Windows: add fail-closed x64 shipping pipeline - #123

Closed

brxs wants to merge 21 commits into

codex/107-integrationfrom

codex/113-windows-shipping

Commits on Aug 8, 2026

Commits on Aug 9, 2026

fix: harden Windows data-root ownership
brxs
committed
ef25580
fix: clear expected unsigned verification failure
brxs
committed
f8d8d34
fix: accept empty Windows data directories safely
brxs
committed
5399abd
test: trace hosted Windows installer aborts
brxs
committed
e096068
test: disambiguate Windows marker failures
brxs
committed
9f92183
fix: validate Windows marker through held handle
brxs
committed
9f4585c
test: reject NUL-extended Windows markers
brxs
committed
aed9866
fix: surface unattended Windows downgrade refusal
brxs
committed
c19d249
fix: compare Windows downgrade versions independently
brxs
committed
0278dc3
fix: close Windows unattended install bypasses
brxs
committed
01253c1
test: harden Windows lifecycle acceptance
brxs
committed
2a268f4
test: make Windows version evidence deterministic
brxs
committed
b4c7f69
fix: use string equality for Windows version evidence
brxs
committed
2e363cb
fix: terminate unsafe Windows purge requests
brxs
committed
4c124c4
test: observe Windows uninstaller worker exits
brxs
committed
3ac14c4
test: observe NSIS worker exit codes
brxs
committed
39a480b