diff --git a/.memory-bank/activeContext.md b/.memory-bank/activeContext.md index 049fe59..95f0894 100644 --- a/.memory-bank/activeContext.md +++ b/.memory-bank/activeContext.md @@ -9,6 +9,18 @@ source: current task evidence ## Current focus +State at 2026-10-10 22:00 UTC: Handoff 5 (the coverage unknowns) is done +locally on `ai/coverage-unknowns`, from `origin/master` `6696f68`; nothing is +pushed. The report is `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md` +with nine CSV tables. rc7 (`fa0701b`) was measured at 3,198/3,649 sequence +points (87.64%); the live suite (first lab, three matrix cells) and the unit +suite on a domain member add only 9 sequence and 4 explicit branch points, all +of `fdd7a8b`. One defect is fixed (`419cfb3`, an identity compared with a name +in `tr-TR`), 79 `It` blocks in four files are added (final commit `b2cb47b`: +1,455 cases per configuration, 3,243 points), and a defect is open (hard-link +names under a root that is not the volume root). The maintainer decides +whether the fix and the tests enter a new candidate. + State at 2026-10-10 15:45 UTC: the maintainer integrated the release-gate stack into `master` (`6dd799f`, CI green): #116 (rc7, `8a6be9f`), #120 (`bdb9981`; it replaced #117, which GitHub closed unmerged when the branch @@ -101,21 +113,21 @@ acceptance is the maintainer's. passed. A dry run of `Run-MatrixSequence.ps1 -Version 5.0.0-rc6` showed that the published-package path works. Labs at 07:50 UTC on 2026-10-10: no fixture or probe residue; `OSWin11E` shuts itself down an hour after its start. -- Test coverage of the 5.0.0 code, assessed 2026-10-10 (nothing was changed). - Measured at `5a5d58b`: 87.84% of the sequence points (3,192 of 3,634) and - 93.96% of the explicit branch points; every cmdlet is at 72.5% or more. Of - the 442 unvisited points, 181 are in code that no cmdlet calls, 103 are - parameter getters, 77 defensive, and 81 environment-specific (47 of them the - ownership retry of an audit write over SMB). Since then the production C# - changed by 70 inserted lines (`962887a`, `fdd7a8b`), so the ratios are off by - 2 points at most. A parser scan finds all 36 cmdlets and all 147 documented - parameters in the unit tests (four only as keys of data-driven hashtables) - and 34 cmdlets in the live tests (not `Enable-Privileges`, `Get-DiskSpace`). - Not measured: the coverage of the live tests and of the suite on a domain - member, and of the code after the fixes. Not tested: Server Core, other - cultures, servers that aren't Windows (#34), and a judged test matrix per - parameter set (57 of 64 sets have a test call that binds them; the coverage - shows every switch visited). +- Handoff 5, the coverage unknowns, 2026-10-10 (report + `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`; raw evidence in the + session folder `816cf47d-2f80-4eba-8ac9-41702c49560b\files\qg-unknowns` + with a hash manifest). rc7 measured at `fa0701b` (four frozen + configurations, AltCover): 3,198/3,649 sequence points (87.64%), 1,090/1,168 + explicit branch points; 232 unvisited methods, all classified. Live suite on + an instrumented copy (first lab and three cells, counts equal to the + acceptance) and unit suite on `OSFile25`: together +9 sequence and +4 + explicit branch points (the code of `fdd7a8b`); the cells add nothing to + the first lab; no test or probe reaches the audit ownership retry or the + audit read denial. The new tests add 45 points (getters of pipeline + parameters; the paths report was wrong that no caller invokes a getter); + 7 of 64 parameter sets closed, 51 partly, 1 open, 4 left to the maintainer. + Cultures `de-DE` and `tr-TR`: one defect, fixed (`419cfb3`). Not tested: + Server Core (plan), ARM64, a localized system, non-Windows servers. - Raw evidence is outside git: the session folder `4b12e2f4-d4c7-4a5d-883a-ddb7421c4848\files` (`qg-paths`, the matrix runs, the night log) and @@ -154,9 +166,11 @@ acceptance is the maintainer's. Modify; protecting them is a design change of the controller and needs a new acceptance). The help could also say that a local standard user who asks about a domain account still gets "Access is denied". -6. The two measurement gaps (Evidence): measure the coverage at the tag again - with the method of the paths report (about 1.5 hours, local), and run the - live tests with an instrumented build to see what they add, the audit - ownership retry first (about 2 to 3 hours with the lab). Neither was - requested; the agent starts them on request. +6. Handoff 5 is done (Evidence). The maintainer decides whether the fix + `419cfb3` and the tests enter a new candidate (rc8), which needs the matrix + cells and the first lab on its bytes, and he decides the open items of the + report: hard-link names under another root (a defect with a + reproduction), a piped `AppliesTo` property that doesn't select the Simple + set, 12 getters of pipeline parameters, the 52 partly closed sets, the audit + paths, Server Core (widens Decision 24), and ARM64. 7. Do not release stable 5.0.0 or equate a percentage with gate closure. diff --git a/.memory-bank/progress.md b/.memory-bank/progress.md index 99c14c0..95783d8 100644 --- a/.memory-bank/progress.md +++ b/.memory-bank/progress.md @@ -99,6 +99,15 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). 9 245 / 0 / 1 per edition; every end state CLEAN. The counts equal those of the final local candidate. Record: `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`. +- 2026-10-10: Handoff 5, the coverage unknowns (local, `ai/coverage-unknowns`, + nothing pushed). rc7 measured at `fa0701b`: 3,198/3,649 sequence points; + the live suite and the suite on a domain member add 9 sequence and 4 + explicit branch points (`fdd7a8b`); one defect fixed (`419cfb3`, `tr-TR`), + 79 `It` blocks added (`b2cb47b`: 1,455 cases per configuration, 3,243 + points); the getter rule of the paths report corrected; the first lab + accepted on the fixed build. Open: hard-link names under another root, a + piped `AppliesTo`, Server Core, ARM64. Report: + `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`. ## Stable capabilities @@ -135,16 +144,18 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). 6. Optional maintainer cleanup: obsolete AppVeyor/Read the Docs access, wiki editing restrictions, `test/transfer`, and old lab checkpoints when no longer needed. No remote changes or snapshot restores here. -7. Remaining-path inventory at the final frozen commit of Handoff 1: - 442 unvisited sequence points in 231 methods, all classified - (`Tests/Coverage`): 223 explained from source with evidence, 8 open - (`FileSecurity` conversions, `RemoveAll` account filters). Other open - decisions: lazy path overloads, abandoned `PrivilegeEnabler`, dot patterns - of `Get-ChildItem2 -Filter`, 17 owner-restore handlers that do not pass on +7. Remaining-path inventory at the final frozen commit of Handoff 5 + (`b2cb47b`): 406 unvisited sequence points in 187 methods, all classified + (`Tests/Coverage`): 167 explained from source with evidence, 20 open (8: + `FileSecurity` conversions, `RemoveAll` account filters; 12 getters of + pipeline parameters that no test binds by property name). Other open + decisions: lazy path overloads, abandoned + `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, 17 + owner-restore handlers that do not pass on what a later command raises (a rare combination), unused classes. An audit - write's ownership retry cannot run on a local volume and is covered only - by the lab. A conditional ACE display remains a .NET representation limit, - not evidence of unconditional permissions. + write's ownership retry cannot run on a local volume or on a Windows file + server (probe) and no test reaches it. A conditional ACE display remains a + .NET representation limit, not evidence of unconditional permissions. 8. Publication recovery (`95b827e`, merged in #120): 14 offline tests and exact artifact SHA-512 verification; the original upload errors remain errors for missing, different, or unverifiable outcomes. The agent published nothing, diff --git a/.memory-bank/techContext.md b/.memory-bank/techContext.md index 59ca08d..e20cce2 100644 --- a/.memory-bank/techContext.md +++ b/.memory-bank/techContext.md @@ -105,35 +105,40 @@ source: repository and executable evidence four configurations sequentially with the real CI wrappers, then AltCover runner --collect recalculates the report. Compute option paths before passing native arguments, not inline Join-Path expressions. -- Report sequence points, not unique source lines. Four-run baselines: rc5 - 2,020/3,476 (58.1%); rc6 2,412/3,540 (68.14%); `3442194` 2,641/3,559 - (74.21%); `5a5d58b` 3,192/3,634 (87.84%), branches 1,273/1,978 (64.36%). - The code changes the denominators: never present these as same-source - increments. The branch summary counts 820 compiler-generated points; report - the explicit branch points too (1,088/1,158, 93.96%). Suite at `5a5d58b`: - 1,310 per configuration, zero failures (skipped: 24 and 55 elevated, 234 - and 265 basic, Desktop and Core). +- Report sequence points, not unique source lines. Four-run baselines: + `3442194` 2,641/3,559 (74.21%); `5a5d58b` 3,192/3,634 (87.84%); `fa0701b` + (rc7) 3,198/3,649 (87.64%); `b2cb47b` 3,243/3,649 (88.87%). The code + changes the denominators: never present these as same-source increments. + The branch summary counts 821 compiler-generated points; report the + explicit branch points too (1,090/1,168, 93.32%). Suite at `b2cb47b`: 1,455 + per configuration, zero failures (skipped: 26 and 57 elevated, 276 and 307 + basic, Desktop and Core). - NUnit skipped ForEach names retain placeholders and parameter tuples, executed names expand them: raw-name intersection and positional alignment are invalid. Check skip eligibility by row: run the suite once per configuration with Pester PassThru and match skipped with executed rows by file, line, path, name, and data (discovery alone misses tests that skip while running; write primitives, as `ConvertTo-Json` of rich rows hangs). -- Remaining inventory: 442 points in 231 methods, classified by rule with - evidence (probe, IL scan, source reading); see `Tests/Coverage`. Preserve - raw XML, row CSVs, logs, commit identity, and build hashes: the frozen - Build rewrites its hash file, so save the hashes of the measured assemblies - (AltCover `__Saved` copies) before any mutation build. -- Bounded mutations: one script per round on the frozen worktree, with guards - that no other mutation of the round can trip (an escape can be an overlap - or an equivalent mutant: check before changing a test). Restore the source - exactly and rebuild. -- Red/green matrix (a guard fails without its fix): build each state of the - branch in its own Release worktree, lay the final `Tests` over it, run the - guarding files with the focused runner in all four configurations, and count - failed rows per name with multiplicity; the last state is the control. Keep - the logs, a manifest with hashes, and the hash of each build: the first red - runs of Handoff 1 were deleted and could not be reproduced. +- Live and domain-member coverage: instrument a copy of the package without + `--portable`, with an absolute report path outside the payload + (`C:\NtfsMatrixProbe\Coverage`, `icacls` Authenticated Users modify) and a + SYSTEM task that snapshots the report after each process (a role that is not + an administrator of the client can't write next to the module). It counts + only when its counts equal the uninstrumented acceptance and every role + logged a flush. Merge by position, never by `uspid`. PowerShell reads the + getter of a parameter that it binds from a piped object: unvisited getters + point at missing pipeline tests. +- Remaining inventory at `b2cb47b`: 406 points in 187 methods, classified by + rule (`Tests/Coverage`). Preserve raw XML, row CSVs, logs, commit identity, + and build hashes: the frozen Build rewrites its hash file, so save the + hashes of the measured assemblies (AltCover `__Saved` copies) first. +- Mutation proofs: bounded one-statement changes on a second frozen worktree, + source restored exactly and rebuilt (an escape can be an overlap, an + equivalent mutant, or a masked case: check before changing a test). Red/green + matrix for a fix: build each state in its own Release worktree, lay the + final `Tests` over it, count failed rows per name in all four + configurations, and keep logs and hashes (Handoff 1's first red runs were + deleted and could not be reproduced). ## Lab acceptance diff --git a/Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md b/Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md index 318a10f..07ed795 100644 --- a/Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md +++ b/Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md @@ -33,7 +33,8 @@ is open. the suite has 1,455 cases per configuration without a failure and covers 3,243 sequence points (88.87%). - **A defect fixed, a defect open.** The comparison of an identity with a name - was wrong in `tr-TR`; it is fixed test-first (`419cfb3`). The hard-link + was wrong in `tr-TR`; it is fixed test-first (`419cfb3`), and the first lab + passes on the fixed build (245 passed, 1 skipped per edition). The hard-link cmdlets (`New-NTFSHardLink -PassThru`, `Get-NTFSHardLink`) fail for a path whose root is not the volume root; the defect is reproduced and left to the maintainer. @@ -926,6 +927,39 @@ points, and 78 explicit branch points; each of the 187 is classified (none is unclassified), 167 as explained and 20 as open (the 8 methods that the paths report left to the maintainer, and 12 getters of pipeline parameters). +## Lab acceptance of the fixed build + +A defect that is not an open item is fixed, and the lab acceptance of the +affected behavior is repeated on the fixed build (the handoff, as the paths +work did). The affected behavior is the comparison of an identity with a name. +No cmdlet uses it (the cmdlets compare identities by SID, and no line of the C# +of the cmdlets compares an identity with a string) and no live test does, so +this run is evidence that the fix changes nothing in the lab. It is not a +release acceptance: a new candidate needs its own (open item 6). + +- Module: the extracted package of the measured final build + (`E\final\package\NTFSSecurity`, packaged like CI by `New-ModulePackage.ps1` + from the pristine copy). The hashes of its four assemblies, logged at the + start of the run, are those of the final measurement. It was passed with + `-ModulePath` to the unmodified controller and live tests of the repository + (Git blobs `635bf162…` and `efe36e50…`), without instrumentation. +- Lab: `WindowsAccessControlLab` (client `F1AFile1`, file server `F1AFile2`, + four domains, the trusts), one call per edition, run `fix1`, + `Run-LiveAcceptance.ps1`. + +| Role | Account | Passed | Failed | Skipped | Exit code | +| --- | --- | ---: | ---: | ---: | ---: | +| Delegate | `A\NtfsLiveDelegate` | 69 | 0 | 0 | 0 | +| ServerAdmin | `A\NtfsLiveServerAdmin` | 36 | 0 | 0 | 0 | +| Admin | `A\NtfsLiveAdmin` | 64 | 0 | 0 | 0 | +| Server | `A\install` | 76 | 0 | 1 | 0 | + +Both editions gave the same counts: 245 passed, 0 failed, 1 skipped +(`LIVE_RESULT_VERIFIED`), the counts of the rc7 acceptance and of the +instrumented runs. The removal of the fixture and the independent check of the +end state found no account, share, folder, profile, task, or group member left +in the four domains and on both machines (`CLEAN`, 21:30:18Z). + ## Decisions made The decisions below are the agent's, taken inside the limits of the handoff; @@ -1032,7 +1066,7 @@ of the effective-access check, Decisions 22 and 24, and #34) stay as they are. | Windows Server Core | Open | a plan with the image index, disk, time, and commands; deploying needs the maintainer's word | | ARM64 | Open | no reproduction | | The final commit | Closed | `b2cb47b`: 1,455 cases per configuration, no failure; 3,243/3,649 sequence points (88.87%); eligibility by row; 187 unvisited methods classified | -| The lab acceptance of the fixed build | see the section below | the first lab, both editions, with the package of the measured bytes | +| The lab acceptance of the fixed build | Closed for the first lab | the measured final package, both editions, 245 passed, 0 failed, 1 skipped each, clean end state; the matrix cells were not repeated (a new candidate needs them) | ## Checks not run, and limits