[devSejung]

What Problem This Solves

Fixes an issue where PlatformClaw inherited explicit approval authority for upstream OpenClaw accounts while its own maintainer iililiiilili could not authorize dependency or security-sensitive changes with a repository write role. Related: #426.

Why This Change Was Made

The repository owner explicitly delegated both guard approvals to iililiiilili and requested removal of upstream approvers. Replace vincentkoc, steipete, and joshavant with iililiiilili in all five workflow approval lists (three Dependency Guard steps and two Security Sensitive Guard steps). Update the two existing workflow assertions.

User Impact

After this reaches main, iililiiilili can authorize changes with /allow-dependencies-change and /allow-security-sensitive-change. Existing trusted-author handling also applies to this account. The repository owner remains authorized through the existing repository-admin check. No GitHub repository role is changed.

Upstream accounts no longer receive authority merely from their usernames. The existing team lookup is scoped to the current repository owner, not the OpenClaw organization. Current-head authorization, trusted-base script execution, and existing CODEOWNERS remain intact. Existing same-head recorded approvals are not retroactively revoked. Automatic comment-triggered reruns and inherited bot wording are outside this change.

Evidence

• Based on main 6591016; four files changed, zero runtime implementation LOC. Workflow config +5/-5; existing tests +2/-4.
• Windows, Node 24: git diff --check and staged whitespace checks passed. Python/PyYAML parsed both workflows and verified all five lists contain only iililiiilili, with matching test assertions and no upstream account names in either workflow.
• Actual createGuardApproverChecks helper, invoked with synthetic GitHub API responses: explicit account accepted, the three upstream accounts denied without a current repository role, and repository-admin authority retained. The first ad hoc probe had an overly broad fixture URL matcher; correcting that fixture to match the collaborator path made the probe pass. This is supplementary function-level proof, not live authorization or a Vitest pass.
• Live GitHub permission reads: devSejung is admin; iililiiilili is write.
• Fresh autoreview --mode uncommitted --base 65910160dbfa268542b0e760855fab61d9ced3af --engine codex --max-priority P2 (GPT-6.1 Sol): scoped-clean. Initial INDEX-only finding was resolved by staging the final candidate, followed by a clean full-candidate review. Published head: 37ec7b4.
• Focused Vitest execution remains unavailable: the existing host toolchain lacks @vitest/utils; Docker Desktop Linux engine is unavailable. No local Vitest or Linux pass is claimed; hosted CI is required. Earlier-head CI is not current-head evidence.

AI-assisted with Codex.