NTFSSecurity/.memory-bank/activeContext.md

status	last-verified	owner	source
current	2026-10-08	active-agent	current task evidence

Active context

Current focus

Phase 2 of the quality gate before 5.0.0 (Decision 21) is complete on the local branch ai/release-5.0.0-rc6, candidate 7b0781f. The maintainer pushes the branch, merges the pull request after CI, and tags 5.0.0-rc6. Then Phase 3 (live tests on more operating systems) and 5.0.0; after 5.0.0 the repository is archived in favor of WindowsAccessControl (Decision 18).

Evidence

• 2026-10-08, Phase 2 on ai/release-5.0.0-rc6, 31 commits on fcb370e (5.0.0-rc5); the candidate is 7b0781f:
  • The suite has 684 tests. Elevated: 662 passed and 22 skipped in Windows PowerShell 5.1, 632 and 52 in PowerShell 7. As a basic user through Invoke-TestsAsBasicUser.ps1: 590 and 94, 560 and 124. No failure, and no test is skipped in all four configurations; CI runs all four since this branch.
  • C# coverage of all four configurations (AltCover without --save, techContext.md): 68.1% of the lines and 44.3% of the branches on 1b9edbb; rc5 58.1% and 38.0%. The earlier figures counted one of the four runs. Of the 972 points that no test ran at e2b6b24 (without the classes that no cmdlet calls), 400 are code that nothing calls, 107 defensive guards, 74 need a failure of Windows, 4 need the lab, and 387 are reachable; 51 of those ran in runs that the first measurement missed, and the top items of the rest are in progress.md, open work 7.
  • Fixed test-first: Get-NTFSSimpleAccess (ReadData, the parent of a relative path); Copy-Item2 and Move-Item2 (a folder at the destination, the missing destination folder of #21, also with -WhatIf); the hard-link cmdlets on shares and at folders; Set-NTFSSecurityDescriptor -PassThru (R5); the error ID of Get-NTFSOrphanedAccess; relative paths that start with a dot, which every cmdlet shortened by two characters (Remove-Item2 .x removed another item); comparing entries and descriptors (InvalidCastException, also Compare-Object in PowerShell 7) and their conversions; InheritedFrom with -ExcludeExplicit and for a descriptor with audit entries (ArgumentOutOfRangeException). Copy-Item2 no longer creates the missing folders of a destination for a folder (assumption, flagged for the maintainer).
  • Live tests: cases 4b to 9 and accounts of b.forest1.net, forest2.net, and forest3.net. The lab acceptance passed for acfe3af, 1b9edbb, and 7b0781f (326 tests each, none failed; Tests/Lab/Acceptance-2026-10-08-5.0.0-rc6.md). Baseline: the published 5.0.0-rc5 fails only the two hard-link tests of case 8. The fixture was removed and the removal checked after each run; three checkpoints ntfs-rc6-*-before-acceptance stay on six machines.
  • Get-NTFSEffectiveAccess -ServerName needs administrators or Access Control Assistance Operators on the named computer (lab probe, documented).
  • Two security-reviewer passes approved the branch with no Blocker or Major finding: fcb370e..e2b6b24 (findings 1, 4, 5, 10 fixed in acfe3af) and e2b6b24..1b9edbb (findings 1, 2, 6, 7 fixed in 7b0781f). Not fixed: a failed privilege disable isn't tried again, and a non-qualified ACE could shift InheritedFrom (neither reproducible); New-NTFSHardLink stays terminating for a folder (a behavior change for the maintainer).
• #34: no reply from the tester since 2026-10-06.

Next step

1. The maintainer pushes the branch, opens the pull request, merges it after CI, and tags 5.0.0-rc6; then the live tests run against the published package (-Version 5.0.0-rc6). The first CI run is the first run of Invoke-TestsAsBasicUser.ps1 on a GitHub runner.
2. The maintainer decides the behavior changes in progress.md, open work 4 (Decision 16), and the scope of Phase 3: the operating systems, the code that nothing calls, and file servers that aren't Windows (#34).