feat(release): automate Microsoft Store submission

[RomneyDa]

Summary

• submit the validated multi-architecture OpenClaw.msixbundle to Partner Center after every stable or correction GitHub release
• keep prereleases out of the Store and upload only the bundle, never the duplicate standalone packages
• authenticate with a short-lived GitHub OIDC assertion through the protected microsoft-store environment; no client secret is stored
• reject existing drafts, create a new submission without deleting anything, and bind update, verification, cleanup, and commit to that exact submission ID
• keep API origin/scope, audience, rollout, timeouts, token lifetime, environment, and draft policy in store-submission.json, with 90-day hash/submission evidence

Store activation decision

The release owner requested automated Node app Store publishing as an additional channel; the existing EXE/ZIP GitHub release remains supported. The Store job runs only after that GitHub release succeeds. Stable/correction tags publish to both channels; alpha tags remain GitHub-only.

The live microsoft-store environment now has a custom deployment policy allowing only v* tags. Partner Center identifiers and the Entra federated credential remain deployment prerequisites; no credential was added by this PR.

Required proof pools

• Runtime/UI proof: none — this changes release automation only; no application UI or runtime path changes.
• Windows package proof: existing build-msix and build-msix-bundle jobs remain authoritative and must succeed before Store submission.
• Release boundary proof: workflow-contract and deterministic API tests cover stable-only routing, release dependency, bundle-only upload, OIDC handling, authorization lifetime, draft ownership, interleaving rejection, metadata preservation, exact-ID commit, and owned-draft cleanup.

Validation

Passed locally at e70e101b:

• ./scripts/test-microsoft-store-submission.ps1
• ./scripts/test-ci-workflow-contract.ps1
• ./scripts/test-msix-alpha-release.ps1
• ./scripts/test-msix-bundle.ps1
• ./scripts/test-msix-versioning.ps1
• ./scripts/test-msix-preview-source-version.ps1
• ./scripts/test-ci-change-classifier.ps1
• PowerShell parser validation for all new scripts
• workflow YAML parse
• git diff --check

Host-limited on macOS:

• ./build.ps1 stops at its explicit Windows prerequisite.
• test-msix-ci-artifacts.ps1 requires Windows Export-Certificate.
• shared/tray suites restore and execute, but existing Windows path/process/GDI assumptions fail on macOS; this PR does not change product code.
• validate-docs.ps1 hits the existing macOS backslash-path handling failure for scripts\\validate-mxc-e2e.ps1 in the proof-pool validator.

Windows CI is the authoritative exact-head build, package, and suite proof.

Real behavior proof

test-microsoft-store-submission.ps1 drives the production wrapper through deterministic OAuth, Dev Center API, and Azure upload doubles. It proves the exact production sequence:

1. exchange the file-backed OIDC assertion once and reject an access token that cannot outlive the upload plus a five-minute margin;
2. confirm the intended product, a published submission, and no pending draft;
3. snapshot published metadata and create a new draft without a delete operation;
4. update and upload only OpenClaw.msixbundle to the exact created submission;
5. repeatedly prove the current pending draft still has the owned ID;
6. retrieve that explicit ID, compare canonical metadata, and commit through the explicit-ID API endpoint;
7. write evidence bound to the bundle SHA-256, published ID, draft ID, metadata hashes, and commit status.

Negative cases prove that a pre-existing human draft is untouched, a draft replaced after upload is neither deleted nor committed, metadata drift deletes only the automation-owned draft, a short-lived access token reaches no Store API, and standalone .msix input fails before authentication. OIDC request-URI tests cover endpoints with and without an existing query string.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[RomneyDa]

Non-git authority boundary is now provisioned: the microsoft-store environment exists with custom deployment policies enabled and exactly one rule, tag pattern v* (type: tag, policy 60757246). No Partner Center identifiers or credentials were added. The workflow still independently rejects prereleases and waits for the GitHub release job before Store mutation.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 23, 2026, 2:45 PM ET / 18:45 UTC (Revision 7).

ClawSweeper review

What this changes

The branch adds a stable-release job that submits the validated Windows app bundle to Microsoft Store, with OIDC authentication, submission-ID checks, release documentation, and contract tests.

Merge readiness

⛔ Blocked before merge - 9 items remain

Current main publishes Store-ready bundles as GitHub release assets but does not submit them to Partner Center, so this PR remains useful. The submission path has two API-response handling defects, and its publishing identity and final Store effects remain unproven.

Priority: P2
Reviewed head: ca0048158ec3b1f7d6c5768396e1a96978e14f28
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The branch has focused safeguards and tests, but API-response defects and missing authority final-effect evidence prevent release readiness.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: Authority-chain proof required: The Store job obtains OIDC authority, and the publisher uses it for bundle upload and submission-ID commit. Deterministic replacement callbacks exercise that sequence, but the stated unprovisioned Entra and Partner Center setup provides no allowed-versus-forbidden final-effect trace or invalidated-draft rehearsal. MEMBER authorship exempts unrelated runtime proof. No existing stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: Authority-chain proof required: The Store job obtains OIDC authority, and the publisher uses it for bundle upload and submission-ID commit. Deterministic replacement callbacks exercise that sequence, but the stated unprovisioned Entra and Partner Center setup provides no allowed-versus-forbidden final-effect trace or invalidated-draft rehearsal. MEMBER authorship exempts unrelated runtime proof. No existing stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	11 items	Current main boundary: Current main stages Store bundle assets for the GitHub release, while the Store submission script and job are absent. Introduced Store job: The introduced job depends on the GitHub release, requests OIDC authority, downloads the validated bundle, and calls the new publisher. Conditional metadata failure: The metadata hash requires every listed property, including TargetPublishDate, before it creates a draft; the test fixture always supplies that property.
Findings	2 actionable findings	[P2] Allow conditional Store metadata to be absent [P2] Compare intended package mutations after upload
Security	Needs attention	Verify the Store publishing authority at the final effect: The workflow requests an OIDC assertion that becomes a Partner Center upload and commit token. The dedicated federation is not configured yet, so the claimed exclusive writer boundary and rejection of a forbidden identity remain unverified.

How this fits together

Release CI builds and validates a Windows bundle, then publishes a GitHub release. The proposed Store job takes that bundle and release result, obtains publishing authority, and sends a submission to Partner Center.

flowchart LR
  A[Release tag] --> B[Validated Windows bundle]
  B --> C[GitHub release]
  C --> D{Stable or correction?}
  D -->|Yes| E[OIDC publishing identity]
  E --> F[Partner Center draft]
  F --> G[Bundle upload and commit]
  D -->|No| H[GitHub release only]

Loading

Decision needed

Question	Recommendation
Should automatic Store submission be enabled for the next stable release before the dedicated Partner Center identity and signed-upgrade rehearsal are complete?	Hold activation for rehearsal: Complete the external identity setup and final-effect and signed-upgrade proofs before enabling the Store job.

Why: The job publishes through an external account after the GitHub release succeeds; code review cannot supply the account setup or authorize the first production rollout.

Before merge

• Add real behavior proof - Needs real behavior proof before merge: Authority-chain proof required: The Store job obtains OIDC authority, and the publisher uses it for bundle upload and submission-ID commit. Deterministic replacement callbacks exercise that sequence, but the stated unprovisioned Entra and Partner Center setup provides no allowed-versus-forbidden final-effect trace or invalidated-draft rehearsal. MEMBER authorship exempts unrelated runtime proof. No existing stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Allow conditional Store metadata to be absent (P2) - Late discovery on the unchanged head: Microsoft documents targetPublishDate for SpecificDate mode, but this hash requires it even for an immediate-publish response. A valid response that omits the conditional field throws before draft creation. Treat absent conditional fields consistently in both hashes and cover that response shape.
• Compare intended package mutations after upload (P2) - Late discovery on the unchanged head: Partner Center can populate package status and other package values. If those values change after the SAS upload, hashing the entire response rejects and deletes an otherwise valid draft before commit. Compare stable intended inputs and cover a service-populated post-upload response.
• Resolve security concern: Verify the Store publishing authority at the final effect - The workflow requests an OIDC assertion that becomes a Partner Center upload and commit token. The dedicated federation is not configured yet, so the claimed exclusive writer boundary and rejection of a forbidden identity remain unverified.
• Resolve merge risk (P1) - The Store job would run after a successful stable GitHub release, but the required Partner Center identifiers and Entra federation are not configured; Store publication would fail until deployment is completed.
• Resolve merge risk (P1) - The new OIDC identity can authorize Store upload and commit, but there is no real final-effect evidence that the intended release identity succeeds and the nearest forbidden identity or invalidated draft cannot reach those effects.
• Resolve merge risk (P1) - Automatic Store distribution could expose existing Store users to a new signed package upgrade without the repository's clean-install and previous-version-upgrade acceptance evidence.
• Complete next step (P2) - Repair the two API-response guards, then complete Store identity setup and redacted allowed/forbidden final-effect and signed-upgrade proof before merge. Updating the PR body should trigger re-review; if it does not, ask a maintainer to comment @clawsweeper re-review.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [P2] Allow conditional Store metadata to be absent — scripts/Submit-MicrosoftStore.ps1:62
• [P2] Compare intended package mutations after upload — scripts/Submit-MicrosoftStore.ps1:281-283
• [medium] Verify the Store publishing authority at the final effect — .github/workflows/ci.yml:1479

Agent review details

Security

Needs attention: The OIDC and explicit-ID design limits authority, but the external federation and forbidden-identity final effects have not been verified.

Review metrics

Metric	Value	Why it matters
Release automation growth	automation/config +503, tests +342, docs +66/-10 lines	The new API owner has substantial deterministic coverage, but its external publishing path still needs a real rehearsal.

Merge-risk options

Maintainer options:

1. Repair and rehearse before activation (recommended)
   Fix the response handling, configure the exclusive Store identity, and capture final-effect and signed-upgrade evidence before enabling automatic submission.
2. Pause Store automation
   Keep the GitHub release asset path while the external publishing and upgrade requirements remain unresolved.

Technical review

Best possible solution:

Keep submission-ID-bound publishing, handle conditional and service-populated API fields safely, then enable the Store job after identity, final-effect, and signed-upgrade acceptance are demonstrated.

Do we have a high-confidence way to reproduce the issue?

No live Partner Center reproduction is available. The source and API contract identify response shapes that reach the two failure paths, while the supplied tests use fixed response doubles.

Is this the best way to solve the issue?

No, not yet. ID-bound operations are appropriate, but conditional metadata and service-populated package values need safer comparisons before the first automated submission.

Full review comments:

• [P2] Allow conditional Store metadata to be absent — scripts/Submit-MicrosoftStore.ps1:62
  Late discovery on the unchanged head: Microsoft documents targetPublishDate for SpecificDate mode, but this hash requires it even for an immediate-publish response. A valid response that omits the conditional field throws before draft creation. Treat absent conditional fields consistently in both hashes and cover that response shape.
  Confidence: 0.83
  Late finding: first raised on code an earlier review cycle already covered.
• [P2] Compare intended package mutations after upload — scripts/Submit-MicrosoftStore.ps1:281-283
  Late discovery on the unchanged head: Partner Center can populate package status and other package values. If those values change after the SAS upload, hashing the entire response rejects and deletes an otherwise valid draft before commit. Compare stable intended inputs and cover a service-populated post-upload response.
  Confidence: 0.78
  Late finding: first raised on code an earlier review cycle already covered.

Overall correctness: patch is incorrect
Overall confidence: 0.84

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a2c4647d4289.

Labels

Label changes:

• add merge-risk: 🚨 compatibility: Automatic submission could deliver a new Store-signed upgrade to existing users without signed-upgrade acceptance evidence.

Label justifications:

• P2: This is a bounded release-channel improvement; GitHub EXE and ZIP publication remains available.
• merge-risk: 🚨 automation: Valid Store responses or absent deployment identifiers could fail the new post-release submission job.
• merge-risk: 🚨 security-boundary: The new OIDC authority reaches Partner Center upload and commit without final-effect proof for allowed and forbidden identities.
• merge-risk: 🚨 compatibility: Automatic submission could deliver a new Store-signed upgrade to existing users without signed-upgrade acceptance evidence.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Authority-chain proof required: The Store job obtains OIDC authority, and the publisher uses it for bundle upload and submission-ID commit. Deterministic replacement callbacks exercise that sequence, but the stated unprovisioned Entra and Partner Center setup provides no allowed-versus-forbidden final-effect trace or invalidated-draft rehearsal. MEMBER authorship exempts unrelated runtime proof. No existing stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Verify the Store publishing authority at the final effect — .github/workflows/ci.yml:1479
  The workflow requests an OIDC assertion that becomes a Partner Center upload and commit token. The dedicated federation is not configured yet, so the claimed exclusive writer boundary and rejection of a forbidden identity remain unverified.
  Confidence: 0.86

What I checked:

• Current main boundary: Current main stages Store bundle assets for the GitHub release, while the Store submission script and job are absent. (.github/workflows/ci.yml:1304, a2c4647d4289)
• Introduced Store job: The introduced job depends on the GitHub release, requests OIDC authority, downloads the validated bundle, and calls the new publisher. (.github/workflows/ci.yml:1427, ca0048158ec3)
• Conditional metadata failure: The metadata hash requires every listed property, including TargetPublishDate, before it creates a draft; the test fixture always supplies that property. (scripts/Submit-MicrosoftStore.ps1:62, ca0048158ec3)
• Partner Center response contract: Microsoft documents targetPublishDate for SpecificDate mode and describes package status plus other package values populated by Partner Center: https://learn.microsoft.com/en-us/windows/uwp/monetize/manage-app-submissions.
• Post-upload equality check: The publisher hashes the full package and delivery-options responses before upload and rejects any difference after upload, including service-populated package fields. (scripts/Submit-MicrosoftStore.ps1:281, ca0048158ec3)
• Deterministic proof scope: The test invokes the production script through replacement OAuth, Store API, and upload callbacks; its fixture does not model omitted conditional metadata or service-populated package changes. (scripts/test-microsoft-store-submission.ps1:26, ca0048158ec3)

Likely related people:

• Dallin Romney: Raw commit 67f6aa5 adds scripts/Build-StoreMsixBundle.ps1:3 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 67f6aa5882db; files: scripts/Build-StoreMsixBundle.ps1)
• natalie-aguinaldo: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• karkarl: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Cover omitted conditional metadata and realistic Partner Center package fields after upload.
• Add redacted final-effect evidence for the allowed release identity, nearest forbidden identity, and invalidated draft before I/O.
• Record completed identity prerequisites and signed clean-install and upgrade acceptance; redact private endpoints, credentials, and other private details.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)

• reviewed 2026-09-23T01:44:48.794Z sha 859accb :: needs real behavior proof before merge. :: [P1] [P1] Prevent the publisher from deleting a competing draft | [P1] [P1] Commit the exact submission that passed verification | [P2] [P2] Refresh the assertion before post-upload authentication
• reviewed 2026-09-23T01:59:50.596Z sha dce6f96 :: needs real behavior proof before merge. :: [P2] Exclude generated submission names from preserved product metadata | [P2] Include the required package compatibility fields
• reviewed 2026-09-23T02:14:01.599Z sha bd91ae5 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T02:23:02.356Z sha 549b2c3 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T07:27:45.813Z sha 549b2c3 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T07:48:48.141Z sha ca00481 :: needs real behavior proof before merge. :: none

[RomneyDa]

Addressed the accepted ClawSweeper findings on e70e101b:

• removed the high-level CLI publication path that could delete an unowned draft
• use explicit submission-ID Dev Center API operations for create, update, verification, cleanup, and commit
• commit cannot select a replacement draft; interleaving coverage proves a competing draft remains untouched
• exchange OIDC once for an access token whose lifetime must exceed upload timeout plus five minutes
• recorded the release-owner decision: Store remains an additional stable/correction channel; alpha stays GitHub-only
• live GitHub environment is restricted to v* tags

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: A newer review tuple already exists; this stale result was superseded.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35808298879
• Updated: 2026-09-23T01:55:58.333Z

[RomneyDa]

Pushed dce6f967: the exact owned draft now records a canonical hash of ApplicationPackages and PackageDeliveryOptions after update, re-reads that same submission ID after upload, and refuses to commit if the package mutation state changed. Regression coverage proves a same-ID competing package mutation is cleaned up without commit.

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35808673648
• Updated: 2026-09-23T02:01:25.243Z

[RomneyDa]

Accepted and fixed both API-contract findings at 8f40af6b:

• Excluded Store-generated per-submission FriendlyName from the cross-submission metadata hash; the fixture now assigns a distinct generated draft name.
• Added minimumDirectXVersion: None and minimumSystemRam: None; the transport fixture rejects a PUT that omits either field.

Focused Store and workflow contract tests pass. The live microsoft-store environment has the exact v* deployment policy but intentionally has no credentials/identifiers yet, so a production Partner Center mutation cannot be fabricated as PR proof.

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Waiting
• Detail: A newer exact-review queue owner superseded this run. This run completed as a no-op.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35808877254
• Updated: 2026-09-23T02:07:11.385Z

[RomneyDa]

Recorded the final-commit owner decision at bd91ae54: submissionWriterPolicy now requires an exclusive GitHub-environment writer. Setup requires the dedicated Entra app to have only the documented federated subject—no client secret, certificate, other subject, or shared publisher—and forbids Partner Center edits to API-created drafts. GitHub concurrency serializes that sole writer. Microsoft documents that a Partner Center edit invalidates later API update/commit operations: https://learn.microsoft.com/windows/uwp/monetize/manage-app-submissions

The policy is required by the production script and deterministic contract tests. The external environment still needs its identifiers and federated credential before genuine Partner Center final-effect proof can exist.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[RomneyDa]

Proactively fixed the late commit-status defect at 549b2c3b: only CommitStarted is accepted. CommitFailed, Canceled, PendingCommit, empty, and unknown statuses now fail before success evidence; the owned draft remains eligible for cleanup. Regression coverage exercises CommitFailed, verifies exactly one commit attempt, and proves cleanup.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35810189379
• Updated: 2026-09-23T02:24:46.283Z

[karkarl]

Global triage: NEEDS_HUMAN_TEST. Take confidence 12%; recommendation confidence 93%; effort medium-to-large; risk high.

Reviewed exact head ca0048158ec3. OIDC secret handling, stable-only routing, bundle enforcement, commit-ambiguity handling, and token lifetime are strong. Blockers: Get-RequiredProperty throws when normal Partner Center responses omit optional fields while tests always materialize them, and exact post-upload mutation-hash equality can abort after Partner Center legitimately changes package status. The Store environment is not provisioned, so stable tags would fail after GitHub release publication. Coordinate with active owner @RomneyDa. Require a real Partner Center rehearsal and windows-clean-installer-upgrade; restate proof pools using repository IDs.