From 51d2d45966b4dace2c8e694a31234596f281d453 Mon Sep 17 00:00:00 2001
From: Lucian Behind The Scenes <loadinglucian@pm.me>
Date: Wed, 29 Jul 2026 11:54:37 +0300
Subject: [PATCH 1/2] fix: defer checks from read-only investigation

---
 .github/codex/maintenance/investigation.md | 5 +++++
 .github/workflows/maintenance-consumer.yml | 2 +-
 test/test_maintenance.py                   | 7 +++++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/codex/maintenance/investigation.md b/.github/codex/maintenance/investigation.md
index 3c75e69..9c0db47 100644
--- a/.github/codex/maintenance/investigation.md
+++ b/.github/codex/maintenance/investigation.md
@@ -9,6 +9,11 @@ artifact installation, or readiness state must change. Cite exact public policy
 commit and digests. Do not independently fetch or classify upstream PHP data.
 Return GO only when every criterion passes and unresolved is empty.
 
+Treat `requiredChecks` as downstream exact-head gates, not investigation-phase
+advisory checks. Declare them in the plan, but do not run them in this read-only
+phase or treat their not-yet-run status as unresolved; writable deterministic
+jobs execute them before merge.
+
 The plan must cite each of the four records in `policy-capture.json` exactly
 once. Each evidence item has `captureId`, the captured `digest`, and a
 `locator` with `kind: json_pointer` and a resolving JSON Pointer `value`.
diff --git a/.github/workflows/maintenance-consumer.yml b/.github/workflows/maintenance-consumer.yml
index c8facd2..9769649 100644
--- a/.github/workflows/maintenance-consumer.yml
+++ b/.github/workflows/maintenance-consumer.yml
@@ -75,7 +75,7 @@ jobs:
               actionKey:$actionKey,
               preconditions:{misePhpHead:$misePhpHead,phpBinPolicyCommit:$phpBinPolicyCommit,supportPolicyDigest:$supportPolicyDigest,policyInvariantsDigest:$policyInvariantsDigest,phpBinOperatorCommit:$phpBinOperatorCommit,operatorState:$operatorState},
               allowedAuthority:["read_repository","read_captured_policy"],
-              nonGoals:["upstream_php_classification","repository_mutation","irreversible_github_effect"],
+              nonGoals:["upstream_php_classification","repository_mutation","required_check_execution","irreversible_github_effect"],
               completionCriteria:[
                 {id:"phase-goal-correct",requirement:"The goal matches exact inputs.",evidenceRequired:"Exact preconditions."},
                 {id:"policy-difference-explained",requirement:"Every required local change is bound to captured policy.",evidenceRequired:"Policy digest and JSON locator."},
diff --git a/test/test_maintenance.py b/test/test_maintenance.py
index 4add3d5..d776dd1 100644
--- a/test/test_maintenance.py
+++ b/test/test_maintenance.py
@@ -70,6 +70,13 @@ def test_protected_controls_are_not_admissible(self):
         self.assertTrue(protected("readiness/new-branch.json"))
         self.assertFalse(protected("lib/releases.lua"))
 
+    def test_investigation_defers_required_checks_to_writable_jobs(self):
+        root = pathlib.Path(__file__).resolve().parents[1]
+        instructions = (root / ".github/codex/maintenance/investigation.md").read_text()
+        consumer = (root / ".github/workflows/maintenance-consumer.yml").read_text()
+        self.assertIn("Treat `requiredChecks` as downstream exact-head gates", instructions)
+        self.assertIn('"required_check_execution"', consumer)
+
     def test_policy_capture_urls_are_commit_pinned(self):
         sha = "a" * 40
         policy, invariants = pinned_policy_urls(sha)

From 7763078b4aba60a74dd363359b217217bb9ec11b Mon Sep 17 00:00:00 2001
From: Lucian Behind The Scenes <loadinglucian@pm.me>
Date: Wed, 29 Jul 2026 12:01:24 +0300
Subject: [PATCH 2/2] test: assert investigation contract boundary

---
 test/test_maintenance.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/test/test_maintenance.py b/test/test_maintenance.py
index d776dd1..c3a6e26 100644
--- a/test/test_maintenance.py
+++ b/test/test_maintenance.py
@@ -75,7 +75,13 @@ def test_investigation_defers_required_checks_to_writable_jobs(self):
         instructions = (root / ".github/codex/maintenance/investigation.md").read_text()
         consumer = (root / ".github/workflows/maintenance-consumer.yml").read_text()
         self.assertIn("Treat `requiredChecks` as downstream exact-head gates", instructions)
-        self.assertIn('"required_check_execution"', consumer)
+        self.assertIn("do not run them in this read-only", instructions)
+        self.assertIn("not-yet-run status as unresolved", instructions)
+        self.assertIn(
+            'nonGoals:["upstream_php_classification","repository_mutation",'
+            '"required_check_execution","irreversible_github_effect"]',
+            consumer,
+        )
 
     def test_policy_capture_urls_are_commit_pinned(self):
         sha = "a" * 40