`ParameterConversion`), so a typo for `Deny` no longer creates an Allow entry; +a list for `-AccessType` and `-AppliesTo` is rejected; the `-SecurityDescriptor` +sets report a failing descriptor and go on; the 17 owner-restore handlers pass +on what a later command raises; `Get-ChildItem2 -Filter` has one matcher with +the Windows PowerShell 5.1 rules; the library fixes 3.1 to 3.3 and 3.10; +`Get-NTFSOrphanedAccess` writes an error; `-SecurityDescriptor` of +`Set-NTFSSecurityDescriptor` at position 1; tests that bind four parameters by +property name; label `rc9`. + +Validation of `de67883`: the full suite in the four CI configurations, 2,116 +cases each, 0 failed (rc8: 1,615; skipped 27, 359, 58, and 390, so every new +case runs where it can); the pages and the help file are a fixpoint (0 drift, 0 +broken links; the help file is identical after a second generation); +PSScriptAnalyzer reports nothing in the 11 changed scripts; the public surface +differs from rc8 by 16 `object` properties, 5 completer classes, 1 protected +method, and 1 parameter position, and equals the candidate of round 1; a +matrix of valid shapes of the five parameters, run on the published rc8 and on +this build in both editions, differs in exactly the 9 list rows of +`Add-NTFSAccess`. Two review rounds (Decision 27, "Built in rc9"): round 1 on the +first integration found a Blocker (the last-dot rule of the filter) and two +Major findings; round 2 on the final tree and three checks of its fixes found +only Minor findings (wrong statements in the pages, completers that were not +culture invariant, the list for `-AccessType` and `-AppliesTo`, ways around +that rejection, a collection that holds itself); all are fixed with a test +that is red without the fix, or decided. A blank, `$null`, or `DBNull` value of +the other parameter group is `AmbiguousParameterSet` (documented, not +restructured). + +Open before the stable pull request: the pull request, merge, and tag of rc9 +(maintainer); the lab acceptance of the published rc9 (agent, about 70 +minutes, `Chain-Published.ps1`); his decision on #34 on 2026-11-02; his check of +`PSGALLERY_API_KEY`. The stable change then touches only the label, the +CHANGELOG, and `$publishedVersions` (add `5.0.0-rc9`). The Memory Bank of this +work is a separate pull request (branch `ai/memory-bank-merged`). State at 2026-10-10: the maintainer integrated the release-gate stack into `master` (#116, #120, #118, #119, #121; `fa0701b`, CI green; GitHub closed #117 @@ -45,155 +68,66 @@ Decisions 22 and 24 on 2026-10-19 and decides 23 on 2026-11-02. ## Evidence -- rc6 Release run `37839669028`, attempt 2, succeeded; GitHub prerelease with - zip appeared 2026-10-09 07:01:34 UTC. The first attempt proves HTTP 409 - after Gallery publication, not the earlier assumed retry chronology. -- Integration on 2026-10-10 (UTC): #116 merged 09:10, #117 closed unmerged - 09:10:16 (events `base_ref_deleted`, `closed`), #120 merged 10:50, #118 - 11:12, #119 11:28, head branches deleted 11:34, CI on `master` at `fa0701b` - green 11:40. A `git merge-tree` simulation of the chain was conflict-free and - ended in the tree of the matrix branch. -- rc7 on 2026-10-10: tag at `fa0701b` about 12:20Z, CI run `38051611526` - green, Gallery 12:30:57Z, GitHub 12:31:09Z. `Test-PublishedRelease.ps1` - (12:33Z): tag commit on `master`, Gallery SHA-512 matches the nupkg, 11 - module files identical in nupkg and zip, manifest `5.0.0-rc7`; hashes in the - deployment notes, evidence in the session folder `published-rc7`. -- Gate 3 on the published rc7, 14:29 to 15:30 UTC (one detached driver; record - `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`, evidence `gate3-rc7` with - a manifest): the three matrix cells (OSFile19, 22, 25 with OSWin11E, both - editions) 1,374 passed, 0 failed, 12 skipped, `LIVE_RESULT_VERIFIED` and - CLEAN in each; the suite in 24 runs on six machine classes without a failure - and with the host's skipped tests; the first lab with case 9 245 / 0 / 1 per - edition, CLEAN in four domains and on both machines. Each controller run - downloaded the package of the identity check (nupkg and DLL hashes equal). - Same counts as the final local candidate; no checkpoint was taken. -- Handoff 1 (paths), measured at `5a5d58b` (frozen Release, four configurations, - CI wrappers, then AltCover): 1,310 cases per configuration, zero failures - (baseline `3442194`: 914 cases); coverage 3,192/3,634 sequence points - (87.84%) and 1,273/1,978 branches (64.36%), against 74.21% and 50.39%. All 231 - methods with 442 unvisited points are classified: 223 explained, 8 open for - the maintainer. Skip eligibility was checked by row: all 578 skipped rows - (137 distinct tests) are executed in two other configurations. -- Eleven defects were fixed, ten with a guard that is red before the fix and - green after it (a red/green matrix over ten states of the branch: 76 rows - red at the base `f11ff41`, none after the last fix; the leak of a native - buffer has no guard). Mutation rounds at `5a5d58b`: 25 of 26 detected, M25 - (the check by type) an equivalent mutant. The matrix doesn't show that a test - preceded its fix: each fix commit carries both. Report: - `Tests/Coverage/Quality-Gate-Paths-2026-10-09.md`. +- Evidence of rc9 is outside git, in the session folder + `816cf47d-2f80-4eba-8ac9-41702c49560b\files\rc9`: the specs and review briefs, + `suite-full1` (first integration), `suite-final`, `suite-final2`, + `suite-final3`, and `suite-final4` (the head `de67883`), the probes (`p-*.ps1`, + `fixb-probe`, `shapes-r2`, `Run-Oracle.ps1`, `Run-Pathological.ps1`), the + published rc8 (`rc8-published`), and the analyzer and surface results. The + review probes of the reviewers are in `C:\Temp\ntfs-rc9\review*-probes-*` + (temporary). The worktrees under `C:\Temp\ntfs-rc9` are temporary too. +- Milestones of earlier gates (rc6 and rc7 releases, handoff 1, the operating + system matrix, handoff 5, the rc7 and rc8 acceptances) are in `progress.md` + and in the records and reports under `Tests/Lab` and `Tests/Coverage`. - Reviews: the custom `security-reviewer` can't start (its model is - unavailable; no override). The built-in `code-review` agent made nine static - passes of the paths work (no Blocker or Major) and four rounds on the matrix - (one Major, record accuracy, resolved by the replay; Minors corrected); the - built-in `security-review` agent found no exploitable vulnerability and two - LOW items left for the maintainer (Next step 5). -- Live candidate of 2026-10-09 (09:20 to 09:51 UTC): 330 passed, 0 failed, 2 - expected skips; published rc6: 326 passed, 4 expected failures, 2 skips; the - 11 tested files match the ZIP. Independent probes verified the fixture - removal on six machines (`Tests/Lab/Acceptance-2026-10-09-quality-gate.md`). -- Six checkpoints report Standard even after a successful ProductionOnly probe; - policy restored, no restore performed: don't claim verified Production - rollback evidence. -- Lab acceptance of the paths fixes, 2026-10-09 20:41 to 21:42 UTC: candidate - `83149ee` against its base `f11ff41`, the same 244 tests per edition (78 - new): 486 passed, 0 failed, 2 expected skips against 338 passed, 148 failed - (each green on the candidate); fixture removal verified. Record: - `Tests/Lab/Acceptance-2026-10-09-quality-gate-paths.md`. -- Operating-system matrix, 2026-10-10 (record - `Tests/Lab/Acceptance-2026-10-10-os-matrix.md` with CSV tables): the suite of - the final candidate `fdd7a8b` passes on OSFile19/22/25, OSWin11E, OSWin11, and - the host (24 runs, no failure; the baseline `83149ee` fails 4 elevated and 20 - basic-user tests on OSFile22 and OSFile25); the live controller passes in - three cells (1,374 passed, 0 failed, 12 skipped) and in the first lab with - case 9 (245 passed, 0 failed, 1 skipped per edition; fixture removed and - verified). The Admin-role effective-access failures in earlier cells were - stale account state, not the module: in a replay the baseline failed two of - three cells and the candidate one, and one lifetime of about ten minutes fits - 43 runs of 27 cells (the Windows mechanism is unknown). The controller names - the case-3 account anew for each fixture (`1dec389`); four more cells with it - passed. A dry run of `Run-MatrixSequence.ps1 -Version 5.0.0-rc6` showed that - the published-package path works. Labs at 07:50 UTC on 2026-10-10: no fixture - or probe residue; `OSWin11E` shuts itself down an hour after its start. -- Handoff 5, the coverage unknowns, 2026-10-10 to 11 (report - `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`; raw evidence in the - session folder `816cf47d-2f80-4eba-8ac9-41702c49560b\files\qg-unknowns` - with a hash manifest). rc7 measured at `fa0701b` (four frozen - configurations, AltCover): 3,198/3,649 sequence points (87.64%), 1,090/1,168 - explicit branch points; 232 unvisited methods, all classified. Live suite on - an instrumented copy (first lab and three cells) and unit suite on - `OSFile25`: together +9 sequence and +4 explicit branch points (the code of - `fdd7a8b`); no test or probe reaches the audit ownership retry or the audit - read denial. 101 new `It` blocks; 7 of 64 parameter sets closed, 51 partly, - 1 open, 4 left to the maintainer. Cultures `de-DE` and `tr-TR`: two defects, - fixed. The piped - `AppliesTo` (Decision 26, debugging insights): fixed in `93ed2c7`; the - independent reviews then found a carry-over of the scope between piped - objects (`9783d2a`; rc7 had it for descriptor objects) and two false - sentences of the documents about empty values (`7bc7925`, `2112ee3`). Final - commit `2112ee3`, product code of `9783d2a` (its help file differs from the - package that the labs accepted): 1,492 cases per configuration, 3,266/3,668 - points, 183 unvisited methods, all classified. The labs accepted the package - (`ap7`, `ap8`): first lab 245/0/1 per edition; the 22 files on - `OSFile19/22/25` and `OSWin11` 1,189/0 in 16 configurations; the three cells - 229/0/2 per edition; all end states clean at 13:45Z. The first start of the - cells did nothing: a `powershell.exe` that PowerShell 7 starts inherits its - `PSModulePath` (lab README). Server Core, ARM64, a localized system, and - non-Windows servers are out of scope (Decision 25). -- rc8, 2026-10-20: fix (b) test-first on `ai/fix-effective-access-init-errors`. - A `-ServerName` of 40,000 characters gave `Synchronize` and no error before - and gives an error now; two tests were red and are green in four - configurations, and the suite has 1,494 cases per configuration, 0 failed. - The independent review (`code-review`) found one Minor, the warning "based on - this computer" before the error (fixed, with tests), and three Nits. The - acceptance evidence is `rc8-published` in the session folder - `816cf47d-2f80-4eba-8ac9-41702c49560b\files\qg-unknowns` (430 files, with a - manifest); the published hashes are in the deployment notes. -- Raw evidence is outside git: the session folder + unavailable; no override); the built-in `code-review` agent reviewed the paths + work, the matrix, rc8, and rc9; the built-in `security-review` agent found no + exploitable vulnerability and two LOW items for the maintainer (Next step 5). +- Raw evidence of the older gates is outside git: the session folder `4b12e2f4-d4c7-4a5d-883a-ddb7421c4848\files` (`qg-paths`, the matrix runs, the - night log) and - `26f151b6-e46f-49bd-9398-b27e20603949\files\quality-gate-3442194-20261009`. + night log), `26f151b6-e46f-49bd-9398-b27e20603949\files\quality-gate-3442194-20261009`, + and `816cf47d-2f80-4eba-8ac9-41702c49560b\files\qg-unknowns` (430 files of + `rc8-published`, with a manifest; the published hashes are in the deployment + notes). +- Six checkpoints of the lab report Standard even after a successful + ProductionOnly probe; policy restored, no restore performed: don't claim + verified Production rollback evidence. ## Next step -1. Gate 3 is done for the published rc7 and rc8 (the records). The stable build - is accepted through rc8 (Decision 21, "Closing the gate"). Open: keep or - replace the matrix VMs (about 60 GB, saved between runs) and the evaluation - client (it shuts down every hour; `OSWin11E` is off), and a domain cell for - Windows 11 26H1, whose client loses the secure channel to the Server 2025 - domain controller. `Chain-Published.ps1` in the session files runs the whole - sequence (not in the kit; deployment notes). +1. The maintainer pushes `ai/rc9`, creates the pull request, merges it after + CI, and tags `5.0.0-rc9` (commands in the reply of 2026-10-21; every release + step is his). Then run `Chain-Published.ps1 -Version 5.0.0-rc9 -Tag 5.0.0-rc9 + -Evidence ` from the session files (about 70 minutes, detached, with the + heartbeat; save the labs afterwards) and write the acceptance record + `Tests/Lab/Acceptance--published-rc9.md`. A defect that it finds needs + rc10. 2. The stable pull request: no `Prerelease`, `## [5.0.0] - ` with an empty - `[Unreleased]` and the links, and `5.0.0-rc8` in `$publishedVersions` (the - list ends at rc7 now). The maintainer checks the expiry of - `PSGALLERY_API_KEY` first, merges, and tags. Every release step is his. -3. Decision 27 (2026-10-21): rc9 changes the library-only items, the dot - patterns of `Get-ChildItem2 -Filter`, the 17 owner-restore handlers, the - errors of the descriptor sets, and three inconsistencies; the designs are - chosen, four work items are in progress. Decisions 22 and 24 are accepted. -4. #34 waits for a tester until 2026-11-02 (Decision 23, option 3; the - follow-up went up on 2026-10-19, no reply yet; checklist: + `[Unreleased]` and the links, and `5.0.0-rc9` in `$publishedVersions` (the + list ends at rc7 now; rc8 comes with the rc9 pull request). The maintainer + checks the expiry of `PSGALLERY_API_KEY` first, merges, and tags. +3. #34 waits for a tester until 2026-11-02 (Decision 23, option 3; checklist: `Tests/Lab/Non-Windows-File-Server-Test.md`). On that date the maintainer chooses between waiting longer and accepting the untested risk with a release-note caveat. No agent can accept it. -5. Of the two LOW findings of the security review (record, Limits), the - swallowed initialization errors of `GetEffectiveAccess` are fixed in rc8 - (`25fe775`, #127): an error instead of a false "no access", and the warning - only with a result. He still decides the other: the ACL of the stage - folders under `C:\` in the lab kit (they inherit Authenticated Users: - Modify; protecting them is a design change of the controller and needs a new - acceptance). rc9 adds to the help that a local standard user who asks about - a domain account still gets "Access is denied" (Decision 27). -6. Handoff 5 is done and merged (Evidence). Decided on 2026-10-19 (Decision - 21): the hard-link names under another root stay a known limit; the pages - and the CHANGELOG say so since rc8. The tests-only round for the plain items - (68 `budget` mentions) ran on 2026-10-20: four implementers, one - `ParameterSets.*` file each, merged as #129: 89 `It` blocks, 121 cases, the - suite 1,494 to 1,615 per configuration, 0 failed; 38 of 64 sets closed, 26 - with a leftover (16 Limit, 7 MaintainerDecision, 3 would-pin), no defect; - report `Tests/Coverage/Quality-Gate-Test-Round-2026-10-20.md`. The runner's - counts equal the local run in three CI runs. No plain gap is left. A defect - that a test finds needs his decision and rc9. Decision 27 settles the rest: - rc9 fixes the 10 rows and the piped optional parameters (designs to - follow); the audit paths over SMB are accepted (#34); the tests for the 8 - getters follow rc9. +4. Open housekeeping: keep or replace the matrix VMs (about 60 GB, saved between + runs) and the evaluation client (it shuts down every hour; `OSWin11E` is + off); a domain cell for Windows 11 26H1, whose client loses the secure + channel to the Server 2025 domain controller; the cleanup list before the + archive (AppVeyor, Read the Docs, wiki, `test/transfer`, old checkpoints) is + the maintainer's. The tests-round report still says that the new tests "have + not run on Windows Server 2019/2022/Windows 11"; the 24 lab runs of + 2026-10-21 changed that (fix in a later documentation pull request). +5. Of the two LOW findings of the security review, the swallowed initialization + errors of `GetEffectiveAccess` are fixed in rc8; he still decides the other: + the ACL of the stage folders under `C:\` in the lab kit (they inherit + Authenticated Users: Modify; protecting them is a design change of the + controller and needs a new acceptance). +6. Known limits after rc9, for the archive (Decision 27): `Get-FileHash2 + -Algorithm` keeps the silent default for a piped value that does not convert; + three settings still read their value with an unchecked cast; + `PrivilegeEnabler` is not disposed in some paths; `Get-NTFSEffectiveAccess` + fails with an `ArgumentOutOfRangeException` on a FAT32 volume or an item with + a NULL DACL (older than rc9); 9 of the 17 owner-restore handlers and the + error branch of `Get-NTFSOrphanedAccess` cannot be pinned by a test. 7. Do not release stable 5.0.0 or equate a percentage with gate closure. diff --git a/.memory-bank/debugging-insights.md b/.memory-bank/debugging-insights.md index 54cbbb3..f0fc6d0 100644 --- a/.memory-bank/debugging-insights.md +++ b/.memory-bank/debugging-insights.md @@ -36,6 +36,11 @@ fails without it (Decision 16). both: two mutations proved it), and is proved red on the previous build and green on the new one in all four configurations (`Tests/ItemCmdlets.Tests.ps1`, `Tests/ObjectApis.Tests.ps1`). +- The argument completers of rc9 had the same flaw (`WildcardPattern` with + `IgnoreCase` only: `THISFOLDERO` found nothing under `tr-TR`); the + second review found it, not the scan. A Turkish test word must put a capital + `I` against a lowercase `i` of the name: `NOPROPAGATEINH` faces the capital + `I` of `Inherit` and passes without the fix, so prove every row red first. ## A test oracle that is wrong on a domain member @@ -148,6 +153,17 @@ fails without it (Decision 16). completion of the names has to be rebuilt (quotes, wildcards, declaration order); help shows `Object`. Probe every form of a value before you write a claim, and ask a reviewer for the negative space. +- PowerShell accepts a comma list or an array for an enumeration that is not + `[Flags]` and combines the numbers bit by bit (a logical or): + `-AppliesTo 'ThisFolderOnly,FilesOnly'` made a `FilesOnly` entry and + `-AccessType 'Allow,Deny'` a `Deny` entry (4.2.6 and rc8 alike). The + conversion rejects a list for such an enumeration, in whatever kind of + collection it comes; a single name and a one-element collection stay valid. + A matrix of valid shapes, run on the published build and on the new one, + showed that exactly the 9 list rows changed. Code that opens a one-element + collection needs a depth limit: an array that holds itself hung the first + version (the binder of rc8 ends the host with a stack overflow on it), so + the conversion opens at most 32 levels and reads at most two elements. - PowerShell calls the getter of a by-property-name parameter once per command, when a piped object first binds it (`p-getter-calls.ps1`). A test that must visit it pipes an object that has the property. A property getter diff --git a/.memory-bank/decisions/0027-open-items-before-5.0.0.md b/.memory-bank/decisions/0027-open-items-before-5.0.0.md index 4be75d6..8b01854 100644 --- a/.memory-bank/decisions/0027-open-items-before-5.0.0.md +++ b/.memory-bank/decisions/0027-open-items-before-5.0.0.md @@ -164,6 +164,30 @@ decided; the rest is to be chosen. Recommended defaults are the agent's. folder). The findings became follow-up commits, and the branch `ai/rc9` was rebuilt with `git cherry-pick` in the order of each chain, so every fix sits in the commit of its item and any item can still be dropped. +- Round 2 (brief `rc9\REVIEW-BRIEF-2.md`): two reviewers read the final tree + (scope A the four add and remove cmdlets, scope B everything else), then + checked the fixes of their own findings. No Blocker and no Major; nine Minor + findings: five wrong or incomplete statements in the pages and the CHANGELOG + (a script block "was silently ignored" when it was evaluated per object; + `-AppliesTo $null` keeps the binder's error; the carry-over of the scope + affected only objects with one flags property; the descriptor sets that go + on after a failing descriptor are a breaking change; the PowerShell 7 list of + patterns was too narrow), the trailing blank and `..` of the filter + (documented, not changed), a stale header of two test files, the completers + without `CultureInvariant` (fixed), and a list for `-AccessType` and + `-AppliesTo` whose numbers PowerShell combines bit by bit (the maintainer + chose on 2026-10-21 to reject it in rc9; older than rc9, the same in + 4.2.6). Two more checks of the fixes found that the rejection could be + bypassed through other kinds of collection (a hash set, a queue, the keys of + a dictionary, a LINQ result, a one-element collection that holds a comma + string), that a collection that holds itself never returned (the binder of + rc8 ends the host with a stack overflow on it), and that the message named + the type, not the typo: fixed in `e39aeed` and `da41a8e`, each with tests + that were red first (32 and 28 rows). Final suite on `de67883`: 2,116 cases + per configuration, 0 failed in four configurations (rc8: 1,615); the pages + and the help file are a fixpoint; PSScriptAnalyzer finds nothing in the 11 + changed scripts; the public surface equals the validated candidate; a matrix + of valid shapes differs from the published rc8 in exactly 9 list rows. What the review found: diff --git a/.memory-bank/progress.md b/.memory-bank/progress.md index bec16a0..f0e3360 100644 --- a/.memory-bank/progress.md +++ b/.memory-bank/progress.md @@ -17,51 +17,31 @@ merged #125 (Handoff 5) and #124 (Dependabot) and decided the path to stable (Decision 21, "Closing the gate"); on 2026-10-20 he merged #126 (the decisions) and #127 (the rc8 fix and label) and tagged rc8; on 2026-10-21 he merged #128 (the rc8 record), #129 (tests), and #130 (this file). The published rc7 and -rc8 passed their lab acceptance in the matrix and in the first lab. Stable -Gallery version: 4.2.6. After 5.0.0, archive in favor of WindowsAccessControl -(Decision 18). +rc8 passed their lab acceptance in the matrix and in the first lab. rc9 +(Decision 27) is built on the local branch `ai/rc9` and waits for his push, +pull request, merge, and tag. Stable Gallery version: 4.2.6. After 5.0.0, +archive in favor of WindowsAccessControl (Decision 18). ## Recent milestones -- 2026-10-02 to 2026-10-06: documentation/help aligned with source, CI and - wiki moved to GitHub Actions, versioning/release automation established, - and prereleases rc1 to rc4 published. Earlier detail is in git, - `CHANGELOG.md`, `Docs/Version-History.md`, and Decisions 1 to 19. -- 2026-10-07: lab comparison of rc2/rc4 reproduced #34 over SMB and proved - changed-section writes preserve the owner. Remote effective-access - fallback returned no result; fixed test-first for rc5 (Decision 20). -- 2026-10-08: #114 merged (`fcb370e`), rc5 published and live-tested. - Decision 21 established the quality gate. Corrected four-run coverage: - rc5 58.1% sequence points/38.0% branches, not the initial one-run result. -- 2026-10-08: rc6 Phase 2 (basic-user CI, parameter-set and error tests, - expanded domain/SMB cases, fixes for privilege cleanup, path resolution, - ownership retries, item conflicts, output equality, inherited flags; suite - 677, 68.14% sequence/44.32% branches; lab acceptance of `7b0781f` passed; - two review passes) and rc7 (Decision 22: breaking link binding and error - changes, SimpleAccess traversal, cross-volume folder preservation, named - effective-access warnings; suite 712; one review without Blocker or Major; - lab candidate `dc6e9f5`: 326 passed, 2 skipped, cleanup verified). -- 2026-10-08: #115 merged (`b51d970`) and tagged rc6. Release run - `37839669028` failed with HTTP 409 after Gallery publication. The log - does not establish the previously assumed initial timeout/retry cause. - Published rc6 live tests differed only in rc7's warning expectation. -- 2026-10-09: release attempt 2 succeeded; rc6 GitHub prerelease and zip - appeared at 07:01:34 UTC. #116 passed CI on `d25647d`. -- 2026-10-09: autonomous follow-up on `ai/quality-gate-coverage` (#117, then - #120), through `3442194`: 202 cases above rc7; fixed rooted result paths and - the first-hidden-item omission; publication recovery verifies the exact - SHA-512 identity, not merely the version. Suite: 914 per configuration, zero - failures; 2,641/3,559 sequence points (74.21%), 974/1,933 branches (50.39%). - Live comparison: candidate 330 passed, 0 failed, 2 expected skips (`7594e0c`). -- 2026-10-09: handoff 1 (#118): suite 914 to 1,310 per configuration, zero - failures; 3,192/3,634 sequence points (87.84%), 1,273/1,978 branches; all 231 - unvisited methods classified (223 explained, 8 open). Eleven defects fixed, - ten with a guard that is red before the fix and green after it (76 rows red - at the base), among them a later command's exception that cmdlets swallowed - (a `throw` made `Remove-Item2` remove the next item) and a privilege left - enabled. Lab acceptance, `83149ee` against `f11ff41`: 486 passed, 0 failed, 2 - expected skips against 338 passed, 148 failed. Report in `Tests/Coverage`; - record `Tests/Lab/Acceptance-2026-10-09-quality-gate-paths.md`. +- 2026-10-02 to 2026-10-09: documentation and help aligned with the source, CI + and wiki on GitHub Actions, release automation, and rc1 to rc6 published + (rc5: the remote effective-access fallback, Decision 20; rc6 and the rc7 + candidate: Phase 2 and the behavior changes of Decision 22). #114 (`fcb370e`) + and #115 (`b51d970`) merged. The rc6 release run failed with HTTP 409 after + Gallery publication and attempt 2 succeeded (GitHub prerelease 2026-10-09 + 07:01:34Z); the log does not establish the earlier assumed timeout cause. + Detail: git, `CHANGELOG.md`, `Docs/Version-History.md`, Decisions 1 to 22. +- 2026-10-09: the autonomous follow-up (#117, then #120, through `3442194`) and + handoff 1 (#118) took the suite from 202 cases above rc7 to 1,310 per + configuration with zero failures and 3,192/3,634 sequence points (87.84%; + 74.21% before); publication recovery verifies the exact SHA-512 identity. + Eleven defects were fixed, ten with a guard that is red before the fix (76 + rows red at the base), among them a later command's exception that cmdlets + swallowed (a `throw` made `Remove-Item2` remove the next item) and a privilege + left enabled. Lab acceptance, `83149ee` against `f11ff41`: 486 passed, 0 + failed against 338 passed, 148 failed. Report in `Tests/Coverage`; record + `Tests/Lab/Acceptance-2026-10-09-quality-gate-paths.md`. - 2026-10-09 to 10: handoffs 2 to 4 under the maintainer's delegation (decisions D1 to D47 in the night log of the session files). The matrix lab `NtfsSecurityOsMatrixLab` (Server 2019, 2022, 2025, a Windows 11 Enterprise @@ -139,6 +119,19 @@ Gallery version: 4.2.6. After 5.0.0, archive in favor of WindowsAccessControl creates an Allow entry); Decision 27 sets the scope of rc9, the designs were chosen on 2026-10-21, and four work items started (branch `ai/rc9-before-stable`). +- 2026-10-21: rc9 built and reviewed (Decision 27; branch `ai/rc9`, 32 commits + over `d0cb57c`, head `de67883`, local until he pushes). Four implementers + worked test-first in worktrees (the five piped parameters, the 17 handlers + and three inconsistencies, the library items, the filter); the chains were + cherry-picked in order, so every fix sits in the commit of its item. Round 1 + (three read-only reviewers) found a Blocker (the last-dot rule of the + filter) and two Major findings (a named `$null`; a blank value of the other + parameter group, documented); round 2 (two reviewers, three checks) found + only Minor findings, among them completers that were not culture invariant + (`tr-TR`) and a list for `-AccessType` or `-AppliesTo`, which PowerShell + combines bit by bit; he chose to reject it. Final suite on `de67883`: 2,116 + cases per configuration, 0 failed in four configurations (rc8: 1,615); docs + fixpoint; analyzer clean; valid shapes differ from rc8 in 9 list rows only. ## Stable capabilities @@ -152,12 +145,13 @@ Gallery version: 4.2.6. After 5.0.0, archive in favor of WindowsAccessControl ## Open work 1. Decision 21 gate: the published rc7 and rc8 are accepted in the matrix and - the first lab (records); stable follows rc8 (Decision 21, "Closing the - gate"). Do not release 5.0.0 until the other gates close: rc9 (Decision - 27), the decision on #34 on 2026-11-02, and the key check. Release steps: - `Docs/Contributing/05-Releasing.md`; remove the prerelease label, date - `[5.0.0]`, add the last prerelease (rc8) to `$publishedVersions` (never the - version of the manifest), tag through CI. + the first lab (records); stable follows rc9 (Decision 27): after his push, + pull request, merge, and tag of rc9 the agent runs the lab acceptance of + the published bytes (about 70 minutes). Do not release 5.0.0 until the other + gates close: that acceptance, the decision on #34 on 2026-11-02, and the key + check. Release steps: `Docs/Contributing/05-Releasing.md`; remove the + prerelease label, date `[5.0.0]`, add the last prerelease (rc9) to + `$publishedVersions` (never the version of the manifest), tag through CI. 2. Issues: #110's seven items were addressed by rc6, but #115 deliberately used no closing keyword. #34 stays open for non-Windows owner feedback or maintainer acceptance. #16, #21, #45, #89 await reporters. #68 tracks diff --git a/.memory-bank/systemPatterns.md b/.memory-bank/systemPatterns.md index 8f7d292..0da3a5d 100644 --- a/.memory-bank/systemPatterns.md +++ b/.memory-bank/systemPatterns.md @@ -1,6 +1,6 @@ --- status: current -last-verified: 2026-10-19 +last-verified: 2026-10-21 owner: active-agent source: repository and regression evidence --- @@ -15,13 +15,10 @@ source: repository and regression evidence | `NTFSSecurity.Init.ps1` | Loads Security2/privilege assemblies and prepends formatting | | `NTFSSecurity.dll` | 36 PowerShell cmdlets; BaseCmdlet path/privilege behavior | | `Security2.dll` | DACL/SACL objects, owners, inheritance, effective access, Win32 | -| AlphaFS | Long-path files/directories/links | -| PrivilegeControl / ProcessPrivileges | Token privilege operations | +| AlphaFS, PrivilegeControl, ProcessPrivileges | Long-path files/directories/links; token privilege operations | | `en-US/NTFSSecurity.dll-Help.xml` | Committed help generated from cmdlet Markdown | -## Decisions - -Read only task-relevant records; the index controls routing. +## Decisions (read only the task-relevant records; the index routes) | # | Decision | | --- | --- | @@ -51,6 +48,7 @@ Read only task-relevant records; the index controls routing. | 24 | [The operating-system matrix lab](decisions/0024-os-matrix-lab.md) | | 25 | [Four environments are out of scope for the tests](decisions/0025-out-of-scope-environments.md) | | 26 | [No default parameter set for Add and Remove (access, audit)](decisions/0026-no-default-parameter-set-add-remove.md) | +| 27 | [The open items before 5.0.0 and the piped optional parameters (rc9)](decisions/0027-open-items-before-5.0.0.md) | ## Patterns @@ -67,36 +65,38 @@ Read only task-relevant records; the index controls routing. attempts all cleanup, and preserves explicit enables. Dispose has no stream. - Pipeline getters never throw; per-item errors name input and allow continuation. - Folder moves never use CopyAllowed; preserve cross-volume source folders. -- Apply implied Hidden/Force before deciding to emit, including the first item. + Apply implied Hidden/Force before deciding to emit, including the first item. - A catch-all for one item's failures passes on what a later command raises - through a Write call (`IsFromLaterCommand`, `PipelineControl`; see - `BaseCmdlets.cs`); add a row to `Tests/PipelineControl.Tests.ps1` for a new - cmdlet. Record an enabled privilege before the next write. -- `Get-ChildItem2 -Filter` matches culture invariant; `*.*` means `*`. + through a Write call (`IsFromLaterCommand`, `BaseCmdlets.cs`); add a row to + `Tests/PipelineControl.Tests.ps1` for a new cmdlet. Record an enabled + privilege before the next write. +- `Get-ChildItem2 -Filter`: one matcher, 5.1 DOS wildcard rules (Decision 27). +- Optional by-name pipeline parameters are `object` + `ParameterConversion` (Decision 27). ### Tests and documentation - Tests import Release in isolated processes, both editions and privilege modes, with guarded sandboxes; a skip needs an eligible counterpart. -- Assert persisted state, errors/targets, continuation, and no failed - PassThru output. Prove new characterization guards with bounded mutations - (one round together only if no guard can fail because of another); restore - source exactly and rebuild before green validation or packaging. A retry - test asserts its precondition (the plain write is denied). +- Assert persisted state, errors/targets, continuation, and no failed PassThru + output. Prove characterization guards with bounded mutations (together only + if no guard can fail because of another); restore source and rebuild before + green runs or packaging. A retry test asserts its precondition (the plain + write is denied). - CI scripts and focused runs set `Stop`: a test that needs a non-terminating error names `-ErrorAction Continue`. Don't name a test variable like an automatic variable (`$foreach`): Pester runs the block inside a foreach. - Fixture DACLs use .NET SetAccessControl, not Set-Acl's unintended SACL writes. - Scope/descendant expectations are independent of the production converter. - Desktop platyPS: generate help, rebuild, round-trip unchanged, check links; - platyPS 0.14.2 turns paired asterisks into emphasis, even in backticks. + 0.14.2 turns paired asterisks into emphasis, even in backticks, and + `Update-MarkdownHelp` reads `Position` from the committed help file. - Live tests use only approved lab targets, SMB then independent server state; Get/SetFileSecurity preserves stored DACLs; rights oracles use S4U tokens. - A suite that is green on the host and CI misses defects that need a domain member or another token (the matrix found three): also run a domain member, other builds, and a basic user; a failure that follows cell order points to - stale account state (Decision 24). Oracles differ there too: `Get-Acl -Audit` - reads an item without audit entries as SACL-protected; read the SACL alone. + stale account state (Decision 24). `Get-Acl -Audit` reads an item without + audit entries as SACL-protected; read the SACL alone. ### CI, publication, and integration diff --git a/.memory-bank/techContext.md b/.memory-bank/techContext.md index 46ec278..c3e06c1 100644 --- a/.memory-bank/techContext.md +++ b/.memory-bank/techContext.md @@ -42,9 +42,9 @@ source: repository and executable evidence ## Constraints -- Manifest: ModuleVersion 5.0.0, prerelease rc8, published 2026-10-20 (tag at - `c719197`). Latest stable 4.2.6. `$publishedVersions` ends at rc7; the reuse - test fails if it holds the manifest's version, so the stable change adds rc8. +- Manifest: ModuleVersion 5.0.0, prerelease rc8 (tag at `c719197`; `ai/rc9` + sets rc9). Latest stable 4.2.6. `$publishedVersions` ends at rc7; the reuse + test fails if it holds the manifest's version, so rc9 adds rc8, stable rc9. - Changed-section writes preserve unchanged owner/group/DACL/SACL (19). Roots use root-folder APIs, not AlphaFS device security (#41). - CHANGELOG contains user-visible changes only (7); tests and CI-only fixes