Patch manager for Windows with offline update mirror and vulnerability reporting

There is a small network with 25-40 Windows 10/11 Pro PCs without a domain, some machines periodically work without the Internet. Currently, updates are applied manually, and there is no clear picture of the level of patches and residual CVEs. A ready-made desktop program for Windows is required, which will allow from one PC administrator to manage the inventory and installation of updates through a local offline mirror.

Technical environment and limitations
- There is no server infrastructure, installation on clients is allowed only as a small Windows service agent.
- Windows 11 administrative PC, Windows 10/11 clients. Access via local network, sometimes only via USB.
- Can't use SCCM/Intune and other heavy enterprise platforms. It is allowed to use the official Windows API, WU API, PowerShell, DISM, BITS, SQLite.
- The result should be turnkey - installer, startup documentation, and source code.

What exactly is the program supposed to do
1) Administrator console (desktop GUI) with local database (SQLite) - list of PCs, their status, last contact, OS version, build, list of installed KB, reboot status.
2) The module for creating a local update repository - downloading selected KB/SSU/LCU from the Microsoft Update Catalog according to the list, storing in the folder structure, checking hashes, version control.
3) Update delivery mode
- On the network - the agent receives the task, pulls files from the repository layer (SMB/HTTP locally), installs the update quietly, gives a log.
- Offline - forming a package on a USB for a specific PC or group, after running on the PC, the agent installs and then exports the report back to the USB for import into the console.
4) Reporting and eligibility criteria
- Export to CSV/JSON report: PC - latest KB - missing KB from the repository list - reboot status.
- "minimum level of patches" policy - a list of mandatory KBs is specified; the program calculates the % of compliance for the park.
5) Logs and diagnostics
- Collection of installation logs (WindowsUpdate.log, CBS, own agent logs), binding to a task, minimal viewing in the console.

A specific result
- Ready-to-use: console installer (MSI or EXE) and standalone agent installer.
- An update repository that can be moved to another drive/PC without losing metadata.
- Instructions in Ukrainian: installation, typical scenarios, recovery after errors.

Measurable acceptance criteria
- On a test bench with 5 PCs, the program correctly inventories installed KBs and shows the difference with the repository with no more than 1 error per 100 records.
- Offline scenario: USB package generation, installation on 2 PCs without internet, report import - should close task status and display actual KB.
- Network installation: running the task on 3 PCs in parallel, monitoring progress, saving logs, no UI hangs.
- Recovery: restarting the agent/console does not break the queue of tasks, unfinished tasks are marked correctly.

Implementation stages are pending
- Brief analysis and design (DB format, console-agent interaction protocol, offline packet format).
- Implementation of agent and console, assembly of installers.
- Bench testing, corrections, final documentation.

Preferred technology: .NET 8 (WPF or WinUI 3) for the console, Windows Service + .NET for the agent. If there are better arguments for another stack, you can offer it, but without dependence on cloud services.