[shailendra-nv]

Summary

Restore Windows-equivalent executable matching for exact network binary rules and directory-verified ASCII case matching for exact and wildcard rules. A policy naming C:\WINDOWS\SYSTEM32\CURL.EXE can authorize trusted runtime c:/windows/system32/curl.exe, including HTTP request checks and credential-owner selection.

After latest changes updating the OR to retain this PR's remaining network-comparison functionality. Exact-rule separator equivalence and evidence-guarded case equivalence remain needed. Native wildcard separator matching is already covered and should be treated as existing behavior, with the new regression keeping that distinction explicit.

This PR targets NVIDIA/OpenShell:windows. Native Windows wildcard rules already accept either slash direction through the existing glob matcher. MXC filesystem normalization, socket-owner attribution, executable hashing, and policy-generation pinning already exist; this change extends network-policy comparison across the remaining gaps.

Related Issue

Closes #5013

Changes

• Normalize ordinary executable separators in YAML/protobuf policy loading and runtime comparisons. Fold ASCII case only after every parent directory of the trusted runtime executable confirms case-insensitive lookup. Preserve exact case when directories are sensitive or indeterminate, and preserve namespace-path spelling.
• Keep Win32 queries behind a safe API in openshell-binary-identity. Never open policy-authored paths or change the executable path used for hashing.
• Carry trusted path evidence from connection authorization into generation-pinned HTTP evaluation and credential-owner admission.
• Distinguish exact spelling, slash-only, case-only, and combined differences in YAML/protobuf regressions. Preserve the existing native wildcard separator behavior independently of preprocessing, and verify that credential selection uses the matching evidence without admitting denied requests.
• Retain the MXC exact-owner allow, mixed-case/slash allow, and wrong-owner deny E2E scenarios. Document the boundary between existing MXC behavior and the network comparison fix.

Testing

Candidate: 0f5896ef678fa4dd4a7a39d4835b6866cbd7daf5, including the latest windows base e451bb390a3b463724ccf5547b46b9432428690d. All results below used this source; no tracked changes were made during runtime diagnostics.

Suite	Command	Total	Passed	Skipped	Failed	Result
Native Windows ARM64 workspace	mise run --skip-tools windows:test:arm64	6,711	6,668	43	0	PASS
Hosted Windows ARM64	mise run --skip-tools windows:test:arm64	6,711	6,668	43	0	PASS
Hosted Windows x64	mise run --skip-tools windows:test:x64	6,711	6,668	43	0	PASS
Native MXC integration, real runtime	mise run --skip-tools windows:test:mxc-real:arm64	14	14	0	0	PASS
Full seven-scenario MXC E2E, fresh short C: work directory	mise run --skip-tools windows:e2e:mxc -- -DemoDir C:\work\openshell-5014-792036df466f445697c336d691bb12d6 -WxcExecPath C:\mxc\wxc-exec.exe -Port 51948	7	7	0	0	PASS

Each workspace run's 43 skips are the lane's existing ignored/runtime-gated tests; they are reported separately from the explicitly executed native MXC suite. Nextest does not execute doc tests. Unsupported Windows runtime packages retain the lane's existing exclusions. The real-MXC suite reported 14 passed, 0 ignored and no internal SKIP messages.

• mise run pre-commit: PASS, including the installed commit hook. Local Python tooling used the already installed pinned Python 3.14.5 x64 interpreter, and Biome used its pinned 2.5.4 x64 executable after the native ARM64 tooling failed. Rust compilation and tests stayed native ARM64. No dependency or lockfile changes were made for these local workarounds.
• Windows x64/ARM64 CI: PASS for both native architectures, including Clippy and full supported-workspace tests. Requested through /ok to test <candidate SHA> and /windows ci; both architecture jobs actually executed.
• Branch Checks: PASS, including Linux x64/ARM64 and macOS ARM64 Rust tests, build modes, SDK checks, lint, and compatibility checks.
• mise run --skip-tools windows:build:arm64 and windows:build:mxc-fixtures:arm64: PASS. All four production binaries and the forwarding fixture were rebuilt from the candidate; the matching Z3 DLL is staged.
• Native integration completed after both requested CI lanes passed. Its network tests exercise real HTTPS through the injected CA plus exact-owner allow, mixed-case/slash socket-owner allow, and wrong-owner deny. The network fixture uses REST enforcement, so the allowed path covers connection and HTTP admission.
• The full E2E pass covers in-policy writes, read-only/default-deny cases, network-policy admission, two exact TCP replies, two exact service HTTP replies followed by HTTP 404 after endpoint deletion, and two exact host-local HTTP replies.

Work-directory limitations observed during E2E: The initial unmodified default run under the D: checkout finished 6 passed / 1 failed / 0 skipped: the host-service batch produced no completion files or service requests. A focused run reproduced it. A subsequent full run under the user's C: profile Temp directory finished 5 passed / 2 failed / 0 skipped: host-service passed, while both forwarding fixtures created temporary readiness files and exited before publishing the renamed readiness file. The unchanged full suite then passed 7/7 in the fresh short C:\work directory shown above. These path-dependent failures remain unresolved; they are not counted as passes or claimed fixed by this PR. No host firewall/security settings or scoring assertions were changed. Diagnostic harness copies were kept outside tracked source.

Local result bundles are retained under target/windows-e2e-results/: results-e2e-20261101-183956 (initial D: failure), results-e2e-20261101-184356 (focused reproduction), results-e2e-20261101-184750 (profile Temp failures), and results-e2e-20261101-185025 (full C:\work pass).

Passing these functional cases does not verify the Windows branch's existing broad-loopback and live-revocation outer-fence stubs. The network-policy admission scenario alone is not an egress-enforcement test.

Checklist

• Follows Conventional Commits
• Updated commit is signed off (DCO)
• Relevant subsystem and published policy documentation included
• Refreshed local validation passed
• Requested Windows CI lanes passed
• Native MXC E2E passed in a fresh short C:\work directory; other-directory failures documented above

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-11-02T03:13:12.918316Z We couldn’t complete this review. Comment @codex review to try again.	0f5896e	Manual request
🔒 Security Review	⚠️ Failed 2026-11-02T03:13:12.807592Z We couldn’t complete this review. Comment @codex security review to try again.	0f5896e	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5014.docs.buildwithfern.com/openshell

[shailendra-nv]

/ok to test 0f5896e

[shailendra-nv]

/windows ci

[shailendra-nv]

Adding following functionality in this PR for NVIDIA/OpenShell:windows.

1. Native wildcard rules already handle either separator, but exact-rule separator equivalence and trusted, directory-verified ASCII case equivalence are still needed, including HTTP admission and credential-owner selection.
2. The updated tests explicitly separate the existing wildcard behavior from those gaps.

Updated and pushed signed-off commit 0f5896ef678fa4dd4a7a39d4835b6866cbd7daf5, incorporating current windows base e451bb390a3b463724ccf5547b46b9432428690d. The remote head and both completed CI runs were rechecked against this exact commit; the working tree is clean.

• Local native ARM64 workspace: 6,668 passed / 43 skipped / 0 failed.
• Hosted Windows ARM64 and x64: each 6,668 passed / 43 skipped / 0 failed, with Clippy also passing. Both requested commands were posted and both architecture jobs executed: Windows CI.
• Branch Checks, pre-commit, fresh native release builds, and fixture build: PASS.
• After CI passed, native real-MXC integration: 14 passed / 0 skipped / 0 failed, including exact-owner allow, mixed-case/slash owner allow, wrong-owner denial, and real HTTPS/HTTP enforcement.
• Full unmodified MXC E2E in a fresh short C:\work\... directory: 7 passed / 0 skipped / 0 failed. This includes filesystem cases, TCP forwarding, HTTP service forwarding/deletion, and host-local HTTP access.

[shailendra-nv]

@codex review

[shailendra-nv]

@codex security

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".