ASNT-107: Microsoft Store: build and submit a Microsoft-signed MSIX #137

Overview

Ship qrate through the Microsoft Store as a second channel beside GitHub releases. GitHub stays the primary channel and does not change.

The motivation is signing. Windows builds are unsigned today and the release notes tell people to click More info → Run anyway. Microsoft re-signs MSIX packages submitted to the Store after certification, so a Store build is signed and SmartScreen-free at zero cost. Developer registration is free for individuals (since September 2025) and for companies (since May 2026).

The Store's EXE/MSI app type would have been far cheaper — it runs your own installer from a versioned URL and permits in-app updates — but Microsoft does not re-sign EXE/MSI submissions, and those require a certificate chaining to a Microsoft Trusted Root CA. That is unobtainable here, so MSIX is the only free route.

Prerequisite (human, cannot be automated)

Reserve the app name in Partner Center and record Identity/Name, Identity/Publisher and PublisherDisplayName. Package identity cannot be changed after the first submission. These belong in repo variables, not literals.

A privacy policy URL is also mandatory at submission. qrate reaches OpenRouter, Cohere, Google Sheets and the plugin catalog, so this is a real checklist item — host it on qrate-site.

Scope

• An .msix artifact built alongside the existing portable zip, NSIS installer and MSI.
• qrate-install.json with kind: "windows-store" inside the package.
• Automated Store submission on stable tags only.
• Documentation for the relocated log path.

Out of scope

• Signing the package. Submitting unsigned is correct; self-signing causes publisher-mismatch validation failures.
• Any change to the GitHub release channel.
• AppExecutionAlias for the qrate CLI — follow-up once feat: add qrate CLI for external agent workflows #122 lands.

Task details

1. MSIX packaging: an AppxManifest.xml template fed from repo variables, makeappx over the existing staging directory, and the Store install marker.
2. Keep uap10:TrustLevel="mediumIL" with the runFullTrust capability. Under appContainer, PDFium's dlopen, ffmpeg's subprocess and agent-runtime's PTY all break.
3. Release workflow: build the package on every v* tag; submit only for stable tags, since certification takes days and pre-releases stay GitHub-only.
4. Submission automation via the Store submission API for MSIX apps. Needs an Entra app registration; tenant ID, client ID and key go in the existing release-signing environment.
5. Docs: MSIX virtualizes %LOCALAPPDATA%, so a Store install's log moves to %LOCALAPPDATA%\Packages\<PackageFamilyName>\LocalState. Every place naming the log path needs the Store case, including Help ▸ Copy Debug Info guidance.

Definition of done

• A v* tag produces an .msix beside the existing Windows artifacts.
• The package installs locally, launches, renders PDFs and video, and starts an agent session.
• A Store-acquired install reports updates as Store-managed (depends on ASNT-106: Microsoft Store: defer updates on Store installs #136).
• A stable tag opens a Store submission without manual steps.

Estimate

3 phases.

Type

Feature

Blocked by #136.

Notion: https://app.notion.com/p/Microsoft-Store-build-and-submit-a-Microsoft-signed-MSIX-3e121d32b13b8135863dec465e5d4adc