Windows Native Helper Pipeline

Windows Native Helper Pipeline A workflow diagram generated by Archify. 01 / Azure Artifact Signing (workflow_dispatch only) 02 / GitHub Actions: windows-2025, matrix x64 + arm64 03 / Operator on a native Windows host Signing variables · 6 repo variables · Azure Artifact Signing (workflow_dispatch only) Signing variables 6 repo variables OIDC login + sign · SHA256 + RFC-3161 · Azure Artifact Signing (workflow_dispatch only) · no local .pfx OIDC login + sign SHA256 + RFC-3161 no local .pfx Authenticode check · Valid + timestamper · Azure Artifact Signing (workflow_dispatch only) Authenticode check Valid + timestamper Push or dispatch · native/windows/** · GitHub Actions: windows-2025, matrix x64 + arm64 Push or dispatch native/windows/** build.ps1 · cl.exe, PE arch check · GitHub Actions: windows-2025, matrix x64 + arm64 build.ps1 cl.exe, PE arch check Protocol probe · info + self-tests · GitHub Actions: windows-2025, matrix x64 + arm64 · x64 only Protocol probe info + self-tests x64 only Unsigned build · push / PR: no upload · GitHub Actions: windows-2025, matrix x64 + arm64 Unsigned build push / PR: no upload Upload artifact · native-helper-<arch> · GitHub Actions: windows-2025, matrix x64 + arm64 Upload artifact native-helper-<arch> Manual qualify · qualify:platform · Operator on a native Windows host · not certification Manual qualify qualify:platform not certification workflow_dispatch only push or PR path filter AIWS_WINDOWS_NATIVE_HELPER signed exe Legend User UI Agent logic Policy Tool action Cloud service External system

Two Distinct Paths

  • • Push and PR runs build and probe both architectures but never sign or upload
  • • Only workflow_dispatch with six configured variables reaches Azure Artifact Signing

What the Probe Proves

  • • self-normal-failure yields FAILED with a valid completion marker
  • • self-terminated yields UNKNOWN because a killed child can never claim completion

Manual Boundary

  • • A person downloads the signed helper and runs the platform qualification locally
  • • Every platform-matrix cell stays UNVERIFIED; a green run is not certification