mirror of
https://github.com/morluto/rea.git
synced 2026-11-12 17:59:08 +00:00
南宫茜andmorluto
a01674377f
* docs(native): specify Windows ReFS filesystem authority * docs(native): plan ReFS filesystem support * feat(native): admit ReFS filesystem identities * feat(native): support ReFS filesystem authority * feat(native): advertise ReFS Windows support * docs(native): format ReFS support documents * docs(native): record ReFS verification tasks * docs(native): record ReFS draft pull request * docs(website): correct remaining ReFS translations * fix(docs): correct Windows native guide link in ReFS plan --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
87 lines
4.7 KiB
Markdown
87 lines
4.7 KiB
Markdown
# Windows ReFS filesystem authority
|
|
|
|
## Problem and outcome
|
|
|
|
The Windows native authority currently admits only fixed local NTFS volumes.
|
|
Its `openFile` admission combines the filesystem-name check and the persistent
|
|
ACL check in one failure, so a ReFS target is rejected with `Backing volume must
|
|
be NTFS with persistent ACLs` even when ReFS reports `FILE_PERSISTENT_ACLS` and
|
|
the target's DACL is readable. The rejection occurs while creating the protected
|
|
target snapshot, before Ghidra starts.
|
|
|
|
Extend the existing shared Windows filesystem authority to fixed local ReFS
|
|
volumes without weakening its handle, identity, DACL, snapshot or cleanup
|
|
boundaries. NTFS behavior must remain unchanged, and every other filesystem must
|
|
continue to fail closed. This increment belongs to the additional-filesystem
|
|
acceptance direction in
|
|
[#289](https://github.com/morluto/rea/issues/289).
|
|
|
|
## Requirements
|
|
|
|
- Admit a fixed local volume only when its filesystem is `NTFS` or `ReFS` and it
|
|
reports `FILE_PERSISTENT_ACLS`. Keep the existing fixed-drive, path-component,
|
|
reparse-point and sharing admission rules unchanged.
|
|
- Report unsupported filesystems and missing persistent ACL support as distinct
|
|
constraints. Do not imply that ReFS lacks ACL support.
|
|
- Record the observed filesystem in the native `File` or `Runtime` owner at
|
|
admission. Handle-relative private children inherit the runtime's filesystem;
|
|
snapshot sources and destinations report their respective observed values.
|
|
Remove the hardcoded `NTFS` identity projection.
|
|
- Accept exactly `NTFS` and `ReFS` in `windowsFileIdentitySchema`; unknown values
|
|
remain invalid. Preserve the existing native observation structure and ABI
|
|
version. An older consumer that only understands NTFS must continue to fail
|
|
closed when it encounters ReFS.
|
|
- Reuse the existing handle-relative implementation rather than adding a second
|
|
filesystem backend. Do not add an environment override or a fallback that
|
|
bypasses source admission, private DACLs, stable file identity, reparse
|
|
rejection, immutable snapshots or owned cleanup.
|
|
- Extend the independent Windows verifier fixture to report volume semantics,
|
|
and make the real native verifier check source, runtime and snapshot
|
|
filesystem identities against that independent observation.
|
|
- Run the complete native conformance lane on NTFS and ReFS at the same revision,
|
|
including DACL readback, source replacement denial, unrelated sibling rename,
|
|
ancestor reparse denial, snapshot digest/cancellation and cleanup containment.
|
|
Run the complete real Windows Ghidra lane on ReFS and repeat it on NTFS.
|
|
- Update the Windows native build guide, Windows Ghidra P0 limitations, recovery
|
|
guidance and verifier reports to say fixed local NTFS/ReFS only. Preserve all
|
|
unrelated NTFS documentation and claims.
|
|
|
|
## Acceptance
|
|
|
|
Focused TypeScript tests accept NTFS and ReFS identities and reject unsupported
|
|
filesystem values. The native build produces the Windows x64 artifact through
|
|
the existing Linux/MinGW lane with Node 24.22.1, and generated artifacts remain
|
|
uncommitted.
|
|
|
|
The same revision passes the complete native verifier on both filesystems and
|
|
the real Windows Ghidra verifier on both filesystems. Source and snapshot
|
|
filesystem identities are observed independently rather than asserted only from
|
|
REA's own output. Relevant source, boundary, documentation, artifact and package
|
|
checks pass; any unrun or failed check is reported explicitly and prevents a
|
|
complete-support claim.
|
|
|
|
## Evidence already obtained
|
|
|
|
A disposable independent Win32 probe, built with the WSL MinGW toolchain and run
|
|
without elevation, completed 24 checks on each filesystem. Both NTFS and ReFS
|
|
reported persistent ACLs; created and read back protected private DACLs;
|
|
provided stable 128-bit file IDs and final handle paths; denied source writes,
|
|
source replacement and ancestor replacement through sharing violations; allowed
|
|
an unrelated sibling rename; rejected conversion of a pinned nonempty ancestor
|
|
into a reparse point with `ERROR_DIR_NOT_EMPTY`; and removed junctions by handle
|
|
without modifying an external sentinel. The probe source, executable and owned
|
|
test directories were removed. These observations support feasibility but do
|
|
not replace the complete REA verification required above.
|
|
|
|
## Out of scope
|
|
|
|
- SMB, UNC, exFAT, FAT32 and other filesystems or namespace variants.
|
|
- Admitting reparse components, SUBST aliases, mounted-folder aliases or a
|
|
mutable-path/provider authority expansion.
|
|
- A separate ReFS backend, changed process-execution authority, Ghidra database
|
|
mutation, or a native ABI version/structure change.
|
|
- Weakening a failing assertion or omitting a required verification lane to make
|
|
ReFS appear supported.
|
|
- Marking the upstream pull request ready on behalf of the human owner or
|
|
merging it.
|