[AnthonyRonning]

The Agent desktop workflow now produces unsigned Windows Dev installer previews on PRs and signed Windows Dev/Prod installers from trusted master. It reuses the existing windows-signing environment, Azure identity/account/profile, and shared Artifact Signing helpers. No Azure configuration changes are needed.

Credential-free builders compile x64 MSVC releases with a static CRT and target-specific notices, using the existing validated master dependency archives. Fresh signing workers inspect embedded PE profile/source metadata without running the application, sign the app, NSIS uninstaller and installer, then attest the final files. Separate native verifiers check exact payload/provenance and installed CLI/ACP startup, first GUI render, host shutdown, and state-preserving uninstall. Dev/Prod installation and registration identities are distinct. The installer requires Windows 10 version 1703 (build 15063) or newer for GPUI’s OS ICU dependency.

The Windows host also handles launchers whose job objects deny breakaway: it retries inside the enclosing job only for Windows error 5, retaining that job’s limits and lifetime. An early native test exercises the actual helper under a restrictive job before the full build.

Master package selection requires all six macOS/Linux/Windows Dev/Prod download verifiers. Windows upgrades use manual Actions installers. Computer-use stays in #1295; Agent update feeds, publisher, and Research packaging are unchanged.

Download the unsigned Windows Dev preview.

Validation

• Current normal commit hook passed: workflow lint, all 629 repository tests, Rust formatting, Git metadata tests, Clippy and workspace tests. A separate local full Agent just ci also passed earlier in the implementation.
• Hosted repository CI passed at a1fb120df.
• Windows desktop qualification passed at the same head: real restrictive-job regression, native metadata/LTO fixture, optimized build, static DLL closure, notices, unsigned installer packaging, installed identity/CLI, signed-out ACP, first GUI render, host stop, and state-preserving uninstall.
• Full native Agent CI passed at the same head across Windows, macOS and Linux, including workspace, provider and Linux release jobs.
• PE/package suites and real NSIS 3.12 compilation/signing-hook fixtures passed. Local flake evaluation passed with --no-build; full local flake execution failed two unchanged macOS GUI probe fixtures at their two-second startup deadlines. Hosted full flake checks passed above; those local deadlines were not changed.
• Credentialed Dev/Prod signing remains restricted to master and awaits the first post-merge run. No signing or publication was dispatched from this PR.

[github-actions]

Maple Auth development preview: https://998ed0b6.maple-auth-dev.pages.dev

Commit: a1fb120dfeb2b800f57fcfe261deebedead96229

Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal.

[github-actions]

Maple development preview: https://51ad89b7.maple-ca8.pages.dev

Commit: a1fb120dfeb2b800f57fcfe261deebedead96229

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.