[RomneyDa]

What Problem This Solves

Gateway packaging currently owns Store credentials and an optional automatic publisher, so write access to this repository can change the code that publishes to Microsoft Store without release-manager approval.

User Impact

There is no installed-product change. Packaging continues to build and retain the authorized multi-architecture Store bundle. Its Store action becomes a main-only, manual request to openclaw/releases; Store publication and approval move to the centralized publisher.

Coordinated cutover dependency: do not merge this request-only change before the standalone openclaw/releases windows-store-publish.yml publisher and its administrative controls are ready. The coordinated central PR link will be added to this description. The central publishing guide is provided by that change.

Administrators must configure the exact-main microsoft-store-gateway environment with @openclaw/release-managers-openclaw required reviewers and administrator bypass disabled; enforce release-manager code-owner review and verify the team's explicit write grant; make the existing release App available for request dispatch; and exclusively move the dedicated Gateway Store identity's federation to that central environment. Remove the old native Store federation so historical workflows cannot bypass central approval. This PR does not change settings, credentials, or cloud trust and is not sufficient alone to activate that boundary.

Verified outstanding prerequisite: GitHub currently reports the intended release-manager team as an unknown CODEOWNERS owner for these rules, with a visibility/write-access suggestion. Administrators must make the team an eligible owner and verify zero CODEOWNERS errors before relying on required code-owner review. This is not passing approval-boundary proof.

Why This Change Was Made

• Keep submit-microsoft-store.yml and its run_id input as an operator recovery surface, but remove workflow_run, MSSTORE_ENABLED, native Store environments/OIDC, and Store API execution.
• Queue {product: gateway, run_id} to the standalone central workflow on main, using the existing release App (ID 2729701) and an Actions-write token scoped only to openclaw/releases. Request acceptance is never reported as Microsoft acceptance.
• Remove the native Store engine, source authorizer, OIDC helper, policy, and their test/CI registrations after tracing their callers. The proven engine and suites move into the coordinated central owner; no source-repository publishing scripts execute in its credential-bearing job.
• Add release-manager CODEOWNERS for workflow code, scripts, dependencies, and identity inputs, plus honest administrator/cutover guidance. Leave MSIX builders, authorized artifact retention, official sideload signing, release publication, identity derivation, and upgrade proof unchanged.
• Upstream Gateway release tooling requests the central publisher directly after the exact-source build. The manual adapter is recovery, not another automatic trigger.

Evidence

Reviewed and validated head: 0bde7cb3c7ef9f130118bd60c09c746c527defb6.

Passed from the repository root in PowerShell 7 on macOS (existing fixture suites received TEMP=[IO.Path]::GetTempPath() because it is unset by this shell):

• ./scripts/Test-Request-MicrosoftStorePublish.Tests.ps1: 17 scenarios, real request owner with synthetic command-boundary fixtures; fixed workflow/repository/main/product/run ID, canonical IDs, no dispatch for foreign/branch/event inputs, failure propagation, request-only status.
• ./scripts/Test-SigningInputs.Tests.ps1: synthetic package and bundle signing-policy checks passed.
• ./scripts/Test-WorkflowSigningConfiguration.ps1: source/build routing and dispatch classification passed (including eight Store runner-preparation fixtures).
• ./scripts/Test-WorkflowPackageVersion.Tests.ps1, ./scripts/Test-PackagingRelevance.Tests.ps1, and ./scripts/Test-MSIXUpgradeMatrix.Tests.ps1: passed.
• ./scripts/Test-DocReferences.ps1: 0 findings.
• actionlint -shellcheck= -pyflakes= .github/workflows/submit-microsoft-store.yml and git diff --check: passed.
• Independent Codex AutoReview over the full base-to-candidate diff: scoped-clean, no actionable P0–P2 findings. A diff simplification pass found no extra production owner or retained compatibility machinery.

Not run: managed quality/xUnit lanes (no managed code changed), Windows NativeAOT/MSIX composition and installed upgrade lanes (Windows host required), live App-backed request/approval/Store proof, admin/ruleset/team settings, Entra federation changes, or live publishing. Hosted CI/review remain separate from these local results. The central implementation and exclusive trust cutover must be verified before production use.

Coordinated Store approval rollout

• Central Store publisher: releases #48
• Evidence-writer prerequisite: releases #47
• Gateway request-only cutover: packaging #212
• Companion request-only cutover: node #1891
• Gateway release handoff: core #181446

Land evidence-writer compatibility before enforcing PR-only main. Coordinate the central/native/caller cutovers with the documented administrator setup: team grants, active review/CI rules, exact-main release-manager environments without bypass, scoped existing App grants/key, product variables, and exclusive Entra federation migration. These PRs do not apply those live settings, merge themselves, or authorize a Store submission.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR replaces native Microsoft Store publication with a manual request to the central release repository.

Example: An operator selects Gateway build run 123.

• Before: The packaging workflow can upload and commit its bundle directly to Microsoft Store.
• After: The adapter requests windows-store-publish.yml on openclaw/releases main with product=gateway and run_id=123, reporting only request acceptance.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The adapter is focused and source review found no discrete defect, but the claimed authority boundary remains unproven and its central deployment is outstanding.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Refactor · Worth it: Yes · Fix scope: Complete
User problem: Packaging-repository write access can affect Store publishing code without mandatory central release-manager approval.
Reason: The maintainer-authored direction places publication under one central owner while preserving bundle production and manual recovery.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open: this maintainer-authored PR provides a useful publication boundary change that requires a coordinated central cutover.

Priority: P2
Reviewed head: 0bde7cb3c7ef9f130118bd60c09c746c527defb6

Before merge

• Add real behavior proof - Authority-chain proof required: the body explicitly leaves live App-backed dispatch, central approval, exclusive federation, and Store behavior unrun. Synthetic command fixtures establish request construction only. Provide redacted logs or terminal evidence mapping an allowed request through the real central owner and showing that a packaging writer without release-manager approval, legacy packaging federation, and revoked approval on queued or retried work cannot reach Store mutation; redact credentials, IPs, and non-public endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security concern: Release-manager code ownership is currently ineffective - GitHub reports the intended team as unknown on every new ownership rule; administrators must establish eligible ownership and enforce the documented review controls before relying on this boundary.
• Resolve merge risk - Before merge, release administrators must establish the coordinated central publishing boundary: the target workflow is absent from inspected central main, and effective review protection and exclusive federation remain outstanding.
• Await maintainer action - Release administrators must make the release-manager team eligible, enforce code-owner and central environment approval, verify App grants, and replace legacy Store federation with exclusive central federation before allowing the cutover.

Findings

• [medium] Release-manager code ownership is currently ineffective — .github/CODEOWNERS:2

Tests

• Missing end-to-end proof: Supply production-path evidence for an allowed request and denial before Store mutation for a packaging writer without release-manager approval, including a historical workflow after federation removal and revoked approval on queued or retried work.

Agent review details

How this fits together

Packaging produces the authorized multi-architecture bundle; the adapter forwards its build run ID, while the central publisher must own source validation, release-manager approval, credentials, and Store mutations.

flowchart LR
  A[Authorized Gateway build] --> B[Retained Store bundle]
  A --> C[Manual request adapter]
  C --> D[Central source validation]
  B --> D
  D --> E[Release manager approval]
  E --> F[Central Store publisher]
  F --> G[Microsoft Store]

Loading

Technical review

Best possible solution:

Complete the central publisher and administrative cutover first, preserving one authoritative publisher and the existing authorized bundle handoff.

Do we have a high-confidence way to reproduce the issue?

Source confirms that current main publishes locally and the PR instead dispatches the central workflow; no live publication or unauthorized-principal experiment was performed.

Is this the best way to solve the issue?

Central ownership is a coherent solution, and the adapter is small with no retired local callers found; its security outcome depends on completing the explicitly documented external cutover.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against dfa5d77d0a5c.

Merge-risk options

Maintainer options:

1. Complete the coordinated cutover (recommended)
   Release administrators land the central publisher, establish effective approval and federation controls, and then allow this request-only replacement to merge.
2. Hold the packaging cutover
   Keep this PR open without retiring the existing publisher until the central owner and administrative prerequisites are ready.

Provenance checked

• Local Store publisher, authorization, policy, and scenario suites changes intended behavior with a stated reason (b50ec33: Provide retryable publication of validated bundles while preserving metadata, rejecting foreign drafts, and retaining ambiguous commits; later merged repairs refined Store response handling.)
• Automatic trigger and manual Store workflow changes intended behavior with a stated reason (feat(release): automate Microsoft Store submissions #99: Support manual recovery and optional automatic delivery from successful release builds; this PR deliberately transfers both publication authority and automatic callers to the coordinated central design.)
• Authorized Store bundle retention and release gates keeps the original intent (131fae3: Separate Store and sideload artifacts while retaining authorized Store bundles; the PR changes the publication consumer without changing their producer.)

Testing

Proof path: unit tests only.

Security

Needs attention: The adapter has no concrete security defect, but effective central publication authority is not yet established.

Evidence

Security concerns:

• [medium] Release-manager code ownership is currently ineffective — .github/CODEOWNERS:2
  GitHub reports the intended team as unknown on every new ownership rule; administrators must establish eligible ownership and enforce the documented review controls before relying on this boundary.
  Confidence: 1

What I checked:

• Verified introduced change: The pinned introduction removes the local publisher, source authorizer, OIDC helper, policy, and their suites; the replacement fixes the central repository, workflow, main branch, product, and canonical run ID. (scripts/Request-MicrosoftStorePublish.ps1:29, 0bde7cb3c7ef)
• Current main still publishes locally: Current main retains workflow_run activation, the microsoft-store environment, Store OIDC, and direct publisher execution; this PR's central cutover is not already implemented. (.github/workflows/submit-microsoft-store.yml:62, dfa5d77d0a5c)
• Administrative prerequisite confirmed: GitHub reports Unknown owner for every new release-manager CODEOWNERS rule, matching the PR's explicit outstanding prerequisite; the file cannot presently establish the intended review protection. (.github/CODEOWNERS:2, 0bde7cb3c7ef)
• Central dependency not landed: The public repository is readable, but the target workflow returns 404 at its inspected main revision. Target docs explicitly designate this repository as the authoritative source-validation and publication owner, establishing the dependency contract; no dependency AGENTS.md was available at the queried root or .github paths. (.github/workflows/windows-store-publish.yml, 3d63d6a83318)
• Accepted direction and cutover constraint: The maintainer-authored body and activation guide explicitly require central-first deployment, eligible code owners, enforced review, protected environment approval, and removal of historical packaging federation; retiring the local automatic publisher is intentional. (docs/microsoft-store.md:9, 0bde7cb3c7ef)
• Coordinated upstream caller: The same author's open feat(release): publish Gateway MSIX to Microsoft Store after stable releases openclaw#181446 targets the central publisher directly and explicitly requires this packaging cutover, administrative controls, and exclusive federation. (95716a4f185b)

Likely related people:

• Dallin Romney: Raw commit 131fae3 adds .github/workflows/gateway-msix.yml:1187 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 131fae3f0f43; files: .github/workflows/gateway-msix.yml)
• Paul Campbell (AgOS): Raw commit 4a55f98 adds .github/workflows/gateway-msix.yml:1001 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 4a55f98a85f5; files: .github/workflows/gateway-msix.yml)

Review metrics

Metric	Value	Why it matters
Publisher consolidation	Production scripts +40/-492; scenario tests +76/-512	The introduced diff removes the native publication owner and its fixtures rather than retaining a competing implementation.

Labels

Label changes:

• add P2: This is a release-operator trust-boundary improvement with no installed-product behavior change.
• add merge-risk: 🚨 security-boundary: Publication authority moves across repositories and depends on effective release-manager approval and exclusive cloud federation.
• add merge-risk: 🚨 automation: The diff removes direct and automatic Store publication and dispatches a central workflow that is not yet present on inspected main.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: This is a release-operator trust-boundary improvement with no installed-product behavior change.
• merge-risk: 🚨 security-boundary: Publication authority moves across repositories and depends on effective release-manager approval and exclusive cloud federation.
• merge-risk: 🚨 automation: The diff removes direct and automatic Store publication and dispatches a central workflow that is not yet present on inspected main.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add final-effect proof that an unapproved packaging writer and historical packaging workflow cannot mutate Microsoft Store, and that revoked approval blocks queued or retried publication.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 27, 2026, 2:07 PM ET / 18:07 UTC.