fix: use valid workflow CODEOWNERS

[vincentkoc]

Summary

• replace the ineligible team CODEOWNER with the valid individual owners @vincentkoc and @steipete
• update the ownership contract assertions and changelog wording
• leave repository access and both rulesets unchanged

Validation

• node scripts/test-required-workflows.mjs
• scripts/validate-workflows.sh
• git diff --check

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[vincentkoc]

@clawsweeper review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32351238176
• Updated: 2026-08-20T08:55:47.764Z

[clawsweeper]

Codex review: found issues before merge. Reviewed August 20, 2026, 4:52 AM ET / 08:52 UTC.

ClawSweeper review

What this changes

The PR replaces the workflow CODEOWNERS team with @vincentkoc and @steipete, updates the matching contract assertions, and revises an Unreleased changelog line.

Merge readiness

⚠️ Ready for maintainer review - 5 items remain

This is a focused correction to the protected workflow ownership contract. Keep it open for explicit confirmation that the new individual-owner roster intentionally replaces the security-team route.

Priority: P2
Reviewed head: 2ea8c2176f2ef8e34efa3e9161e7c67cbf65cdd7
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The patch is focused and keeps the ownership assertion synchronized; merge readiness depends on owner confirmation of the security-review roster.
Proof confidence	🌊 off-meta tidepool	Not applicable: This MEMBER-authored metadata-only PR is not subject to the external-contributor real-behavior-proof gate; the successful validation check is supplemental.
Patch quality	🐚 platinum hermit (4/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This MEMBER-authored metadata-only PR is not subject to the external-contributor real-behavior-proof gate; the successful validation check is supplemental.
Evidence reviewed	3 items	Current ownership contract: Current main assigns the four protected paths to the security team plus @vincentkoc, while the test asserts those exact entries. Proposed scope: The branch changes only CODEOWNERS, its exact-match contract assertions, and one changelog line; workflow definitions and rulesets are unchanged. Feature provenance: The current-main ownership update and earlier ruleset-protection work both appear in Vincent Koc's history on this surface.
Findings	1 actionable finding	[P3] Remove the release-owned changelog edit
Security	Needs attention	Confirm replacement CODEOWNER eligibility: All four protected paths lose the current security-team owner; GitHub must confirm both individual accounts are eligible and policy intends the team route to be removed.

Live Verification

Command: node scripts/test-required-workflows.mjs

Result: FAIL (failed) — execution before step 1 run: sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

Assertions:

• FAIL expect_output: required workflow contracts passed

How this fits together

Release-workflows protects reusable release workflows with GitHub CODEOWNERS and a local assertion script. Those rules route reviews for workflow and validation-script changes before release automation can be modified.

flowchart LR
  A[Protected workflow files] --> B[CODEOWNERS rules]
  B --> C[GitHub review routing]
  B --> D[Ownership contract test]
  D --> E[Validation workflow]
  E --> F[Release workflow changes]

Loading

Decision needed

Question	Recommendation
Should the protected workflow paths replace @openclaw/openclaw-secops with @vincentkoc and @steipete as their complete CODEOWNERS roster?	Approve the individual-owner roster: Merge after confirming both accounts are eligible owners and the team route is intentionally no longer required.

Why: This changes the review boundary for release-workflow trust anchors, and repository source cannot establish GitHub access eligibility or the intended security-review policy.

Before merge

• Remove the release-owned changelog edit (P3) - CHANGELOG.md is release-owned for this repository, so this normal PR should leave its Unreleased entry to the release process. Keep the ownership correction and contract assertions focused on their protected-path boundary.
• Resolve security concern: Confirm replacement CODEOWNER eligibility - All four protected paths lose the current security-team owner; GitHub must confirm both individual accounts are eligible and policy intends the team route to be removed.
• Resolve merge risk (P1) - Merging removes the existing security-team CODEOWNER from all protected workflow paths; source alone cannot establish that both replacement accounts are eligible and intended to satisfy the repository ruleset.
• Complete next step (P2) - The mechanical change is clear, but the new protected-path review boundary requires explicit owner confirmation before merge.

Findings

• [P3] Remove the release-owned changelog edit — CHANGELOG.md:7
• [medium] Confirm replacement CODEOWNER eligibility — .github/CODEOWNERS:2

Agent review details

Security

Needs attention: The diff adds no executable or supply-chain code, but it changes the security-sensitive reviewer boundary for protected release workflows.

Review metrics

Metric	Value	Why it matters
Ownership contract surface	3 files affected; 9 additions, 9 deletions	Four protected-path ownership rules and their exact-match assertions change together.

Merge-risk options

Maintainer options:

1. Confirm GitHub eligibility before merge (recommended)
   Verify the two individual accounts are eligible CODEOWNERS and that ruleset enforcement accepts the intended review boundary.

Technical review

Best possible solution:

Adopt the two individual owners only after confirming both accounts are eligible for every protected path and that replacing the security-team review route is intentional.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is repository ownership metadata, not a runtime behavior with an end-user reproduction path.

Is this the best way to solve the issue?

Yes, conditionally: updating the rules and exact-match contract together is the narrowest repair, provided the replacement roster is the intended eligible GitHub boundary.

Full review comments:

• [P3] Remove the release-owned changelog edit — CHANGELOG.md:7
  CHANGELOG.md is release-owned for this repository, so this normal PR should leave its Unreleased entry to the release process. Keep the ownership correction and contract assertions focused on their protected-path boundary.
  Confidence: 0.95

Overall correctness: patch is correct
Overall confidence: 0.95

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 2b2138982aeb.

Labels

Label changes:

• add P2: Protected release-workflow review routing changes and needs normal-priority human confirmation.
• add merge-risk: 🚨 compatibility: Existing protected-path review routing changes from a team plus one individual to two individuals.
• add merge-risk: 🚨 security-boundary: CODEOWNERS controls review routing for workflow and validation-script trust anchors.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This MEMBER-authored metadata-only PR is not subject to the external-contributor real-behavior-proof gate; the successful validation check is supplemental.

Label justifications:

• P2: Protected release-workflow review routing changes and needs normal-priority human confirmation.
• merge-risk: 🚨 compatibility: Existing protected-path review routing changes from a team plus one individual to two individuals.
• merge-risk: 🚨 security-boundary: CODEOWNERS controls review routing for workflow and validation-script trust anchors.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This MEMBER-authored metadata-only PR is not subject to the external-contributor real-behavior-proof gate; the successful validation check is supplemental.

Evidence

Security concerns:

• [medium] Confirm replacement CODEOWNER eligibility — .github/CODEOWNERS:2
  All four protected paths lose the current security-team owner; GitHub must confirm both individual accounts are eligible and policy intends the team route to be removed.
  Confidence: 0.96

What I checked:

• Current ownership contract: Current main assigns the four protected paths to the security team plus @vincentkoc, while the test asserts those exact entries. (.github/CODEOWNERS:2, 2b2138982aeb)
• Proposed scope: The branch changes only CODEOWNERS, its exact-match contract assertions, and one changelog line; workflow definitions and rulesets are unchanged. (.github/CODEOWNERS:2, 2ea8c2176f2e)
• Feature provenance: The current-main ownership update and earlier ruleset-protection work both appear in Vincent Koc's history on this surface. (.github/CODEOWNERS:2, 2b2138982aeb)

Likely related people:

• vincentkoc: Authored the current-main ownership update and the earlier ruleset-protection work. (role: feature owner and recent area contributor; confidence: high; commits: 2b2138982aeb, c3ff91272382; files: .github/CODEOWNERS, scripts/test-required-workflows.mjs)
• steipete: The PR names this account as replacement CODEOWNER for every protected path. (role: intended protected-path owner; confidence: medium; files: .github/CODEOWNERS)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Remove the release-owned changelog edit.
• Confirm in GitHub that both named accounts are eligible CODEOWNERS and that the ruleset accepts the intended review boundary.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[vincentkoc]

@clawsweeper re-review

Maintainer decision: approved. Live repository permission checks report both @vincentkoc and @steipete as repository admins. Replacing the ineligible @openclaw/openclaw-secops CODEOWNER token with these two eligible individual owners is intentional. The release-owned changelog edit was removed on head f32ea51; repository access and rulesets 20505981 and 21081758 remain unchanged.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[vincentkoc]

@clawsweeper re-review

Applied the exact-head review artifact finding on head 8125a28: README now names @vincentkoc and @steipete as the approved workflow owners. The diff remains limited to CODEOWNERS, its contract assertions, and matching guidance. CI validate and the focused ownership contract are green; repository access, CHANGELOG.md, and rulesets 20505981 and 21081758 are unchanged.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The item is closed; no stale verdict was published.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32353194414
• Updated: 2026-08-20T09:18:35.120Z

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix: use valid workflow CODEOWNERS This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[vincentkoc]

Exact-head ClawSweeper run https://github.com/openclaw/clawsweeper/actions/runs/32352219099 completed successfully for 8125a28. Its immutable review artifact reports: no findings, security cleared, no rank-up moves, patch correct, and no maintainer decision remaining. The durable public-comment publisher is delayed; this records the exact-head evidence before merge.