diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
new file mode 100644
index 00000000..8ce3c503
--- /dev/null
+++ b/.github/workflows/windows.yml
@@ -0,0 +1,35 @@
+# Native Windows compatibility probe (#43). NOT a required gate — it runs on
+# demand (and on windows-ci/** branches) to surface the real PowerShell/cmd
+# blockers against a genuine windows-latest runner, instead of guessing on macOS.
+# Build + unit tests must pass; the kit-command smoke is allowed to fail so it
+# reports the remaining operational gaps (POSIX git hooks, tar, ACLs) as it goes.
+name: Windows (native, probe)
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches:
+      - "windows-ci/**"
+
+permissions:
+  contents: read
+
+jobs:
+  windows-native:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: 22
+      - name: Install
+        run: npm ci
+      - name: Build (cross-platform: rimraf + node chmod, no POSIX rm/chmod)
+        run: npm run build
+      - name: Unit tests
+        run: npm test
+      - name: kit smoke (init / check) — gaps surface here, non-blocking
+        continue-on-error: true
+        run: |
+          node dist/cli.js --version
+          node dist/cli.js check --category security
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0c1ed35a..de22ffd7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ## [Unreleased]
 
+## [1.28.2] - 2026-06-24
+
+### Changed
+
+- **Cross-platform build script (#43).** The `build`/`build:prod` scripts used POSIX `rm -rf dist` + `chmod +x dist/cli.js`, which fail on native Windows. Now use two tiny no-dep node scripts — `scripts/clean-dist.mjs` (`fs.rmSync`) + `scripts/chmod-cli.mjs` (no-ops on `win32`) — same output on POSIX (verified: `dist/cli.js` stays `0755`). Lets kit build on Windows; another #43 blocker cleared.
+
+### Added
+
+- **`windows-latest` compatibility probe CI (#43).** A non-required workflow (`workflow_dispatch` + `windows-ci/**` branches) that builds + unit-tests on a real Windows runner and smoke-runs `kit check` (non-blocking) — so the remaining native-Windows blockers (POSIX git hooks, `tar`, secret-file ACLs) get surfaced + fixed against a genuine Windows env instead of guessed at on macOS. Actions are SHA-pinned (passes `kit gha-audit`).
+
 ## [1.28.1] - 2026-06-24
 
 ### Fixed
diff --git a/Dockerfile b/Dockerfile
index bad6d64d..7d0c3124 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,6 +21,7 @@ RUN npm ci
 COPY src ./src
 COPY tsconfig*.json ./
 COPY .kit ./.kit
+COPY scripts ./scripts
 
 # Build TypeScript → JavaScript
 RUN npm run build
diff --git a/package-lock.json b/package-lock.json
index 37cd97a0..d5559204 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "sandstream-kit",
-  "version": "1.28.1",
+  "version": "1.28.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "sandstream-kit",
-      "version": "1.28.1",
+      "version": "1.28.2",
       "license": "MIT",
       "workspaces": [
         "packages/*"
diff --git a/package.json b/package.json
index 1b6c0d04..f1371350 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "sandstream-kit",
-  "version": "1.28.1",
+  "version": "1.28.2",
   "description": "developer kit. zero LLM, local-first, multi-vault. one command from git clone to working dev environment.",
   "license": "MIT",
   "funding": "https://buymeacoffee.com/sandstream",
@@ -26,8 +26,8 @@
     "access": "public"
   },
   "scripts": {
-    "build": "npm run build --workspace=packages/adapter-sdk && npm run build --workspace=packages/kit-plugin-railway && npm run build --workspace=packages/kit-plugin-supabase && npm run build --workspace=packages/kit-plugin-vercel && npm run build --workspace=packages/kit-plugin-github && npm run build --workspace=packages/kit-plugin-stripe && npm run build --workspace=packages/kit-plugin-fly && npm run build --workspace=packages/kit-plugin-cloudflare && npm run build --workspace=packages/kit-plugin-snyk && npm run build --workspace=packages/kit-plugin-wiz && npm run build --workspace=packages/kit-plugin-sentry && rm -rf dist && tsc && chmod +x dist/cli.js",
-    "build:prod": "npm run build --workspace=packages/adapter-sdk && npm run build --workspace=packages/kit-plugin-railway && npm run build --workspace=packages/kit-plugin-supabase && npm run build --workspace=packages/kit-plugin-vercel && npm run build --workspace=packages/kit-plugin-github && npm run build --workspace=packages/kit-plugin-stripe && npm run build --workspace=packages/kit-plugin-fly && npm run build --workspace=packages/kit-plugin-cloudflare && npm run build --workspace=packages/kit-plugin-snyk && npm run build --workspace=packages/kit-plugin-wiz && npm run build --workspace=packages/kit-plugin-sentry && rm -rf dist && tsc -p tsconfig.prod.json && chmod +x dist/cli.js",
+    "build": "npm run build --workspace=packages/adapter-sdk && npm run build --workspace=packages/kit-plugin-railway && npm run build --workspace=packages/kit-plugin-supabase && npm run build --workspace=packages/kit-plugin-vercel && npm run build --workspace=packages/kit-plugin-github && npm run build --workspace=packages/kit-plugin-stripe && npm run build --workspace=packages/kit-plugin-fly && npm run build --workspace=packages/kit-plugin-cloudflare && npm run build --workspace=packages/kit-plugin-snyk && npm run build --workspace=packages/kit-plugin-wiz && npm run build --workspace=packages/kit-plugin-sentry && node scripts/clean-dist.mjs && tsc && node scripts/chmod-cli.mjs",
+    "build:prod": "npm run build --workspace=packages/adapter-sdk && npm run build --workspace=packages/kit-plugin-railway && npm run build --workspace=packages/kit-plugin-supabase && npm run build --workspace=packages/kit-plugin-vercel && npm run build --workspace=packages/kit-plugin-github && npm run build --workspace=packages/kit-plugin-stripe && npm run build --workspace=packages/kit-plugin-fly && npm run build --workspace=packages/kit-plugin-cloudflare && npm run build --workspace=packages/kit-plugin-snyk && npm run build --workspace=packages/kit-plugin-wiz && npm run build --workspace=packages/kit-plugin-sentry && node scripts/clean-dist.mjs && tsc -p tsconfig.prod.json && node scripts/chmod-cli.mjs",
     "prepublishOnly": "npm run build:prod",
     "dev": "tsx src/cli.ts",
     "test": "KIT_NON_INTERACTIVE=1 KIT_BUMBLEBEE=0 KIT_NO_FAILURE_SIM=1 KIT_NO_UPDATE_CHECK=1 node --test --test-timeout=180000 --test-concurrency=2 dist/*.test.js dist/**/*.test.js",
diff --git a/scripts/chmod-cli.mjs b/scripts/chmod-cli.mjs
new file mode 100644
index 00000000..dc29002b
--- /dev/null
+++ b/scripts/chmod-cli.mjs
@@ -0,0 +1,13 @@
+// Make the built CLI executable on POSIX. No-op on Windows (NTFS has no +x bit;
+// the .cmd/PATHEXT shim handles execution there). Cross-platform replacement for
+// the build script's `chmod +x dist/cli.js` (#43).
+import { chmodSync } from "node:fs";
+
+if (process.platform !== "win32") {
+  try {
+    chmodSync("dist/cli.js", 0o755);
+  } catch (err) {
+    console.error("chmod dist/cli.js failed:", err.message);
+    process.exit(1);
+  }
+}
diff --git a/scripts/clean-dist.mjs b/scripts/clean-dist.mjs
new file mode 100644
index 00000000..386b3c6e
--- /dev/null
+++ b/scripts/clean-dist.mjs
@@ -0,0 +1,6 @@
+// Cross-platform `rm -rf dist` for the build script (#43). Uses node's built-in
+// fs.rmSync so it needs no external dep (rimraf isn't a direct dependency) and
+// works identically on POSIX + Windows.
+import { rmSync } from "node:fs";
+
+rmSync("dist", { recursive: true, force: true });