epic(windows): immutable signed installer and multi-device deployment architecture

[balejosg]

Epic goal

Coordinate the fresh OpenPath-first implementation that replaces per-request personalized Windows executables with one immutable Authenticode-signed release installer plus external one/multi-device deployment bootstrap.

This issue is coordination only. Do not implement product logic directly here.

Global invariants

same OpenPath release
-> same OpenPath-Windows-Setup.exe bytes
-> same SHA-256
-> same Authenticode signature
-> no per-request PE mutation

OpenPath owns generic installer/deployment capability
ClassroomPath remains a thin wrapper

The signing path must preserve the 0 EUR recurring-cost requirement.

Active implementation tickets

• security(windows): ship one immutable Authenticode-signed installer with zero recurring signing cost #250 — immutable Authenticode-signed Windows installer + external bootstrap
• feat(enrollment): add generic multi-device deployment grants and Windows deployment bundles #248 — generic one/multi-device deployment grants, bundles and atomic redemption
• feat(release): attest the immutable signed Windows installer in the OpenPath promotion contract #251 — signed-installer promotion/provenance contract
• refactor(windows): cut over to immutable installer deployments and retire per-request EXE personalization #249 — cut over canonical OpenPath Windows flow and retire per-request EXE personalization
• refactor(windows): consume OpenPath immutable deployment bundles as a thin wrapper ClassroomPath#161 — thin-wrapper migration consuming the final OpenPath contracts

Dependency graph

#250
  |\
  | +------> #251
  |
  +--------> #248
               |
               v
             #249
               |
               v
   ClassroomPath #161

#251 may progress once #250 defines the final signed artifact contract, and must be aligned before the final #249 cutover is considered complete.

Definition of done

This epic is complete only when:

• OpenPath publishes one immutable signed Windows installer per release.
• Final installer SHA/provenance refers to post-sign bytes.
• No supported runtime path mutates PE bytes per classroom/deployment/download.
• OpenPath supports bounded deployments for 1..N devices through one generic primitive.
• Concurrent redemption cannot exceed deployment capacity.
• Retries are idempotent and abandoned reservations are recoverable.
• Every successfully enrolled endpoint receives its own durable credential/identity.
• Same bundle workflow supports normal double-click operator use and documented unattended installation.
• OpenPath standalone exposes creation/download/status/revocation UX.
• Core canary and Windows E2E validate immutable EXE + bootstrap + redemption without leaking bearer credentials.
• OpenPath promotion/provenance publishes one authoritative immutable Windows artifact identity.
• Legacy personalized-EXE runtime/storage/API assumptions are retired safely.
• ClassroomPath chore(deps-dev): update typescript-eslint requirement from ^8.20.0 to ^8.57.1 in /firefox-extension #161 consumes only public OpenPath contracts and contains no second generic implementation.
• Maintained documentation reflects the final canonical architecture.

Historical context only

Older issues such as #242, #244 and #247 may be useful during reconnaissance, but they are not implementation tickets for this epic.

Epic management rule

If implementation discovers additional independent work, create a new issue and add it to this epic. Do not repurpose an older unrelated or superseded ticket.