spec: make endpoint authority an explicit, sourced decision in the contract

[yuema137]

Addresses the second incident in #25 (the comment thread), which #29 did not touch. #25 stays open until this merges.

What went wrong

An agent had read the working rules — sections 14, 21 and 22 were in its context. It then wrote a contract and a fresh-session kickoff that stopped after local documentation and tests, requiring a new approval for commit, push and PR creation. The operator never asked for that endpoint. The restriction then propagated into the handoff, where a successor session that reads the handoff correctly inherits an agent-invented limitation as though the operator had set it.

So "make the agent read more" cannot fix this. It had read.

The actual mechanism, which is three facts together

1. Workflow §5 already requires the contract to identify "whether commit, branch publication, PR updates, and validation are authorized".
2. The contract template had no field to record that in. NORMAL STOP CONDITION is free text; STOP CONDITION states the shipped endpoint as generic prose, not as a filled decision. A §5 requirement whose answer has nowhere to live is one the filled artifact does not carry.
3. implementation-working-rules.md said: "The project-specific contract overrides generic defaults below where it is more restrictive." That is the loophole — an agent that chose caution wrote something the rules then treated as winning over §14 and §21, because nothing distinguished a restriction the operator asked for from one the agent invented.

Adding the field alone would have left point 3 still legitimizing the invention. So this PR does both.

Four commits

1. ENDPOINT AUTHORITY in the contract template. Six endpoints as separate decisions — implementation + local validation, semantic commits, branch push, PR creation/update, CI repair to review readiness, merge — each with the shipped default and the section it comes from, so filling the block means choosing against a stated default rather than inventing one. Each line records a source: explicit operator instruction, applicable repository restriction, or unresolved. Caution is named as not being a source. Merge is fixed on the line: explicit operator authorization, no source value changes it.
2. An unsourced restriction is not a project decision. A more restrictive contract overrides only when the restriction records a source; otherwise it overrides nothing and is resolved with the operator before freeze. Deliberately not symmetric: an unsourced line is resolved, not widened past the shipped defaults, and merge authority is never widened at all.
3. Propagation. The handoff's minimum record list gains endpoint authority with each line's source. PR CONTEXT AUTHORITY ORDER gains the item it was missing — it ranked repository truth, design, parents, handoff and memory, but said nothing about the operator talking to the session right now, so a stale restriction outranked a fresh instruction by omission. An explicit instruction in the current session now outranks a recorded restriction, quoted and recorded as the new source, with neither side silently dropped. Merge is carved out of both.
4. Reconcile at freeze, and tell the human. Freezing requires comparing the filled block against what the operator actually said: a block stopping at local tests, in an effort whose agreed workflow runs to PR readiness, is a mismatch to raise, not a cautious default to freeze. The converse is stated in the same breath — a planning-only request does not acquire publication permission because the shipped default has one. The human autonomy paragraph now says the contract records which endpoints you authorized, that merge is never one, and that the agent may not quietly narrow the list.

Validation

• The specification pin refused commits 1 and 3 until the baseline was updated deliberately — verified by reverting translations.json alone and seeing Established specification changed: .../implementation-working-rules.md
• Reread §§14, 21, 22 after commit 2: §21 already lists "local tests are green" among the reasons not to stop, so the incident's contract contradicted it and the override sentence is what let it win. No contradiction introduced.
• Shipped text read back from both dist/ copies, not only from source
• Ran 171 tests ... OK (skipped=1); all five --check validations PASS; packages at codex 23 / claude-code 22 files
• Both languages updated; mirror and presentation hashes refreshed

Limits, stated because #25 asks for them

No test asserts that an agent applied any of this, and none pretends to. What changed is the shape of the artifact: the decision now has a field, a default, a source, and a rule that an unsourced narrowing does not win. Whether a given session reconciles correctly stays a semantic judgement. The merge boundary is untouched in every direction, and nothing here grants blanket publication access.

🤖 Generated with Claude Code