docs: refresh stale counts across docs + add a doc-freshness test guard (#43)

Four releases of module additions (NPS, Always-On VPN, CIS Compliance, SIEM
Forwarder) left documentation counts stale. This corrects them everywhere and
adds an enforcement guard so they can't silently drift again.

Corrections (all to the live source-of-truth: 77 modules, 189 CLI actions):
  * README: 181 -> 189 CLI actions (x3), the module-architecture table now
    lists 70-76, a Security Operations feature bullet, directory tree + region
    count to 77, and the test badge relabelled "structural tests" (distinct
    from the Pester unit-test badge) at the current count.
  * 34-Help.ps1: in-tool CLI-actions help 176 -> 189 + names the new actions.
  * ROADMAP / CONTRIBUTING / docs/ASSURANCE_CASE: module/test counts refreshed.
  * dist/ (chocolatey nuspec, scoop json, winget locale): action counts -> 189.

New guard (Tests/Run-Tests.ps1, Section 174 "Documentation Freshness"): for
README, CONTRIBUTING, ROADMAP, 34-Help, and the dist/ manifests, every quoted
"NNN CLI/available actions" must equal the live -Action count, and README's
module count must equal the live module count — derived from the codebase at
test time, so a stale doc fails the suite (and Validate-Release) before publish.

Docs + test-infra + a help string only — no behavioral change, no version bump.

Author: TheAbider

CONTRIBUTING.md

@@ -1,4 +1,4 @@
-# Contributing to RackStack
+# Contributing to RackStack
 
 Thanks for your interest in contributing! Here's how to get started.
 
@@ -30,7 +30,7 @@ powershell -ExecutionPolicy Bypass -File Tests\pssa-check.ps1
 
 ## Pull Request Checklist
 
-- [ ] All 4,759 tests pass (`Run-Tests.ps1` exits with code 0)
+- [ ] All 5,002 tests pass (`Run-Tests.ps1` exits with code 0)
 - [ ] PSScriptAnalyzer reports 0 errors (`pssa-check.ps1`)
 - [ ] Monolithic synced (`sync-to-monolithic.ps1` shows 0 parse errors)
 - [ ] New functions follow PowerShell verb-noun naming (`Get-`, `Set-`, `Test-`, `Show-`)

Modules/34-Help.ps1

@@ -253,7 +253,7 @@ function Search-HelpTopics {
         @{ Title = "Performance"; Keywords = @("performance", "cpu", "memory", "disk", "io", "bandwidth", "dashboard", "process"); Description = "Live performance dashboard with CPU, memory, disk I/O, and network bandwidth monitoring" }
         @{ Title = "Licensing & NTP"; Keywords = @("license", "activation", "kms", "avma", "ntp", "time", "timezone", "clock"); Description = "Windows licensing status (KMS/AVMA/Retail), NTP configuration, time sync, and timezone setup" }
         @{ Title = "VM Management"; Keywords = @("checkpoint", "snapshot", "export", "import", "migration", "vhd", "iso"); Description = "VM checkpoints, export/import, migration readiness, VHD health, and ISO inventory" }
-        @{ Title = "CLI Actions"; Keywords = @("cli", "action", "headless", "automation", "fleet", "json", "audit", "scan", "score", "dashboard", "monitor", "policy", "sla", "netmap", "validate"); Description = "176 CLI actions for headless automation. Run -ListActions to see all. JSON output via -OutputFormat JSON. Key: PolicyCheck, SLAReport, NetMap, Validate, ServerScore, HealthDashboard, FleetReport." }
+        @{ Title = "CLI Actions"; Keywords = @("cli", "action", "headless", "automation", "fleet", "json", "audit", "scan", "score", "dashboard", "monitor", "policy", "sla", "netmap", "validate"); Description = "189 CLI actions for headless automation. Run -ListActions to see all. JSON output via -OutputFormat JSON. Key: ServerScore, HealthDashboard, FleetReport, CISScan, NPSSetup, AlwaysOnVPNSetup, SIEMStatus." }
         @{ Title = "SelfTest Action"; Keywords = @("selftest", "self-test", "diagnose", "diagnostic", "verify", "healthcheck", "sanity"); Description = "Internal diagnostic. -Action SelfTest checks PS version, elevation, module count, version consistency, defaults.json validity, temp path writability, FileServer reachability, and agent installer config. Exit 1 on any failure. Use -OutputFormat JSON for structured output." }
         @{ Title = "Security Audits"; Keywords = @("security", "audit", "hardening", "compliance", "tls", "smb", "kerberos", "credguard", "applocker", "bitlockeraudit", "defenderexclusionaudit", "audit-policy", "secureboot", "tpm"); Description = "Security-focused CLI audits: TLSAudit, SMBAudit, KerberosAudit, CredGuardAudit, AppLockerAudit, BitLockerAudit, DefenderExclusionAudit, AuditPolicyAudit, SecureBootAudit, TPMAudit, UserAudit, LogonAudit, InsecureServiceAudit, RegistryAudit. All support -OutputFormat JSON." }
         @{ Title = "Network Audits"; Keywords = @("netaudit", "dns", "firewall-audit", "firewalllog", "arp", "route", "tcp", "netstat", "dhcp", "netprofile", "winrm", "qos", "nicoffload"); Description = "Network audits: DNSAudit, DNSCacheAudit, FirewallAudit, FirewallRuleAudit, FirewallLogAudit, ARPTableAudit, RouteTableAudit, TcpSettingsAudit, NetStatAudit, DHCPAudit, NetworkProfileAudit, WinRMAudit, QoSPolicyAudit, NICOffloadAudit, NICErrorAudit, HostsFileAudit, VPNAudit, ProxyAudit." }

README.md

@@ -28,7 +28,7 @@
   <a href="https://www.bestpractices.dev/projects/12921"><img alt="OpenSSF Best Practices" src="https://www.bestpractices.dev/projects/12921/badge"></a>
   <a href="https://codecov.io/gh/TheAbider/RackStack"><img alt="codecov" src="https://codecov.io/gh/TheAbider/RackStack/branch/master/graph/badge.svg"></a>
   <img alt="PSScriptAnalyzer 0 errors" src="https://img.shields.io/badge/PSScriptAnalyzer-0%20errors-brightgreen">
-  <img alt="4990 tests" src="https://img.shields.io/badge/tests-4990-brightgreen">
+  <img alt="5002 structural tests" src="https://img.shields.io/badge/structural%20tests-5002-brightgreen">
   <img alt="Pester 312 tests" src="https://img.shields.io/badge/Pester-312%20tests-brightgreen">
   <img alt="SLSA Level 3" src="https://slsa.dev/images/gh-badge-level3.svg">
 </p>
@@ -37,7 +37,7 @@
 
 ---
 
-RackStack is a menu-driven PowerShell tool that automates everything between "Windows is installed" and "server is in production." Where sconfig gives you 15 options, RackStack gives you 181 CLI actions and 60+ interactive menus covering networking, Hyper-V, SAN/iSCSI, clustering, VM deployment, cloud onboarding, and batch automation, all with undo, transaction rollback, and audit logging.
+RackStack is a menu-driven PowerShell tool that automates everything between "Windows is installed" and "server is in production." Where sconfig gives you 15 options, RackStack gives you 189 CLI actions and 60+ interactive menus covering networking, Hyper-V, SAN/iSCSI, clustering, VM deployment, cloud onboarding, and batch automation, all with undo, transaction rollback, and audit logging.
 
 Built for MSPs, sysadmins, and infrastructure teams who build servers repeatedly and want it done right every time.
 
@@ -61,10 +61,12 @@ Built for MSPs, sysadmins, and infrastructure teams who build servers repeatedly
 
 **Automation** -- JSON-driven batch mode (24 idempotent steps with transaction rollback), Quick Setup Wizard, configuration export/import, HTML reports, JSON audit logging with rotation
 
-**Monitoring** -- 181 CLI actions with JSON output for fleet automation, `ServerScore` (unified 0-100 health grade), `HealthDashboard` (all-in-one monitoring endpoint), `ClusterHealthScore`, `StorageHealthScore`, System Center (SCCM/SCOM/WAC) + Azure AD/Intune integration
+**Monitoring** -- 189 CLI actions with JSON output for fleet automation, `ServerScore` (unified 0-100 health grade), `HealthDashboard` (all-in-one monitoring endpoint), `ClusterHealthScore`, `StorageHealthScore`, System Center (SCCM/SCOM/WAC) + Azure AD/Intune integration
 
 **Cloud & Security** -- Azure Arc server onboarding (install the Connected Machine Agent, connect the host to Azure's hybrid management plane via service-principal auth); Microsoft Defender for Endpoint onboarding (activate the built-in EDR sensor against your tenant, with a built-in detection test)
 
+**Security Operations** -- Network Policy Server (RADIUS) for 802.1X / VPN authentication, Always-On VPN (RRAS gateway + device/user-tunnel ProfileXML generation), CIS Windows Server L1 compliance scanning (read-only, severity-weighted score + HTML/JSON report), and SIEM log forwarding (Windows Event Forwarding plus Splunk Universal Forwarder / Elastic Winlogbeat config); plus Group Policy backup/restore/drift and Just Enough Administration (JEA) constrained endpoints
+
 **Monitoring & Diagnostics** -- Health dashboard (disk I/O latency, NIC errors, memory pressure, Hyper-V guest health, top CPU processes), performance snapshots with trend reports and "days until full" estimates, event log viewer, service manager, network diagnostics (ping, traceroute, port test, subnet sweep, DNS, ARP)
 
 **Drift Detection** -- Save configuration baselines, compare snapshots over time, track setting changes across baselines, auto-baseline after batch mode
@@ -435,7 +437,7 @@ $report.Issues
 
 **Tiers:** `Light` (minimal, safe for prod), `Standard` (recommended), `Aggressive` (maximum cleanup/debloat).
 
-### 181 CLI Actions
+### 189 CLI Actions
 
 | Category | Actions |
 |----------|---------|
@@ -480,10 +482,10 @@ RackStack/
 ├── Modules/
 │   ├── 00-Initialization.ps1   # Constants, variables, config loading
 │   ├── 01-Console.ps1          # Console window management
-│   ├── ...                     # 67 more modules
-│   └── 69-StorageMigration.ps1
+│   ├── ...                     # 74 more modules
+│   └── 76-SIEMForwarder.ps1
 ├── Tests/
-│   ├── Run-Tests.ps1           # 4,990 automated tests
+│   ├── Run-Tests.ps1           # 5,002 automated tests
 │   ├── Validate-Release.ps1    # Pre-release validation suite
 │   └── ...
 └── docs/
@@ -509,11 +511,18 @@ RackStack/
 | 67    | **Update Server** | WSUS install, post-install, configuration, and sync |
 | 68    | **PKI** | AD CS Certificate Authority bootstrap |
 | 69    | **Migration** | Storage Migration Service role setup |
+| 70    | **Dry Run** | Preview-and-commit mode for batch + CLI actions |
+| 71    | **Group Policy** | GPO backup, restore, and drift detection |
+| 72    | **JEA** | Just Enough Administration constrained endpoints |
+| 73    | **NPS** | Network Policy Server (RADIUS) for 802.1X / VPN auth |
+| 74    | **Always-On VPN** | Remote Access (RRAS) VPN gateway + ProfileXML generation |
+| 75    | **Compliance** | CIS Windows Server L1 benchmark scanner (read-only, scored) |
+| 76    | **SIEM Forwarder** | WEF / Splunk / Winlogbeat log forwarding + Sentinel readiness |
 
 ## Testing
 
 ```powershell
-# Full test suite (4,990 tests, ~4 minutes)
+# Full test suite (5,002 tests, ~4 minutes)
 powershell -ExecutionPolicy Bypass -File Tests\Run-Tests.ps1
 
 # PSScriptAnalyzer (0 errors on all 77 modules + monolithic)
@@ -533,7 +542,7 @@ Tests cover parsing, module loading, function existence (615 functions), version
 4. Test: `.\Tests\Run-Tests.ps1`
 5. Compile: `Invoke-PS2EXE -InputFile 'RackStack v{ver}.ps1' -OutputFile 'RackStack.exe'`
 
-The sync script matches `#region`/`#endregion` markers between modules and the monolithic file. All 76 region pairs are flat (non-nested). Use `-DryRun` to preview.
+The sync script matches `#region`/`#endregion` markers between modules and the monolithic file. All 77 region pairs are flat (non-nested). Use `-DryRun` to preview.
 
 > **File summary:** `RackStack.ps1` = modular loader (for dev). `RackStack v{version}.ps1` = monolithic build (for deployment). `RackStack.exe` = compiled from monolithic (for end users).
 

ROADMAP.md

@@ -9,12 +9,12 @@ time.
 The roadmap is intentionally narrow. RackStack is a single-maintainer
 project; commitments here are realistic, not aspirational.
 
-Last updated: **2026-05-28** (v1.100.0).
+Last updated: **2026-05-29** (v1.107.0).
 
 Recently shipped: the five hybrid-cloud / server-role feature modules
 (Azure Arc, Microsoft Defender for Endpoint, WSUS, AD CS, Storage
 Migration — v1.99.0) and session-wide **Interactive Dry-Run Mode**
-(v1.100.0). RackStack is now 71 modules.
+(v1.100.0). The security-operations arc followed in v1.102-v1.107: GPO Manager (71), JEA (72), NPS/RADIUS (73), Always-On VPN (74), CIS compliance scanner (75), and SIEM log forwarder (76). RackStack is now 77 modules.
 
 ---
 
@@ -48,7 +48,7 @@ Migration — v1.99.0) and session-wide **Interactive Dry-Run Mode**
 | Item | Why not |
 |---|---|
 | Cross-platform port (Linux, macOS) | RackStack's entire purpose is Windows Server configuration. Hyper-V, BitLocker, Failover Clustering, MPIO, AD DS, iSCSI initiator — none of these have a meaningful Linux/macOS equivalent in the same workflow. A port would be a different project. |
-| Switch from PowerShell to C# / Go / Rust | The existing 71 modules + 4,800+ regression tests would be lost. Rewrite cost-benefit is not justifiable. |
+| Switch from PowerShell to C# / Go / Rust | The existing 77 modules + 4,990 regression tests would be lost. Rewrite cost-benefit is not justifiable. |
 | GUI front-end | The 72-char box-drawing console UI is intentional; it works over RDP, SSH-tunneled PowerShell, and emergency console-only scenarios where a GUI cannot. |
 | Web dashboard | Out of scope. Operators integrate via the `-OutputFormat JSON` CLI surface and route into their own dashboards. |
 | External REST API | Same as above — `-OutputFormat JSON` is the integration surface. |

Tests/Run-Tests.ps1

@@ -8970,6 +8970,56 @@ catch {
     Write-TestResult "SIEM Forwarder Tests" $false $_.Exception.Message
 }
 
+# ============================================================================
+# SECTION 174: DOCUMENTATION FRESHNESS (counts must match the codebase)
+# ============================================================================
+# Pre-release guard: every user-facing CLI-action count and module count baked
+# into documentation must equal the live value computed from the source. This
+# is what kept drifting (181 vs 189 actions; 65/71 vs 77 modules) across docs,
+# the README badge, the in-tool help, and the package manifests. The harness is
+# the right enforcement point — it already knows the ground truth.
+Write-SectionHeader "SECTION 174: DOCUMENTATION FRESHNESS (counts match codebase)"
+
+try {
+    # Live ground truth.
+    $epRaw = Get-Content "$modulesPath\50-EntryPoint.ps1" -Raw
+    $epListBlock = [regex]::Match($epRaw, '\$actionList = @\([\s\S]*?\)[\s\S]{0,50}CLIOutputFormat').Value
+    $liveActionCount = @([regex]::Matches($epListBlock, "Action\s*=\s*'")).Count
+    $liveModuleCount = $expectedModuleCount   # 77 (00-76), asserted earlier
+    Write-TestResult "DocFreshness: live action count resolved ($liveActionCount)" ($liveActionCount -gt 0) "Found $liveActionCount"
+
+    # Doc files that quote a CLI-action count. (Wiki is a separate clone — not checked here.)
+    $docFiles = @('README.md', 'CONTRIBUTING.md', 'ROADMAP.md', 'Modules\34-Help.ps1',
+        'dist\chocolatey\rackstack.nuspec', 'dist\scoop\rackstack.json')
+    $wingetDir = Join-Path $script:ModuleRoot 'dist\winget'
+    if (Test-Path $wingetDir) { $docFiles += @(Get-ChildItem -Path $wingetDir -Recurse -Filter '*.yaml' -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }) }
+
+    foreach ($rel in $docFiles) {
+        $df = if ([System.IO.Path]::IsPathRooted($rel)) { $rel } else { Join-Path $script:ModuleRoot $rel }
+        $label = [System.IO.Path]::GetFileName($df)
+        if (-not (Test-Path -LiteralPath $df)) { continue }
+        $dt = Get-Content -LiteralPath $df -Raw
+        # Any "NNN [structured ]CLI action(s)" or "NNN available actions" must equal the live count.
+        $actionHits = @([regex]::Matches($dt, '(\d{2,4})\s+(?:structured\s+)?(?:CLI|available)\s+actions?'))
+        $staleAction = @($actionHits | Where-Object { [int]$_.Groups[1].Value -ne $liveActionCount })
+        Write-TestResult "DocFreshness: $label CLI-action count == $liveActionCount" ($staleAction.Count -eq 0) $(if ($staleAction.Count) { "stale: $(($staleAction | ForEach-Object { $_.Value }) -join ', ')" } else { "" })
+    }
+
+    # README module count: every ADJACENT "NNN modules" must equal the live module
+    # count. "NN more modules" (the directory-tree elision) has a word between the
+    # number and "modules", so the adjacency regex correctly skips it.
+    $readmeRaw = Get-Content (Join-Path $script:ModuleRoot 'README.md') -Raw
+    $modHits = @([regex]::Matches($readmeRaw, '(\d{2,4})\s+modules\b'))
+    $staleMod = @($modHits | Where-Object { [int]$_.Groups[1].Value -ne $liveModuleCount })
+    Write-TestResult "DocFreshness: README module count == $liveModuleCount" ($staleMod.Count -eq 0) $(if ($staleMod.Count) { "stale: $(($staleMod | ForEach-Object { $_.Value }) -join ', ')" } else { "" })
+
+    # README test badge label is the specific 'structural tests' (distinct from the Pester badge).
+    Write-TestResult "DocFreshness: README test badge uses a specific label" ($readmeRaw -match 'structural%20tests|structural tests')
+}
+catch {
+    Write-TestResult "Documentation Freshness Tests" $false $_.Exception.Message
+}
+
 # ============================================================================
 # FINAL SUMMARY
 # ============================================================================

dist/chocolatey/rackstack.nuspec

@@ -18,7 +18,7 @@
     <tags>windows-server hyper-v iscsi clustering powershell sysadmin automation msp admin-tools</tags>
     <summary>PowerShell automation toolkit for configuring Windows Server hosts</summary>
     <description>
-RackStack is a menu-driven PowerShell tool that automates everything between "Windows is installed" and "server is in production." 176 CLI actions and 60+ interactive menus covering networking, Hyper-V, SAN/iSCSI, clustering, VM deployment, and batch automation, all with undo, transaction rollback, and audit logging.
+RackStack is a menu-driven PowerShell tool that automates everything between "Windows is installed" and "server is in production." 189 CLI actions and 60+ interactive menus covering networking, Hyper-V, SAN/iSCSI, clustering, VM deployment, and batch automation, all with undo, transaction rollback, and audit logging.
 
 Built for MSPs, sysadmins, and infrastructure teams who build servers repeatedly and want it done right every time.
 

dist/scoop/rackstack.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/ScoopInstaller/Scoop/master/schema.json",
   "version": "0.0.0",
-  "description": "PowerShell automation toolkit for configuring Windows Server hosts — Hyper-V virtualization hosts, failover cluster nodes, iSCSI storage clients, Active Directory members, and standalone servers. Ships as a code-signed EXE plus a PowerShell Gallery wrapper module exposing 175+ structured CLI actions.",
+  "description": "PowerShell automation toolkit for configuring Windows Server hosts — Hyper-V virtualization hosts, failover cluster nodes, iSCSI storage clients, Active Directory members, and standalone servers. Ships as a code-signed EXE plus a PowerShell Gallery wrapper module exposing 189 structured CLI actions.",
   "homepage": "https://github.com/TheAbider/RackStack",
   "license": "MIT",
   "url": "https://github.com/TheAbider/RackStack/releases/download/v0.0.0/RackStack.exe",

dist/winget/1.99.1/TheAbider.RackStack.locale.en-US.yaml

@@ -13,7 +13,7 @@ Copyright: Copyright (c) 2026 TheAbider
 ShortDescription: PowerShell automation toolkit for configuring Windows Server hosts.
 Description: |-
   RackStack is a menu-driven PowerShell tool that automates everything between
-  "Windows is installed" and "server is in production." It provides 181 CLI
+  "Windows is installed" and "server is in production." It provides 189 CLI
   actions and 60+ interactive menus covering networking, Hyper-V, SAN/iSCSI,
   clustering, VM deployment, cloud onboarding, and batch automation, all with
   undo, transaction rollback, and audit logging. Built for MSPs, sysadmins,

docs/ASSURANCE_CASE.md

@@ -154,7 +154,7 @@ threat.
 | Action-history file moved out of `C:\Temp` to ACL-locked `%ProgramData%\<Tool>\state\` | v1.98.55 fix; see `Get-RackStackSecureStateDir` helper. |
 | Batch-undo state file ACL-verified on load | `Modules/50-EntryPoint.ps1` `Invoke-BatchMode` — `Test-RackStackStateFileAcl` refuses to deserialize if any non-admin SID has write access. |
 | File-server downloads use HTTPS only; no http:// scheme allowed | `Modules/39-FileServer.ps1` — `BaseURL` is operator-set and documented as HTTPS-only. |
-| All `Start-Process -ArgumentList` use array form when arguments could come from any input that's not maintainer-controlled | Audited across all 65 modules in round 33. |
+| All `Start-Process -ArgumentList` use array form when arguments could come from any input that's not maintainer-controlled | Audited across all 77 modules (rounds 33+ include the NPS, Always-On VPN, Compliance, and SIEM-Forwarder modules). |
 
 **Counter-argument considered.** An attacker who's already an admin
 could write to HKLM. **Response:** correct — but they already won.
@@ -240,13 +240,13 @@ following are acknowledged and tracked:
 
 ### CR-3: Pester coverage is measured on a subset of modules
 - 96.18% coverage applies to 3 modules (03-InputValidation,
-  22-Password, 02-Logging). The other 62 modules are covered by the
+  22-Password, 02-Logging). The other 74 modules are covered by the
   regex-pattern harness, which is structural rather than line-based.
 - Mitigation: expanding measured coverage is a tracked roadmap item
   (`ROADMAP.md` Next quarter).
 - Honest scope statement: a Pester-measured 96% is not the same as a
   whole-codebase 96%; readers should weight the regex harness's
-  4598-pattern coverage alongside.
+  4990-pattern coverage alongside.
 
 ### CR-4: ps2exe PE timestamp non-determinism
 - The compiled EXE has a PE COFF timestamp field that's set by ps2exe