fix: publish automation PR statuses

.github/workflows/maintenance-implementation.yml

@@ -309,6 +309,7 @@ jobs:
       pull-requests: write
       checks: write
       actions: write
+      statuses: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:

.github/workflows/maintenance-release.yml

@@ -26,6 +26,7 @@ permissions:
   actions: write
   checks: write
   pull-requests: write
+  statuses: write
 
 concurrency:
   group: guarded-release-${{ inputs.version }}

.github/workflows/maintenance-watch.yml

@@ -150,6 +150,7 @@ jobs:
       contents: write
       id-token: write
       pull-requests: write
+      statuses: write
       issues: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

docs/repository-settings.md

@@ -38,7 +38,8 @@ Required repository state:
   deterministic PR coordinator explicitly dispatches `ci.yml` and
   `protected-controls.yml` at the exact PR branch, accepts only newly created
   successful validator runs for that head SHA, and only then publishes the
-  Actions-owned required checks onto the PR rollup with the validator URLs.
+  Actions-owned check evidence plus PR-visible commit statuses with the exact
+  validator URLs.
 - Allow GitHub-owned Actions plus only `openai/codex-action` and
   `jdx/mise-action`, and require every Action reference to use a full commit
   SHA.

scripts/dispatch-pr-checks

@@ -102,6 +102,16 @@ while ((SECONDS < deadline)); do
       # after both new validator runs pass, retaining their URLs as evidence.
       primary_gate="$(publish_gate "$primary")"
       protected_gate="$(publish_gate "$protected")"
+      for validator in "$primary" "$protected"; do
+        name="$(jq -r .name <<<"$validator")"
+        details="$(jq -r .details_url <<<"$validator")"
+        gh api --method POST -H "Accept: application/vnd.github+json" \
+          "repos/$repository/statuses/$head_sha" \
+          -f state=success \
+          -f "context=$name" \
+          -f "target_url=$details" \
+          -f description="Exact-head dispatched validator passed" >/dev/null
+      done
       for _ in {1..24}; do
         rollup="$(gh pr checks "$pr_number" --repo "$repository" --required \
           --json name,bucket,link 2>/dev/null || true)"

tests/test_maintenance.py

@@ -287,6 +287,7 @@ def test_token_created_prs_explicitly_dispatch_required_checks(self):
         self.assertIn("gh workflow run ci.yml", dispatcher)
         self.assertIn("gh workflow run protected-controls.yml", dispatcher)
         self.assertIn('"repos/$repository/check-runs"', dispatcher)
+        self.assertIn('"repos/$repository/statuses/$head_sha"', dispatcher)
         self.assertIn("Exact-head validator passed", dispatcher)
         for workflow in (
             "maintenance-watch.yml",
@@ -297,6 +298,7 @@ def test_token_created_prs_explicitly_dispatch_required_checks(self):
             self.assertIn("./scripts/dispatch-pr-checks", body)
             self.assertNotIn("gh pr checks", body)
             self.assertIn("checks: write", body)
+            self.assertIn("statuses: write", body)
 
     def test_malformed_contract_shapes_fail_closed(self):
         contract = self._contract()