[EVMCOD]

⚠️ Stacked on #79

This PR is stacked on #79 (build/windows-package-script) and its base is that branch, not main. It runs scripts/build-windows.ps1, which only exists in #79. Merge #79 first; GitHub then retargets this PR to main (or retarget it by hand). The diff here is only the workflow, its test, the guard, a CHANGELOG line and a docs bullet. Same shape as #70 for Linux.

What

A new workflow, .github/workflows/windows-bundles.yml, with one job (windows-bundles) that builds the Windows NSIS installer (.exe) and MSI with scripts/build-windows.ps1 -Bundles nsis,msi and keeps them as artifacts.

• Runner: windows-latest (GitHub-hosted, literal label; no vars.RUNS_ON, no self-hosted). timeout-minutes: 60, permissions: contents: read.
• Trigger: workflow_dispatch only. Not on push, not on pull_request, not scheduled, so it is not a required check and never runs by itself. (GitHub only lets you dispatch a workflow that exists on the default branch: after this merges, run it with gh workflow run windows-bundles.yml --ref <branch>.)
• Steps: checkout; Python 3.14; Rust stable + rust-cache on desktop/src-tauri; the build script; sizes and sha256 into the job summary; two smoke tests (below); two upload-artifact steps.
• Smoke tests: (1) the frozen conductloop-server.exe starts and answers /api/health (blocking); (2) the NSIS installer is installed silently (/S, per user) and the installed app is started and must start its server on :7777 (continue-on-error: true, informational).
• Artifacts: conductloop-windows-nsis and conductloop-windows-msi, retention-days: 3, if-no-files-found: error.
• Nothing is published: no release, no tag, no secret, no signing, no updater.
• All actions pinned by SHA with a version comment (the ones already used in the repo plus upload-artifact v7.0.2, as in linux-bundles.yml).
• Guard (tests/test_workflows_guard.py): windows-latest was already allowed, so no pinned-image exception is needed. The "closed list" gets a new BUNDLE_WORKFLOWS set: only those workflows may upload artifacts and only with retention-days: 3; and windows-latest is checked to be the runner of this job.
• docs/PORTABILITY.md: a bullet about the CI bundle job. CHANGELOG line under Unreleased.

How it was tested

• scripts/verify.sh --offline on this branch (4d4dca8): passed (tests/test_browser_visibility_js.py, tests/test_desktop_nav_js.py excluded because they hang on the box; tests/test_license_worker.py not run).
• tests/test_windows_bundles_workflow.py (new) and the extended tests/test_workflows_guard.py.
• Run on a real windows-latest runner, from a scratch branch wip/windows-bundles-validation (the same workflow plus a push trigger; a not-yet-merged workflow cannot be dispatched, GitHub answers 404). That branch is only for validation and must never be merged. Its content equals this branch except those 4 trigger lines.
  • Run 40946201670: success, windows-latest (D:\a\conductloop, PowerShell 7, Python 3.14.9), 10 min 44 s. NSIS and MSI were built; the frozen server answered /api/health; the silently installed app (conductloop-desktop.exe, conductloop-server.exe) started its server on :7777.
  • Artifacts (downloaded and checked): conductloop-windows-nsis/ConductLoop_1.2.3_x64-setup.exe 83 457 010 bytes, sha256 2bf07bd17227ffd4fce53bf506241f3b266d3ff5cc16b8e07e02ce3b3dccdd8a; conductloop-windows-msi/ConductLoop_1.2.3_x64_en-US.msi 84 439 040 bytes, sha256 4f3d09dde533c804edc3319ec47f119216887c03b2465822107b4e612e50b733. They match the sha256 in the job summary.
  • Run 40945979171 (earlier) failed in 27 s at the build step: a bug in the script (-Bundles nsis,msi), fixed in build(desktop): Windows packaging script (NSIS and MSI, experimental, unsigned) #79. The setup steps passed, so it was not a spending-limit failure.

Untested ("sin probar")

• The installers were not run by hand on a real Windows desktop: window, tray, icon, Start menu, uninstall. The only evidence is the runner's silent install and the health check on :7777.
• SmartScreen behavior with the unsigned installer; antivirus false positives; the WebView2 download path on a machine without WebView2 (the runner has it).
• The MSI is built but never installed or run.
• The workflow_dispatch trigger itself was not exercised from the default branch (only possible after merge); the job was exercised through the scratch branch's push trigger.
• x64 only; no ARM64.

Checklist

• Verified locally with scripts/verify.sh.
• Tests added or updated.
• CHANGELOG.md entry under Unreleased.
• No personal data, no secrets.
• Docs updated.
• Workflows: GitHub-hosted label (windows-latest), action SHAs pinned with a version comment, permissions contents: read.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T20:34:36.262576Z	4d4dca8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.