From 2e33259b461dec9b113353c7db0226e7046554a3 Mon Sep 17 00:00:00 2001
From: euforic <cs@euforic.io>
Date: Mon, 12 Oct 2026 22:27:43 -0700
Subject: [PATCH 1/4] Connect shared shipping queue and preserve main
 validation

---
 .agents/ship.md | 14 ++++++++++++++
 README.md       |  2 ++
 2 files changed, 16 insertions(+)
 create mode 100644 .agents/ship.md

diff --git a/.agents/ship.md b/.agents/ship.md
new file mode 100644
index 0000000..158f0b6
--- /dev/null
+++ b/.agents/ship.md
@@ -0,0 +1,14 @@
+# Ship changes through the shared queue
+
+Repository: `euforicio/dotlocal`. Candidate acceptance is configured. Activation still requires the shared identity, environment and branch protections.
+
+Read the [shared shipping guide](https://github.com/euforicio/orion-infra/blob/main/docs/agent-shipping.md).
+Use an operator-controlled coordinator checkout at `RIFT_SHIPPING_HOME`.
+
+1. Follow this repository's required validation and review instructions. Work on a separate branch; capture the reviewed main base SHA. Never push main from the editing agent.
+2. Enqueue the ready remote branch with `python3 "$RIFT_SHIPPING_HOME/scripts/shipping/submit.py" enqueue --repository euforicio/dotlocal --branch BRANCH --base FULL_BASE_SHA --review-url HTTPS_REVIEW_URL`. Enqueuing does not start Actions.
+3. Request `submit.py prepare --repository euforicio/dotlocal --limit 5` at a shipping boundary. Wait for the full acceptance workflows on its combined candidate and independently review that final diff.
+4. Use `submit.py ship --repository euforicio/dotlocal --batch FULL_MANIFEST_SHA --review-url HTTPS_COMBINED_REVIEW_URL` to check. Add `--land` only when landing is intended and authorized.
+5. Watch the existing main safety and deployment runs. Preserve their gates. Receipts are audit evidence; they never authorize skipping CI.
+
+If preparation/landing is blocked, retain the existing PR/release path. Resolve conflicts explicitly, revalidate changed candidates, and reconcile uncertain writes before retrying. Do not expose shipping credentials to candidate code.
diff --git a/README.md b/README.md
index 1b80951..3458d04 100644
--- a/README.md
+++ b/README.md
@@ -261,3 +261,5 @@ your change. Open an [issue](https://github.com/euforicio/dotlocal/issues) or
 ## License
 
 dotlocal is released under the [MIT License](LICENSE).
+
+[Shared shipping queue](.agents/ship.md): batch ready changes, retain full main safety runs, and record exact validation receipts.

From de3edb1abcdb2571d231d5063a87b33a138e54ce Mon Sep 17 00:00:00 2001
From: euforic <cs@euforic.io>
Date: Tue, 13 Oct 2026 07:34:51 -0700
Subject: [PATCH 2/4] Connect candidate validation to the shared shipping queue

---
 .agents/ship.md          |  4 ++--
 .github/workflows/ci.yml | 35 ++++++++++++++++++++++++++++++++++-
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/.agents/ship.md b/.agents/ship.md
index 158f0b6..0326256 100644
--- a/.agents/ship.md
+++ b/.agents/ship.md
@@ -1,8 +1,8 @@
 # Ship changes through the shared queue
 
-Repository: `euforicio/dotlocal`. Candidate acceptance is configured. Activation still requires the shared identity, environment and branch protections.
+Repository: `euforicio/dotlocal`. Candidate acceptance is configured. Queue activation remains off until the rollout PR passes, branch rules are installed, and the repository-specific check-mode pilot succeeds.
 
-Read the [shared shipping guide](https://github.com/euforicio/orion-infra/blob/main/docs/agent-shipping.md).
+Read the [shared shipping guide](https://github.com/euforicio/orion-infra/blob/shipping-control/docs/agent-shipping.md).
 Use an operator-controlled coordinator checkout at `RIFT_SHIPPING_HOME`.
 
 1. Follow this repository's required validation and review instructions. Work on a separate branch; capture the reviewed main base SHA. Never push main from the editing agent.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 97d95bc..5b6c2c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ permissions:
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   zig:
@@ -68,3 +68,36 @@ jobs:
           zig build example -Doptimize=ReleaseSafe "-Dtarget=$ZIG_TARGET" -frosetta
       - name: Benchmark real paths
         run: zig build bench -Doptimize=ReleaseSafe "-Dtarget=$ZIG_TARGET" -frosetta
+
+  # Separate publisher: no checkout or candidate code gets status-write access.
+  acceptance-status:
+    name: Publish acceptance status
+    needs: zig
+    if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      statuses: write
+    steps:
+      - name: Publish the actual validator result for branch rules
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VALIDATION_RESULT: ${{ needs.zig.result }}
+          REPOSITORY: ${{ github.repository }}
+          COMMIT: ${{ github.sha }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          state=failure
+          if [ "$VALIDATION_RESULT" = success ]; then state=success; fi
+          gh api "repos/$REPOSITORY/statuses/$COMMIT" --method POST \
+            -f state="$state" -f context='Zig 0.17.0 (macOS)' \
+            -f target_url="$RUN_URL" -f description="Candidate validation: $VALIDATION_RESULT" > /dev/null
+          gh api "repos/$REPOSITORY/statuses/$COMMIT" --method POST \
+            -f state="$state" -f context='Zig 0.17.0 (Linux)' \
+            -f target_url="$RUN_URL" -f description="Candidate validation: $VALIDATION_RESULT" > /dev/null
+          gh api "repos/$REPOSITORY/statuses/$COMMIT" --method POST \
+            -f state="$state" -f context='Zig 0.17.0 (Linux ARM64)' \
+            -f target_url="$RUN_URL" -f description="Candidate validation: $VALIDATION_RESULT" > /dev/null
+          gh api "repos/$REPOSITORY/statuses/$COMMIT" --method POST \
+            -f state="$state" -f context='Zig 0.17.0 (macOS Intel (Rosetta))' \
+            -f target_url="$RUN_URL" -f description="Candidate validation: $VALIDATION_RESULT" > /dev/null

From 49bb6dac7de7832192a7cd7f294ba354ff15085a Mon Sep 17 00:00:00 2001
From: euforic <cs@euforic.io>
Date: Tue, 13 Oct 2026 07:35:31 -0700
Subject: [PATCH 3/4] Preserve every main validation run and bound runner time

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5b6c2c6..b06b668 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: shipping-validation-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:

From 1707d540a069ad4a9cd80037360ca9f78b1ffefd Mon Sep 17 00:00:00 2001
From: euforic <cs@euforic.io>
Date: Tue, 13 Oct 2026 07:44:17 -0700
Subject: [PATCH 4/4] Publish acceptance statuses only for manual shipping
 candidates

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b06b668..4e17923 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,7 +73,7 @@ jobs:
   acceptance-status:
     name: Publish acceptance status
     needs: zig
-    if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    if: always() && github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     timeout-minutes: 2
     permissions: