fix: clarify existing merge and release authority

MAINTAINING.md

@@ -3,11 +3,13 @@
 This repository-local procedure owns release preparation and publication for
 `jamesreimer/agent-workflows`. Ordinary changes follow
 [CONTRIBUTING.md](CONTRIBUTING.md).
-Contribution permission, review approval, and passing validation do not grant
-merge or release authority. Obtain explicit human authorization for the intended
-publication action, version, and exact release commit before creating or pushing
-a tag or publishing a GitHub Release. A merge authorization is not a release
-authorization. This procedure supplies mechanics, not authority or an
+Merge authority comes from the actual project contract or other established
+project authority. Contribution permission, review approval, and passing
+validation do not independently grant merge authority. Release authorization is
+separate: explicit human authorization must cover the selected version, exact
+release commit, and intended release actions before creating or pushing the
+release tag or publishing a GitHub Release. Merge authorization does not imply
+release authorization. This procedure supplies mechanics, not authority or an
 organization-neutral release policy.
 
 ## Repo-template reconciliation
@@ -150,7 +152,7 @@ or verification failure; do not continue to a later publication step.
    below, not the ordinary after-merge/pre-tag correction path.
 
 3. Select reviewed, merged work on `main` under the actual project contract,
-   including required independent review and human publication authorization.
+   including required independent review and merge authority.
    Record the reviewed PR-head SHA and the resulting published SHA with their
    content correspondence evidence. A merge or squash can produce a different
    SHA; release the qualified published commit, not an unmerged PR head.

roles/publication.md

@@ -18,8 +18,13 @@ or effect. See [authority and source status](../README.md#authority-and-source-s
 
 ## Source-derived guidance
 
-Establish authority for the particular publication action and its consequences;
-implementation and review success are not that authorization (OEC §§6–7, 14).
+Authority for the particular publication action and its consequences must exist
+and be explicit enough for the executor to determine permitted actions and where
+execution must stop (OEC §6).
+One deliberate, unambiguous project authorization may already cover several
+authority boundaries (OEC §6). Implementation, review, validation, available
+capability, or successful intermediate state do not themselves supply missing
+authority (OEC §§6–7, 11, 14–15).
 Verify the actual input's correspondence to its immutable identity and all
 required shared targets where authoritative consumption applies (SAP §§5–8,
 15.1). Dispositions cannot hide unmet completion conditions (AR §12).
@@ -53,9 +58,16 @@ to another role, stop and return an instantiated, ready-to-use handoff for that
 role. Preparing that handoff does not itself authorize the sender to execute it.
 
 Read the [review → publication](../handoffs/review-to-publication.md) handoff,
-actual authorization, and reviewed candidate. Check that the state about to be
-published is the reviewed state and that the project's publication conditions
-are satisfied. If the candidate changed, route it through the composition's
+actual authorization, and reviewed candidate. Confirm whether the actual project
+contract, instantiated handoff, or other applicable project authority already
+covers the proposed action and its consequences. When authority clearly exists,
+proceed within it without requesting redundant authorization. When authority is
+absent or unclear, stop and return control; implementation, review, or validation
+success and available capability do not supply missing authority.
+
+Check that the state about to be published is the reviewed state and that the
+project's publication conditions are satisfied. If the candidate changed, route
+it through the composition's
 proportionate re-review before relying on the review; do not silently substitute
 bytes or conduct an unrequested redesign at publication time.