[RomneyDa]

Problem

Gateway and Companion Store credentials currently live behind native workflows that ordinary repository writers can invoke. Workflow files alone do not enforce release-manager approval, and the existing release ledger writers push directly to main.

Outcome

• Make openclaw/releases the single Store submission owner, with a fixed gateway/companion request contract and separate protected environments.
• Reject publication unless the actual environment requires team 16590423 (@openclaw/release-managers-openclaw), exact-main deployment, and no administrator bypass. Prepare a source/run/attempt/artifact/package/hash approval summary, then re-resolve and compare those facts before credential use.
• Run only the reviewed central publisher. Migrate the proven Gateway Microsoft API engine, including metadata-preservation and ambiguous-commit safeguards, rather than maintaining two engines.
• Provide unapplied environment and review/CI ruleset templates, corrected CODEOWNERS, and an ordered administrator cutover. Evidence-only writers do not receive a main-branch bypass.

Coordinated PRs and rollout

1. Prerequisite: releases #47 makes evidence updates ordinary checked PRs before PR-only main rules are enabled.
2. This PR adds the central publisher and required administrator settings templates.
3. Gateway #212 and Companion #1891 remove native Store writers and queue central requests. Companion retains its separate stable-promotion gate.
4. Core #181446 queues the central Gateway publisher after the exact-source build, separate from npm completion.

Coordinate these cutovers with verified team access, active review/CI rules, the two central environments, scoped existing GitHub App grants/key, product variables, and exclusive Entra federation migration. Drain old/native runs and outstanding tokens; deleting workflow files is not cloud revocation. No new PAT or persistent Microsoft Store secret is inherently required.

Validation

Candidate head: d8517174532eeea622b4be05b9cb0fdc4d5f2352.

• 39 real-owner authorization scenarios pass (including reviewer/ref/source/attempt/artifact/hash and postapproval substitution rejection).
• Migrated Microsoft Store API regression suite passes, preserving actual-price-change rejection and uncertain-commit behavior.
• Python 3.14 regression suite: 65/65 pass.
• Node 26 regression suite: 16/16 pass.
• Changed-workflow actionlint, settings JSON parsing, and git diff --check pass.
• Independent P0–P2 review is in progress; findings will be addressed on this PR.

Risk and remaining proof

This PR does not apply live settings or grant cloud authority. Administrators must review/apply/read back the documented GitHub and Entra cutover; current credentials/federations and actual blocked/approved publication behavior remain unverified. No merge, release dispatch, Store submission, runtime deployment, or tenant/secret mutation was performed. Hosted CI and review are pending; this is non-draft, not claimed merge-ready.

Coordinated Store approval rollout

• Central Store publisher: releases #48
• Evidence-writer prerequisite: releases #47
• Gateway request-only cutover: packaging #212
• Companion request-only cutover: node #1891
• Gateway release handoff: core #181446

Land evidence-writer compatibility before enforcing PR-only main. Coordinate the central/native/caller cutovers with the documented administrator setup: team grants, active review/CI rules, exact-main release-manager environments without bypass, scoped existing App grants/key, product variables, and exclusive Entra federation migration. These PRs do not apply those live settings, merge themselves, or authorize a Store submission.