Vouch request: chrisyifanjin

[chrisyifanjin]

What do you want to work on?

I am new to OpenShell and would like to work on a fix for #3942.

When two programs share a network rule, an update enabling allow_uninspected_credentials for only one program can also give the other program that exception.

My proposed change is in the Policy Engine here. We can add the missing flag comparison so the existing checks reject updates that don't explicitly declare all affected programs.

Why this change?

An update naming one program should not silently give another program extra permissions.

This fix makes this flag follow the same declaration checks as the other permission flags, while still allowing the exception when its scope is explicitly declared.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md