Core-side work item for the enterprise add-on's Windows packages deliverable (add-on #75, PI-4 / ADR-A009). Filed here because feature work on the core packaging pipeline lands in this repo; the add-on repo only tracks it.
Both foundations have landed: the air-gap build profile (ADR-0225: vendored omp + bundled relocatable Python + the CI air-gap smoke gate) and the managed-config update channel (add-on #74). The Linux (deb/rpm, PR #147) and macOS (pkg + cask, PR #141) enterprise targets already exist; Windows is the remaining platform. Current build.win targets are nsis + portable only: nothing SCCM or Intune can consume for managed, in-place-upgradable deployment.
Scope:
- build.win gains msi (SCCM) and appx (MSIX family, Intune LOB) targets, x64, built by the existing dist:win CI job on windows-latest.
- MSI: perMachine, pinned stable UpgradeCode (the in-place-upgrade + no-duplicate-install contract), versioned artifact name. WiX warnings not treated as errors (the bundled repo tree is large).
- AppX/MSIX: enterprise identity (identityName / publisher / publisherDisplayName / applicationId), versioned artifact name. Builds unsigned in CI; org PKI signing documented (Intune requires a device-trusted cert for LOB MSIX).
- Authenticode rides the existing WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD seam in build-desktop.yml; no new secrets, nothing in-repo.
- CI: *.msi and *.appx attached to run artifacts, tag releases, and the rolling latest release.
- A config-contract test pinning the UpgradeCode value, perMachine, the target set, and the AppX identity so silent drift (the MSI data-loss failure mode) fails CI.
- docs/WINDOWS-ENTERPRISE-DEPLOYMENT.md runbook mirroring the Linux/macOS ones: SCCM application, Intune Win32 (.intunewin wrap of the MSI), Intune MSIX LOB, in-place upgrade semantics, user-data preservation (userData lives in %APPDATA%, never under the install dir), signing.
Done when: dist:win produces LucidAgent--x64.msi and .appx alongside the NSIS/portable artifacts, the air-gap smoke still gates the build, the config test locks the upgrade contract, and the runbook covers SCCM + both Intune paths.
Producing/installing the real packages on a managed Windows fleet is runner-bound validation, same as the Linux/macOS work; the checklist lives in the runbook.
Core-side work item for the enterprise add-on's Windows packages deliverable (add-on #75, PI-4 / ADR-A009). Filed here because feature work on the core packaging pipeline lands in this repo; the add-on repo only tracks it.
Both foundations have landed: the air-gap build profile (ADR-0225: vendored omp + bundled relocatable Python + the CI air-gap smoke gate) and the managed-config update channel (add-on #74). The Linux (deb/rpm, PR #147) and macOS (pkg + cask, PR #141) enterprise targets already exist; Windows is the remaining platform. Current build.win targets are nsis + portable only: nothing SCCM or Intune can consume for managed, in-place-upgradable deployment.
Scope:
Done when: dist:win produces LucidAgent--x64.msi and .appx alongside the NSIS/portable artifacts, the air-gap smoke still gates the build, the config test locks the upgrade contract, and the runbook covers SCCM + both Intune paths.
Producing/installing the real packages on a managed Windows fleet is runner-bound validation, same as the Linux/macOS work; the checklist lives in the runbook.