feat(windows): Windows Gap Closure (v2.0 milestone)

Squash of 212 commits on windows-squash that delivered Windows/Unix
parity for everyday CLI usage, network policy, and developer tooling.

Milestone: v2.0 Windows Gap Closure (tag `v2.0` on source branch).
Shipped 2026-04-18. See .planning/milestones/v2.0-ROADMAP.md for the
full 11-phase, 29-plan archive.

Scope:
- Phase 5: Windows detach readiness fix (WaitNamedPipeW readiness
  probe in run_detached_launch).
- Phase 6: WFP enforcement activation — SID-based kernel filtering
  promoted to primary network backend; driver gate removed; duplicate
  activation path cleaned.
- Phase 7: Quick wins — `nono wrap` (Direct strategy + Job Object +
  WFP) and `nono logs` / `nono inspect` / `nono prune` session
  commands on Windows.
- Phase 8: Interactive `nono shell` via ConPTY (CreatePseudoConsole)
  inside Job Object + WFP sandbox on Windows 10 build 17763+.
- Phase 9: Port-granular WFP policy (--allow-port with bind/connect
  independence) + proxy credential injection (--network-profile /
  --credential / --upstream-proxy).
- Phase 10: `nono learn` on Windows via ETW (ferrisetw + Win32-format
  path conversion, file + network events, admin-gated).
- Phase 11 (stretch): Runtime capability expansion over named pipe
  with constant-time token auth + interactive approval.
- Phase 12: Milestone bookkeeping cleanup.
- Phase 13: v2.0 human verification UAT — 10 items resolved to
  terminal verdicts (3 pass, 7 waived).
- Phase 14: v2.0 fix pass (detached-console-grandchild partial fix +
  help-text correction + runbook flag repair).
- Phase 15: Detached Console + ConPTY architecture investigation —
  direction-b closure of the v2.0 carry-forward (gated PTY-disable +
  null-token + AppID WFP on detached Windows path only). 5-row smoke
  gate pass; 4 Phase 13 UAT items promoted to pass.

Also includes earlier upstream sync work (WSL2 feature matrix +
security hardening, release 0.26.0-0.29.1 bookkeeping, keystore
file:// URI support, macOS proxy NO_PROXY fix, other fork
maintenance) that lived on the same branch.

Security-critical notes:
- Direction-b scoped waivers for detached Windows path: Low-IL
  isolation waived on detached path (Job Object + filesystem sandbox
  remain primary); per-session-SID WFP replaced by AppID WFP on
  detached path (still kernel-enforced; requires nono-wfp-service).
  Non-detached path keeps WRITE_RESTRICTED + session-SID + ConPTY
  unchanged.
- WRITE_RESTRICTED narrows the restricting-SID access-check gate to
  writes only so DLL loads and console init aren't blocked.
- All paths canonicalized at grant time; path-component comparison
  (not string starts_with) used throughout to prevent
  `/home-evil/...` style escapes.

191 files changed, +50,204 / -5,244.

Supersedes pre-squash branches:
- pr/windows-epic12-clean-v2 (PR nolabs-ai#555)
- pr555/windows-epic12-clean-v3 (PR nolabs-ai#583)
- win-101-windows-build-foundation (PR nolabs-ai#530)

Signed-off-by: oscarmackjr-twg <oscar.mack.jr@gmail.com>

Author: oscarmackjr-twg

.continue-here.md

@@ -0,0 +1,44 @@
+---
+phase: 04-state-integrity-deployment
+task: 0
+total_tasks: 0
+status: in_progress
+last_updated: 2026-04-05T03:53:00.494Z
+---
+
+<current_state>
+Phase 4 planning is complete. The roadmap and state have been reconciled. All research, validation strategy, and planning documents are created and verified.
+</current_state>
+
+<completed_work>
+- Context gathered and reconciled for Windows Parity milestone.
+- Phase 4 research completed (`04-RESEARCH.md`).
+- Phase 4 context and decisions locked (`04-CONTEXT.md`).
+- Phase 4 validation strategy established (`04-VALIDATION.md`).
+- Phase 4 plans 01 and 02 generated and verified (`04-01-PLAN.md`, `04-02-PLAN.md`).
+</completed_work>
+
+<remaining_work>
+- Execute Plan 04-01: Windows Filesystem Snapshot & Rollback Integration.
+- Execute Plan 04-02: MSI Signing Pipeline and WFP Cleanup.
+</remaining_work>
+
+<decisions_made>
+- **Merkle Trees for Snapshots**: Consistent with Unix, but will require mapping `fs_capabilities` to the Windows execution strategy.
+- **Soft Limits**: Log warnings for large workspaces rather than aborting.
+- **GitHub Secrets for Signing**: Simplified CI integration.
+- **Tag-Only Signing**: Quota conservation.
+- **WFP Dynamic Sessions**: OS-level automated cleanup.
+</decisions_made>
+
+<blockers>
+- None.
+</blockers>
+
+<context>
+The goal of Phase 4 is to finalize the "State Integrity & Deployment" pillar of the Windows Parity milestone. We've established the plan to bring Merkle tree-based rollbacks to Windows and automate the signed MSI distribution.
+</context>
+
+<next_action>
+Start with: `/gsd:execute-phase 4`
+</next_action>

.gitattributes

@@ -0,0 +1,18 @@
+# Default: LF for all text files
+* text=auto eol=lf
+
+# Force LF line endings for shell scripts (required for WSL2/Linux execution)
+*.sh text eol=lf
+
+# Source and doc files — LF everywhere for consistency
+*.rs text eol=lf
+*.toml text eol=lf
+*.md text eol=lf
+*.mdx text eol=lf
+*.json text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+
+# Keep Windows batch files as CRLF
+*.bat text eol=crlf
+*.cmd text eol=crlf

.github/workflows/ci.yml

@@ -124,6 +124,224 @@ jobs:
       - name: Run tests
         run: cargo test --workspace --verbose
 
+  windows-build:
+    name: Windows Build
+    needs: changes
+    if: ${{ !startsWith(github.head_ref, 'dependabot/github_actions/') && needs.changes.outputs.run_code_jobs == 'true' }}
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache cargo registry
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Run Windows build harness
+        shell: pwsh
+        run: .\scripts\windows-test-harness.ps1 -Suite build -LogDir ci-logs
+
+      - name: Upload Windows build logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: windows-build-logs
+          path: |
+            ci-logs\windows-build.log
+          if-no-files-found: warn
+
+  windows-smoke:
+    name: Windows Smoke
+    needs: changes
+    if: ${{ !startsWith(github.head_ref, 'dependabot/github_actions/') && needs.changes.outputs.run_code_jobs == 'true' }}
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache cargo registry
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Run Windows smoke harness
+        shell: pwsh
+        run: .\scripts\windows-test-harness.ps1 -Suite smoke -LogDir ci-logs
+
+      - name: Upload Windows smoke logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: windows-smoke-logs
+          path: ci-logs\windows-smoke.log
+          if-no-files-found: warn
+
+  windows-integration:
+    name: Windows Integration
+    needs: changes
+    if: ${{ !startsWith(github.head_ref, 'dependabot/github_actions/') && needs.changes.outputs.run_code_jobs == 'true' }}
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache cargo registry
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Run Windows integration harness
+        shell: pwsh
+        run: .\scripts\windows-test-harness.ps1 -Suite integration -LogDir ci-logs
+
+      - name: Upload Windows integration logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: windows-integration-logs
+          path: ci-logs\windows-integration.log
+          if-no-files-found: warn
+
+  windows-security:
+    name: Windows Security
+    needs: changes
+    if: ${{ !startsWith(github.head_ref, 'dependabot/github_actions/') && needs.changes.outputs.run_code_jobs == 'true' }}
+    runs-on: windows-latest
+    env:
+      NONO_CI_HAS_WFP: true   # windows-latest runners run as Administrator
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache cargo registry
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Run Windows security harness
+        shell: pwsh
+        run: .\scripts\windows-test-harness.ps1 -Suite security -LogDir ci-logs
+
+      - name: Upload Windows security logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: windows-security-logs
+          path: ci-logs\windows-security.log
+          if-no-files-found: warn
+
+  windows-regression:
+    name: Windows Regression
+    needs: changes
+    if: ${{ !startsWith(github.head_ref, 'dependabot/github_actions/') && needs.changes.outputs.run_code_jobs == 'true' }}
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache cargo registry
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Run Windows regression harness
+        shell: pwsh
+        run: .\scripts\windows-test-harness.ps1 -Suite regression -LogDir ci-logs
+
+      - name: Upload Windows regression logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: windows-regression-logs
+          path: ci-logs\windows-regression.log
+          if-no-files-found: warn
+
+  windows-packaging:
+    name: Windows Packaging
+    needs: changes
+    if: ${{ !startsWith(github.head_ref, 'dependabot/github_actions/') && needs.changes.outputs.run_code_jobs == 'true' }}
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache cargo registry
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Build Windows release binaries
+        shell: pwsh
+        run: cargo build --release -p nono-cli
+
+      - name: Validate Windows MSI contract
+        shell: pwsh
+        run: |
+          .\scripts\validate-windows-msi-contract.ps1 `
+            -BinaryPath .\target\release\nono.exe `
+            -ServiceBinaryPath .\target\release\nono-wfp-service.exe
+
   fmt:
     name: Rustfmt
     needs: changes