v1.2.2 — English-language enforcement (OS + AD prerequisites) (#23)

[VAsHachiRoku]

Linked issue

Closes #23

What this PR does

Adds English-language enforcement so the Tier Model fails fast — before any deployment or audit change — when the environment is not English (en-US). This is the documentation + guard-rail direction agreed on issue #23 (the alternative, full language-independent SID resolution in PR #18, is intentionally not taken here).

Two unconditional checks are added to Test-TierModelPrerequisites and are inherited by both Deploy-TierModel.ps1 and Audit-TierModel.ps1:

1. Host operating system — reads the local machine's static InstallLanguage LCID (HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language) and requires an English variant (primary language 0x09, e.g. en-US/en-GB). Runs after the elevation check and before the Pester/module checks, and returns immediately on a non-English host so the operator is never asked to install modules on an unsupported OS.
2. Active Directory — resolves three well-known groups by SID (Domain Admins <DomainSID>-512, Server Operators S-1-5-32-549, Account Operators S-1-5-32-548) and requires each directory Name to be its English value. Child-domain safe (no Enterprise/Schema Admins); names are read from AD (never client-side SID translation, which the local OS would localize into a false pass). Fails closed even if one well-known group cannot be resolved mid-check.

Also included: new docs/language-support.md (English-only rationale, the 18 fully-localized Windows Server languages that are detected/stopped, and a future community-localization roadmap), prerequisite notes across README + deployment guides + FAQ, CHANGELOG entry, and the v1.2.2 version bump.

Security / tiering impact

• Touches prerequisites — adds two new fail-fast validations. It tightens (never relaxes) validation: a non-English environment is now stopped up front instead of proceeding to partial/failed deployments where localized well-known-group names don't resolve.
• No changes to OUs, ACLs/delegations, GPOs, tier boundaries, or the security topology. No new public parameters or alternate topologies are introduced.
• English (en-US) deployments and audits are behaviorally unchanged (verified on a live English DC — see testing).

Testing

• Automated: .\tests\Invoke-AllTests.ps1 — 1,435 / 1,435 passing, overall docs-scope coverage 88.72% (module scope ~91%, all above the 80% CI gate). New prerequisite code is fully covered (10 new unit tests).
• Lint: PSScriptAnalyzer (CI ruleset) — 0 issues on the module.
• Live English lab (Windows Server 2025, en-US): -FullDeployment with -IncludeMsa -IncludeGmsa -IncludeDmsa -IncludeWinLaps → Applied 705, Errors 0; full audit (all features) → 100% compliant, 0 drift, 0 errors. Both logged "Prerequisites validation passed" (the new checks are transparent to a genuine English environment).
• Live German lab: the host-OS check correctly fails fast with the friendly non-English message before any change.

Checklist

• This change was discussed and agreed in the linked issue before I wrote code
• The PR addresses one concern (English-language enforcement + its release)
• I did not add new public parameters, alternate topologies, or relax prerequisite / validation logic unless it was the agreed subject of the issue
• Tests added or updated; .\tests\Invoke-AllTests.ps1 passes and coverage stays ≥ 80%
• No unrelated reformatting or whitespace churn
• Documentation updated for any changed behavior

[Copilot]

Pull request overview

This PR adds fail-fast “English-only” enforcement to TierModel prerequisite validation so deployments/audits stop before making changes when the execution host OS or the Active Directory environment is not English, and updates docs/versioning accordingly.

Changes:

• Add host OS install-language (LCID) gate and AD well-known group-name gate to Test-TierModelPrerequisites.
• Add/adjust Pester unit + integration tests to cover the new language gates.
• Update documentation, changelog, and module version to v1.2.2, including a new Language Support page.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/Unit.Prerequisites.Tests.ps1	Adds unit coverage for host-OS + AD language gates (positive/negative/guarded cases).
tests/Unit.ModuleManifest.Tests.ps1	Updates manifest version assertion to 1.2.2.
tests/Integration.WinLapsDeployment.Tests.ps1	Mocks host OS install language to allow integration flow past new gate.
README.md	Adds Language Support link + updates version/test/coverage numbers and prereq note.
modules/TierModel/TierModel.psd1	Bumps module version to 1.2.2 and updates ReleaseNotes.
modules/TierModel/public/Test-TierModelPrerequisites.ps1	Implements host OS + AD English enforcement logic.
mkdocs.yml	Adds Language Support page to site navigation.
docs/test-coverage.md	Updates latest measurement summary and per-file coverage numbers for v1.2.2.
docs/quick-deployment-guide.md	Adds English-only prerequisite notes and references Language Support.
docs/language-support.md	New doc explaining English-only policy, enforcement design, and language matrix/roadmap.
docs/index.md	Adds Language Support under reference section.
docs/faq.md	Adds FAQ entry describing supported language behavior and links to Language Support.
docs/detailed-deployment-guide.md	Adds English-only environment note at top of guide.
CHANGELOG.md	Adds v1.2.2 release entry documenting new gates and doc updates.

Suppressed comments (1)

modules/TierModel/public/Test-TierModelPrerequisites.ps1:465

• The AD language failure message says “English (en-US) Active Directory only”, but the check is really about English well-known group names (not a specific locale). Also, with the current logic a failure may be due to an unresolvable canary SID (unverifiable) rather than a localized name; the wording can be adjusted to cover both cases cleanly.

                        $null = $result.Errors.Add("Non-English Active Directory detected. The Tier Model supports English (en-US) Active Directory only.")
                        $null = $result.Remediation.Add("Run Deploy and Audit against an English (en-US) Active Directory. See Language Support: https://microsoft.github.io/ActiveDirectoryTierModel/language-support/")

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (3)

modules/TierModel/public/Test-TierModelPrerequisites.ps1:451

• The AD language gate currently continues when a canary group lookup throws, which can allow a false pass when one or more of the three well-known groups cannot be resolved (contradicts the documented/PR-described “fail closed even if one group can’t be resolved”). Instead, record the failure as a mismatch so the check fails closed and preserves diagnostics.

                        catch {
                            # A single well-known group could not be resolved; skip it so a
                            # transient failure cannot mask a confirmed mismatch on another.
                            continue
                        }

modules/TierModel/public/Test-TierModelPrerequisites.ps1:157

• The host-OS language check allows any English primary language (0x09, e.g. en-US/en-GB), but the emitted error/remediation text says “en-US only”. This is misleading for operators on other English variants and contradicts the code comment right above.

                $null = $result.Errors.Add("Non-English host operating system detected. The Tier Model supports English (en-US) Windows only.")
                $null = $result.Remediation.Add("Run Deploy and Audit from an English (en-US) Windows host. See Language Support: https://microsoft.github.io/ActiveDirectoryTierModel/language-support/")

docs/language-support.md:3

• This page states “English (en-US) only”, but the implemented host OS gate accepts other English install-language variants (primary language 0x09), and the unit tests explicitly validate en-GB (0809) as a pass. The doc should reflect the actual rule (English primary language), or the code should be tightened to en-US only.

> **Status: English (`en-US`) only.** At this time the Active Directory Tier Model