daac231148
All checks were successful
Build SilverMetal Enhanced - Windows ISO / build (pull_request) Successful in 5m37s
VM e2e findings on the real-user desktop: 1. Lock/login screen + wallpaper NOT branded (OEM About WAS) — Windows resets the offline-baked personalization (PersonalizationCSP / default-user wallpaper / FVE) during OOBE, same class as the UAC reset. Fix: stage windows/branding/ into the image and re-run Apply-Branding -Mode Online from SetupComplete (post-OOBE, as SYSTEM) where it sticks. OEM About re-asserted harmlessly. 2. sm-bootstrap account still present after onboarding — TearDownAsync's in-session Remove-LocalUser no-ops (can't delete the account you're logged in as). Fix: keep the best-effort in-session attempt, but DEFER the real removal to a SYSTEM AtStartup scheduled task that runs on next boot (sm-bootstrap not logged on), removes the account + Win32_UserProfile, then deletes itself. (Network 'no adapter' in the VM was a Proxmox NIC-model regression to virtio — fixed by switching the VM to Intel e1000; not a SilverMetal change.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
windows/installer
The custom packed-ISO build pipeline. See ../iso-builder.md for the design.
| File | Role |
|---|---|
build.ps1 |
Pipeline orchestrator (7 stages). Run on Windows + Windows ADK. |
inputs.manifest.json |
Pinned inputs — base ISO SHA-256, driver-pack/Stack/tool versions. The Microsoft ISO is an input, never committed. |
autounattend/autounattend.xml |
OOBE automation — local account (no MSA), regional, BitLocker-ready disk layout, hands off to first-boot. |
oem/SetupComplete.cmd |
First-boot entry point — runs the shared ../hardening/ modules, then schedules Verify. |
Usage (M2+):
.\build.ps1 -SourceIso 'D:\Win11_IoT_Enterprise_LTSC_x64.iso'
Current status: M0 scaffold — stages 2–7 throw NotImplemented until M2/M3.