Orchestrata Ultimate / RTM / 066-powershell-tool
RTM: 066-powershell-tool
Requirement to symbol to test rows for 066-powershell-tool: PowerShellTool - Windows PowerShell Execution.
At a glance
| Item | Value |
|---|---|
| Requirement IDs | 194 |
Traced from src/ |
0 (0.0%) |
| Untraced | 194 |
Cited from tests/ |
0 (0.0%) |
Traced in src/ but not cited from tests/ |
0 |
Reading this matrix
This matrix lists each of the 194 requirement IDs of spec 066-powershell-tool with the src/ symbols that cite it and the tests that cite it. 0 of them (0.0%) have at least one citing symbol and 194 have none.
0 requirements are also cited from tests/, and 0 are traced in code but never named by a test. A test citation is a @traces on a test function; it shows intent to cover, not that the test runs or reaches the symbol.
Rows showing none in the symbols column are the gaps to close first. The densest untraced groups are REQ-066-* (194).
Requirement to symbols to tests
| Requirement | Symbols in src/ |
Tests citing it |
|---|---|---|
REQ-066-001 The tool MUST execute single PowerShell commands and capture output within the... |
none | none |
REQ-066-002 Command is executed using detected PowerShell binary |
none | none |
REQ-066-003 Stdout and stderr are captured separately |
none | none |
REQ-066-004 Exit code is returned in result |
none | none |
REQ-066-005 Execution time is measured in milliseconds |
none | none |
REQ-066-006 The tool MUST execute PowerShell script files (.ps1) with parameter binding. |
none | none |
REQ-066-007 Script path is validated to exist and end in .ps1 |
none | none |
REQ-066-008 Parameters are bound using -File parameter syntax |
none | none |
REQ-066-009 Execution follows same security rules as single commands |
none | none |
REQ-066-010 Errors during parameter binding return descriptive messages |
none | none |
REQ-066-011 The tool MUST enforce a command allowlist for security sandboxing. |
none | none |
REQ-066-012 Commands are validated before execution |
none | none |
REQ-066-013 Default patterns include Get-, Test-, Select-, Where-, Sort-* |
none | none |
REQ-066-014 Custom allowlists can be specified per execution |
none | none |
REQ-066-015 Blocked commands return ERR-003 error |
none | none |
REQ-066-016 The tool MUST implement configurable execution timeout. |
none | none |
REQ-066-017 Default timeout is 60 seconds |
none | none |
REQ-066-018 Timeout range is 1-600 seconds |
none | none |
REQ-066-019 Process tree is killed on timeout |
none | none |
REQ-066-020 Timeout error (ERR-002) is returned on expiration |
none | none |
REQ-066-021 The tool MUST sanitize command output to remove sensitive data. |
none | none |
REQ-066-022 Passwords, tokens, keys are replaced with [REDACTED] |
none | none |
REQ-066-023 Connection strings are sanitized |
none | none |
REQ-066-024 Private keys are masked |
none | none |
REQ-066-025 Custom patterns can be configured |
none | none |
REQ-066-026 The tool MUST detect PowerShell binary across platforms. |
none | none |
REQ-066-027 Windows: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
none | none |
REQ-066-028 Cross-platform: pwsh in PATH |
none | none |
REQ-066-029 Linux/macOS: /usr/bin/pwsh |
none | none |
REQ-066-030 Returns ERR-001 if not found |
none | none |
REQ-066-031 The tool MUST parse and return structured output (JSON/text). |
none | none |
REQ-066-032 PowerShell objects are serialized to JSON |
none | none |
REQ-066-033 Text output is preserved as-is |
none | none |
REQ-066-034 output_json field contains parsed objects when applicable |
none | none |
REQ-066-035 Null when output cannot be parsed as JSON |
none | none |
REQ-066-036 The tool MUST support working directory specification. |
none | none |
REQ-066-037 Optional working_directory parameter |
none | none |
REQ-066-038 Validates directory exists before execution |
none | none |
REQ-066-039 ERR-009 returned if directory invalid |
none | none |
REQ-066-040 The tool MUST implement execution cancellation. |
none | none |
REQ-066-041 cancel() method accepts execution_id |
none | none |
REQ-066-042 SIGINT signal sent first (soft cancel) |
none | none |
REQ-066-043 Force kill after 5 second grace period |
none | none |
REQ-066-044 ERR-012 returned if cancelled |
none | none |
REQ-066-045 The tool MUST log all executions for audit trail. |
none | none |
REQ-066-046 Timestamp recorded for each execution |
none | none |
REQ-066-047 Command, user, result, and duration logged |
none | none |
REQ-066-048 Logs include success/failure status |
none | none |
REQ-066-049 Audit trail is queryable |
none | none |
REQ-066-101 Command execution latency | < 100ms | < 500ms | |
none | none |
REQ-066-102 Script startup time | < 200ms | < 1000ms | |
none | none |
REQ-066-103 Output sanitization | < 50ms | < 200ms | |
none | none |
REQ-066-104 Memory usage | < 100MB | < 200MB | |
none | none |
REQ-066-105 Concurrent executions | 10 | 20 | |
none | none |
REQ-066-106 Uptime | 99.9% availability | |
none | none |
REQ-066-107 Error recovery | Automatic retry on transient failures | |
none | none |
REQ-066-108 Graceful degradation | Fallback to default allowlist if custom fails | |
none | none |
REQ-066-109 Timeout handling | Process tree termination on timeout | |
none | none |
REQ-066-110 Input validation | All inputs validated before execution | |
none | none |
REQ-066-111 Sandboxing | Command allowlist enforced by default | |
none | none |
REQ-066-112 Output filtering | Sensitive data patterns redacted | |
none | none |
REQ-066-113 Audit trail | All executions logged with full context | |
none | none |
REQ-066-114 No code injection | Parameterized execution prevents injection | |
none | none |
REQ-066-115 Windows | Windows 10/Server 2019 | |
none | none |
REQ-066-116 PowerShell | 5.1 | |
none | none |
REQ-066-117 PowerShell Core | 7.0+ | |
none | none |
REQ-066-118 Python | 3.11+ | |
none | none |
REQ-066-119 Logging | Structured JSON logs with context | |
none | none |
REQ-066-120 Metrics | Execution count, duration, success rate | |
none | none |
REQ-066-121 Tracing | OpenTelemetry compatible spans | |
none | none |
REQ-066-122 Health checks | /health endpoint for liveness | |
none | none |
REQ-066-050 A tool request SHALL conform to the PowerShellToolRequest JSON Schema below:... |
none | none |
REQ-066-051 A tool result SHALL conform to the PowerShellToolResult JSON Schema below, carrying... |
none | none |
REQ-066-052 A command validation result SHALL conform to the CommandValidationResult JSON Schema... |
none | none |
REQ-066-053 Security configuration SHALL conform to the PowerShellSecurityConfig JSON Schema... |
none | none |
REQ-066-054 PowerShell executable not found on system | Return error with message, log attempt | |
none | none |
REQ-066-055 Command execution exceeded timeout | Kill process tree, return timeout error with... |
none | none |
REQ-066-056 Command '{cmdlet}' is not in allowed command list | Block execution, return ERR-003 | |
none | none |
REQ-066-057 Command '{cmdlet}' is explicitly blocked for security | Block execution, return ERR-004 | |
none | none |
REQ-066-058 Command contains blocked pattern: {pattern} | Block execution, return ERR-005 | |
none | none |
REQ-066-059 Script file not found: {path} | Return error with file path | |
none | none |
REQ-066-060 Script file is not a valid .ps1 file | Validate extension, return ERR-007 | |
none | none |
REQ-066-061 Failed to bind parameters to script | Return detailed binding error | |
none | none |
REQ-066-062 Working directory does not exist | Validate before execution, return ERR-009 | |
none | none |
REQ-066-063 Output size {size} exceeds maximum {max} | Truncate output, return ERR-010 | |
none | none |
REQ-066-064 Permission denied to execute command | Check permissions, return ERR-011 | |
none | none |
REQ-066-065 Command execution was cancelled | Return ERR-012 with cancelled status | |
none | none |
REQ-066-066 Required PowerShell module '{module}' is not installed | Check module availability,... |
none | none |
REQ-066-067 PowerShell command syntax error | Return ERR-014 with syntax error details | |
none | none |
REQ-066-068 Failed to decode PowerShell output | Try multiple encodings, return ERR-015 | |
none | none |
REQ-066-069 Command exceeds maximum character limit | Validate length, return ERR-016 | |
none | none |
REQ-066-070 Timeout value is negative, zero, or exceeds maximum | Validate range 1-600, return... |
none | none |
REQ-066-071 Working directory path traversal attempt detected | Block execution, return ERR-018 | |
none | none |
REQ-066-072 No command or script path provided | Validate input, return ERR-019 | |
none | none |
REQ-066-073 The tool SHALL expose the PowerShellTool interface shown below — the name,... |
none | none |
REQ-066-074 The tool SHALL return the ToolResult structure shown below, with the fields... |
none | none |
REQ-066-075 The tool server SHALL expose the REST endpoints shown below: `POST... |
none | none |
REQ-066-076 The tool implements a command allowlist system with the following default patterns: |
none | none |
REQ-066-077 The tool SHALL explicitly block the cmdlets listed below. |
none | none |
REQ-066-078 The following regex patterns trigger automatic blocking: |
none | none |
REQ-066-079 Output sanitization removes or masks the following patterns: |
none | none |
REQ-066-080 The tool SHALL support the timeout levels below: a Default of 60 seconds for standard... |
none | none |
REQ-066-081 Hard timeout kills PowerShell process tree |
none | none |
REQ-066-082 Soft timeout sends Ctrl+C signal first |
none | none |
REQ-066-083 Grace period of 5 seconds after soft timeout |
none | none |
REQ-066-084 Force kill if process doesn't terminate |
none | none |
REQ-066-085 Working Directory Restriction: Optional enforcement of working directory to... |
none | none |
REQ-066-086 Output Size Limitation: Maximum 1MB output by default, configurable up to 10MB |
none | none |
REQ-066-087 Module Isolation: Prevent loading of untrusted PowerShell modules |
none | none |
REQ-066-088 Script Signing: Optional enforcement of signed scripts only |
none | none |
REQ-066-089 Audit Logging: All executions logged with timestamp, user, command, and result |
none | none |
REQ-066-123 Unit Tests | 85% | 95% | |
none | none |
REQ-066-124 Integration Tests | 100% | 100% | |
none | none |
REQ-066-125 Security Tests | 100% | 100% | |
none | none |
REQ-066-126 TR-001 | Single command execution returns valid output | Integration | |
none | none |
REQ-066-127 TR-002 | Script file execution with parameter binding | Integration | |
none | none |
REQ-066-128 TR-003 | Command allowlist correctly permits/blocks | Unit | |
none | none |
REQ-066-129 TR-004 | Execution timeout triggers on expiration | Unit | |
none | none |
REQ-066-130 TR-005 | Output sanitization removes sensitive data | Unit | |
none | none |
REQ-066-131 TR-006 | PowerShell binary detection works cross-platform | Integration | |
none | none |
REQ-066-132 TR-007 | Working directory validation enforced | Integration | |
none | none |
REQ-066-133 TR-008 | Execution cancellation terminates process | Integration | |
none | none |
REQ-066-134 TR-101 | Blocked cmdlets are rejected | Security | |
none | none |
REQ-066-135 TR-102 | Invoke-Expression commands blocked | Security | |
none | none |
REQ-066-136 TR-103 | Path traversal attempts blocked | Security | |
none | none |
REQ-066-137 TR-104 | Output sanitization for passwords | Security | |
none | none |
REQ-066-138 TR-105 | Output sanitization for API keys | Security | |
none | none |
REQ-066-139 TR-106 | Output sanitization for tokens | Security | |
none | none |
REQ-066-140 TR-107 | Output sanitization for private keys | Security | |
none | none |
REQ-066-141 TR-201 | Command execution latency | < 100ms | |
none | none |
REQ-066-142 TR-202 | Script startup time | < 200ms | |
none | none |
REQ-066-143 TR-203 | Output sanitization time | < 50ms | |
none | none |
REQ-066-144 TR-204 | Concurrent execution support | 10+ processes | |
none | none |
REQ-066-145 Python Version | 3.11+ | |
none | none |
REQ-066-146 PowerShell Version | 5.1+ / 7.0+ | |
none | none |
REQ-066-147 Operating System | Windows 10/Server 2019+ | |
none | none |
REQ-066-148 Test Isolation | Each test runs independently | |
none | none |
REQ-066-149 All unit tests must pass before merge |
none | none |
REQ-066-150 All integration tests must pass before release |
none | none |
REQ-066-151 Security tests must pass 100% before deployment |
none | none |
REQ-066-152 Performance tests must meet thresholds |
none | none |
REQ-066-153 Command Validation | 100% of allowlist/blocklist patterns | |
none | none |
REQ-066-154 Output Sanitization | 100% of sensitive patterns | |
none | none |
REQ-066-155 Timeout Handling | All timeout scenarios | |
none | none |
REQ-066-156 Error Handling | All error conditions (E001-E015) | |
none | none |
REQ-066-157 Path Detection | Windows/PowerShell Core detection | |
none | none |
REQ-066-158 Execute Get-Service | Returns service list with status | |
none | none |
REQ-066-159 Execute blocked Remove-Item | Returns E004 error | |
none | none |
REQ-066-160 Execute script with parameters | Parameters bound correctly | |
none | none |
REQ-066-161 Command timeout | Returns E002 error | |
none | none |
REQ-066-162 Output exceeds size limit | Returns E010 error | |
none | none |
REQ-066-163 Invalid script path | Returns E006 error | |
none | none |
REQ-066-164 Sanitize password in output | Password replaced with [REDACTED] | |
none | none |
REQ-066-165 Command with Invoke-Expression | Blocked, E005 | |
none | none |
REQ-066-166 Command with path traversal | Blocked, V004 | |
none | none |
REQ-066-167 Output with API key | Sanitized | |
none | none |
REQ-066-168 Output with private key | Sanitized | |
none | none |
REQ-066-169 Script execution timeout | Graceful termination | |
none | none |
REQ-066-090 The PowerShell tool integrates with the orchestrata-ultimate tool ecosystem through: |
none | none |
REQ-066-091 The tool SHALL integrate with the security framework as listed below — PAM++... |
none | none |
REQ-066-092 The tool SHALL integrate with the API server as listed below — HTTP endpoints exposing... |
none | none |
REQ-066-093 The tool SHALL integrate with monitoring as listed below — export of execution metrics... |
none | none |
REQ-066-170 Single command execution | 100% success rate on allowed commands | Integration tests | |
none | none |
REQ-066-171 Script execution | Parameters bound correctly | Integration tests | |
none | none |
REQ-066-172 Security enforcement | 100% of blocked commands rejected | Security tests | |
none | none |
REQ-066-173 Output sanitization | 100% sensitive data redacted | Unit tests | |
none | none |
REQ-066-174 Command latency | < 100ms for simple commands | Load testing | |
none | none |
REQ-066-175 Startup time | < 200ms for PowerShell init | Profiling | |
none | none |
REQ-066-176 Throughput | 10 concurrent executions | Stress testing | |
none | none |
REQ-066-177 Command isolation | No unauthorized command execution | Penetration testing | |
none | none |
REQ-066-178 Data protection | Zero sensitive data in logs | Audit review | |
none | none |
REQ-066-179 Access control | Only authorized users can execute | Auth tests | |
none | none |
REQ-066-180 All unit tests pass (>85% coverage) |
none | none |
REQ-066-181 All integration tests pass (100%) |
none | none |
REQ-066-182 All security tests pass (100%) |
none | none |
REQ-066-183 Documentation complete and reviewed |
none | none |
REQ-066-184 Performance benchmarks met |
none | none |
REQ-066-185 Security audit passed |
none | none |
REQ-066-186 Compliance check passed |
none | none |
REQ-066-187 Deployment scripts tested |
none | none |
REQ-066-188 Monitoring dashboards configured |
none | none |
REQ-066-189 Runbooks documented |
none | none |
REQ-066-190 Incident response procedures defined |
none | none |
REQ-066-191 Backup/restore procedures tested |
none | none |
REQ-066-192 The tool SHALL declare the dependencies shown below: python >=3.11, `aiofiles... |
none | none |
REQ-066-094 PowerShell binary detection SHALL proceed in the order shown below —... |
none | none |
REQ-066-095 Command execution SHALL proceed in the order shown below: validate the command against... |
none | none |
REQ-066-096 Script execution SHALL proceed in the order shown below: validate that the script path... |
none | none |
REQ-066-097 Execution SHALL require tool:powershell, the allowlist SHALL be enforced, and output... |
none | none |
REQ-066-193 Component logging SHALL log all major operations with appropriate log levels, include... |
none | none |
REQ-066-194 Performance metrics SHALL comprise operation duration histograms, request/error rate... |
none | none |
REQ-066-195 Distributed tracing SHALL provide trace propagation across component boundaries, span... |
none | none |
REQ-066-196 Critical alerts SHALL cover error rate spikes, performance degradation, resource... |
none | none |
REQ-066-197 The operational dashboard SHALL present real-time system health, performance trends,... |
none | none |