fix: clarify existing merge and release authority

[jamesreimer]

Change and authority

Refs #25. Clarify how Publication confirms existing project authority, and distinguish ordinary merge authority from explicit human release authorization. The user's settled Planning → Implementation contract authorizes this two-file wording correction only. It does not authorize a new authority model, standards amendment, merge, release, dependency remediation, settings change, or direct transfer to Claude. The completion boundary is an open PR with successful local and exact-candidate hosted qualification, followed by return to Planning for independent review. No issue-closing relationship is requested.

• Base: 23c294d73039ef8faa9703bbe95d7eb647b499c6.
• Candidate: 101c36d4074e2a468363e64226a1af387a4d4b37.
• Candidate tree: 397b55203647cfad7054435bc1faa796147af52f.
• Changed files exactly: roles/publication.md, MAINTAINING.md.

Publication's source-derived paragraph now requires authority to exist and be explicit enough to determine permitted actions and the stop boundary, permits one deliberate and unambiguous authorization to cover several boundaries, and excludes implementation/review/validation success, capability, and intermediate state as sources of missing authority. Workflow-local guidance confirms coverage under the actual contract, instantiated handoff, or applicable project authority; it proceeds within clear authority without redundant authorization requests and stops/returns control for absent or unclear authority. Candidate-change re-review remains intact.

MAINTAINING's opening paragraph assigns merge authority to actual project authority, excludes contribution/review/validation as independent grants, and requires explicit human authorization covering the selected version, exact release commit, and intended release actions before release-tag creation/push or GitHub Release publication. Merge authorization does not imply release authorization. Outside the opening paragraph, MAINTAINING changes only the step 3 authority phrase from human publication authorization to merge authority. All release mechanics and all Publication issue-closure guidance remain byte-identical to base.

Independent-review corrections and dispositions

Independent review of 6a9d335edc1de9d083eb19889d88ca14b500216d (tree 15f70ede85360e4acf9887d9eb07cbf5236bae8f) required corrections F-1/F-2/F-3. Planning authorized these within the existing two-file contract; this candidate supersedes that reviewed state for proportionate re-review.

F-1 — corrected source-derived authority strength. The first paragraph now begins:

Authority for the particular publication action and its consequences must exist and be explicit enough for the executor to determine permitted actions and where execution must stop (OEC §6).

The next sentence remains:

One deliberate, unambiguous project authorization may already cover several authority boundaries (OEC §6).

Against the pinned OEC §6, the first sentence now carries both mandatory existence and sufficient explicitness to determine permitted action and stop boundary. The second remains permissive, not a mandate to combine boundaries. The exclusions for implementation/review/validation/capability/intermediate success remain. No redundant-authorization instruction was moved into source-derived guidance; the workflow-local absent/unclear-authority stop-and-return path is unchanged.

F-2 — corrected release-preparation step 3. It now reads:

Select reviewed, merged work on main under the actual project contract, including required independent review and merge authority.

This identifies the authority governing the already-merged state without requiring fresh human merge authorization at selection or qualification. The separate explicit human release-action/version/commit requirements before tag creation/push and GitHub Release publication remain intact. No release mechanics changed.

F-3 — corrected retained future-release summary. The proposed summary below now describes recognition of existing merge authority and return of control for absent or unclear authority, rather than claiming the explicit unclear-authority wording was merely preserved. CHANGELOG.md remains unchanged.

Dismissed observations are carried forward without reopening or expansion: “the release tag” requires no correction; workflow-local “proceed within it” does not bypass correspondence checks; review-to-publication delegates to Publication and does not authorize unclear-authority execution. Those passages and the handoff remain unchanged. No new evidence requires a different disposition.

The correction diff from the old candidate changes only the first source-derived authority sentence and MAINTAINING step 3. The PR-description summary correction changes no candidate file. No adjacent files, settings, dependencies, source pins, standards, validation architecture, issue-closure mechanics, roles/handoff structure, or unrelated governance were changed. Independent re-review is still required; implementor checks are not its substitute.

Source strength and adjacent-file inspection

Verified the pinned OEC source. Section 6 permits deliberate, unambiguous combined authorization; the candidate says may, not must. Sections 6–7, 11, 14–15 support the non-expansion guidance. Section 15's uncertainty handling is not recast as permission to assume authority or as a stronger source-derived mandate. The explicit stop/return and no-redundant-request procedure is workflow-local. Existing source applicability and governing pins remain unchanged. No Standards Templates/OEC mutation is involved; this is a local operational defect, not repo-template reconciliation.

Deliberately unchanged adjacent surfaces:

• CONTRIBUTING.md: actual contract and required review gates govern; release authority is separate. No contradiction.
• AGENTS.md: follow existing authority for routine mechanics, respect actual completion/publication gates, and treat credentials as insufficient authority. No contradiction.
• handoffs/review-to-publication.md: its absent-authority return path delegates execution to Publication. It neither permits unclear authority nor requires a fresh grant where authority exists. The expanded Publication guidance closes the operational ambiguity without changing the handoff. No contradiction or unsafe path found.
• workflows/reviewed-change.md: expressly permits combining already-authorized boundaries without ceremonial reauthorization; preserves role transfer, review, and publish-only-when-authorized gates. No contradiction.

Validation

Node v24.18.1, npm 11.19.0, pre-commit 4.6.2. Repeated the complete local qualification after F-1/F-2 corrections. Staged exact intended files before qualification; committed those tested bytes without changes; index/worktree clean afterward.

• npm ci --ignore-scripts: exit 0; no dependency-file changes.
• .venv/bin/pre-commit run --all-files --show-diff-on-failure: exit 0; all applicable hooks passed, including Markdown authoring and link regression suites, offline links, actionlint, Ruff, canonical artifact checks/tests, and generic checks. Broken-symlink selection had no applicable files; expected skip only.
• git diff --check, git diff --cached --check: exit 0.
• python3 scripts/validate_local.py: exit 0.
• python3 -m unittest discover -s tests: exit 0; 5 tests passed.
• Manual semantic inspection covered clear/absent/unclear authority, success alone, combined-authorization permission, candidate-change re-review, release specificity, unchanged adjacent surfaces, and protected procedure correspondence. No validator change or prose-mirroring test was introduced.
• Corrected-candidate hosted qualification: SUCCESS. Run 37410129900, required Repository validation job 112096484133, completed successfully for 101c36d4074e2a468363e64226a1af387a4d4b37. Checkout logs record the exact ref, checkout, and final git log -1 --format=%H output. All listed workflow steps and applicable hooks succeeded; the broken-symlink hook had no applicable files (expected selection). Hosted installation reports the same 9 affected-package entries (3 low, 1 moderate, 5 high). No required check remains unresolved. Prior run 37409088491/job 112093224744 remains historical success for the superseded candidate, not the evidence for this correction.

Current audit and ownership

npm audit --json: exit 1, not clean or passed. Complete JSON equals the previously dispositioned audit: 9 affected-package entries, 3 low, 1 moderate, 5 high; 0 informational and 0 critical. Three advisory identities, not nine independent advisories:

• repo-template#56: braces advisory GHSA-vfj7-8cjw-p6xm; five high entries: braces, micromatch, fast-glob, globby, markdownlint-cli2. Installed path includes markdownlint-cli2 0.23.3 → micromatch 4.0.8 → braces 3.0.3 and globby 16.2.4 → fast-glob 3.3.3 → micromatch.
• repo-template#59: KaTeX GHSA-238p-pmpm-9mq7, path markdownlint-cli2 0.23.3 → markdownlint 0.41.1 → micromark-extension-math 3.1.0 → katex 0.16.47; three low entries katex, micromark-extension-math, markdownlint. Also smol-toml@1.8.0, GHSA-r4xh-jqrq-34v2, one moderate entry through markdownlint-cli2.

Audit metadata reports 181 total dependencies (prod 126, dev 56, optional/peer/peerOptional 0, reproduced as reported). The proposed semver-major markdownlint-cli2 downgrade to 0.21.0 remains unchanged and was not applied or accepted as viable. Dependencies and validation architecture are unchanged. The current Planning contract explicitly carries these separately owned findings; no material audit change was found. Dependency remediation is outside #25. No waiver, harmlessness finding, audit suppression, or clean-audit claim follows.

Changelog and consumers

Notable compatible clarification/fix, PATCH-class under the current pre-1.0 policy when considered alone. Proposed future-release summary:

Clarify that Publication recognizes existing merge authority instead of requesting it again, returns control when authority is absent or unclear, and keeps explicit release authorization separate.

Supporting references: this PR and #25. No version/date or release section is selected; CHANGELOG.md is unchanged. The whole eventual release delta determines its version. Consumers of the Publication role gain clearer operational wording; repository maintainers gain a clearer merge/release distinction. Copied roles and consuming projects update deliberately under their own authority. No new permission, approval count, source adoption, role transfer, release mechanic, cross-project-memory rule, or project-specific governance is introduced.

Implementation answers and limits

1. Only the two authorized files changed: yes.
2. Actual contradiction in the four inspected adjacent files: none found; all unchanged.
3. OEC §6 permissive strength preserved: yes, may.
4. No redundant re-ask behavior confined to workflow-local guidance: yes.
5. Unclear authority returns control: yes; execution stops.
6. Merge authority clearly separated from release authorization: yes.
7. Explicit human release-tag/GitHub Release authorization intact: yes, including version and exact commit.
8. Unrelated governance expansion: none.

Independent review remains separate and outstanding. Automated checks do not establish semantic correctness; offline links do not validate remote availability. No scope deviations or further implementation findings. Publication and issue closure are not authorized by this implementation return.

Corrections are complete and ready for proportionate independent re-review under the settled Planning contract. The completed Implementation → Review handoff is returned to Planning first for Claude, not sent directly to Claude. PR remains open; no merge, tag, release, issue closure, or independent re-review conclusion is claimed. No new findings or unresolved implementation condition were identified. The audit remains non-clean and separately owned as recorded above.