Connect full candidate validation to the shipping queue

.agents/ship.md

@@ -0,0 +1,14 @@
+# Ship changes through the shared queue
+
+Repository: `euforicio/dotlocal`. Candidate acceptance is configured. Queue activation remains off until the rollout PR passes, branch rules are installed, and the repository-specific check-mode pilot succeeds.
+
+Read the [shared shipping guide](https://github.com/euforicio/orion-infra/blob/shipping-control/docs/agent-shipping.md).
+Use an operator-controlled coordinator checkout at `RIFT_SHIPPING_HOME`.
+
+1. Follow this repository's required validation and review instructions. Work on a separate branch; capture the reviewed main base SHA. Never push main from the editing agent.
+2. Enqueue the ready remote branch with `python3 "$RIFT_SHIPPING_HOME/scripts/shipping/submit.py" enqueue --repository euforicio/dotlocal --branch BRANCH --base FULL_BASE_SHA --review-url HTTPS_REVIEW_URL`. Enqueuing does not start Actions.
+3. Request `submit.py prepare --repository euforicio/dotlocal --limit 5` at a shipping boundary. Wait for the full acceptance workflows on its combined candidate and independently review that final diff.
+4. Use `submit.py ship --repository euforicio/dotlocal --batch FULL_MANIFEST_SHA --review-url HTTPS_COMBINED_REVIEW_URL` to check. Add `--land` only when landing is intended and authorized.
+5. Watch the existing main safety and deployment runs. Preserve their gates. Receipts are audit evidence; they never authorize skipping CI.
+
+If preparation/landing is blocked, retain the existing PR/release path. Resolve conflicts explicitly, revalidate changed candidates, and reconcile uncertain writes before retrying. Do not expose shipping credentials to candidate code.

.github/workflows/ci.yml

@@ -11,8 +11,8 @@ permissions:
   contents: read
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: shipping-validation-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   zig:
@@ -68,3 +68,36 @@ jobs:
           zig build example -Doptimize=ReleaseSafe "-Dtarget=$ZIG_TARGET" -frosetta
       - name: Benchmark real paths
         run: zig build bench -Doptimize=ReleaseSafe "-Dtarget=$ZIG_TARGET" -frosetta
+
+  # Separate publisher: no checkout or candidate code gets status-write access.
+  acceptance-status:
+    name: Publish acceptance status
+    needs: zig
+    if: always() && github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      statuses: write
+    steps:
+      - name: Publish the actual validator result for branch rules
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VALIDATION_RESULT: ${{ needs.zig.result }}
+          REPOSITORY: ${{ github.repository }}
+          COMMIT: ${{ github.sha }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          state=failure
+          if [ "$VALIDATION_RESULT" = success ]; then state=success; fi
+          gh api "repos/$REPOSITORY/statuses/$COMMIT" --method POST \
+            -f state="$state" -f context='Zig 0.17.0 (macOS)' \
+            -f target_url="$RUN_URL" -f description="Candidate validation: $VALIDATION_RESULT" > /dev/null
+          gh api "repos/$REPOSITORY/statuses/$COMMIT" --method POST \
+            -f state="$state" -f context='Zig 0.17.0 (Linux)' \
+            -f target_url="$RUN_URL" -f description="Candidate validation: $VALIDATION_RESULT" > /dev/null
+          gh api "repos/$REPOSITORY/statuses/$COMMIT" --method POST \
+            -f state="$state" -f context='Zig 0.17.0 (Linux ARM64)' \
+            -f target_url="$RUN_URL" -f description="Candidate validation: $VALIDATION_RESULT" > /dev/null
+          gh api "repos/$REPOSITORY/statuses/$COMMIT" --method POST \
+            -f state="$state" -f context='Zig 0.17.0 (macOS Intel (Rosetta))' \
+            -f target_url="$RUN_URL" -f description="Candidate validation: $VALIDATION_RESULT" > /dev/null

README.md

@@ -261,3 +261,5 @@ your change. Open an [issue](https://github.com/euforicio/dotlocal/issues) or
 ## License
 
 dotlocal is released under the [MIT License](LICENSE).
+
+[Shared shipping queue](.agents/ship.md): batch ready changes, retain full main safety runs, and record exact validation receipts.