Add native Windows client compilation gate

Author: moha-bekh

.github/workflows/windows-source.yml

@@ -0,0 +1,54 @@
+name: Windows client source
+
+'on':
+  push:
+    paths:
+      - 'apps/client/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - '.github/workflows/windows-source.yml'
+  pull_request:
+    paths:
+      - 'apps/client/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - '.github/workflows/windows-source.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: windows-source-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  client:
+    runs-on: windows-2025
+    timeout-minutes: 30
+    env:
+      CARGO_BUILD_JOBS: '2'
+      CARGO_PROFILE_DEV_DEBUG: '0'
+      CARGO_PROFILE_TEST_DEBUG: '0'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '26.11.1'
+          cache: npm
+          cache-dependency-path: apps/client/package-lock.json
+      - name: Record actual Windows build environment
+        run: |
+          [System.Environment]::OSVersion.VersionString
+          [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture
+          rustup show active-toolchain
+      - name: Prepare bundled frontend
+        run: |
+          npm --prefix apps/client ci
+          npm --prefix apps/client run build
+      - name: Build actual Windows client with bundled assets
+        run: cargo build --locked -p vmanyware-client --features tauri/custom-protocol

STATE.md

@@ -7116,3 +7116,19 @@ credential operations occurred. No unrelated application test suite was rerun.
 Scoped server library/test Clippy with warnings denied and cargo fmt check pass
 (`.lab/native-deps/snapshot-schema-clippy.log`); diff review passes. Next CI result
 is pending push/observation, not assumed green.
+
+
+## 2026-10-23 — Windows native compilation gate
+
+Scope/acceptance: establish actual Windows compilation evidence for the existing
+client before expanding its unsupported SSH/store boundary. Added a path-filtered
+Windows client source workflow using standard windows-2025 x64, existing pinned
+checkout/setup-node actions, read-only permissions, two Cargo jobs, debug symbols
+disabled and a 30-minute limit. It records Windows/architecture/Rust, builds locked
+frontend dependencies and the actual Tauri executable with bundled assets. No
+app launch, credential operation, custom VM, installer or parity claim. GitHub's
+official runner reference confirms windows-2025 is a standard public x64 label.
+Workflow diff reviewed; execution is pending push/observation. No local application
+suite repeated for this CI-only change. Next: observe Windows build and correct
+actual target-specific failures. Local checks 40030173686 for 1247440 is in progress;
+continue observing its handle, not restarting. Android approval is unchanged.

docs/platforms.md

@@ -61,6 +61,17 @@ observed. Runtime/OS prompts, signing identity, locked store, isolated keychain
 roundtrip and system-source SSH still need a real approved macOS target. Neither
 metadata compilation nor a native build closes these gates. See ADR 0090.
 
+## Windows compilation baseline — 2026-10-23
+
+The path-filtered `Windows client source` workflow targets the standard
+`windows-2025` x64 runner with the repository-pinned Rust/Node versions. It builds
+the actual Tauri client and bundled frontend using `tauri/custom-protocol`, without
+launching the app, installing it or accessing a credential store. Workflow
+preparation alone is not compilation evidence; the observed result is in STATE.md.
+SSH, encrypted application identities and OS-backed secret storage still report
+unsupported on Windows. A successful build does not establish those capabilities,
+GUI/runtime behavior, signed installers or release support.
+
 ## Reproduce the current development checks
 
 | Tool | Tested version/configuration |