[RomneyDa]

Current landing status (2026-10-22)

Head: ee77292685956bbb71b4072104624544431a7519. Current-head CI passed, including core/CLI, tray/setup/integration, UI/accessibility, both MSIX architectures, the combined bundle, all three WSL E2E lanes and CI Gate. C# and Actions security checks also passed. Setup/connect completed in 20m38s overall (build/setup plus the unchanged 20-minute test-step cap).

Prerequisite #1831 (fix(ci): keep progressing E2E fixtures alive under the hang guard) landed as 6647e5497dd0f87a8d61dae83e6d98bb9e8b2797. Its exact reviewed commit 0faca6a2 was integrated here to qualify the composed head concurrently. The final main-relative diff is Store automation only; its patch-id matches the pre-integration feature exactly. No new feature-code edits were made during integration.

Current-head focused proof: publisher fixtures, 22 source-authorization cases, the complete CI workflow contracts and new real process lifecycle cases all passed. The 100%-gradual-rollout defect is fixed and regression-covered. Feature review plus the focused rollout correction and watchdog prerequisite reviews have no remaining actionable source findings.

Previous-head CI 46b07cee failed in setup/connect and network recovery because the 600-second VSTest timer counted progressing shared fixture initialization as inactivity. WSL creation took 325 seconds; install, gateway startup, both pairings and connectivity then succeeded. The prerequisite changes only the activity signal, retaining 600-second silence and 20-minute hard step limits. The same-version VSTest reproduction aborts under the old guard while logging progress, and passes under the replacement. UI/revocation passed. Hosted Shared 4,676 passed / 8 skipped, Tray 4,474 passed and SetupEngine 2,425 passed / 1 skipped also passed on that prior head.

Native Windows closeout on Store head 46b07cee: build passed in 82.5s; Shared 4,656 passed / 1 failed / 27 skipped; Tray 4,467 passed / 7 failed. Known Parallels symlink privilege, ARM64/x64 fixture, native speech DLL and redirected-folder limitations remain recorded as failures. Native publisher/source/workflow contracts passed. Separate exact-head native qualification of the watchdog prerequisite completed: build and full process/workflow contracts passed, with the same documented local unit-test limitations. Hosted composed-head CI subsequently passed, as linked above.

ClawSweeper's completed review was on ca004815, not this head. Its optional-metadata and server-owned package-field findings are fixed and fixture-covered. Activation concerns are explicitly deferred under the maintainer-selected staged rollout: merge dormant code, keep MSSTORE_ENABLED unset until live authority/submission and Store lifecycle proof. No live Store proof or exact-head ClawSweeper review is claimed.

Admin readback: main-only microsoft-store environment, all three identifiers, and the dedicated secretless OIDC identity are configured. Partner Center checks await fresh admin login. No release or Store submission dispatched. Historical validation below retains original-head attribution.

What Problem This Solves

Release operators need a reliable, retryable Microsoft Store submission path for validated releases, without rebuilding or replacing an existing Partner Center draft.

User Impact

Operators can manually run Submit Microsoft Store on main with a successful release run_id, or enable the same path automatically with the repository variable MSSTORE_ENABLED=true. Automatic submission defaults off. Existing GitHub releases and unsigned Store handoff artifacts are preserved. Setup and recovery guide.

Why This Change Was Made

The dedicated workflow consumes only an authorized release artifact and runs trusted main code in the protected microsoft-store environment. It uses short-lived OIDC instead of a client secret. The publisher verifies bundle and Partner Center product identity, preserves product metadata, rejects existing drafts, and commits only its own exact submission ID. Valid conditional metadata and server-populated package fields are accepted; ambiguous commit failures never delete the possibly accepted submission.

This repair integrates current main without rewriting the original author's commits. Stable/correction tags and approved alpha-to-stable promotion record a run/attempt/tag/commit/hash witness before the Store workflow can consume their bundle.

Evidence

Previous head: da421cf9fff21e04f8f43a14b418314c11d9938f. Previous-head CI.

Independent rubber-duck review completed using a Codex review child. Its fork-PR eligibility finding was fixed and covered: successful fork PR completions are skipped, not failed or submitted. The follow-up review also verified the release-step test boundary correction. No remaining actionable source-review finding. This is not live Store authorization proof.

Deployment is intentionally staged. No live Store upload/commit, signing or release was performed during this repair. The current landing section above records subsequent admin configuration and integration work.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• none: release automation and API/source contract changes only. No new custom Windows runtime capability. Existing signed Store install/upgrade rollout gates are not waived.

Validation

Passed on current source: scripts/test-microsoft-store-submission.ps1, scripts/Test-StoreSubmissionSource.Tests.ps1 (22 scenarios), scripts/test-ci-workflow-contract.ps1, actionlint for both changed workflows, and git diff --check origin/main.

Native Windows 11 ARM64 required closeout completed on pre-rebase head acd47fc955f668c8c440fe0b2139d759c826eaee in an isolated Parallels checkout. scripts/setup-dev.ps1 -CheckOnly reported all prerequisites met. Results:

Command	Result
./build.ps1	Passed, 70.3 seconds
dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore	4,656 passed, 1 failed, 27 skipped; 128.5 seconds
dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore	4,467 passed, 7 failed, 0 skipped; 157.2 seconds
Tray tests filtered to ReleaseSigningWorkflowTests	5 passed, 0 failed, 0 skipped
Publisher fixtures, source authorization, native documentation	Passed; 22 source scenarios and 65 Markdown files

The Shared failure is missing symbolic-link privilege. The seven Tray failures are four x64 prerequisite fixtures running under ARM64 PowerShell, one missing native speech DLL dependency, and two sandbox tests rejecting Parallels-redirected known folders (C:\Mac\Home is a reparse point). These unchanged tests also failed before the release-contract fix. They are recorded as failed, not waived or counted green. The task-caused release-asset test failure was fixed by bounding its assertions to the Create Release step; unsigned-package assertions remain intact. No host settings or installed Gateway were altered. Pre-rebase hosted CI was terminal failed; see the attributed holds below. Rebased-head CI is pending. This is not a merge-ready assertion.

macOS scripts/validate-docs.ps1 is blocked by the existing backslash path handling in validate-proof-pools.ps1; native Windows documentation validation in the full build passes. The earlier main baseline had unrelated WSL Latest E2E failures because Node 24.19.0 was below the Gateway minimum, baseline run. Merged prerequisite #1824 (fix(setup): use a Node runtime accepted by the Gateway installer) updates that runtime and is now included through the rebase. Earlier hosted results remain visible at the linked run. Live Store deployment proof is still outstanding.

Rebase validation (da421cf9)

Rebased onto merged prerequisite 51f18c1222c996fb6fa2eb4d7e8d668492103a0e. The complete base-relative feature patch is byte-for-byte identical to the pre-rebase patch. The resulting tree differs from the previous head only by the three files from #1824.

Fresh focused checks on da421cf9fff21e04f8f43a14b418314c11d9938f passed: publisher fixtures; source authorization (22 scenarios); CI workflow contracts; actionlint for both changed workflows; ReleaseSigningWorkflowTests (5 passed); and git diff --check origin/main.

Full native build/Shared/Tray closeout was not repeated for this mechanical base update. The earlier native results remain attributed to their original head, not presented as new-head runs. New-head hosted CI is pending. The earlier UI bootstrap abort remains unproven on this head. No Store submission was triggered.

Pre-rebase CI follow-up (acd47fc9)

The pre-rebase run is terminal failed, not pending. Store contract validation, both MSIX builds and the bundle passed. Hosted Shared: 4,676 passed / 8 skipped; Tray: 4,474 passed; SetupEngine: 2,425 passed / 1 skipped.

• Three WSL E2E lanes fail before CLI installation because setup pins Node 24.19.0 while the current installer requires 24.22.1+. The identical failure is present on untouched main. Prerequisite #1824 (fix(setup): use a Node runtime accepted by the Gateway installer) is now merged and included through the rebase onto 51f18c1222c996fb6fa2eb4d7e8d668492103a0e. Its hosted run passed all three WSL lanes. That is prerequisite proof, not a passing run of this rebased PR.
• UI lane: five-minute inactivity abort during WinAppSDK bootstrap, last phase UIThreadProc: before bootstrap. The actual hung stack was not retained. This appears unrelated to the release-only diff but is not independently reproduced on base. It remains an unresolved CI hold, not a waived test.

No CI reruns, test skips, timeout increases, or feature-branch code changes were made during this attribution.

Real Behavior Proof

• Environment tested: macOS PowerShell 7 and native Windows ARM64 (Parallels), isolated checkout.
• PR head or commit tested: fresh focused checks on da421cf9fff21e04f8f43a14b418314c11d9938f; earlier native closeout on acd47fc955f668c8c440fe0b2139d759c826eaee.
• Exact steps or command run: production publisher driven by deterministic HTTP/upload fixtures; source resolver driven by success/forbidden/stale fixtures. Commands listed above.
• Evidence after fix: publisher fixtures pass; 22 source-authorization cases pass. Live read-only resolver rejected ordinary main CI as ineligible.
• Observed result: exact-ID commit acceptance, product binding, metadata preservation, server-populated package tolerance, and denial of fork/alpha/expired/mismatched sources.
• Screenshot or artifact links verified? N/A, no UI change.
• Not verified or blocked: live GitHub OIDC exchange and Partner Center permissions/upload/commit, certification, and Store-signed install/upgrade. CommitStarted is acceptance, not completed publication. Automatic activation remains disabled pending these deployment gates.

Security Impact

• New permissions or capabilities? Yes, OIDC-backed Store submission in a dedicated protected job.
• Secrets or tokens handling changed? Yes, short-lived file-backed assertions, cleanup, and masked access tokens; no Store client secret.
• New or changed network calls? Yes, Entra OAuth, Dev Center submission API, and returned Azure upload URL.
• Command or tool execution surface changed? Yes, manual workflow_dispatch accepts only a numeric source run ID, not source code or an artifact URL.
• Data access scope changed? Yes, the dedicated Partner Center product writer.
• Mitigation: trusted main workflow, successful canonical release provenance, stable tag/commit/hash binding, environment protection, exclusive OIDC writer, serialized publication, product identity check, exact owned-draft operations, and staged activation.

Compatibility and Migration

• Backward compatible? Yes. Existing release paths and handoff artifacts remain; old Node runs without the new release witness cannot be submitted by this workflow.
• Config or environment changes? Yes.
• Migration needed? Yes, one-time deployment configuration before activation.
• Verified admin state: all three MSSTORE_* environment variables and the dedicated Entra app/federated credential already exist; the app has no passwords or certificates. The microsoft-store deployment policy has now been changed from tags-only to the main branch. Verify Partner Center Manager (Windows) assignment, published product baseline, and absence of a pending draft. After manual rehearsal and lifecycle acceptance, set repository MSSTORE_ENABLED=true. No matching organization-level Store secrets/variables were found.

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[RomneyDa]

Non-git authority boundary is now provisioned: the microsoft-store environment exists with custom deployment policies enabled and exactly one rule, tag pattern v* (type: tag, policy 60757246). No Partner Center identifiers or credentials were added. The workflow still independently rejects prereleases and waits for the GitHub release job before Store mutation.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 28, 2026, 1:59 PM ET / 17:59 UTC (Revision 8).

ClawSweeper review

What this changes

The branch adds a stable-release job that uploads the validated Windows app bundle to Microsoft Store using GitHub OIDC, with submission checks, release documentation, and contract tests.

Merge readiness

⛔ Blocked before merge - 9 items remain

The PR remains useful: current main still leaves Partner Center submission manual. Two Store API contract defects remain on the reviewed head, and automated publication should wait for a real Partner Center rehearsal and release activation decision.

Priority: P2
Reviewed head: ca0048158ec3b1f7d6c5768396e1a96978e14f28
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The branch has useful release safeguards and substantial tests, but two API contract blockers and missing authority final-effect proof limit merge confidence.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: Authority-chain proof required: The new release job obtains an OIDC assertion and the production publisher uses the resulting token to upload and commit a Store draft. The submitted test drives that script through OAuth, Store API, and upload doubles; the stated unprovisioned account provides no real allowed-versus-forbidden final-effect trace. Record a redacted Partner Center rehearsal and signed install/upgrade acceptance, using the applicable proof-pool IDs. No existing stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: Authority-chain proof required: The new release job obtains an OIDC assertion and the production publisher uses the resulting token to upload and commit a Store draft. The submitted test drives that script through OAuth, Store API, and upload doubles; the stated unprovisioned account provides no real allowed-versus-forbidden final-effect trace. Record a redacted Partner Center rehearsal and signed install/upgrade acceptance, using the applicable proof-pool IDs. No existing stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	12 items	Introduced release job: The pinned PR delta adds a stable-only Store job after the GitHub release and grants it OIDC token permission. Conditional metadata handling: The publisher requires every field in its metadata hash list, including TargetPublishDate, even for immediate publication. Post-upload comparison: The publisher compares the complete package and delivery-option response after upload with the earlier PUT response and aborts on any difference.
Findings	2 actionable findings	[P2] Allow conditional Store metadata to be absent [P2] Compare intended package changes after upload
Security	Needs attention	Verify the publishing identity at the final Store effect: The tag gate and exclusive writer policy are asserted in workflow, documentation, and discussion, while the Entra credential and Partner Center account are not yet provisioned. A redacted rehearsal must show the permitted release identity reaching the intended submission and a forbidden or invalidated identity being rejected before Store mutation.

How this fits together

The release workflow builds and publishes Windows packages to GitHub. This PR adds a later job that takes the validated bundle, obtains a short-lived publishing identity, and submits an update to Partner Center.

flowchart LR
A[Stable release tag] --> B[Validated Windows bundle]
B --> C[GitHub release]
C --> D{Store job eligible?}
D -->|Yes| E[OIDC publishing identity]
E --> F[Partner Center draft]
F --> G[Store submission]
D -->|No| H[GitHub release only]

Loading

Decision needed

Question	Recommendation
Should the Store submission job become active for stable tags before the Partner Center identity and signed-install acceptance are complete?	Stage activation: Keep automatic Store mutation gated until the account is provisioned and a real submission rehearsal and signed-install checks pass.

Why: The release-owner direction favors Store as an additional channel, but the current environment prerequisites and rollout acceptance remain incomplete; only a release owner can authorize when automatic Store mutation begins.

Before merge

• Add real behavior proof - Needs real behavior proof before merge: Authority-chain proof required: The new release job obtains an OIDC assertion and the production publisher uses the resulting token to upload and commit a Store draft. The submitted test drives that script through OAuth, Store API, and upload doubles; the stated unprovisioned account provides no real allowed-versus-forbidden final-effect trace. Record a redacted Partner Center rehearsal and signed install/upgrade acceptance, using the applicable proof-pool IDs. No existing stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Allow conditional Store metadata to be absent (P2) - The metadata hash calls Get-RequiredProperty for TargetPublishDate even when TargetPublishMode is Immediate. Microsoft defines that date for SpecificDate publication, so a valid response omitting it aborts submission before the draft is prepared. Treat absent conditional fields consistently in both snapshots and add a fixture that omits them.
• Compare intended package changes after upload (P2) - The full mutation hash assumes the post-upload GET exactly matches the PUT response. Partner Center can populate package fields or change package status, so a valid upload can be rejected and its draft deleted before commit. Compare the intended file and delivery settings while allowing documented server-owned changes, then cover that response in the fixture.
• Resolve security concern: Verify the publishing identity at the final Store effect - The tag gate and exclusive writer policy are asserted in workflow, documentation, and discussion, while the Entra credential and Partner Center account are not yet provisioned. A redacted rehearsal must show the permitted release identity reaching the intended submission and a forbidden or invalidated identity being rejected before Store mutation.
• Resolve merge risk (P1) - The next eligible stable tag will start the Store job after the GitHub release succeeds, while the PR discussion says the Store identifiers and federated credential are not provisioned; the release workflow would then finish with a failed Store channel.
• Resolve merge risk (P1) - The exclusive OIDC writer and draft ownership policy have only deterministic-double coverage. There is no redacted final-effect trace showing that an allowed release can commit and the nearest forbidden or invalidated identity cannot reach Partner Center mutation.
• Resolve merge risk (P1) - Automated Store submission would advance distribution before the signed clean-install and upgrade acceptance tracked for Store rollout is recorded.
• Complete next step (P2) - Repair the two API contract findings, update the PR's proof-pool declaration, provide redacted allowed and denied Partner Center final-effect proof, and obtain release activation approval. Updating the PR body should trigger a fresh ClawSweeper review; if it does not, ask a maintainer to comment @clawsweeper re-review.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [P2] Allow conditional Store metadata to be absent — scripts/Submit-MicrosoftStore.ps1:54-62
• [P2] Compare intended package changes after upload — scripts/Submit-MicrosoftStore.ps1:270-272
• [medium] Verify the publishing identity at the final Store effect — .github/workflows/ci.yml:1437

Agent review details

Security

Needs attention: The diff avoids stored client secrets, but the new OIDC-to-Partner-Center publishing boundary still lacks real allowed and denied final-effect evidence.

Review metrics

Metric	Value	Why it matters
Code and validation growth	production +503, tests +342, docs net +56 lines	The new release publisher justifies substantial code, but its API contract still needs live validation.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #1375
Summary: This PR is a candidate for the automated submission part of the broader open Store distribution work; that issue retains separate rollout and lifecycle gates.

Members:

• canonical: Enable Microsoft Store distribution (lift the MSIX publish pause) #1375 - The issue explicitly tracks lifting the Store distribution pause, including Partner Center and signed lifecycle acceptance.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Stage Store activation (recommended)
   Repair the Partner Center response handling, keep the publishing job gated, and enable it after a real identity and submission rehearsal.
2. Pause the publishing change
   Leave GitHub release asset publication in place while the wider Store rollout issue collects lifecycle and account acceptance.

Technical review

Best possible solution:

Keep Store publishing staged until the publisher tolerates valid Partner Center responses, the identity and Store account are provisioned, and a redacted live rehearsal plus signed-install acceptance supports activation.

Do we have a high-confidence way to reproduce the issue?

No. The new publisher is absent on current main, and the PR shows deterministic API doubles rather than a Partner Center response or final-effect rehearsal.

Is this the best way to solve the issue?

No, not yet. Submission-ID-bound publishing is a sensible direction, but valid conditional metadata and server-populated package fields need narrower checks before activation.

Full review comments:

• [P2] Allow conditional Store metadata to be absent — scripts/Submit-MicrosoftStore.ps1:54-62
  The metadata hash calls Get-RequiredProperty for TargetPublishDate even when TargetPublishMode is Immediate. Microsoft defines that date for SpecificDate publication, so a valid response omitting it aborts submission before the draft is prepared. Treat absent conditional fields consistently in both snapshots and add a fixture that omits them.
  Confidence: 0.88
• [P2] Compare intended package changes after upload — scripts/Submit-MicrosoftStore.ps1:270-272
  The full mutation hash assumes the post-upload GET exactly matches the PUT response. Partner Center can populate package fields or change package status, so a valid upload can be rejected and its draft deleted before commit. Compare the intended file and delivery settings while allowing documented server-owned changes, then cover that response in the fixture.
  Confidence: 0.84

Overall correctness: patch is incorrect
Overall confidence: 0.89

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 3331b5e38876.

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a bounded release-channel improvement with material pre-activation work, rather than an active user runtime outage.
• merge-risk: 🚨 compatibility: Automatic Store submission can change the existing stable-release process and advance distribution before upgrade acceptance.
• merge-risk: 🚨 automation: The new post-release job will fail on an eligible stable tag while its acknowledged environment identifiers and credential remain absent.
• merge-risk: 🚨 security-boundary: The new OIDC publishing identity reaches Store mutation, but allowed and forbidden final effects have not been observed in the real authority setup.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Authority-chain proof required: The new release job obtains an OIDC assertion and the production publisher uses the resulting token to upload and commit a Store draft. The submitted test drives that script through OAuth, Store API, and upload doubles; the stated unprovisioned account provides no real allowed-versus-forbidden final-effect trace. Record a redacted Partner Center rehearsal and signed install/upgrade acceptance, using the applicable proof-pool IDs. No existing stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Verify the publishing identity at the final Store effect — .github/workflows/ci.yml:1437
  The tag gate and exclusive writer policy are asserted in workflow, documentation, and discussion, while the Entra credential and Partner Center account are not yet provisioned. A redacted rehearsal must show the permitted release identity reaching the intended submission and a forbidden or invalidated identity being rejected before Store mutation.
  Confidence: 0.86

What I checked:

• Introduced release job: The pinned PR delta adds a stable-only Store job after the GitHub release and grants it OIDC token permission. (.github/workflows/ci.yml:1425, ca0048158ec3)
• Conditional metadata handling: The publisher requires every field in its metadata hash list, including TargetPublishDate, even for immediate publication. (scripts/Submit-MicrosoftStore.ps1:62, ca0048158ec3)
• Post-upload comparison: The publisher compares the complete package and delivery-option response after upload with the earlier PUT response and aborts on any difference. (scripts/Submit-MicrosoftStore.ps1:270, ca0048158ec3)
• Fixture coverage gap: The deterministic fixture always supplies the conditional metadata fields and models package mutation as an extra competing package, rather than a Partner Center populated field or status transition. (scripts/test-microsoft-store-submission.ps1:31, ca0048158ec3)
• Partner Center contract: Microsoft documents TargetPublishDate only for SpecificDate publication, and says Partner Center populates additional package fields. Its documented package states include PendingUpload and Uploaded: https://learn.microsoft.com/en-us/windows/uwp/monetize/manage-app-submissions.
• Current main boundary: Current main still describes the bundle as a manual Partner Center submission input and says Store distribution remains paused. (docs/RELEASING.md:373, 3331b5e38876)

Likely related people:

• Dallin Romney: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Natalie Aguinaldo: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Scott Hanselman: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Cover omitted conditional metadata and realistic Partner Center package fields after upload.
• Add final-effect proof for the allowed release identity and nearest forbidden identity, including invalidated draft authority before Store I/O; redact credentials, endpoints, and private details.
• Declare the applicable repository proof-pool IDs and record signed clean-install and upgrade acceptance before activation.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (7 earlier review cycles)

• reviewed 2026-09-23T01:44:48.794Z sha 859accb :: needs real behavior proof before merge. :: [P1] [P1] Prevent the publisher from deleting a competing draft | [P1] [P1] Commit the exact submission that passed verification | [P2] [P2] Refresh the assertion before post-upload authentication
• reviewed 2026-09-23T01:59:50.596Z sha dce6f96 :: needs real behavior proof before merge. :: [P2] Exclude generated submission names from preserved product metadata | [P2] Include the required package compatibility fields
• reviewed 2026-09-23T02:14:01.599Z sha bd91ae5 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T02:23:02.356Z sha 549b2c3 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T07:27:45.813Z sha 549b2c3 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T07:48:48.141Z sha ca00481 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T18:45:45.885Z sha ca00481 :: needs real behavior proof before merge. :: [P2] Allow conditional Store metadata to be absent | [P2] Compare intended package mutations after upload

[RomneyDa]

Addressed the accepted ClawSweeper findings on e70e101b:

• removed the high-level CLI publication path that could delete an unowned draft
• use explicit submission-ID Dev Center API operations for create, update, verification, cleanup, and commit
• commit cannot select a replacement draft; interleaving coverage proves a competing draft remains untouched
• exchange OIDC once for an access token whose lifetime must exceed upload timeout plus five minutes
• recorded the release-owner decision: Store remains an additional stable/correction channel; alpha stays GitHub-only
• live GitHub environment is restricted to v* tags

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: A newer review tuple already exists; this stale result was superseded.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35808298879
• Updated: 2026-09-23T01:55:58.333Z

[RomneyDa]

Pushed dce6f967: the exact owned draft now records a canonical hash of ApplicationPackages and PackageDeliveryOptions after update, re-reads that same submission ID after upload, and refuses to commit if the package mutation state changed. Regression coverage proves a same-ID competing package mutation is cleaned up without commit.

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35808673648
• Updated: 2026-09-23T02:01:25.243Z

[RomneyDa]

Accepted and fixed both API-contract findings at 8f40af6b:

• Excluded Store-generated per-submission FriendlyName from the cross-submission metadata hash; the fixture now assigns a distinct generated draft name.
• Added minimumDirectXVersion: None and minimumSystemRam: None; the transport fixture rejects a PUT that omits either field.

Focused Store and workflow contract tests pass. The live microsoft-store environment has the exact v* deployment policy but intentionally has no credentials/identifiers yet, so a production Partner Center mutation cannot be fabricated as PR proof.

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Waiting
• Detail: A newer exact-review queue owner superseded this run. This run completed as a no-op.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35808877254
• Updated: 2026-09-23T02:07:11.385Z

[RomneyDa]

Recorded the final-commit owner decision at bd91ae54: submissionWriterPolicy now requires an exclusive GitHub-environment writer. Setup requires the dedicated Entra app to have only the documented federated subject—no client secret, certificate, other subject, or shared publisher—and forbids Partner Center edits to API-created drafts. GitHub concurrency serializes that sole writer. Microsoft documents that a Partner Center edit invalidates later API update/commit operations: https://learn.microsoft.com/windows/uwp/monetize/manage-app-submissions

The policy is required by the production script and deterministic contract tests. The external environment still needs its identifiers and federated credential before genuine Partner Center final-effect proof can exist.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[RomneyDa]

Proactively fixed the late commit-status defect at 549b2c3b: only CommitStarted is accepted. CommitFailed, Canceled, PendingCommit, empty, and unknown statuses now fail before success evidence; the owned draft remains eligible for cleanup. Regression coverage exercises CommitFailed, verifies exactly one commit attempt, and proves cleanup.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35810189379
• Updated: 2026-09-23T02:24:46.283Z

[karkarl]

Global triage: NEEDS_HUMAN_TEST. Take confidence 12%; recommendation confidence 93%; effort medium-to-large; risk high.

Reviewed exact head ca0048158ec3. OIDC secret handling, stable-only routing, bundle enforcement, commit-ambiguity handling, and token lifetime are strong. Blockers: Get-RequiredProperty throws when normal Partner Center responses omit optional fields while tests always materialize them, and exact post-upload mutation-hash equality can abort after Partner Center legitimately changes package status. The Store environment is not provisioned, so stable tags would fail after GitHub release publication. Coordinate with active owner @RomneyDa. Require a real Partner Center rehearsal and windows-clean-installer-upgrade; restate proof pools using repository IDs.

[shanselman]

Ownership audit: no active maintainer or agent session is driving this draft, and its Partner Center contract/proof blockers remain open. Removing the stale active-landing label until work resumes.

[github-actions]

This pull request has been automatically marked as stale due to inactivity.
Please update it or it will be closed.

[shanselman]

@RomneyDa I’m an automated assistant acting on Scott’s behalf for this backlog cleanup.

There is strong work in this draft, especially around OIDC, stable-only routing, bundle enforcement, and ambiguous submission handling. Before we decide whether it belongs in the active queue, what is your plan for it? Do you intend to continue it and have access to the Partner Center environment needed to resolve the remaining API-contract issues and run real end-to-end proof, or would you prefer that we close it for now and preserve the branch until that ownership and environment exist?

Either answer is completely reasonable. We mainly want the open PR list to reflect work that has a realistic path to completion.

[clawsweeper]

ClawSweeper reviews are opt-in for maintainers. If a review is required, finish the work and validation first, then comment @clawsweeper review. Please avoid repeated requests while a review is queued or running; agents should not request reviews automatically.