NTFSSecurity/.memory-bank/progress.md

status	last-verified	owner	source
current	2026-10-21	active-agent	repository and validation evidence

Progress

Current status

5.0.0-rc9 is published on the Gallery and GitHub (2026-10-22, tag at 823c814); rc8 (2026-10-20, tag at c719197) and rc7 (2026-10-10, tag at fa0701b) are the ones before it. On 2026-10-10 the maintainer merged the stack of #116, #120, #118, #119, and #121 into master (CI green; the milestones have the details). On 2026-10-19 he merged #125 (Handoff 5) and #124 (Dependabot) and decided the path to stable (Decision 21, "Closing the gate"); on 2026-10-20 he merged #126 (the decisions) and #127 (the rc8 fix and label) and tagged rc8; on 2026-10-21 he merged #128 (the rc8 record), #129 (tests), and #130 (this file); on 2026-10-22 he merged #131 (rc9) and #132 (the Memory Bank) and tagged rc9. The published rc7 and rc8 passed their lab acceptance in the matrix and in the first lab; the acceptance of the published rc9 runs (see activeContext.md). Stable Gallery version: 4.2.6. After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).

Recent milestones

• 2026-10-02 to 2026-10-09: documentation and help aligned with the source, CI and wiki on GitHub Actions, release automation, and rc1 to rc6 published (rc5: the remote effective-access fallback, Decision 20; rc6 and the rc7 candidate: Phase 2 and the behavior changes of Decision 22). #114 (fcb370e) and #115 (b51d970) merged. The rc6 release run failed with HTTP 409 after Gallery publication and attempt 2 succeeded (GitHub prerelease 2026-10-09 07:01:34Z); the log does not establish the earlier assumed timeout cause. Detail: git, CHANGELOG.md, Docs/Version-History.md, Decisions 1 to 22.
• 2026-10-09 to 10: the quality gate. The autonomous follow-up (#117, then #120) and handoff 1 (#118) took the suite from 202 cases above rc7 to 1,310 per configuration (3,192/3,634 sequence points, 87.84%) and fixed eleven defects, ten with a guard that is red before the fix (a later command's exception that cmdlets swallowed, a privilege left enabled); lab acceptance 83149ee against f11ff41: 486 passed against 338 passed, 148 failed (record Tests/Lab/Acceptance-2026-10-09-quality-gate-paths.md). Handoffs 2 to 4 (decisions D1 to D47 in the night log of the session files) built the matrix lab NtfsSecurityOsMatrixLab (Server 2019, 2022, 2025, Windows 11 22H2; 26H1 suite only), which found three module defects, fixed in 962887a and fdd7a8b (audit inheritance by descriptor, Get-NTFSEffectiveAccess -ServerName '', the same cmdlet for a non-administrator on a domain member); the final candidate passed the suite on every machine (24 runs), the live controller in three cells (1,374/0/12), and the first lab (245/0/1 per edition); the built-in security review found no exploitable vulnerability and two LOW items for the maintainer. Record Tests/Lab/Acceptance-2026-10-10-os-matrix.md.
• 2026-10-10: the maintainer integrated the stack. His branch deletion after the merge of #116 (8a6be9f) removed the base branch of #117, and GitHub closed #117 unmerged instead of retargeting it (cli/cli#14223; Decision 15 has the rule); #120 (bdb9981) replaced it, then #118 (03bef2c) and #119 (fa0701b) merged; CI on master passed at 11:40Z.
• 2026-10-10: rc7 published (tag fa0701b at about 12:20Z, Gallery 12:30:57Z, GitHub 12:31:09Z, no approval step; identity check passed at 12:33Z; hashes in the deployment notes). Gate 3 on the published rc7 (14:29 to 15:30 UTC, one detached driver): three cells 1,374/0/12, the suite in 24 runs on six machine classes without a failure, the first lab 245/0/1 per edition, every end state CLEAN; the counts equal those of the final local candidate. Record Tests/Lab/Acceptance-2026-10-10-published-rc7.md.
• 2026-10-10 to 2026-10-11: Handoff 5, the coverage unknowns (branch ai/coverage-unknowns, merged as #125 on 2026-10-19). rc7 measured at fa0701b: 3,198/3,649 sequence points; the live suite and the suite on a domain member add 9 sequence and 4 explicit branch points (fdd7a8b); two tr-TR defects fixed test-first (419cfb3; 0028ccd, fbe0289, 8a625c8); 101 It blocks added. The piped AppliesTo that a path dropped is fixed (93ed2c7, 9783d2a, Decision 26) after three independent reviews and two checks: a carry-over of the scope between piped objects, and false sentences about empty values (7bc7925, 2112ee3). Final 2112ee3, product code built once at 9783d2a: 1,492 cases per configuration, 3,266/3,668 points. The labs accepted the package: first lab 245/0/1 per edition, the suite 1,189/0 in 16 configurations on four machines, three cells 229/0/2 per edition, every end state clean. Open: hard-link names under another root, the silent default scope of an unconvertible piped AppliesTo. Report: Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md.
• 2026-10-19: #125 (Handoff 5) and #124 merged, CI on master green. The maintainer decided the path to stable (Decision 21): Decisions 22 and 24 accepted, 23 option 3 with the decision date 2026-11-02 (the #34 follow-up went up at 12:09 UTC), rc8 with the fix of GetEffectiveAccess, and a tests-only round for the plain test gaps until 2026-11-02.
• 2026-10-20: rc8. The maintainer merged #126 and #127 (c719197: the fix of the swallowed initialization errors of GetEffectiveAccess, the known limit of the hard-link cmdlets in the pages and the CHANGELOG, label rc8) and tagged 5.0.0-rc8 at about 10:28Z; Gallery 10:40:58Z, GitHub 10:41:07Z, no approval step. The identity check passed (10:42Z). The lab acceptance of the published bytes ran in one detached chain (68 minutes, 10:38 to 11:47Z, the saved machines restored first): three cells 1,374 passed, 0 failed, 12 skipped; the suite in 24 runs without a failure (1,191 cases per configuration); the first lab 245/0/1 per edition; every end state CLEAN. A probe on four operating systems showed the boundary of the new error (a name of 32,718 characters). Record Tests/Lab/Acceptance-2026-10-20-published-rc8.md (#128).
• 2026-10-20: tests-only round (Decision 21). Four implementers, one ParameterSets.* test file each (#129): 89 It blocks, 121 cases, the suite 1,494 to 1,615 per configuration, 0 failed in four configurations; 38 of 64 sets closed (7 before), 26 with a leftover (16 Limit, 7 MaintainerDecision, 3 would-pin); no defect. Report: Tests/Coverage/Quality-Gate-Test-Round-2026-10-20.md. On 2026-10-21 he merged #129 (08:24Z) and #130 (08:47Z); the new tests passed in three CI runs and in 24 lab runs on six machine classes (0 failed). A probe then found that piped optional parameters ignore a bad value (a typo for Deny creates an Allow entry); Decision 27 sets the scope of rc9, the designs were chosen on 2026-10-21, and four work items started (branch ai/rc9-before-stable).
• 2026-10-21: rc9 built and reviewed (Decision 27; branch ai/rc9, 36 commits over d0cb57c, head 696ac38). Four implementers worked test-first in worktrees (the five piped parameters, the 17 handlers and three inconsistencies, the library items, the filter); the chains were cherry-picked in order, so every fix sits in the commit of its item. Round 1 (three read-only reviewers) found a Blocker (the last-dot rule of the filter) and two Major findings (a named $null; a blank value of the other parameter group, documented); round 2 (two reviewers, five checks) found only Minor findings and Nits, among them completers that were not culture invariant (tr-TR) and a list for -AccessType or -AppliesTo, which PowerShell combines bit by bit; he chose to reject it. Final suite on 696ac38: 2,162 cases per configuration, 0 failed in four configurations (rc8: 1,615); docs fixpoint; analyzer clean; valid shapes differ from rc8 in 9 list rows only; both reviewers: no finding.
• 2026-10-22: rc9 published. The maintainer merged #131 (823c814, 08:13Z; its tree equals the validated 696ac38; the CI of the PR ran 2,162 cases per configuration on the runner, equal to the local run in all four configurations) and #132 (f2bcd9d, 10:15Z), and tagged 823c814 at about 08:37Z. The CI run 39749188259 of the tag passed, Release without an approval step; GitHub 08:51:19Z. Test-PublishedRelease.ps1: identity verified at 10:54Z. Published bytes: NTFSSecurity.dll SHA-256 464CAB365AD63CD22208B21012A5B7F0B8B630E819CF300019787A0172791198, zip 5A05BC008605D9B4B1EAB074FFC811B460FAF6D3549701D00ABA15D9208ED571, nupkg 72CC5E28567BEC564DB052AF34C91F237ECFC9558FA2E981E201E02E16B4F8F3. The published bytes give the results of the validated build in the pathological, ToString, and valid-shape probes (9 list rows differ from rc8). The lab acceptance chain started at 11:00:36Z.

Stable capabilities

• 36 cmdlets: access, audit, inheritance, owners/descriptors, privileges, long-path items, links, hash, and disk space.
• Windows PowerShell 5.1 and PowerShell 7; RIPEMD160 and MACTripleDES are available only in Desktop. Both editions run elevated/basic-user in CI.
• Pester fixtures use Tests/TestHelpers.psm1 TEMP sandboxes. Live tests are excluded from CI and run only on approved lab client/server targets.

Open work

1. Decision 21 gate: the published rc7 and rc8 are accepted in the matrix and the first lab (records); stable follows rc9 (Decision 27): after his push, pull request, merge, and tag of rc9 the agent runs the lab acceptance of the published bytes (about 70 minutes). Do not release 5.0.0 until the other gates close: that acceptance, the decision on #34 on 2026-11-02, and the key check. Release steps: Docs/Contributing/05-Releasing.md; remove the prerelease label, date [5.0.0], add the last prerelease (rc9) to $publishedVersions (never the version of the manifest), tag through CI.
2. Issues: #110's seven items were addressed by rc6, but #115 deliberately used no closing keyword. #34 stays open for non-Windows owner feedback or maintainer acceptance. #16, #21, #45, #89 await reporters. #68 tracks ShouldProcess for security cmdlets; enhancements #22/#49/#68/#77/#87 are not planned for 5.0.0. Labels follow Decision 17.
3. Deferred reviews (not silently accepted): rc3 extra DACL read/SDDL snapshots/duplicate SACL check; rc4 findings listed in #113, including library-only RemoveAll account filters; rc5 unchecked Authz errors and lab-controller hardening; rc6 failed privilege-disable retry (not reproduced); rc7 audit missing-path error IDs declined in Decision 22.
4. Architecture/cmdlet design: Decision 22 is accepted (2026-10-19); two link changes are breaking. Keep unused classes/helper overloads until a maintainer decision; do not remove them to improve coverage percentages.
5. ARM64 workstation: out of scope (maintainer, 2026-10-11, Decision 25).
6. Optional maintainer cleanup: obsolete AppVeyor/Read the Docs access, wiki editing restrictions, test/transfer, and old lab checkpoints when no longer needed. No remote changes or snapshot restores here.
7. Remaining-path inventory at the final measured commit of Handoff 5 (2112ee3): 402 unvisited sequence points in 183 methods, all classified (Tests/Coverage): 167 explained from source with evidence, 16 open (8: FileSecurity conversions, RemoveAll account filters; 8 getters of pipeline parameters that no test binds by property name). Decision 27: rc9 fixes the conversions, RemoveAll, the lazy overloads, the dot patterns, and the 17 handlers; PrivilegeEnabler and unused classes stay. No trigger for an audit write's ownership retry was found on a local volume or a Windows file server (probe of 48 calls) and no test reaches it. A conditional ACE display remains a .NET representation limit, not evidence of unconditional permissions.
8. Publication recovery (95b827e, merged in #120): 14 offline tests and exact artifact SHA-512 verification; the original upload errors remain errors for missing, different, or unverifiable outcomes. The agent published nothing, so the recovery has never run against the Gallery.
9. Operating-system matrix (Decision 24, accepted 2026-10-19): the lab and the cells exist and the published rc7 and rc8 pass them (records). #34: the follow-up went up on 2026-10-19, no reply yet; the decision date is 2026-11-02.
10. Lab rollback evidence: new checkpoints report Standard even after a successful temporary ProductionOnly probe; original VM policy restored, no checkpoint restored. Don't represent them as verified Production snapshots.