[RomneyDa]

Problem

The release-evidence workflows push generated records directly to main with GITHUB_TOKEN. Enforcing main's normal pull-request/code-review rules must not require a blanket bot bypass, and GITHUB_TOKEN-created PRs would suppress the normal CI events needed to accept those records.

Change

• Both evidence entry points use the existing GitHub App (2729701, GH_APP_PRIVATE_KEY), restricted to the releases installation/repository with Contents write and Pull requests write. The job's GITHUB_TOKEN is read-only.
• The shared writer proposes immutable, content-addressed, evidence-only PRs; it never pushes main, force-pushes, merges, or changes repository settings.
• Preserve safe release IDs, a clean index, exact generated-directory comparison after rebasing, and an exact simulated merge result against fresh main. Unrelated concurrent main changes survive; same-directory additions/conflicts stop.
• Reuse only the same App's matching open PR and exact head. Foreign/closed/mismatched PRs and orphan branches require manual recovery. Reconcile ambiguous writes instead of blindly replaying them.
• Report pending PRs as pending, not as ledger publication. An unchanged record is reported on main only after verifying the complete directory against fresh remote state.

Validation

Head: 66ee6ab9282804ba707ae2f3f0a8b8b250542833.

• 13/13 focused tests passed, using real temporary Git remotes for both production workflow entry points and stubbing only the external GitHub transport: pending PR/no-main-write, exact no-op, unrelated/concurrent additions, stale no-op/conflict rejection, post-push races, App/head ownership, immutable replay, orphan recovery, ambiguous/rejected creation, missing input/path/staged-work rejection, and renames concealing a sibling record deletion.
• Final full Python regression lane: 77/77 passed on Python 3.14. Node regression suite: 16/16 passed on Node 26.12.1 (unchanged inputs).
• bash -n, ShellCheck, Actionlint for both changed workflows, Node syntax checks, and git diff --check.
• Independent Codex P0–P2 AutoReview before commit found one P2: rename detection could conceal a deletion outside the allowed evidence directory. A real-Git regression reproduced the bypass, then passed with --no-renames on the existing path-admission check. The finding is addressed with that focused proof.

The first full Python invocation used macOS's Python 3.9 and hit eight unchanged appcast tests using zip(strict=...); the full lane was rerun with installed Python 3.14. No test was weakened or excluded.

Prerequisites and unrun lanes

• An administrator must verify the existing App is installed on openclaw/releases with the requested Contents/Pull requests grants and that GH_APP_PRIVATE_KEY is available. No new PAT, persistent push credential, or main-rule bypass is introduced.
• This is the evidence-writer compatibility prerequisite for the coordinated central Store-governance PR set. Main rules/CODEOWNERS and Store-publisher changes are separate; this PR does not activate those settings.
• No live App-authenticated evidence workflow, merge, repository setting mutation, or Store/release publishing run was performed. Hosted CI/review are separate from the local proof above.

Coordinated Store approval rollout

• Central Store publisher: releases #48
• Evidence-writer prerequisite: releases #47
• Gateway request-only cutover: packaging #212
• Companion request-only cutover: node #1891
• Gateway release handoff: core #181446

Land evidence-writer compatibility before enforcing PR-only main. Coordinate the central/native/caller cutovers with the documented administrator setup: team grants, active review/CI rules, exact-main release-manager environments without bypass, scoped existing App grants/key, product variables, and exclusive Entra federation migration. These PRs do not apply those live settings, merge themselves, or authorize a Store submission.