From 4af008da0f04433a43f8908273cb54b242d88a40 Mon Sep 17 00:00:00 2001
From: iamdoubz <>
Date: Tue, 14 Jul 2026 16:26:59 -0500
Subject: [PATCH] docs(deploy): enterprise deployment guide (wa-defaults.ini,
 install flags)

---
 docs/enterprise-deployment.md | 101 ++++++++++++++++++++++++++++++++++
 1 file changed, 101 insertions(+)
 create mode 100644 docs/enterprise-deployment.md

diff --git a/docs/enterprise-deployment.md b/docs/enterprise-deployment.md
new file mode 100644
index 0000000..1bfd6b6
--- /dev/null
+++ b/docs/enterprise-deployment.md
@@ -0,0 +1,101 @@
+# Enterprise deployment
+
+How to mass-deploy WhispAssist and preset its defaults with native Windows tooling (Group Policy,
+SCCM, Intune, `msiexec`, silent NSIS). No management console, no phone-home. See ADR-0012.
+
+WhispAssist ships two bundles:
+
+| Bundle | Scope | Admin? |
+|---|---|---|
+| `WhispAssist_<ver>_x64_en-US.msi` | Per-machine (all users) | Yes |
+| `WhispAssist_<ver>_x64-setup.exe` (NSIS) | Current-user **or** all-users (prompts) | Only for all-users |
+
+## Install location
+
+- **MSI:** `msiexec /i WhispAssist_<ver>_x64_en-US.msi INSTALLDIR="D:\Apps\WhispAssist" /qn`
+  (`INSTALLDIR` is Tauri's WiX install-dir property; confirm against the generated `.wxs` if a build
+  changes it.)
+- **NSIS:** `WhispAssist_<ver>_x64-setup.exe /S /D=D:\Apps\WhispAssist`
+  (`/S` = silent, `/D=` = install dir; `/D=` must be **last** and unquoted per NSIS.)
+
+## Install scope (per-user vs all-users)
+
+The NSIS `.exe` shows a "current user / all users" page. **Current user needs no admin** and installs
+under the user profile; **all users** requires elevation. Silent all-users:
+`WhispAssist_<ver>_x64-setup.exe /S`. The MSI is always per-machine (all-users) and requires admin.
+
+## Auto-start at login
+
+Off by default (NFR-RES-4). Turn it on for the user either in-app (Settings ▸ Recording ▸ *Launch
+WhispAssist at login*) or by presetting `auto_start = true` in `wa-defaults.ini` (below). It installs
+a **per-user** `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` entry — no admin, and it does
+**not** start recording on its own.
+
+## Preset default settings — `wa-defaults.ini`
+
+On a machine's **first** launch (before `settings.json` exists), WhispAssist reads an admin-supplied
+INI and seeds that user's `settings.json`. After that the user's own settings win and the file is
+ignored. First location found wins:
+
+1. `%PROGRAMDATA%\WhispAssist\wa-defaults.ini` — machine-wide. Deploy with a GPO/SCCM/Intune file copy.
+2. `<install dir>\wa-defaults.ini` — the template shipped next to the executable.
+
+The shipped template is fully commented out, so a default install behaves as if it were absent.
+Uncomment and edit the keys you want to preset.
+
+### Format
+
+Flat `key = value`, one per line. `;` and `#` comment lines and `[section]` headers are ignored.
+`true`/`false` become switches, plain numbers become numbers, everything else is text. Unknown or
+misspelled keys are ignored.
+
+> **Never put secrets in this file.** API keys, OAuth tokens and sync passwords live only in the OS
+> credential store. Any key containing `key`, `token`, `secret`, `credential` or `password` is
+> dropped on read. Presetting `llm_provider = anthropic` still requires the key to be provisioned
+> separately — the file adds no egress path.
+
+### Keys
+
+| Key | Values | Meaning |
+|---|---|---|
+| `default_record` | true/false | Record every meeting by default (consent notice still applies). |
+| `preferred_backend` | auto\|npu\|nvidia\|amd\|intel\|cpu | Transcription backend. |
+| `whisper_model` | catalog id (e.g. `base.en-q5_1`) | Default transcription model. |
+| `auto_download_model` | true/false | Fetch `whisper_model` in the background on first launch. |
+| `whisper_language` | auto\|ISO-639-1 | Default language (multilingual model only). |
+| `low_overhead` | true/false | CPU + smallest model preset. |
+| `storage_root` | path | Where meetings are stored. |
+| `retention_max_age_days` | number | Delete meetings older than N days. |
+| `retention_max_size_gb` | number | Cap total storage at N GB. |
+| `llm_provider` | ollama\|custom\|anthropic\|off | Summary provider (key provisioned separately). |
+| `llm_endpoint` | url | LLM endpoint. |
+| `llm_model` | text | LLM model name. |
+| `microphone_enabled` | true/false | Capture the user's mic into the transcript. |
+| `auto_record_calendar` | true/false | Auto-start recording on calendar events (app open only). |
+| `theme` | system\|light\|dark | UI theme. |
+| `auto_start` | true/false | Launch WhispAssist at login (per-user Run entry). |
+| `sync_enabled` | true/false | Sync master switch (targets/credentials configured in-app). |
+
+### Example
+
+```ini
+default_record       = true
+preferred_backend    = npu
+whisper_model        = small.en-q5_1
+auto_download_model  = true
+retention_max_age_days = 90
+auto_start           = true
+```
+
+## Silent end-to-end example
+
+```bat
+:: 1. Push machine-wide defaults (as SYSTEM via GPO/SCCM)
+mkdir "%ProgramData%\WhispAssist"
+copy wa-defaults.ini "%ProgramData%\WhispAssist\wa-defaults.ini"
+
+:: 2. Install per-machine, custom location, no UI
+msiexec /i WhispAssist_<ver>_x64_en-US.msi INSTALLDIR="C:\Program Files\WhispAssist" /qn
+```
+
+Each user's first launch then seeds their `settings.json` from the machine-wide file.