[shailendra-nv]

Summary

Restore Windows-equivalent executable matching for exact network binary rules and directory-verified ASCII case matching for exact and wildcard rules. A policy naming C:\WINDOWS\SYSTEM32\CURL.EXE can authorize trusted runtime c:/windows/system32/curl.exe, including HTTP request checks and credential-owner selection.

After latest changes updating the OR to retain this PR's remaining network-comparison functionality. Exact-rule separator equivalence and evidence-guarded case equivalence remain needed. Native wildcard separator matching is already covered and should be treated as existing behavior, with the new regression keeping that distinction explicit.

This PR targets NVIDIA/OpenShell:windows. Native Windows wildcard rules already accept either slash direction through the existing glob matcher. MXC filesystem normalization, socket-owner attribution, executable hashing, and policy-generation pinning already exist; this change extends network-policy comparison across the remaining gaps.

Related Issue

Closes #5013

Changes

• Normalize ordinary executable separators in YAML/protobuf policy loading and runtime comparisons. Fold ASCII case only after every parent directory of the trusted runtime executable confirms case-insensitive lookup. Preserve exact case when directories are sensitive or indeterminate, and preserve namespace-path spelling.
• Keep Win32 queries behind a safe API in openshell-binary-identity. Never open policy-authored paths or change the executable path used for hashing.
• Carry trusted path evidence from connection authorization into generation-pinned HTTP evaluation and credential-owner admission.
• Distinguish exact spelling, slash-only, case-only, and combined differences in YAML/protobuf regressions. Preserve the existing native wildcard separator behavior independently of preprocessing, and verify that credential selection uses the matching evidence without admitting denied requests.
• Retain the MXC exact-owner allow, mixed-case/slash allow, and wrong-owner deny E2E scenarios. Document the boundary between existing MXC behavior and the network comparison fix.

Testing

Candidate: 0f5896ef678fa4dd4a7a39d4835b6866cbd7daf5, including the latest windows base e451bb390a3b463724ccf5547b46b9432428690d. All results below used this source; no tracked changes were made during runtime diagnostics.

Suite	Command	Total	Passed	Skipped	Failed	Result
Native Windows ARM64 workspace	mise run --skip-tools windows:test:arm64	6,711	6,668	43	0	PASS
Hosted Windows ARM64	mise run --skip-tools windows:test:arm64	6,711	6,668	43	0	PASS
Hosted Windows x64	mise run --skip-tools windows:test:x64	6,711	6,668	43	0	PASS
GitLab native Windows ARM64 workspace	mise run --skip-tools windows:test:arm64	6,711	6,668	43	0	PASS
GitLab driver contracts / feature matrix (test executions)	mise run --skip-tools windows:test:unsupported:arm64	10	10	0	0	PASS
Native MXC integration, real runtime	mise run --skip-tools windows:test:mxc-real:arm64	14	14	0	0	PASS
Full seven-scenario MXC E2E, fresh short C: work directory	mise run --skip-tools windows:e2e:mxc -- -DemoDir C:\work\openshell-5014-792036df466f445697c336d691bb12d6 -WxcExecPath C:\mxc\wxc-exec.exe -Port 51948	7	7	0	0	PASS
Post-GitLab real-MXC E2E using verified CI packages	windows:e2e:mxc with the CI -BinaryDir: default suite plus four focused runs	11	11	0	0	PASS

Each workspace run's 43 skips are the lane's existing ignored/runtime-gated tests; they are reported separately from the explicitly executed native MXC suite. Nextest does not execute doc tests. Unsupported Windows runtime packages retain the lane's existing exclusions. The real-MXC suite reported 14 passed, 0 ignored and no internal SKIP messages.

• mise run pre-commit: PASS, including the installed commit hook. Local Python tooling used the already installed pinned Python 3.14.5 x64 interpreter, and Biome used its pinned 2.5.4 x64 executable after the native ARM64 tooling failed. Rust compilation and tests stayed native ARM64. No dependency or lockfile changes were made for these local workarounds.

• Windows x64/ARM64 CI: PASS for both native architectures, including Clippy and full supported-workspace tests. Both architecture jobs actually executed after the approved PR mirror push.

• Branch Checks: PASS, including Linux x64/ARM64 and macOS ARM64 Rust tests, build modes, SDK checks, lint, and compatibility checks.

• mise run --skip-tools windows:build:arm64 and windows:build:mxc-fixtures:arm64: PASS. All four production binaries and the forwarding fixture were rebuilt from the candidate; the matching Z3 DLL is staged.

• Native integration completed after both requested CI lanes passed. Its network tests exercise real HTTPS through the injected CA plus exact-owner allow, mixed-case/slash socket-owner allow, and wrong-owner deny. The network fixture uses REST enforcement, so the allowed path covers connection and HTTP admission.

• The full E2E pass covers in-policy writes, read-only/default-deny cases, network-policy admission, two exact TCP replies, two exact service HTTP replies followed by HTTP 404 after endpoint deletion, and two exact host-local HTTP replies.

• GitLab native Windows ARM64 CI: PASS, requested with /windows-ci, for the exact candidate commit. Check, four-binary release build, workspace tests, all six driver-contract/feature-matrix commands, artifact generation, and clean-extraction package smoke checks passed. The workspace run reported three slow tests and no retries or flaky passes. The driver-matrix row counts ten test executions across six commands. See the published CI summary.

• After GitLab completed, downloaded both job packages and verified their published SHA-256 sidecars. Ran the existing real-MXC harness against the four CI-built executables and their included Z3 4.16.0 DLL: 7/7 default scenarios, plus https-ca, socket-owner-allow, socket-owner-normalized, and socket-owner-deny, all passed with zero skips. Each invocation used a fresh short C:\work directory. The std-only forwarding fixture was built locally from the same candidate commit. All five production executable/DLL hashes were unchanged after E2E.

• GitLab reporting published the sanitized full log and PR summary successfully. Its attempt to set the GitHub commit status returned HTTP 404; both GitLab jobs' successful results were verified directly.

Work-directory limitations observed during E2E: The initial unmodified default run under the D: checkout finished 6 passed / 1 failed / 0 skipped: the host-service batch produced no completion files or service requests. A focused run reproduced it. A subsequent full run under the user's C: profile Temp directory finished 5 passed / 2 failed / 0 skipped: host-service passed, while both forwarding fixtures created temporary readiness files and exited before publishing the renamed readiness file. The unchanged full suite then passed 7/7 in the fresh short C:\work directory shown above. These path-dependent failures remain unresolved; they are not counted as passes or claimed fixed by this PR. No host firewall/security settings or scoring assertions were changed. Diagnostic harness copies were kept outside tracked source.

Local result bundles are retained under target/windows-e2e-results/: results-e2e-20261101-183956 (initial D: failure), results-e2e-20261101-184356 (focused reproduction), results-e2e-20261101-184750 (profile Temp failures), and results-e2e-20261101-185025 (full C:\work pass). Post-GitLab package runs are retained as results-e2e-20261102-220921 (default seven), results-e2e-20261102-220953 (HTTPS/CA), results-e2e-20261102-221004 (exact owner), results-e2e-20261102-221015 (normalized owner), and results-e2e-20261102-221026 (wrong owner denied).

Passing these functional cases does not verify the Windows branch's existing broad-loopback and live-revocation outer-fence stubs. The network-policy admission scenario alone is not an egress-enforcement test.

Checklist

• Follows Conventional Commits
• Updated commit is signed off (DCO)
• Relevant subsystem and published policy documentation included
• Refreshed local validation passed
• Requested Windows CI lanes passed
• Native MXC E2E passed in a fresh short C:\work directory; other-directory failures documented above

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-11-02T03:13:12.918316Z We couldn’t complete this review. Comment @codex review to try again.	0f5896e	Manual request
🔒 Security Review	⚠️ Failed 2026-11-02T03:13:12.807592Z We couldn’t complete this review. Comment @codex security review to try again.	0f5896e	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5014.docs.buildwithfern.com/openshell

[shailendra-nv]

/ok to test 0f5896e

[shailendra-nv]

/windows-ci

[shailendra-nv]

Adding following functionality in this PR for NVIDIA/OpenShell:windows.

1. Native wildcard rules already handle either separator, but exact-rule separator equivalence and trusted, directory-verified ASCII case equivalence are still needed, including HTTP admission and credential-owner selection.
2. The updated tests explicitly separate the existing wildcard behavior from those gaps.

Updated and pushed signed-off commit 0f5896ef678fa4dd4a7a39d4835b6866cbd7daf5, incorporating current windows base e451bb390a3b463724ccf5547b46b9432428690d. The remote head and both completed CI runs were rechecked against this exact commit; the working tree is clean.

• Local native ARM64 workspace: 6,668 passed / 43 skipped / 0 failed.
• Hosted Windows ARM64 and x64: each 6,668 passed / 43 skipped / 0 failed, with Clippy also passing. Both requested commands were posted and both architecture jobs executed: Windows CI.
• Branch Checks, pre-commit, fresh native release builds, and fixture build: PASS.
• After CI passed, native real-MXC integration: 14 passed / 0 skipped / 0 failed, including exact-owner allow, mixed-case/slash owner allow, wrong-owner denial, and real HTTPS/HTTP enforcement.
• Full unmodified MXC E2E in a fresh short C:\work\... directory: 7 passed / 0 skipped / 0 failed. This includes filesystem cases, TCP forwarding, HTTP service forwarding/deletion, and host-local HTTP access.

[shailendra-nv]

@codex review

[shailendra-nv]

@codex security

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[shailendra-nv]

/windows-ci

[sam-india-007]

Windows ARM64 CI: ✅ passed

Commit 0f5896e, requested by @shailendra-nv, 1h 15m, full log

Step	Result	Duration
if ($env:PR_NUMBER) { Import-Module .\scripts\pr-ci\OpenShellPrCi.psm1; Assert-PrCiVariables -PrN...	✅ passed	0s
& .\scripts\setup-windows-arm64-runner.ps1 -VerifyOnly	✅ passed	2s
$env:PATH = "$(Split-Path -Parent $env:RUSTC_WRAPPER);$env:PATH"; $found = (Get-Command sccache -...	✅ passed	0s
New-Item -ItemType Directory -Force (Split-Path -Parent $env:SCCACHE_ERROR_LOG) | Out-Null; & $en...	✅ passed	2s
& $env:RUSTC_WRAPPER --zero-stats	✅ passed	0s
& .\scripts\checkout-openshell.ps1 -Ref $env:OPENSHELL_REF	✅ passed	4s
& .\scripts\set-openshell-version.ps1 -Version $env:OPENSHELL_VERSION	✅ passed	0s
Set-Location $env:OPENSHELL_CHECKOUT_DIR	✅ passed	0s
mise run --skip-tools windows:check:arm64	✅ passed	4m 54s
mise run --skip-tools windows:build:arm64	✅ passed	22m 52s
mise run --skip-tools windows:test:arm64	✅ passed	23m 17s
mise run --skip-tools windows:test:unsupported:arm64	✅ passed	23m 08s
mise run --skip-tools windows:artifacts	✅ passed	2s
& "$env:CI_PROJECT_DIR\scripts\package-windows-release.ps1"	✅ passed	46s

[shailendra-nv]

Validation completed for 0f5896ef678fa4dd4a7a39d4835b6866cbd7daf5 using the requested native Windows ARM64 GitLab CI. Sanitized full CI log; CI summary.

• Workspace: 6,668 passed / 43 skipped / 0 failed, no retries or flaky passes.
• Driver contracts and feature matrix: 10 passed test executions across six commands. Check, all four release binaries, packaging, and clean-extraction smoke checks also passed.
• After CI completed, downloaded both packages and verified their SHA-256 files. The four CI-built executables plus their Z3 DLL passed 11/11 real-MXC E2E scenarios, with zero skips or failures: all seven default scenarios, HTTPS/CA, exact socket-owner allow, mixed-case/slash socket-owner allow, and wrong-owner deny.

These post-CI runs used fresh short C:\work directories and the unchanged harness. The original D: and profile Temp work-directory failures remain documented in the PR; this does not claim they are fixed. All production executable/DLL hashes were unchanged after E2E, and test processes and disposable signing-key directories were cleaned up.

The PR description now includes these results. GitLab's reporting job succeeded and published its summary/log; setting the GitHub commit status returned HTTP 404. No additional PR source changes were needed, so the validated head remains 0f5896ef.