0 Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-12 17:59:08 +00:00

Files

T

南宫茜andmorluto a01674377f feat(native): support ReFS filesystem authority (#10086 )

* docs(native): specify Windows ReFS filesystem authority

* docs(native): plan ReFS filesystem support

* feat(native): admit ReFS filesystem identities

* feat(native): support ReFS filesystem authority

* feat(native): advertise ReFS Windows support

* docs(native): format ReFS support documents

* docs(native): record ReFS verification tasks

* docs(native): record ReFS draft pull request

* docs(website): correct remaining ReFS translations

* fix(docs): correct Windows native guide link in ReFS plan

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

2026-11-11 21:36:57 -05:00

4.7 KiB

Raw Blame History

Windows ReFS filesystem authority

Problem and outcome

The Windows native authority currently admits only fixed local NTFS volumes. Its openFile admission combines the filesystem-name check and the persistent ACL check in one failure, so a ReFS target is rejected with Backing volume must be NTFS with persistent ACLs even when ReFS reports FILE_PERSISTENT_ACLS and the target's DACL is readable. The rejection occurs while creating the protected target snapshot, before Ghidra starts.

Extend the existing shared Windows filesystem authority to fixed local ReFS volumes without weakening its handle, identity, DACL, snapshot or cleanup boundaries. NTFS behavior must remain unchanged, and every other filesystem must continue to fail closed. This increment belongs to the additional-filesystem acceptance direction in #289.

Requirements

Admit a fixed local volume only when its filesystem is NTFS or ReFS and it reports FILE_PERSISTENT_ACLS. Keep the existing fixed-drive, path-component, reparse-point and sharing admission rules unchanged.
Report unsupported filesystems and missing persistent ACL support as distinct constraints. Do not imply that ReFS lacks ACL support.
Record the observed filesystem in the native File or Runtime owner at admission. Handle-relative private children inherit the runtime's filesystem; snapshot sources and destinations report their respective observed values. Remove the hardcoded NTFS identity projection.
Accept exactly NTFS and ReFS in windowsFileIdentitySchema; unknown values remain invalid. Preserve the existing native observation structure and ABI version. An older consumer that only understands NTFS must continue to fail closed when it encounters ReFS.
Reuse the existing handle-relative implementation rather than adding a second filesystem backend. Do not add an environment override or a fallback that bypasses source admission, private DACLs, stable file identity, reparse rejection, immutable snapshots or owned cleanup.
Extend the independent Windows verifier fixture to report volume semantics, and make the real native verifier check source, runtime and snapshot filesystem identities against that independent observation.
Run the complete native conformance lane on NTFS and ReFS at the same revision, including DACL readback, source replacement denial, unrelated sibling rename, ancestor reparse denial, snapshot digest/cancellation and cleanup containment. Run the complete real Windows Ghidra lane on ReFS and repeat it on NTFS.
Update the Windows native build guide, Windows Ghidra P0 limitations, recovery guidance and verifier reports to say fixed local NTFS/ReFS only. Preserve all unrelated NTFS documentation and claims.

Acceptance

Focused TypeScript tests accept NTFS and ReFS identities and reject unsupported filesystem values. The native build produces the Windows x64 artifact through the existing Linux/MinGW lane with Node 24.22.1, and generated artifacts remain uncommitted.

The same revision passes the complete native verifier on both filesystems and the real Windows Ghidra verifier on both filesystems. Source and snapshot filesystem identities are observed independently rather than asserted only from REA's own output. Relevant source, boundary, documentation, artifact and package checks pass; any unrun or failed check is reported explicitly and prevents a complete-support claim.

Evidence already obtained

A disposable independent Win32 probe, built with the WSL MinGW toolchain and run without elevation, completed 24 checks on each filesystem. Both NTFS and ReFS reported persistent ACLs; created and read back protected private DACLs; provided stable 128-bit file IDs and final handle paths; denied source writes, source replacement and ancestor replacement through sharing violations; allowed an unrelated sibling rename; rejected conversion of a pinned nonempty ancestor into a reparse point with ERROR_DIR_NOT_EMPTY; and removed junctions by handle without modifying an external sentinel. The probe source, executable and owned test directories were removed. These observations support feasibility but do not replace the complete REA verification required above.

Out of scope

SMB, UNC, exFAT, FAT32 and other filesystems or namespace variants.
Admitting reparse components, SUBST aliases, mounted-folder aliases or a mutable-path/provider authority expansion.
A separate ReFS backend, changed process-execution authority, Ghidra database mutation, or a native ABI version/structure change.
Weakening a failing assertion or omitting a required verification lane to make ReFS appear supported.
Marking the upstream pull request ready on behalf of the human owner or merging it.

4.7 KiB Raw Blame History