From c947c8220224393103ca2820df8bb732797dc994 Mon Sep 17 00:00:00 2001 From: Lucian Behind The Scenes Date: Wed, 29 Jul 2026 11:54:37 +0300 Subject: [PATCH 1/2] fix: defer checks from read-only investigation --- .github/codex/maintenance/investigation.md | 5 +++++ .github/workflows/maintenance-watch.yml | 1 + tests/test_maintenance.py | 7 +++++++ 3 files changed, 13 insertions(+) diff --git a/.github/codex/maintenance/investigation.md b/.github/codex/maintenance/investigation.md index a78c83c..3075449 100644 --- a/.github/codex/maintenance/investigation.md +++ b/.github/codex/maintenance/investigation.md @@ -38,6 +38,11 @@ Return GO only when the action is unambiguous, all criteria passed with resolving evidence, preconditions remain exact, and unresolved is empty. Otherwise return `blocked` or `needs_human` and NO-GO. Make no edit. +Treat `requiredChecks` as downstream exact-head gates, not investigation-phase +advisory checks. Declare them in the plan, but do not run them in this read-only +phase or treat their not-yet-run status as unresolved; writable deterministic +jobs execute them before merge. + If changed evidence has no maintenance consequence, use action `no_change` and the key `no_change:` so the reviewed snapshot remains uniquely auditable. diff --git a/.github/workflows/maintenance-watch.yml b/.github/workflows/maintenance-watch.yml index 639f827..8684eb6 100644 --- a/.github/workflows/maintenance-watch.yml +++ b/.github/workflows/maintenance-watch.yml @@ -78,6 +78,7 @@ jobs: --allowed-authority read_captured_evidence \ --allowed-authority allowlisted_web_search \ --non-goal repository_mutation \ + --non-goal required_check_execution \ --non-goal irreversible_github_effect \ --stop-condition missing_or_contradictory_required_evidence \ --stop-condition changed_precondition \ diff --git a/tests/test_maintenance.py b/tests/test_maintenance.py index 75ac157..a9ffc89 100644 --- a/tests/test_maintenance.py +++ b/tests/test_maintenance.py @@ -147,6 +147,13 @@ def test_investigation_evidence_references_are_machine_resolvable(self): self.assertIsNotNone(COMPLETION_EVIDENCE_REF_RE.fullmatch(reference)) self.assertIsNone(COMPLETION_EVIDENCE_REF_RE.fullmatch("watch-decision.json reports success")) + def test_investigation_defers_required_checks_to_writable_jobs(self): + root = pathlib.Path(__file__).resolve().parents[1] + instructions = (root / ".github/codex/maintenance/investigation.md").read_text() + watcher = (root / ".github/workflows/maintenance-watch.yml").read_text() + self.assertIn("Treat `requiredChecks` as downstream exact-head gates", instructions) + self.assertIn("--non-goal required_check_execution", watcher) + def test_deterministic_evidence_state_shape_is_fail_closed(self): capture_ids = ( "php_supported_versions", From 218bf8b39427e011c6106e0264abd86eb04a0402 Mon Sep 17 00:00:00 2001 From: Lucian Behind The Scenes Date: Wed, 29 Jul 2026 12:01:24 +0300 Subject: [PATCH 2/2] test: assert investigation contract boundary --- tests/test_maintenance.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tests/test_maintenance.py b/tests/test_maintenance.py index a9ffc89..08942ac 100644 --- a/tests/test_maintenance.py +++ b/tests/test_maintenance.py @@ -152,7 +152,14 @@ def test_investigation_defers_required_checks_to_writable_jobs(self): instructions = (root / ".github/codex/maintenance/investigation.md").read_text() watcher = (root / ".github/workflows/maintenance-watch.yml").read_text() self.assertIn("Treat `requiredChecks` as downstream exact-head gates", instructions) - self.assertIn("--non-goal required_check_execution", watcher) + self.assertIn("do not run them in this read-only", instructions) + self.assertIn("not-yet-run status as unresolved", instructions) + self.assertIn( + "--non-goal repository_mutation \\\n" + " --non-goal required_check_execution \\\n" + " --non-goal irreversible_github_effect \\", + watcher, + ) def test_deterministic_evidence_state_shape_is_fail_closed(self): capture_ids = (