[RomneyDa]

What Problem This Solves

Companion repository write access must not also grant authority to publish its package to Microsoft Store.

User Impact

Operators can request Store publication, while only the central publisher may obtain Store credentials after release-manager approval. This is a coordinated cutover: central code, enforced environment/ruleset settings, App access, and Entra federation migration are prerequisites, not effects of merging this PR.

Why This Change Was Made

Replace the native publisher with a request-only adapter to openclaw/releases workflow windows-store-publish.yml on main, accepting only fixed product=companion and a canonical source run_id. Retain the manual recovery entry point and optional MSSTORE_ENABLED successful stable CI/promotion trigger. Preview-only promotions are filtered before minting the cross-repository token.

Remove the native Store API, OIDC exchange, identity/publishing policy, and superseded authorizer tests. Central code owns authoritative source/witness/current-attempt/tag/hash validation, product identity, approval, and Store submission. Native unsigned x64/ARM64 inputs, bundle and store-release-source-<attempt> witness producers, version reservations, stable-promotion approval, and GitHub release gates are unchanged.

Add release-manager CODEOWNERS for automation and release trust inputs, with explicit enforcement prerequisites. CODEOWNERS alone cannot prevent direct push or revoke historical workflows' Store identity.

Related: openclaw/openclaw#181446 and openclaw/openclaw-windows-packaging#212. The central publisher PR is a coordinated dependency and will be cross-linked here.

Evidence

The production PowerShell adapter executed against fixed external GitHub fixtures: 31 scenarios passed. Cases cover exact central dispatch, manual recovery, stable/correction CI, prepared promotion, preview-only promotion with no witness, old/expired witnesses, foreign/main/alpha exclusions, canonical IDs, and ambiguous request failure. The new preview-only regression failed on the recovered pre-fix implementation before passing with the witness-presence filter.

Both changed workflows pass actionlint. Existing CI lane/gate/process contract checks pass. Native Windows and live approval/Store proof remain explicitly unverified below.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• none: this PR changes the request/publishing authority boundary, not Companion binary, UI, installer, native architecture, WSL, or MCP behavior. GitHub-hosted Windows CI and separate administrator-controlled cutover rehearsal remain required; no custom Windows proof pool is claimed.

Validation

Validated candidate: 9183037d40f965242b29d06b6fad2654b47f07de (same source bytes as the executed focused checks).

• PASS: pwsh -NoLogo -NoProfile -NonInteractive -File scripts/test-store-publication-request.ps1: 31 scenarios executed, none skipped; real gh replaced by an in-memory transport and only test-owned temporary files used.
• PASS: actionlint -shellcheck= -pyflakes= .github/workflows/submit-microsoft-store.yml .github/workflows/ci.yml.
• PASS: ./scripts/test-ci-workflow-contract.ps1: CI routing/gates/release/proof contracts, 5 E2E runner guard cases, and output-idle process fixtures. The intentional missing-base fixture fails closed as expected.
• PASS: git diff --check; reference search found no remaining calls to the retired native publisher/source/OIDC scripts or policy.
• BLOCKED: ./scripts/validate-docs.ps1 rejects the existing Windows-style proof-pool entry scripts\validate-mxc-e2e.ps1 on macOS. No unrelated path-check rewrite included.
• BLOCKED/UNRUN: ./build.ps1, dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore, and dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore. ./scripts/setup-dev.ps1 -CheckOnly reports “OpenClaw Windows development requires Windows.” No native test pass is claimed.
• Independent review: shared Codex AutoReview with explicit implementation/proof-plan assessment, complete P0-P3 scope: scoped-clean, no findings. The prior P2 preview-only promotion dispatch was reproduced and fixed before the clean review; no live enforcement or native proof is inferred.
• Hosted CI, ClawSweeper, and required human review: pending on the published head.

Real Behavior Proof

• Environment tested: macOS, PowerShell 7.6.6; external GitHub I/O fixed to synthetic fixtures.
• PR head or commit tested: 9183037d40f965242b29d06b6fad2654b47f07de (focused check/review source preserved through commit).
• Exact steps or command run: pwsh -NoLogo -NoProfile -NonInteractive -File scripts/test-store-publication-request.ps1.
• Evidence after fix: Companion Store publication requests: 31 scenarios passed. The captured dispatch is exactly gh workflow run windows-store-publish.yml --repo openclaw/releases --ref main -f product=companion -f run_id=123 for eligible fixture requests. Preview-only promotion emits no dispatch.
• Observed result: only central request acceptance is reported; native adapter has no Store endpoint, publishing identity, protected Store environment, or id-token: write permission.
• Screenshot or artifact links verified? N/A. This is behavioral fixture proof, not a live App-backed request or protected approval deployment.
• Not verified or blocked: live GitHub App installation permissions, central request/deployment, reviewer/ruleset enforcement, exclusive federation, actual Microsoft commit/certification, native build/shared/tray lanes. No build, Store submission, app installation, runtime, tenant, or repository settings were changed for proof.

Security Impact

• New permissions or capabilities? Yes: the existing release App mints a token restricted to repository releases and Actions write, only to request the fixed central workflow.
• Secrets or tokens handling changed? Yes: GH_APP_PRIVATE_KEY is used for a short-lived request token. Store identifiers and OIDC handling are removed here; the action is commit-pinned, token selection is narrow, and checkout does not persist credentials.
• New or changed network calls? Yes: central workflow dispatch; prepared-promotion filtering reads current-run artifact metadata with the source repository token.
• Command or tool execution surface changed? Yes: only fixed workflow/repository/ref/product plus validated positive source run ID reaches gh workflow run; no caller-supplied script or product identity.
• Data access scope changed? Yes: request authority is not Store publishing authority. Central publisher must independently revalidate source and bundle and execute only centrally reviewed code after protected approval.
• If any answer is Yes, explain the risk and mitigation: historical native workflow code remains a bypass until its Entra federated trust is revoked. This PR deliberately does not claim that YAML deletion or CODEOWNERS performs that administrator cutover.

Compatibility and Migration

• Backward compatible? No: existing submit-microsoft-store.yml manual run ID input remains, but success now means central request accepted, not Store commit.
• Config or environment changes? Yes.
• Migration needed? Yes.
• Exact upgrade steps: first land/review the central publisher; provision microsoft-store-companion for main-only deployments, release-manager team approval, prevention of self-review, and no administrator deployment bypass; enforce release-manager code-owner review for protected automation paths including CODEOWNERS, dismiss stale approval, require latest-push approval, and remove direct-push/bypass paths; move exclusive Companion Entra federation from this repository to central and revoke old/native or alternate publishing writers; grant the existing release App access to request central Actions and make its existing key available; then land this request-only cutover and manually rehearse the approval path before enabling automatic requests. Keep existing native stable-promotion approval. No new PAT or persistent Store password is inherently required. See docs/MICROSOFT_STORE.md for recovery and prerequisites.

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

Coordinated Store approval rollout

• Central Store publisher: releases #48
• Evidence-writer prerequisite: releases #47
• Gateway request-only cutover: packaging #212
• Companion request-only cutover: node #1891
• Gateway release handoff: core #181446

Land evidence-writer compatibility before enforcing PR-only main. Coordinate the central/native/caller cutovers with the documented administrator setup: team grants, active review/CI rules, exact-main release-manager environments without bypass, scoped existing App grants/key, product variables, and exclusive Entra federation migration. These PRs do not apply those live settings, merge themselves, or authorize a Store submission.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR replaces Companion’s native Microsoft Store publisher with requests to the central release-manager-approved publisher.

Example: An operator selects Companion release run 123.

• Before: The native workflow obtains Microsoft credentials and submits the bundle itself.
• After: It requests product=companion and run_id=123 from openclaw/releases; request acceptance does not mean Store publication.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The patch is focused and CI-supported, but fixtures do not establish the security boundary that is its central purpose.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Refactor · Worth it: Yes · Fix scope: Complete
User problem: Release operators need to request Companion publication without ordinary repository write access granting Store publishing authority.
Reason: The maintainer-authored direction establishes a single credential-bearing publisher, preserves release inputs, and explicitly accepts the coordinated cutover requirement.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open: this maintainer-authored PR makes a coherent, approved transfer of Store publishing ownership, and current main still uses the native publisher; no definite introduced code defect was found.

Priority: P2
Reviewed head: 9183037d40f965242b29d06b6fad2654b47f07de

Before merge

• Add real behavior proof - Authority-chain proof required: the 31 macOS PowerShell scenarios exercise StorePublicationRequest.ps1 with gh replaced, proving filtering and dispatch arguments only. Supply redacted current-head logs or terminal evidence showing the App-backed request, approved exact-bundle publication, denial of an ordinary Companion writer before Store I/O, and invalidation of retired native credentials and stale queued or replayed authority. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security review attention item - No concrete introduced bypass was found, but the transferred publishing authority still requires administrator-controlled verification.
• Resolve merge risk - A release administrator must verify that the App’s complete grants and enforced central review rules prevent a Companion repository writer holding the App key from changing central publishing code.
• Await maintainer action - A release administrator must complete the documented central-publisher, App-grant, review/environment-enforcement, and exclusive-federation prerequisites before landing this cutover.

Findings

None.

Tests

• Missing end-to-end proof: Missing is current-head final-effect evidence for approved publication, denial of an ordinary source-repository writer, and rejection of historical or queued authority after revocation; the reported preview-only regression has a stated pre-fix failure and post-fix pass.

Agent review details

How this fits together

Companion CI produces unsigned bundles and release witnesses; the request adapter forwards a source run ID to the central publisher, which owns source verification, approval, credentials, and Store submission.

flowchart LR
  A[Companion release CI] --> B[Bundle and release witness]
  A --> C[Native request adapter]
  C --> D[Central source verification]
  B --> D
  D --> E[Release manager approval]
  E --> F[Central Store publisher]
  F --> G[Microsoft Store]

Loading

Technical review

Best possible solution:

Land the single central publishing owner through the documented administrator cutover while preserving native bundle production, release witnesses, and stable-promotion approval.

Do we have a high-confidence way to reproduce the issue?

Current-main source clearly locates Store credential use and submission in the native workflow; no live unauthorized publication was attempted or established.

Is this the best way to solve the issue?

The scoped adapter and removal of the old publisher are the smallest coherent ownership transfer, provided the central dependency and administrative boundary are established first.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 48cb8a18fdb5.

Merge-risk options

Maintainer options:

1. Verify the complete App authority boundary (recommended)
   Have a release administrator read back App grants and central protections and establish that source-repository write access cannot modify the protected publisher.
2. Pause the coordinated cutover
   Keep this PR open until the central dependency and administrator-controlled boundary are ready.

Provenance checked

• Native Store publisher, source authorization, policy, and associated tests changes intended behavior with a stated reason (8ca63eb: The prior automation provided artifact-bound, retryable publication with product checks, metadata preservation, owned-draft operations, and protection against ambiguous commit responses.)
• Store workflow routing and release documentation changes intended behavior with a stated reason (8ca63eb: Manual recovery and optional automatic delivery originally shared the native protected publisher; this PR deliberately retains request entry points while moving approval and submission to the central owner.)

Testing

Proof path: unit tests only.

Security

Needs attention: No concrete introduced bypass was found, but the transferred publishing authority still requires administrator-controlled verification.

Evidence

What I checked:

• Verified introduced change: The pinned diff removes the native publisher, source authorizer, OIDC helper, policy, and obsolete tests, replacing them with a fixed central dispatch and focused adapter tests. (scripts/StorePublicationRequest.ps1:72, 9183037d40f9)
• Current main retains native publishing: Fetched main still runs the credential-bearing microsoft-store job and Submit-MicrosoftStore.ps1, so the requested ownership transfer is not already implemented there. (.github/workflows/submit-microsoft-store.yml:58, 48cb8a18fdb5)
• Accepted direction and mandatory cutover: The full maintainer-authored body explicitly selects central publishing and requires administrator setup before landing; the guide preserves that condition and warns that deleting YAML does not revoke historical federation. (docs/MICROSOFT_STORE.md:16, 9183037d40f9)
• Affirmative dependency contract: The adapter executes windows-store-publish.yml in this repository. The reviewed dependency independently resolves Companion witnesses and bundles, compares approved facts after waiting, and rechecks environment protection before credential use; feat(release): require central release-manager approval for Windows Store publishing releases#48 remains open and reports live enforcement unverified. No AGENTS.md was present in its recursive tree. (.github/workflows/windows-store-publish.yml:155, d8517174532e)
• Validation and proof limits: Exact-head CI Gate, core/CLI, tray/setup/integration, UI, MSIX, bundle, and WSL E2E checks pass. The full body identifies the 31 request scenarios as synthetic gh fixtures and expressly leaves App-backed dispatch, approval enforcement, and exclusive federation unverified. (scripts/test-store-publication-request.ps1:15, 9183037d40f9)
• Feature history and review policy: History and feat(release): automate Microsoft Store submission #1474 establish RomneyDa’s prior Store automation work and its artifact-binding, metadata-preservation, and ambiguous-commit safeguards. Root and docs AGENTS.md were read completely; no other changed-path ancestor instructions or maintainer-notes directory existed. Local follow-history encountered unavailable older objects, but the prior PR and base blobs supplied the relevant rationale. No helper, second reviewer, build, or test was run; final git status was clean. (.github/workflows/submit-microsoft-store.yml:1, 8ca63eb746bf)

Likely related people:

• Karen: Raw commit 94006b3 adds .github/workflows/promote-alpha-release.yml:11 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 94006b3672a0; files: .github/workflows/promote-alpha-release.yml)

Review metrics

Metric	Value	Why it matters
Production and test footprint	Production scripts/workflows +114/-628; tests +182/-459	The change removes the duplicate native publishing engine and replaces its tests with coverage of the narrower request contract.

Labels

Label changes:

• add P2: This is a useful release-security improvement without evidence of an urgent installed-product regression.
• add merge-risk: 🚨 security-boundary: The change transfers publishing authority across repositories and introduces App-key-backed dispatch whose effective authority depends on live grants and protections.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: This is a useful release-security improvement without evidence of an urgent installed-product regression.
• merge-risk: 🚨 security-boundary: The change transfers publishing authority across repositories and introduces App-key-backed dispatch whose effective authority depends on live grants and protections.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add final-effect proof for an ordinary Companion writer and an approved release manager, including revocation of historical native credentials and stale queued authority before Store I/O.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 27, 2026, 2:54 PM ET / 18:54 UTC.