[cvsnt] branch tag and chacl

[Wolfram Kuss]

I have to split up development of a software project into a public
part and a closed part. My idea was to use branches since this allows
easy joining of code from branch to trunk or vice versa. Access rights
are then governed by chacl. I have admin access to the server machine
the CVS NT server is running on. Version is

"Concurrent Versions System (CVSNT) 2.0.14 (client/server)".

I created the branch using 

cvs rtag -b Branch_A

Using chacl, I set rights to "none" for everyone for the branch. Lsacl
shows this worked:

default:rwc
default:n  tag:Branch_A

BTW, in one test I had also givven one person "rwc" access to Branch_A
just in case cvsnt does not like branches none is able to access ;-).
I am doing all tests with one specific file. Status says:

   Existing Tags:
      Branch_A             	(branch: 1.64.2)
      Before_Branch_A_Creation	(revision: 1.64)

But log says:

1.64.0.2 : 'Branch_A'

Is this discrepancy ok?

Anyway, the problem is, people, including me, can for example do a
diff from WinCVS of their local with the file revision 1.64.2.1.
Internally, this does a

cvs update -p -r 1.64.2.1 bdgvalues.h

So, everyone is able to see the contents of the "secret" branch.

As test, I updated with sticky into the secret branch. 
While this worked, I can not go back, it tells me

cvs server: User 'Osram' cannot access c:/cvs/bdg_common/src/H on
tag/branch Branch_A

So it seems just the wrong way round?

The only cause I can think of is that I missunderstand what the tag
Branch_A means. Maybe I have to create another tag?

Any help appreciated,
Wolfram Kuss.