From 425e903796948ac89b681593a4405fde22a772a6 Mon Sep 17 00:00:00 2001 From: Raimund Andree Date: Sat, 10 Oct 2026 15:40:37 +0000 Subject: [PATCH] test(lab): record the acceptance of the published 5.0.0-rc7 The published prerelease passed every stage of the lab acceptance on 2026-10-10, with the counts of the final local candidate: the three cells of the operating-system matrix (1,374 passed, 0 failed, 12 skipped), the module's own suite in 24 runs on six machine classes without a failure, and the first lab with case 9 (245 passed, 0 failed, 1 skipped per edition). Every end state was verified clean. Each controller run used the package that the identity check had verified byte for byte. Add the record with four tables, link it from the lab README and describe the order of the stages, which follows the one-hour life of the evaluation client. Update Decision 24, the progress, the active context, and the deployment notes for the state after the acceptance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant --- .memory-bank/activeContext.md | 44 ++-- .memory-bank/decisions/0024-os-matrix-lab.md | 22 +- .memory-bank/deployment-notes.md | 16 +- .memory-bank/progress.md | 25 +- ...eptance-2026-10-10-published-rc7-Cells.csv | 25 ++ ...ance-2026-10-10-published-rc7-FirstLab.csv | 9 + ...ce-2026-10-10-published-rc7-LocalSuite.csv | 25 ++ ...e-2026-10-10-published-rc7-ModuleFiles.csv | 12 + .../Acceptance-2026-10-10-published-rc7.md | 222 ++++++++++++++++++ Tests/Lab/README.md | 19 +- 10 files changed, 380 insertions(+), 39 deletions(-) create mode 100644 Tests/Lab/Acceptance-2026-10-10-published-rc7-Cells.csv create mode 100644 Tests/Lab/Acceptance-2026-10-10-published-rc7-FirstLab.csv create mode 100644 Tests/Lab/Acceptance-2026-10-10-published-rc7-LocalSuite.csv create mode 100644 Tests/Lab/Acceptance-2026-10-10-published-rc7-ModuleFiles.csv create mode 100644 Tests/Lab/Acceptance-2026-10-10-published-rc7.md diff --git a/.memory-bank/activeContext.md b/.memory-bank/activeContext.md index b308665..efe019a 100644 --- a/.memory-bank/activeContext.md +++ b/.memory-bank/activeContext.md @@ -9,17 +9,19 @@ source: current task evidence ## Current focus -State at 2026-10-10 12:40 UTC: the maintainer integrated the release-gate stack -into `master` (`fa0701b`, CI green at 11:40Z): #116 (rc7, `8a6be9f`), #120 +State at 2026-10-10 15:45 UTC: the maintainer integrated the release-gate stack +into `master` (`6dd799f`, CI green): #116 (rc7, `8a6be9f`), #120 (`bdb9981`; it replaced #117, which GitHub closed unmerged when the branch deletion after #116 removed its base, see Decision 15), #118 (`03bef2c`, -handoff 1, the paths), and #119 (`fa0701b`, handoff 2, the operating-system -matrix). He tagged `fa0701b` as `5.0.0-rc7` at about 12:20Z, and rc7 is -published (Gallery 12:30:57Z, GitHub 12:31:09Z); 4.2.6 stays the stable -Gallery version. rc7 contains the Phase 2 behavior changes, the path tests and -fixes, and the three module fixes of the matrix (`962887a`, `fdd7a8b`). The -Memory Bank update is pull request #121 (CI green at 12:33Z, open when this was -written). Stable 5.0.0 stays gated (Decision 21). +handoff 1, the paths), #119 (`fa0701b`, handoff 2, the operating-system +matrix), and #121 (the Memory Bank). He tagged `fa0701b` as `5.0.0-rc7` at about +12:20Z, and rc7 is published (Gallery 12:30:57Z, GitHub 12:31:09Z); 4.2.6 stays +the stable Gallery version. rc7 contains the Phase 2 behavior changes, the path +tests and fixes, and the three module fixes of the matrix (`962887a`, +`fdd7a8b`). The published rc7 passed its lab acceptance (gate 3) on the same +day, in the matrix and in the first lab, with the counts of the final local +candidate (record `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`). Stable +5.0.0 stays gated (Decision 21). The maintainer asked on 2026-10-09 at 21:21 UTC to continue with the release-gate handoffs and to decide and report later. The agent's decisions are @@ -43,6 +45,15 @@ acceptance is the maintainer's. (12:33Z): tag commit on `master`, Gallery SHA-512 matches the nupkg, 11 module files identical in nupkg and zip, manifest `5.0.0-rc7`; hashes in the deployment notes, evidence in the session folder `published-rc7`. +- Gate 3 on the published rc7, 14:29 to 15:30 UTC (one detached driver; record + `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`, evidence `gate3-rc7` with + a manifest): the three matrix cells (OSFile19, 22, 25 with OSWin11E, both + editions) 1,374 passed, 0 failed, 12 skipped, `LIVE_RESULT_VERIFIED` and + CLEAN in each; the suite in 24 runs on six machine classes without a failure + and with the host's skipped tests; the first lab with case 9 245 / 0 / 1 per + edition, CLEAN in four domains and on both machines. Each controller run + downloaded the package of the identity check (nupkg and DLL hashes equal). + Same counts as the final local candidate; no checkpoint was taken. - Handoff 1 (paths), measured at `5a5d58b` (frozen Release, four configurations, CI wrappers, then AltCover): 1,310 cases per configuration, zero failures (baseline `3442194`: 914 cases); coverage 3,192/3,634 sequence points @@ -97,13 +108,14 @@ acceptance is the maintainer's. ## Next step -1. Gate 3 on the published rc7 (the agent runs it on request): the identity - check is done (12:33Z); the live controller with `-Version 5.0.0-rc7` in - the first lab and `Run-MatrixSequence.ps1 -Version 5.0.0-rc7` for every - cell remain (deployment notes, "Accept a published package"). Open: keep or - replace the matrix VMs (about 60 GB) and the evaluation client (it shuts - down every hour), and a domain cell for Windows 11 26H1, whose client loses - the secure channel to the Server 2025 domain controller. +1. Gate 3 is done for the published rc7 (the record above). A changed binary + (rc8, or the build of 5.0.0) needs the same cells again; the release + procedure accepts the last prerelease for the stable build (his decision). + Open: keep or replace the matrix VMs (about 60 GB) and the evaluation client + (it shuts down every hour; `OSWin11E` is off), and a domain cell for Windows + 11 26H1, whose client loses the secure channel to the Server 2025 domain + controller. A kit script for the whole sequence would make the repetition + one command (the driver is `Run-Gate3.ps1` in the evidence; not in the kit). 2. The change that sets the next version (rc8 or 5.0.0) adds `5.0.0-rc7` to `$publishedVersions`; adding it earlier fails the reuse test (deployment notes). Every release step is the maintainer's. diff --git a/.memory-bank/decisions/0024-os-matrix-lab.md b/.memory-bank/decisions/0024-os-matrix-lab.md index c36e8ab..b8fbdef 100644 --- a/.memory-bank/decisions/0024-os-matrix-lab.md +++ b/.memory-bank/decisions/0024-os-matrix-lab.md @@ -137,14 +137,16 @@ source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff - Result: [the record](../../Tests/Lab/Acceptance-2026-10-10-os-matrix.md). The final candidate (`fdd7a8b`) passes the module's suite on all five machines and the host in all four configurations, and the live cells (see the record). + The published 5.0.0-rc7 passed the same stages on 2026-10-10 with the same + counts: the three cells (1,374 passed, 0 failed, 12 skipped), the suite in 24 + runs, and the first lab with case 9 (245 / 0 / 1 per edition); see + [its record](../../Tests/Lab/Acceptance-2026-10-10-published-rc7.md). - Open: the maintainer confirms or changes the matrix and decides whether to - keep the VMs after 5.0.0. Local `-ModulePath` runs are validation; the gate - needs the published package in every cell (Handoff 3, stage D). The newest - Windows 11 build that can join a Server 2025 domain here is 22H2; a domain - cell with 26H1 needs a newer domain controller build or a fix of the - mismatch. The maintainer also decides which of the module fixes belong to - rc7 (two commits: `962887a` holds two fixes, `fdd7a8b` one; `fdd7a8b` reverts - cleanly on its own, `962887a` conflicts with it in `Lib.cs` and `CHANGELOG.md` - if `fdd7a8b` stays), and whether the - evaluation client stays (it needs a start shortly before every run) or is - replaced by a client with a license that doesn't expire. + keep the VMs after 5.0.0. A stable 5.0.0 is a new build, so the release + procedure accepts the last prerelease; a changed binary needs the same cells + again. The newest Windows 11 build that can join a Server 2025 domain here is + 22H2; a domain cell with 26H1 needs a newer domain controller build or a fix + of the mismatch. All three module fixes went into rc7 (#119; `962887a` holds + two, `fdd7a8b` one, and they don't revert separately). The maintainer also + decides whether the evaluation client stays (it needs a start shortly before + every run) or is replaced by a client with a license that doesn't expire. diff --git a/.memory-bank/deployment-notes.md b/.memory-bank/deployment-notes.md index 2b20f04..a3cb7aa 100644 --- a/.memory-bank/deployment-notes.md +++ b/.memory-bank/deployment-notes.md @@ -45,8 +45,11 @@ don't revert separately, because they conflict in `Security2/Win32/Lib.cs` and `CHANGELOG.md`), with the kit, the controller changes, and the record of the operating-system matrix (Decision 24). -1. Accept the published package (next section). The identity check is done; - the first lab and every cell of the matrix remain (gate 3). +1. Accept the published package (next section): done for rc7 on 2026-10-10, + with the identity check, the three cells, the suite on six machine classes, + and the first lab (record + `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`). + A changed binary (rc8, or the build of 5.0.0) needs the same cells again. 2. Add `5.0.0-rc7` to `$publishedVersions` in `Tests/Repository.Tests.ps1` only in the change that sets the next version (rc8 or 5.0.0), as `Docs/Contributing/05-Releasing.md` says. The test "Should not reuse a @@ -76,6 +79,15 @@ Local `-ModulePath` runs are validation; the gate needs the published bytes. the final local candidate through the same stages (readiness, controller, `Validate-LabResults.ps1`, snapshot, `-RemoveFixture`, `Test-MatrixCleanup.ps1` with the four domain controllers and both machines) in one detached driver. + The published rc7 ran in one detached driver in this order (61 minutes, + 14:29 to 15:30Z, `OSWin11E` started 14:25:49Z): the cells, then + `Run-MatrixLocalSuite.ps1 -ModulePath \NTFSSecurity of the + identity check> -Mode Elevated,Basic` on the host and five machines (one + every 75 seconds: AutomatedLab imports one lab at a time), then + `Test-MatrixCleanup.ps1 -Mode Verify` (CLEAN at the first check, so the + cells first and the suites after them leave nothing to repair), then the + first lab. The driver is `Run-Gate3.ps1` in the evidence folder `gate3-rc7` + of the session files; it only calls these scripts and isn't in the kit. 3. Remove the fixture and check the end state independently with `Test-MatrixCleanup.ps1`, which takes the lab name and the machine names (`-LabName WindowsAccessControlLab -DomainController F1ADC1, F1BDC1, F2DC1, diff --git a/.memory-bank/progress.md b/.memory-bank/progress.md index 5747a56..99c14c0 100644 --- a/.memory-bank/progress.md +++ b/.memory-bank/progress.md @@ -11,11 +11,12 @@ source: repository and validation evidence 5.0.0-rc7 is published on the Gallery and GitHub (2026-10-10, tag at `fa0701b`); rc6 is the one before it. On 2026-10-10 the maintainer merged the -whole stack into `master` (`fa0701b`, CI green): #116 (rc7), #120 (it replaced +whole stack into `master` (CI green): #116 (rc7), #120 (it replaced #117, which GitHub closed unmerged when the branch deletion after #116 removed -its base), #118 (the quality-gate paths), and #119 (the operating-system -matrix with three module fixes, Decision 24 proposed). The published rc7 still -needs its lab acceptance (gate 3). Stable Gallery version: 4.2.6. +its base), #118 (the quality-gate paths), #119 (the operating-system matrix +with three module fixes, Decision 24 proposed), and #121 (the Memory Bank). The +published rc7 passed its lab acceptance (gate 3) in the matrix and in the first +lab. Stable Gallery version: 4.2.6. After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). ## Recent milestones @@ -92,6 +93,12 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). approval step (Gallery 12:30:57Z, GitHub 12:31:09Z). The identity check (`Test-PublishedRelease.ps1`, 12:33Z) passed: Gallery SHA-512, nupkg and zip identical, manifest `5.0.0-rc7`. Hashes: deployment notes. +- 2026-10-10: gate 3 on the published rc7, 14:29 to 15:30 UTC, in one detached + driver: the three matrix cells 1,374 passed, 0 failed, 12 skipped; the suite + in 24 runs on six machine classes without a failure; the first lab with case + 9 245 / 0 / 1 per edition; every end state CLEAN. The counts equal those of + the final local candidate. Record: + `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`. ## Stable capabilities @@ -104,9 +111,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). ## Open work -1. Decision 21 gate: test the published rc7 (identity verified; the first lab - and every matrix cell remain) and review Decision 22. Do not release 5.0.0 - until the remaining-path and OS-matrix gates close. Release steps: +1. Decision 21 gate: the published rc7 is accepted in the matrix and the first + lab (record); review Decision 22 and the open items below. Do not release + 5.0.0 until the remaining-path and OS-matrix gates close. Release steps: `Docs/Contributing/05-Releasing.md`; remove the prerelease label, date `[5.0.0]`, add the last prerelease to `$publishedVersions` (never the version of the manifest), tag through CI. @@ -143,8 +150,8 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). missing, different, or unverifiable outcomes. The agent published nothing, so the recovery has never run against the Gallery. 9. Operating-system matrix (Decision 24, proposed): the lab and the cells exist - and the candidate passes them; the published rc7 still needs its acceptance - in every cell. #34 has no new reply since 2026-10-06. + and the published rc7 passes them (record); the maintainer approves the + matrix. #34 has no new reply since 2026-10-06. 10. Lab rollback evidence: new checkpoints report Standard even after a successful temporary ProductionOnly probe; original VM policy restored, no checkpoint restored. Don't represent them as verified Production snapshots. diff --git a/Tests/Lab/Acceptance-2026-10-10-published-rc7-Cells.csv b/Tests/Lab/Acceptance-2026-10-10-published-rc7-Cells.csv new file mode 100644 index 0000000..0597fec --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-10-published-rc7-Cells.csv @@ -0,0 +1,25 @@ +"Run","Candidate","FileServer","FileServerOs","Client","ClientOs","Edition","Role","Account","ExitCode","Passed","Failed","Skipped" +"g3-m","5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"g3-m","5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"g3-m","5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"g3-m","5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Server","osmatrix\install","0","73","0","1" +"g3-m","5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"g3-m","5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"g3-m","5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"g3-m","5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Server","osmatrix\install","0","73","0","1" +"g3-m","5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"g3-m","5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"g3-m","5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"g3-m","5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Server","osmatrix\install","0","73","0","1" +"g3-m","5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"g3-m","5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"g3-m","5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"g3-m","5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Server","osmatrix\install","0","73","0","1" +"g3-m","5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"g3-m","5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"g3-m","5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"g3-m","5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Server","osmatrix\install","0","73","0","1" +"g3-m","5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0" +"g3-m","5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0" +"g3-m","5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1" +"g3-m","5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Server","osmatrix\install","0","73","0","1" diff --git a/Tests/Lab/Acceptance-2026-10-10-published-rc7-FirstLab.csv b/Tests/Lab/Acceptance-2026-10-10-published-rc7-FirstLab.csv new file mode 100644 index 0000000..c1e62b2 --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-10-published-rc7-FirstLab.csv @@ -0,0 +1,9 @@ +"Version","Edition","Role","Account","ExitCode","Passed","Failed","Skipped" +"5.0.0-rc7","Desktop","Delegate","A\NtfsLiveDelegate","0","69","0","0" +"5.0.0-rc7","Desktop","ServerAdmin","A\NtfsLiveServerAdmin","0","36","0","0" +"5.0.0-rc7","Desktop","Admin","A\NtfsLiveAdmin","0","64","0","0" +"5.0.0-rc7","Desktop","Server","A\install","0","76","0","1" +"5.0.0-rc7","Core","Delegate","A\NtfsLiveDelegate","0","69","0","0" +"5.0.0-rc7","Core","ServerAdmin","A\NtfsLiveServerAdmin","0","36","0","0" +"5.0.0-rc7","Core","Admin","A\NtfsLiveAdmin","0","64","0","0" +"5.0.0-rc7","Core","Server","A\install","0","76","0","1" diff --git a/Tests/Lab/Acceptance-2026-10-10-published-rc7-LocalSuite.csv b/Tests/Lab/Acceptance-2026-10-10-published-rc7-LocalSuite.csv new file mode 100644 index 0000000..8138bf4 --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-10-published-rc7-LocalSuite.csv @@ -0,0 +1,25 @@ +"Candidate","Machine","Os","Mode","Edition","PowerShell","Result","Passed","Failed","Skipped","Total","Seconds" +"5.0.0-rc7","LOCAL","Windows Server 2025 Datacenter 26100.33438","Basic","Core","7.6.6","Passed","779","0","231","1010","20" +"5.0.0-rc7","LOCAL","Windows Server 2025 Datacenter 26100.33438","Basic","Desktop","5.1.26100.33438","Passed","781","0","229","1010","22" +"5.0.0-rc7","LOCAL","Windows Server 2025 Datacenter 26100.33438","Elevated","Core","7.6.6","Passed","991","0","19","1010","88" +"5.0.0-rc7","LOCAL","Windows Server 2025 Datacenter 26100.33438","Elevated","Desktop","5.1.26100.33438","Passed","993","0","17","1010","103" +"5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 17763.1217","Basic","Core","7.6.3","Passed","780","0","231","1011","114" +"5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 17763.1217","Basic","Desktop","5.1.17763.1007","Passed","782","0","229","1011","121" +"5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 17763.1217","Elevated","Core","7.6.3","Passed","992","0","19","1011","201" +"5.0.0-rc7","OSFile19","Windows Server 2019 Datacenter 17763.1217","Elevated","Desktop","5.1.17763.1007","Passed","994","0","17","1011","100" +"5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 20348.4773","Basic","Core","7.6.3","Passed","780","0","231","1011","116" +"5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 20348.4773","Basic","Desktop","5.1.20348.4294","Passed","782","0","229","1011","122" +"5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 20348.4773","Elevated","Core","7.6.3","Passed","992","0","19","1011","216" +"5.0.0-rc7","OSFile22","Windows Server 2022 Datacenter 20348.4773","Elevated","Desktop","5.1.20348.4294","Passed","994","0","17","1011","119" +"5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 26100.32690","Basic","Core","7.6.3","Passed","780","0","231","1011","126" +"5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 26100.32690","Basic","Desktop","5.1.26100.32684","Passed","782","0","229","1011","158" +"5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 26100.32690","Elevated","Core","7.6.3","Passed","992","0","19","1011","221" +"5.0.0-rc7","OSFile25","Windows Server 2025 Datacenter 26100.32690","Elevated","Desktop","5.1.26100.32684","Passed","994","0","17","1011","248" +"5.0.0-rc7","OSWin11","Windows 10 Pro 28000.1836","Basic","Core","7.6.3","Passed","780","0","231","1011","36" +"5.0.0-rc7","OSWin11","Windows 10 Pro 28000.1836","Basic","Desktop","5.1.28000.1830","Passed","782","0","229","1011","164" +"5.0.0-rc7","OSWin11","Windows 10 Pro 28000.1836","Elevated","Core","7.6.3","Passed","992","0","19","1011","99" +"5.0.0-rc7","OSWin11","Windows 10 Pro 28000.1836","Elevated","Desktop","5.1.28000.1830","Passed","994","0","17","1011","173" +"5.0.0-rc7","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Basic","Core","7.6.3","Passed","780","0","231","1011","32" +"5.0.0-rc7","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Basic","Desktop","5.1.22621.169","Passed","782","0","229","1011","119" +"5.0.0-rc7","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Elevated","Core","7.6.3","Passed","992","0","19","1011","106" +"5.0.0-rc7","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Elevated","Desktop","5.1.22621.169","Passed","994","0","17","1011","127" diff --git a/Tests/Lab/Acceptance-2026-10-10-published-rc7-ModuleFiles.csv b/Tests/Lab/Acceptance-2026-10-10-published-rc7-ModuleFiles.csv new file mode 100644 index 0000000..d05118d --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-10-published-rc7-ModuleFiles.csv @@ -0,0 +1,12 @@ +"File","ZipSha256","NupkgSha256","Equal" +"AlphaFS.dll","A8DA47194AB0F71232C69D01955AD93BA73C7ECEB58D0DE800CA085D4A2E18D8","A8DA47194AB0F71232C69D01955AD93BA73C7ECEB58D0DE800CA085D4A2E18D8","True" +"NTFSSecurity.dll","D3B7CBE362C37D1016559669CB2EFF5034A6945CA1B03DDB49F1361363D203A7","D3B7CBE362C37D1016559669CB2EFF5034A6945CA1B03DDB49F1361363D203A7","True" +"NTFSSecurity.format.ps1xml","FB0920CC37ED858F55AFD54998DC854E27FBBE6A0177CB059CB03CFE91361197","FB0920CC37ED858F55AFD54998DC854E27FBBE6A0177CB059CB03CFE91361197","True" +"NTFSSecurity.Init.ps1","59583423241951EBE0FC2D8237D0C28C3ECC8C7CD2C115D2660F8579888632FC","59583423241951EBE0FC2D8237D0C28C3ECC8C7CD2C115D2660F8579888632FC","True" +"NTFSSecurity.psd1","968514234BAAF16789A560C86A6F701F69E91262F1EAB62142DDF6D05A8D2A52","968514234BAAF16789A560C86A6F701F69E91262F1EAB62142DDF6D05A8D2A52","True" +"NTFSSecurity.psm1","3F777E9D141EE0046119DA9D5ECF88A3BC7E023726098FE2FB150528E2FB59B8","3F777E9D141EE0046119DA9D5ECF88A3BC7E023726098FE2FB150528E2FB59B8","True" +"NTFSSecurity.types.ps1xml","CB6882FF91E6716605D5599E7B464C3346E461216ACED07E847621738F04FB9B","CB6882FF91E6716605D5599E7B464C3346E461216ACED07E847621738F04FB9B","True" +"PrivilegeControl.dll","E9BDB722DF1EBFFBCC45BE9E42F59C1C84A8DB13A8635BA13E35B3744F1CE27E","E9BDB722DF1EBFFBCC45BE9E42F59C1C84A8DB13A8635BA13E35B3744F1CE27E","True" +"ProcessPrivileges.dll","4394FB440A06F804DA548CFC135DBE1A5F9D8BC978C3A6B75D34F9802BCB0A1D","4394FB440A06F804DA548CFC135DBE1A5F9D8BC978C3A6B75D34F9802BCB0A1D","True" +"Security2.dll","A805399FB94927A7DFB4E70937168B970827179A5140E3ACF562FB97CF7D67E2","A805399FB94927A7DFB4E70937168B970827179A5140E3ACF562FB97CF7D67E2","True" +"en-US\NTFSSecurity.dll-Help.xml","61A5FA38BA745C9D29C574C7550FD12DA49E9718E58006175B51E9A8FBA2DEC3","61A5FA38BA745C9D29C574C7550FD12DA49E9718E58006175B51E9A8FBA2DEC3","True" diff --git a/Tests/Lab/Acceptance-2026-10-10-published-rc7.md b/Tests/Lab/Acceptance-2026-10-10-published-rc7.md new file mode 100644 index 0000000..ccca390 --- /dev/null +++ b/Tests/Lab/Acceptance-2026-10-10-published-rc7.md @@ -0,0 +1,222 @@ +# Acceptance of the published 5.0.0-rc7, 2026-10-10 + +Live and local acceptance of the exact prerelease that the PowerShell Gallery +has, in the operating-system matrix and in the first lab (stage D of the 5.0.0 +quality gate, Decisions 21 and 24). The +[record of the matrix](Acceptance-2026-10-10-os-matrix.md) tested local builds +with `-ModulePath` and said that the acceptance of a release is the run with +`-Version` of the published prerelease. This record doesn't repeat the machines, +the defects, or the method of that record; it adds what differs when the +package comes from the Gallery. It isn't a claim that the quality gate is +complete (see the limits at the end). + +## Result + +- The published 5.0.0-rc7 passed every stage. The identity check (tag, CI run, + Gallery hash, GitHub zip) passed before the runs. The live controller passed + in the three cells of the matrix, both editions, every role: 1,374 passed, 0 + failed, 12 skipped, and the independent end-state check of every cell said + CLEAN. The module's own suite passed in all 24 runs (six machine classes, two + editions, elevated and as a basic user), and every skipped test is also + skipped on the host. The live controller passed in the first lab, where case 9 + runs: 245 passed, 0 failed, 1 skipped in each edition, and the removal of the + fixture was verified in four domains and on both machines. +- Every number equals the one of the final local candidate `fdd7a8b` in the + record of the matrix: 1,374 / 0 / 12 in the cells, 245 / 0 / 1 per edition in + the first lab, and the same counts in all 24 suite runs. The published package + behaves like the candidate that was tested before it. +- The failures of the effective-access tests of the Admin role in the Windows + Server 2022 cell, which the earlier record traced to state that outlives a + re-created account name, did not recur: the controller names that account anew + for every fixture. One sequence of three cells can't show that an effect that + depends on timing is gone, so this is an observation, not a proof. +- The run changed nothing in the module, the tests, or the kit: it used the + files of the tag. + +## Candidate and artifact identity + +`Test-PublishedRelease.ps1 -Version 5.0.0-rc7` ran at 12:33 UTC, before the +runs, and printed `PUBLISHED_IDENTITY_VERIFIED`. It changes nothing on GitHub or +in the Gallery. + +| | Published 5.0.0-rc7 | +| --- | --- | +| Tag | `5.0.0-rc7`, commit `fa0701b591098ec6a6fab2ef12fe2c31d7fc7e88`, on `master` | +| CI run of the tag | `38051611526` (started 12:20:44 UTC): Build and test and Release succeeded | +| PowerShell Gallery | published 12:30:57 UTC; the SHA-512 that the Gallery publishes matches the downloaded package | +| GitHub prerelease | published 12:31:09 UTC | +| `NTFSSecurity.5.0.0-rc7.nupkg` SHA-256 | `40922397B7CB307C64DD99960659539AF5C8AD9D2F55C6BF26E8AB434DEC8DCC` | +| `NTFSSecurity.zip` SHA-256 | `9705C8CCFA0FB8FC355E401444044D94BF176729BA84104D2C423C429AC1430B` | +| `NTFSSecurity.dll` SHA-256 | `D3B7CBE362C37D1016559669CB2EFF5034A6945CA1B03DDB49F1361363D203A7` | +| Manifest | `5.0.0` with `Prerelease = 'rc7'` | + +The 11 module files of the nupkg and of the zip are byte for byte equal +([the hashes](Acceptance-2026-10-10-published-rc7-ModuleFiles.csv)). The +controller checks the SHA-512 that the Gallery publishes before it runs a +package, and it kept the package that it downloaded in each of its four runs +(the three cells and the first lab): all four nupkg files and all four DLLs +equal the values above. The suites staged the extracted zip, and their logs +record the same DLL hash. The build isn't byte-reproducible, so these hashes +belong to this one build (see the record of the matrix). + +## Method + +The method of the record of the matrix applies. What differs: + +- **Frozen kit.** The kit, the controller, and the live tests are the files of + the tag, in an isolated worktree, so that no change of the working tree could + affect a run in progress. The live tests are the Git blob + `efe36e5073b9b10742ca7de242ddcbe90d8eda62`, the one of every earlier run of + the final candidate. The controller is the blob + `635bf162421b4df4efc76d5677212e8782e8bf77`; it differs from the controllers of + the runs `rc7l` and `fl1` of the earlier record in comments only (10 and 2 + lines). +- **Order.** The evaluation client `OSWin11E` shuts itself down an hour after + its start, which was 14:25:49 UTC, so one detached driver ran the stages in + this order: the three cells of the matrix, the module's suite on six machine + classes, the check of what the suites left in the matrix lab, and the first + lab. The first lab doesn't need the client. The driver only calls the scripts + of the kit; its text is in the local evidence. +- **Live controller.** `Run-MatrixSequence.ps1 -Version 5.0.0-rc7 -FileServer + OSFile19,OSFile22,OSFile25`, with the client `OSWin11E`: the readiness of + every machine, the controller in both editions, `Validate-LabResults.ps1` for + every role from the result files (`-Expect Candidate`), a snapshot of the + fixture SIDs, `-RemoveFixture`, and `Test-MatrixCleanup.ps1`. In the first lab + the same stages ran with the foreign domain controllers of case 9. +- **Suite.** `Run-MatrixLocalSuite.ps1 -ModulePath` with the extracted zip, + `-Mode Elevated,Basic`, both editions, on OSFile19, OSFile22, OSFile25, + OSWin11E, OSWin11 (with the local installation account), and the host as the + reference. The processes started 75 seconds apart, because AutomatedLab + imports one lab at a time. +- **No checkpoint.** The procedure in the README takes a checkpoint of the + machines before a run. This run took none: the earlier checkpoints report the + type Standard and weren't touched, and the end state of every cell was + verified instead. + +## Results + +### Live controller in the matrix + +The Windows 11 client `OSWin11E` with each file server, one sequence +(`g3-m`), 14:29 to 14:52 UTC. Every role was checked from the result files, and +`Validate-LabResults.ps1` printed `LIVE_RESULT_VERIFIED (Candidate)` for each +cell. The counts are the same in both editions and in all three cells +([Cells.csv](Acceptance-2026-10-10-published-rc7-Cells.csv)): + +| Role | Passed / failed / skipped | +| --- | --- | +| Delegate | 69 / 0 / 0 | +| ServerAdmin | 36 / 0 / 0 | +| Admin | 51 / 0 / 1 | +| Server | 73 / 0 / 1 | + +That is 229 passed, 0 failed, and 2 skipped per edition and cell, and 1,374 +passed, 0 failed, 12 skipped for the three cells. The skipped tests are those +of the earlier record: case 9 (the matrix lab has no foreign domain) and the +test of the module version in the Server role (that role runs without the +module). + +| File server | Cell | Controller | End-state check | +| --- | --- | --- | --- | +| OSFile19 (Windows Server 2019) | 14:29:11 to 14:36:01 | 14:29:49 to 14:34:56 | CLEAN | +| OSFile22 (Windows Server 2022) | 14:36:01 to 14:42:26 | 14:36:29 to 14:41:27 | CLEAN | +| OSFile25 (Windows Server 2025) | 14:42:26 to 14:51:59 | 14:42:53 to 14:50:58 | CLEAN | + +### First lab (case 9) + +`WindowsAccessControlLab`, both editions, 15:12 to 15:28 UTC: the domain +controller `F1ADC1`, the file server `F1AFile2`, and the client `F1AFile1` +(domain `a.forest1.net`), with the foreign domain controllers `F1BDC1`, +`F2DC1`, and `F3DC1`. `Validate-LabResults.ps1` printed +`LIVE_RESULT_VERIFIED (Candidate)`. The counts are the same in both editions +([FirstLab.csv](Acceptance-2026-10-10-published-rc7-FirstLab.csv)): + +| Role | Passed / failed / skipped | +| --- | --- | +| Delegate | 69 / 0 / 0 | +| ServerAdmin | 36 / 0 / 0 | +| Admin | 64 / 0 / 0 | +| Server | 76 / 0 / 1 | + +That is 245 passed, 0 failed, and 1 skipped per edition; the skipped test is +the test of the module version in the Server role. The fixture was removed with +`-RemoveFixture`, and the independent check (10 recorded SIDs: the accounts of +the lab domain and `NtfsLiveForeign` in each of the three foreign domains) +found the four domains and both machines clean: no organizational unit, +account, share, folder, local group, membership, or profile of the fixture, and +none of the residue that the check counts. Its verdict was CLEAN (15:30 UTC). + +### The module's own suite + +Passed / failed / skipped. Every configuration has 1,011 cases on the machines +of the domain and 1,010 on the host, which has no DNS domain +([LocalSuite.csv](Acceptance-2026-10-10-published-rc7-LocalSuite.csv)). + +| Machine | Elevated, Windows PowerShell | Elevated, PowerShell 7 | Basic user, Windows PowerShell | Basic user, PowerShell 7 | +| --- | --- | --- | --- | --- | +| OSFile19 (Server 2019) | 994 / 0 / 17 | 992 / 0 / 19 | 782 / 0 / 229 | 780 / 0 / 231 | +| OSFile22 (Server 2022) | 994 / 0 / 17 | 992 / 0 / 19 | 782 / 0 / 229 | 780 / 0 / 231 | +| OSFile25 (Server 2025) | 994 / 0 / 17 | 992 / 0 / 19 | 782 / 0 / 229 | 780 / 0 / 231 | +| OSWin11E (Windows 11 22H2) | 994 / 0 / 17 | 992 / 0 / 19 | 782 / 0 / 229 | 780 / 0 / 231 | +| OSWin11 (Windows 11 26H1) | 994 / 0 / 17 | 992 / 0 / 19 | 782 / 0 / 229 | 780 / 0 / 231 | +| Host (reference) | 993 / 0 / 17 | 991 / 0 / 19 | 781 / 0 / 229 | 779 / 0 / 231 | + +In all 20 comparisons with the host, the skipped tests are the same, name for +name, as multisets. No run has a failed test, a failed container, or a test that +didn't run. The operating-system builds and the PowerShell versions are those of +the record of the matrix (the readiness checks and the results of this run show +the same builds); the host has PowerShell 7.6.6, the virtual machines 7.6.3. + +After the suites, `Test-MatrixCleanup.ps1 -Mode Verify` checked the domain and +the machines OSFile19, OSFile22, OSFile25, and OSWin11E again (15:11 UTC): CLEAN +at the first check, so no repair was needed. + +## Limits and open items + +- This is one run of one binary. A changed binary needs the same cells again; + results of different binaries don't combine into one matrix. A stable 5.0.0 is + a new build, because its manifest has no `Prerelease` value, so the identity + of the tested bytes doesn't carry over to it. The release procedure + (`Docs/Contributing/05-Releasing.md`) accepts the last prerelease instead; + that is the maintainer's decision, not this record's. +- Case 9 (accounts of other domains and forests) needs trusts that the matrix + lab doesn't have, so the cells skip it, and it ran only in the first lab, on + Windows Server 2025. The first lab has no other operating system. +- Windows 11 26H1 has no live cell: its secure channel to the Windows Server + 2025 domain controller of the lab fails, so it runs the suite only. The client + of the cells is the Windows 11 22H2 evaluation build. +- The file servers are Windows. A server of another kind is the subject of + Decision 23 (issue #34) and wasn't tested. +- The matrix and its decision (Decision 24) are proposed. This record is the + acceptance of the published rc7 on that proposed matrix; whether the matrix is + the right one, and whether the gate is closed, are the maintainer's decisions. +- `Test-MatrixCleanup.ps1` can't reach OSWin11 with the domain account, so the + end state of that machine isn't independently verified. The suite runner + removes its own stage and its scheduled tasks, and the other four machines and + the domain were clean. +- `OSWin11E` shut itself down by itself after the run, as it does an hour after + every start (it was off at 15:30 UTC), and was left off. The other machines of + the matrix lab and of the first lab are running, with no fixture in either + lab. +- The two LOW findings of the security review in the record of the matrix (the + swallowed initialization exceptions of `GetEffectiveAccess`, and the ACL of + the staging folders under `C:\`) are unchanged and weren't part of this run. +- The effective-access state that outlives a re-created account name wasn't + investigated again; one sequence of three cells is no test of it. + +## Evidence + +The raw logs, result files, the downloaded packages, and the driver are local, +outside Git, in the session files of the run (the folders `gate3-rc7` and +`published-rc7`). `evidence-manifest.csv` in `gate3-rc7` lists the size and the +SHA-256 of 332 files: everything in `gate3-rc7` except itself, and the four +files at the top of `published-rc7` (the packages, the identity result, and the +hashes of the module files). The tables of this record are next to it: + +- [the identity of the module files](Acceptance-2026-10-10-published-rc7-ModuleFiles.csv), +- [the controller cells](Acceptance-2026-10-10-published-rc7-Cells.csv), +- [the counts of the first-lab run](Acceptance-2026-10-10-published-rc7-FirstLab.csv), +- [the suite results](Acceptance-2026-10-10-published-rc7-LocalSuite.csv). + +The scripts that ran are in [Acceptance](Acceptance); the decision is +`.memory-bank\decisions\0024-os-matrix-lab.md`. diff --git a/Tests/Lab/README.md b/Tests/Lab/README.md index 78d0262..2742feb 100644 --- a/Tests/Lab/README.md +++ b/Tests/Lab/README.md @@ -233,11 +233,26 @@ the host: - `Probe-LaterCommand.ps1` is the diagnostic of the [record of the paths fixes](Acceptance-2026-10-09-quality-gate-paths.md). +To accept a published prerelease, run the stages in this order, because the +evaluation client `OSWin11E` shuts itself down an hour after its start: start +the client and check the readiness of the matrix lab, then +`Run-MatrixSequence.ps1 -Version ` for the cells, then +`Run-MatrixLocalSuite.ps1 -ModulePath` on every machine with the extracted +module of the release (`Test-PublishedRelease.ps1` leaves it in the folder +`zip-\NTFSSecurity` of its output folder), then +`Test-MatrixCleanup.ps1 -Mode Verify` for the matrix lab, and last the +controller with `-Version` in the first lab, where case 9 runs. Start the suites +a minute or more apart, because AutomatedLab imports one lab at a time, and +never together with a controller. The +[record of the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md) ran +the stages that way. + Records: [5.0.0-rc6](Acceptance-2026-10-08-5.0.0-rc6.md), [5.0.0-rc7](Acceptance-2026-10-08-5.0.0-rc7.md), [quality-gate follow-up](Acceptance-2026-10-09-quality-gate.md), -[quality-gate paths follow-up](Acceptance-2026-10-09-quality-gate-paths.md), and -[operating-system matrix](Acceptance-2026-10-10-os-matrix.md). +[quality-gate paths follow-up](Acceptance-2026-10-09-quality-gate-paths.md), +[operating-system matrix](Acceptance-2026-10-10-os-matrix.md), and +[the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md). The review of the code that no unit test visits, with the fixes that the lab has to repeat, is in [Tests/Coverage](../Coverage/Quality-Gate-Paths-2026-10-09.md).