introduce new Office XML config files

.github/workflows/release-checks.yml

@@ -7,6 +7,7 @@ on:
   push:
     branches:
       - main
+      - latest
     tags:
       - "v*.*.*"
   workflow_dispatch:

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # Contributing
 
-This repository distributes public, non-sensitive device and automation configuration files. It is not an application repository and should stay small, predictable, and easy for consumers to pin by release tag.
+This repository distributes public, non-sensitive device and automation configuration files. It is not an application repository and should stay small, predictable, and easy for consumers to use through immutable release tags or the mutable `latest` channel.
 
 ## Change Process
 
@@ -12,6 +12,7 @@ Before opening a pull request:
 - Place config files under `configs/<area>/<name>`.
 - Update `manifest.json` for every added, changed, or removed config file.
 - Use release-tag raw URLs in the manifest, never floating `main` URLs.
+- Treat `latest` as a release channel that is moved only after a reviewed and tagged release.
 - Update each manifest checksum with the SHA-256 of the referenced file.
 - Keep documentation focused on consumption, ownership, and release behavior.
 
@@ -30,11 +31,23 @@ Every published config file must have one manifest entry with:
 Example URL pattern:
 
 ```text
-https://raw.githubusercontent.com/netrics/mwp-config/<tag>/configs/<area>/<name>
+https://raw.githubusercontent.com/netrics/mwp-configs/<tag>/configs/<area>/<name>
 ```
 
+## Latest Channel
+
+The `latest` branch mirrors the current released commit. It is useful for tools that need Docker-style "current release" behavior, such as direct Office XML downloads.
+
+Latest URL pattern:
+
+```text
+https://raw.githubusercontent.com/netrics/mwp-configs/latest/configs/<area>/<name>
+```
+
+Do not open pull requests directly against `latest`. Change files on `main`, tag the release, then move `latest` to the same commit.
+
 ## Review Expectations
 
-Reviewers should verify that config content is public-safe, the manifest matches the file tree, checksums are correct, and consumers can keep using existing tag-pinned URLs.
+Reviewers should verify that config content is public-safe, the manifest matches the file tree, checksums are correct, and consumers can keep using existing tag-pinned URLs. For changes that affect mutable consumers, reviewers should also confirm that the `latest` channel can safely advance to the release commit.
 
 Do not add source-code application folders, build systems, deployment scaffolding, or generated artifacts unless they are required for this repository's config distribution contract.

PULL_REQUEST_TEMPLATE.md

@@ -9,11 +9,12 @@ Describe the config or repository change and the intended release tag.
 - [ ] `manifest.json` has been updated for every added, changed, or removed config file.
 - [ ] Manifest `sha256` values match the referenced files.
 - [ ] Manifest `rawUrl` values are pinned to the intended release tag, not `main`.
+- [ ] Any `latest` channel impact is intentional and described below.
 - [ ] `release-checks` passes.
 
 ## Consumer Impact
 
-Describe whether existing tag-pinned consumers are unaffected, or whether this prepares a new release for updated consumers.
+Describe whether existing tag-pinned consumers are unaffected, and whether the mutable `latest` channel should advance to this release.
 
 ## Validation
 

README.md

@@ -6,27 +6,33 @@ This repository is intentionally quiet. It is not an application repository, doe
 
 ## Consumption
 
-Consumers should pin every request to an immutable release tag.
+Consumers should prefer immutable release tags. The repository also publishes a mutable `latest` channel for tooling that needs Docker-style "current release" behavior.
 
-Manifest URL:
+Pinned manifest URL:
 
 ```text
-https://raw.githubusercontent.com/netrics/mwp-config/v1.0.0/manifest.json
+https://raw.githubusercontent.com/netrics/mwp-configs/v1.0.0/manifest.json
 ```
 
-Config URL pattern:
+Pinned config URL pattern:
 
 ```text
-https://raw.githubusercontent.com/netrics/mwp-config/<tag>/configs/<area>/<name>
+https://raw.githubusercontent.com/netrics/mwp-configs/<tag>/configs/<area>/<name>
 ```
 
 Example:
 
 ```text
-https://raw.githubusercontent.com/netrics/mwp-config/v1.0.0/configs/<area>/<name>
+https://raw.githubusercontent.com/netrics/mwp-configs/v1.0.0/configs/<area>/<name>
 ```
 
-Do not consume floating `main` URLs. Tags such as `v1.0.0` and `v1.1.0` are the compatibility boundary for devices and automation.
+Mutable `latest` channel URL pattern:
+
+```text
+https://raw.githubusercontent.com/netrics/mwp-configs/latest/configs/<area>/<name>
+```
+
+Do not consume floating `main` URLs. Tags such as `v1.0.0` and `v1.1.0` are the compatibility boundary for deterministic consumers. The `latest` branch is mutable and is advanced only after a reviewed and tagged release.
 
 ## Manifest
 
@@ -39,11 +45,13 @@ The root `manifest.json` is machine-readable and contains:
 
 Each config entry contains `path`, `area`, `name`, `sha256`, and a tag-pinned `rawUrl`.
 
+The `latest` branch carries the same manifest as the current release. Consumers can fetch `latest/manifest.json` to discover the current release version, then use the manifest's tag-pinned `rawUrl` values when they need checksum-stable downloads.
+
 The initial `v1.0.0` release is scaffold-only and intentionally has no real config entries.
 
 ## Ownership
 
-Netrics owns the repository and release process. Changes land through pull requests to `main`, then releases are created by tagging `main`.
+Netrics owns the repository and release process. Changes land through pull requests to `main`, releases are created by tagging `main`, and the `latest` branch is moved to the released commit.
 
 GitHub Issues, Wiki, Projects, and Discussions should remain disabled. Use the owning team's internal channels for change requests and operational support.
 

configs/officeXml/M365-Add-Project.xml

@@ -0,0 +1,12 @@
+<Configuration ID="M365-Add-Project">
+  <Logging Level="Standard" Path="C:\Windows\Logs\Software\OfficeLogs" />
+  <Add Channel="MonthlyEnterprise" AllowCdnFallback="TRUE" Version="MatchInstalled">
+    <Product ID="ProjectProRetail">
+      <Language ID="MatchInstalled" TargetProduct="O365ProPlusRetail" />
+    </Product>
+  </Add>
+  <Updates Enabled="TRUE" Branch="MonthlyEnterprise" />
+  <Display Level="None" AcceptEULA="TRUE" />
+  <Property Name="AUTOACTIVATE" Value="1" />
+  <Updates Enabled="TRUE" />
+</Configuration>

configs/officeXml/M365-Add-Visio.xml

@@ -0,0 +1,12 @@
+<Configuration ID="M365-Add-Visio">
+  <Logging Level="Standard" Path="C:\Windows\Logs\Software\OfficeLogs" />
+  <Add Channel="MonthlyEnterprise" AllowCdnFallback="TRUE" Version="MatchInstalled">
+    <Product ID="VisioProRetail">
+      <Language ID="MatchInstalled" TargetProduct="O365ProPlusRetail" />
+    </Product>
+  </Add>
+  <Updates Enabled="TRUE" Branch="MonthlyEnterprise" />
+  <Display Level="None" AcceptEULA="TRUE" />
+  <Property Name="AUTOACTIVATE" Value="1" />
+  <Updates Enabled="TRUE" />
+</Configuration>

configs/officeXml/M365-Base-CH-MUI-MatchOS.xml

@@ -0,0 +1,25 @@
+<Configuration ID="M365-Base-CH-MUI-MatchOS">
+  <Add OfficeClientEdition="64"
+       Channel="MonthlyEnterprise"
+       AllowCdnFallback="TRUE"
+       MigrateArch="TRUE">
+    <Product ID="O365ProPlusRetail">
+      <Language ID="MatchOS" Fallback="en-us" />
+      <Language ID="de-de" />
+      <Language ID="fr-fr" />
+      <Language ID="it-it" />
+      <Language ID="en-us" />
+      <ExcludeApp ID="OneDrive" />
+      <ExcludeApp ID="Teams" />
+      <ExcludeApp ID="Groove" />
+      <ExcludeApp ID="Lync" />
+      <ExcludeApp ID="Bing" />
+    </Product>
+  </Add>
+
+  <Display Level="None" AcceptEULA="TRUE" />
+  <Property Name="FORCEAPPSHUTDOWN" Value="TRUE" />
+  <Property Name="AUTOACTIVATE" Value="1" />
+  <Updates Enabled="TRUE" />
+  <RemoveMSI />
+</Configuration>

docs/release-flow.md

@@ -1,10 +1,10 @@
 # Release Flow
 
-This repository publishes non-sensitive config files through tag-pinned raw GitHub URLs.
+This repository publishes non-sensitive config files through immutable release tags and a mutable Docker-style `latest` channel.
 
 ## Repository Settings
 
-Configure `netrics/mwp-config` as a public repository with Issues, Wiki, Projects, and Discussions disabled.
+Configure `netrics/mwp-configs` as a public repository with Issues, Wiki, Projects, and Discussions disabled.
 
 Protect `main` with:
 
@@ -13,6 +13,12 @@ Protect `main` with:
 - force pushes disabled
 - branch deletion disabled
 
+Protect `latest` with:
+
+- pushes restricted to release maintainers or release automation
+- pull requests to `latest` disabled by convention
+- force pushes avoided unless recovering a broken channel pointer
+
 ## First Release
 
 The first public release is scaffold-only:
@@ -31,16 +37,31 @@ It contains the repository contract, schema, validation workflow, and an empty m
 4. Wait for `release-checks` and review approval.
 5. Merge to `main`.
 6. Tag `main`, for example `v1.1.0`.
+7. Move the `latest` branch to the same commit.
+
+Consumers that need deterministic behavior must use URLs pinned to release tags. Consumers that need automatic current-release behavior may use `latest` URLs. Do not publish or document floating `main` raw URLs for devices or automation.
+
+Example release commands after `main` contains the reviewed release commit:
+
+```powershell
+git checkout main
+git pull --ff-only origin main
+git tag -a v1.1.0 -m "v1.1.0"
+git push origin v1.1.0
+git push origin main:latest
+```
 
-Consumers must only use URLs pinned to release tags. Do not publish or document floating `main` raw URLs for devices or automation.
+The `latest` branch must point at a commit that has already passed review and release checks on `main`.
 
 ## Post-Release Fetch Test
 
 After publishing a tag, fetch the manifest and at least one config URL from the public raw endpoint.
 
 ```powershell
-Invoke-WebRequest https://raw.githubusercontent.com/netrics/mwp-config/v1.0.0/manifest.json
-Invoke-WebRequest https://raw.githubusercontent.com/netrics/mwp-config/<tag>/configs/<area>/<name>
+Invoke-WebRequest https://raw.githubusercontent.com/netrics/mwp-configs/v1.0.0/manifest.json
+Invoke-WebRequest https://raw.githubusercontent.com/netrics/mwp-configs/<tag>/configs/<area>/<name>
+Invoke-WebRequest https://raw.githubusercontent.com/netrics/mwp-configs/latest/manifest.json
+Invoke-WebRequest https://raw.githubusercontent.com/netrics/mwp-configs/latest/configs/<area>/<name>
 ```
 
 The first release has no config files, so the config fetch test starts with the first release that includes a real config entry.

manifest.json

@@ -1,7 +1,29 @@
 {
   "$schema": "./manifest.schema.json",
-  "repo": "netrics/mwp-config",
-  "version": "v1.0.0",
-  "generatedAt": "2026-04-29T13:21:35Z",
-  "configs": []
+  "repo": "netrics/mwp-configs",
+  "version": "v1.1.0",
+  "generatedAt": "2026-04-29T14:01:03Z",
+  "configs": [
+    {
+      "path": "configs/officeXml/M365-Add-Project.xml",
+      "area": "officeXml",
+      "name": "M365-Add-Project.xml",
+      "sha256": "8fbaa5f0cd40aad2e107cde41cf0f26489bb3d2529cfbb00ff31bc623116474d",
+      "rawUrl": "https://raw.githubusercontent.com/netrics/mwp-configs/v1.1.0/configs/officeXml/M365-Add-Project.xml"
+    },
+    {
+      "path": "configs/officeXml/M365-Add-Visio.xml",
+      "area": "officeXml",
+      "name": "M365-Add-Visio.xml",
+      "sha256": "3731a0884b2004027eb624096027074f9802c7f39ee4273bb4cfa20aed81e67b",
+      "rawUrl": "https://raw.githubusercontent.com/netrics/mwp-configs/v1.1.0/configs/officeXml/M365-Add-Visio.xml"
+    },
+    {
+      "path": "configs/officeXml/M365-Base-CH-MUI-MatchOS.xml",
+      "area": "officeXml",
+      "name": "M365-Base-CH-MUI-MatchOS.xml",
+      "sha256": "864cf42bd5e2d05f16aef3a75d687f0fc0ab3e709ee6f619a7bc7bb2a47176ac",
+      "rawUrl": "https://raw.githubusercontent.com/netrics/mwp-configs/v1.1.0/configs/officeXml/M365-Base-CH-MUI-MatchOS.xml"
+    }
+  ]
 }

manifest.schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/netrics/mwp-config/v1.0.0/manifest.schema.json",
-  "title": "netrics/mwp-config manifest",
+  "$id": "https://raw.githubusercontent.com/netrics/mwp-configs/v1.0.0/manifest.schema.json",
+  "title": "netrics/mwp-configs manifest",
   "type": "object",
   "required": [
     "$schema",
@@ -18,7 +18,7 @@
     },
     "repo": {
       "type": "string",
-      "const": "netrics/mwp-config"
+      "const": "netrics/mwp-configs"
     },
     "version": {
       "type": "string",
@@ -59,7 +59,7 @@
           },
           "rawUrl": {
             "type": "string",
-            "pattern": "^https://raw\\.githubusercontent\\.com/netrics/mwp-config/v[0-9]+\\.[0-9]+\\.[0-9]+/configs/[^/]+/[^/]+$"
+            "pattern": "^https://raw\\.githubusercontent\\.com/netrics/mwp-configs/v[0-9]+\\.[0-9]+\\.[0-9]+/configs/[^/]+/[^/]+$"
           }
         }
       }