build(desktop): deliver signed Windows preview packages #2108

Goal

Deliver a signed normal-product Windows installer and qualify the integrated existing-connection and personal local-setup workflows on standard-user Windows 11 x64.

Parent: #2099. Windows baseline/reference: #1654. First-wave delivery: #2099. Work item: F1-06.

PR breakdown

• PR 06-C — Installed local bootstrap and Task Scheduler qualification. Integrate the shared Installer/Ops resources into the signed Windows distribution and verify clean-machine provisioning, managed Python/pythonw availability, per-user background registration, repair, and removal policy through actual Windows 11 behavior. Keep shared bootstrap/Ops logic in feat(installer): bootstrap a managed local PowerContext runtime #2115/feat(ops): expose structured personal Server lifecycle operations #2116; this PR owns Windows integration and platform fixes.

• PR 06-A — Product build and Windows signing. Reuse existing NSIS packaging and add the normal product-build/signing path. Coordinate artifact naming, versioning, signing inputs, and checksums with the shared release pipeline; keep ci-fixtures out of distributable product builds.

• PR 06-B — Installed Windows qualification. Complete the reproducible installation/upgrade/uninstallation harness and evidence, with necessary platform fixes. Exercise WebView2 bootstrap, credentials, local diagnostics, and the integrated shared feature set on the declared target.

Dependencies and coordination

• feat(installer): bootstrap a managed local PowerContext runtime #2115 supplies bootstrap/runtime management, feat(ops): expose structured personal Server lifecycle operations #2116 supplies structured operations and native OS contracts, and feat(desktop): guide local Server setup and lifecycle management #2117 supplies setup/management UI. build(desktop): publish Desktop and local runtime installation artifacts #2112 produces pinned runtime/helper resources and the release manifest. Agree on stable paths, signing/trust, and resource interfaces early; final PR 06-C qualification consumes their integrated outcomes.

• Continue feat(desktop): deliver a connect-only preview for existing Servers #1654 and reuse existing NSIS/Windows CI acceptance. Coordinate signing/version/artifact interfaces with build(desktop): publish Desktop and local runtime installation artifacts #2112; packaging infrastructure can proceed before final page styling.

• Use matching normal-product qualification from feat(desktop): integrate Server discovery and operation compatibility #2101, including applicable feat(desktop): add macOS native preview support #2056 work.

• Final package acceptance consumes feat(desktop): establish the shared application layout and navigation #2102, feat(desktop): complete the connection-to-Scope journey #2103, feat(desktop): complete Memory save, search, and exact-read journeys #2104, feat(desktop): visualize health and processing observations #2105, feat(desktop): visualize current-Scope inventory and usage #2106, and feat(desktop): summarize session requests and copy safe diagnostics #2107. Feature owners fix shared behavior; this issue verifies the packaged result.

Acceptance criteria

• Clean network-connected standard-user Windows 11 x64 requires no preinstalled Python, uv, Git, or compiler. The supported managed runtime includes the executable layout required by the existing Windows service adapter, including pythonw.exe; it survives Desktop upgrades/removal according to the declared ownership policy.

• Exercise real Task Scheduler registration, configured login behavior, reboot/login/reconnect, explicit stop/start/restart, and GUI exit. No hidden interactive Python/credential prompt may hang the noninteractive setup flow; report permission/setup failures with a recoverable state.

• Verify download/integrity failure, interrupted provisioning, repeated setup, occupied port/foreign install, damaged runtime, inspect/repair/remove, and preserved config/data. Removing Desktop, removing background service/runtime, and deleting user data are explicit separate decisions.

• The first local save/search/exact-read/copy and observation flow works without model configuration or manual tokens/Scope IDs. Qualify runtime/helper inputs and their signatures/digests together with the exact installer.

• A named owner configures the required signing identity/environment; the normal product installer is signed and verifiable. Fixture-qualified CI installers remain clearly separate and ineligible for publication.

• Test clean standard-user Windows 11 x64 with WebView2 absent/present, bootstrap failure/recovery, and non-ASCII installation paths. Hosted windows-2025 CI is reported separately from Windows 11 evidence.

• The UI launches without local Python or a running Server; connecting an independently prepared qualified Server enables the complete core and observation workflows.

• Exercise Credential Manager across application restarts, explicit session-only behavior, constrained diagnostics, clipboard paste-back, real IME, keyboard/focus, screen reader, high contrast, and scaling.

• Upgrade/removal behavior for profiles and credentials is explicit and verified. Exiting/uninstalling Desktop preserves the independent Server and its data.

• Record Desktop/Server versions, Windows/WebView versions, source commit, package digest, steps, results, and acceptance owner. Validate the exact final signed artifact intended for publication.

• Publish outputs through build(desktop): publish Desktop and local runtime installation artifacts #2112's shared release path rather than a separate Windows-only release convention.

Delivery priority

Windows 11 x64 and macOS Apple Silicon/Intel are required for #2099. Linux #2110 and #2111 are optional, owner-driven work under #1428; missing Linux implementation, packaging, or qualification does not block this issue's first-wave acceptance or the Windows/macOS release. Any advertised Linux support requires its own actual qualification.

Non-goals

No duplicate shared Installer/Ops implementation, Agent setup, automatic updates, Windows ARM support, or claims that an unsigned CI artifact is a qualified public release. Shared local-Server functionality is owned by #2115/#2116/#2117 and must be qualified here.

References and delivery rules

• Product scope and PR breakdown; static UI prototype. The prototype uses sample data, not production state logic.
• RFC docs(rfc): propose Tauri desktop control center #1455 and the Desktop delivery plan.
• Keep focused PRs independently reviewable and intermediate merges usable. An internal adapter may land before its page; do not expose incomplete features as operational. Close this issue only after its complete outcome is verified.
• Preserve the reviewed native transport, credential, public API, and context boundaries. Record actual backend/platform execution separately from mocks and CI-only fixtures.