[MatthewFeroz]

Problem

Windows registry value names are case-insensitive, but the Group Policy reader rejects checked values such as Clients\Desktop=1 and AllowedDrivers\Codex=1. The resulting policy prevents startup. This addresses CodeRabbit's finding.

Change

Resolve checked client names against ManagedPolicyClient.literals and provider names against the server's registered driver IDs before validation. This preserves canonical spellings such as claudeAgent. Unknown names remain unchanged so existing validation still rejects them. Extend the existing registry-reader test with mixed-case and unknown-name cases.

Scope and approval

Stacked on #29862, targeting t3/group-policy-template at 297de1fc1e. Julius asked Matt to submit the fix as a stacked PR. The diff contains only the checkbox-casing fix and its regression coverage.

Verification

The Windows 11 Enterprise VM comparison ran the original and fixed CLI bundles against the same registry contents under HKLM\SOFTWARE\Policies\T3Tools\T3Code, with Organization set and the corresponding checkbox group enabled.

Checked registry value	Original policy show	Fixed policy show
Clients\Desktop=1	Exit 1, client schema error	Exit 0, clients: ["desktop"]
AllowedDrivers\Codex=1	Exit 1, unknown provider	Exit 0, allowedDrivers: ["codex"]
AllowedDrivers\CLAUDEAGENT=1	Exit 1, unknown provider	Exit 0, allowedDrivers: ["claudeAgent"]
Clients\UnknownClient=1	Exit 1	Exit 1, still rejected
AllowedDrivers\UnknownDriver=1	Exit 1	Exit 1, still rejected

The recorded VM runs used the in-process Win32 registry reader. The source-built Windows desktop app was also exercised with this fix during the broader policy validation. Intune and domain GPO deployment were not tested.

• vp test run --project root packages/shared/src/managedPolicyFile.test.ts passed all 4 tests.
• From apps/server, vp test run src/policy/policyTemplates.test.ts src/policy/ManagedPolicy.test.ts passed all 12 tests.
• vp run check:changed passed formatting, lint, knip, GraphQL checks, and typechecking. Its combined test step failed before completing because the existing Windows @betteroffice/fonts-cjk alias resolves to a malformed path containing ../../../../../../C:/Users/Matthew%20Feroz/..., producing OS error 123. No font configuration changes are included here.

Implemented and prepared with GPT-6 Astra through the Codex harness in T3 Code.

[macroscopeapp]

Approvability

Verdict: Approved at 4fec7b1

Macroscope's review found this PR approvable — The change accepts mixed-case Windows policy checkbox names while preserving canonical identifiers and rejection of unknown names. It leaves product defaults and policy enforcement rules unchanged.

^{You can add or adjust custom eligibility rules. Learn more.}