spec: make endpoint authority an explicit, sourced decision in the contract

README.md

@@ -115,7 +115,7 @@ You do not need to approve every commit. You do need to own the decisions that c
 
 ![Where you step in.](docs/assets/people.svg)
 
-After design approval, the agent investigates, implements, validates, reviews, records, and commits. If PR and CI work are authorized, it completes those too without waiting for you to prompt each step.
+After design approval, the agent investigates, implements, validates, reviews, records, and commits. If PR and CI work are authorized, it completes those too without waiting for you to prompt each step. The contract records which endpoints you authorized — commit, push, opening the PR, CI repair — and merge is never one of them. The agent may not quietly narrow that list either: a stopping point you did not ask for is a question for you, not a cautious default it can adopt on your behalf.
 
 A material scope change or an action outside existing authorization comes back to you with evidence and a proposal.
 

README.zh-CN.md

@@ -115,7 +115,7 @@ Do not merge.
 
 ![你在哪些地方参与？](docs/assets/people.zh-CN.svg)
 
-设计批准以后，agent 自己调查、实现、验证、review、记录并 commit。PR 和 CI 工作如果已经授权，它也会继续做完，不用你一步一步催。
+design 批准之后，agent 自己调查、实现、验证、review、记录并 commit。如果 PR 和 CI 工作已获授权，它也会一并做完，不需要你一步一步催。contract 里记着你授权到哪些 endpoint——commit、push、开 PR、修 CI——merge 永远不在其中。agent 也不许偷偷把这份清单收窄：一个你没要求过的停止点，是要拿来问你的，不是它可以替你采用的保守默认值。
 
 遇到实质性范围变化，或者现有授权以外的操作，agent 带着证据和方案回来找你。
 

dist/claude-code/structured-coding/README.md

@@ -75,7 +75,7 @@ A plan describes what you intend to build. It does not, on its own, tell an agen
 
 You do not need to approve every commit. You do need to own the decisions that change the agreement.
 
-After design approval, the agent investigates, implements, validates, reviews, records, and commits. If PR and CI work are authorized, it completes those too without waiting for you to prompt each step.
+After design approval, the agent investigates, implements, validates, reviews, records, and commits. If PR and CI work are authorized, it completes those too without waiting for you to prompt each step. The contract records which endpoints you authorized — commit, push, opening the PR, CI repair — and merge is never one of them. The agent may not quietly narrow that list either: a stopping point you did not ask for is a question for you, not a cautious default it can adopt on your behalf.
 
 A material scope change or an action outside existing authorization comes back to you with evidence and a proposal.
 

dist/claude-code/structured-coding/README.zh-CN.md

@@ -75,7 +75,7 @@ Do not merge.
 
 不用每次 commit 都点头。但会改变约定的决定，得由你来做。
 
-设计批准以后，agent 自己调查、实现、验证、review、记录并 commit。PR 和 CI 工作如果已经授权，它也会继续做完，不用你一步一步催。
+design 批准之后，agent 自己调查、实现、验证、review、记录并 commit。如果 PR 和 CI 工作已获授权，它也会一并做完，不需要你一步一步催。contract 里记着你授权到哪些 endpoint——commit、push、开 PR、修 CI——merge 永远不在其中。agent 也不许偷偷把这份清单收窄：一个你没要求过的停止点，是要拿来问你的，不是它可以替你采用的保守默认值。
 
 遇到实质性范围变化，或者现有授权以外的操作，agent 带着证据和方案回来找你。
 

dist/claude-code/structured-coding/prompts/implementation-working-rules.md

@@ -85,6 +85,7 @@ PR CONTEXT INITIALIZATION:
     - working-tree fingerprint;  
     - approved scope;  
     - frozen invariants;  
+    - endpoint authority, with each line's source;  
     - implementation sequence;  
     - validation budget;  
     - current checkpoint;  
@@ -106,6 +107,14 @@ PR CONTEXT AUTHORITY ORDER:
 
   A lower item may never override a higher one.
 
+  An explicit operator instruction in the CURRENT session outranks a recorded  
+  restriction, including one carried in the handoff. Quote the instruction,  
+  update ENDPOINT AUTHORITY with it as the source, and say plainly that it  
+  replaces the earlier line. Do not silently drop either side.
+
+  Merge authority is outside this: it is never inherited, never widened, and  
+  always requires the operator's explicit authorization for this merge.
+
 PR CONTEXT CONTINUITY:  
   During THIS PR:
 
@@ -165,6 +174,31 @@ PR CONTEXT CLOSEOUT:
   The NEXT PR starts from a fresh filled Implementation Working Rules contract  
   and a freshly initialized context.
 
+ENDPOINT AUTHORITY:  
+  Each endpoint is a separate decision. Record the decision and its SOURCE:  
+  an explicit operator instruction, an applicable repository restriction, or  
+  `unresolved`. Caution is not a source: an endpoint you narrowed yourself is  
+  `unresolved`, not the operator's decision, and is settled before freeze.
+
+  - implementation + local validation:  <default: authorized>  
+      source: <...>  
+  - semantic commits:                   <default: authorized; section 14 —  
+                                         no approval before each commit>  
+      source: <...>  
+  - branch push:                        <default: authorized; section 21>  
+      source: <...>  
+  - PR creation / update:               <default: authorized; section 21>  
+      source: <...>  
+  - CI repair to review readiness:      <default: authorized; section 21>  
+      source: <...>  
+  - merge:                              explicit operator authorization only;  
+                                         section 22. No source value changes  
+                                         this line.
+
+  A planning-only or explicitly local-only request restricts publication, and  
+  that restriction has a source: the operator's instruction. The absence of any  
+  instruction does not.
+
 NORMAL STOP CONDITION:  
   <e.g. PR 01a READY FOR OPERATOR REVIEW — DO NOT MERGE>
 
@@ -182,7 +216,17 @@ MERGE AUTHORITY:
 If a field is not applicable, mark it `N/A` rather than inventing a value.
 
 The project-specific contract overrides generic defaults below where it is  
-more restrictive.
+more restrictive **and the restriction records a source**: an explicit operator  
+instruction or an applicable repository restriction.
+
+A restriction with no source is not a project decision and does not override  
+anything. Resolve it with the operator before freeze instead of acting on it.  
+Without this, choosing caution and writing the result into the contract presents  
+an agent's decision as the operator's — and every later session that reads the  
+contract correctly then inherits it as a frozen operator boundary.
+
+This does not work in reverse. An unsourced line is resolved, not widened past  
+the shipped defaults, and merge authority is never widened at all.
 
 # 1. Inspect before asking, guessing, or changing the design
 

dist/claude-code/structured-coding/references/agent-workflow.md

@@ -86,6 +86,8 @@ Iterate the PR design with the operator. Prepare a filled implementation contrac
 
 The contract must distinguish the per-Gate limit from the total runtime/cost envelope and identify whether commit, branch publication, PR updates, and validation are authorized. Reuse existing session authorization; do not ask again for a decision already made.
 
+Before freezing, reconcile that endpoint block against what the operator actually said. A block that stops at local documentation and tests, in an effort whose agreed workflow runs to PR review readiness, is a mismatch to raise — not a cautious default to freeze. The converse is equally a mismatch: a planning-only or explicitly local-only request does not acquire publication permission because the shipped default has one. Every narrowing needs a source the operator would recognize, and a line without one is unresolved rather than decided.
+
 When the operator approves the concrete design for implementation, record a visible header such as:
 
 ```markdown
@@ -112,7 +114,7 @@ Before implementation edits, the new session must:
 
 1. Inspect branch, HEAD, status, recent history, and relevant running jobs.
 2. Read the PR design in full, its filled contract, and the needed binding parents.
-3. Verify approved design identity, implementation authorization, base, and merged prerequisites.
+3. Verify approved design identity, implementation authorization, base, and merged prerequisites. Read the contract's endpoint authority and work to it; a line whose source is unresolved is raised with the operator, not narrowed further.
 4. Read both execution prompt files completely and inspect the source/tests for the first milestone.
 5. Initialize the handoff for this PR with the fields required by the original contract.
 
@@ -156,7 +158,7 @@ Preserve measurement evidence and frozen parity references. Store durable eviden
 
 Compaction does not reset progress or initialize a new PR. Recover the active PR from the handoff, verify it against repository identity and branch/base, and follow the source authority order: repository/git/process truth → primary design → binding parents → handoff → emergency snapshot → conversational memory.
 
-Re-read the current PR design in full, the filled contract, and both execution prompts. Inspect active processes and CI runs before launching replacements. Re-open the source seam for the exact next action and reconcile stale checkbox/evidence claims before editing.
+Re-read the current PR design in full, the filled contract, and both execution prompts. A restriction found only in the handoff, with no source and no support in the contract, is reported rather than obeyed; a newer explicit instruction from the operator supersedes it. Inspect active processes and CI runs before launching replacements. Re-open the source seam for the exact next action and reconcile stale checkbox/evidence claims before editing.
 
 For planned manual compaction, synchronize the design, handoff, HEAD, and working-tree fingerprint first. For unavoidable automatic compaction, a stale semantic handoff should produce a mechanical rescue snapshot and recovery warning, not a compaction deadlock. The hook must not invent a semantic summary.
 

dist/claude-code/structured-coding/references/agent-workflow.zh-CN.md

@@ -86,6 +86,8 @@ Validation 为指定 claim 提供确定性或实证 execution evidence。Review
 
 contract 必须区分每次 Gate 的限制和总 runtime/cost 范围，并明确 commit、branch 发布、PR 更新和 validation 是否已授权。沿用已有 session 授权，不要重复询问已经作出的决定。
 
+freeze 之前，把这个 endpoint 块跟 operator 实际说过的话对一遍。整件事约定的流程是做到 PR review-ready，而块里却停在本地文档和测试——这是需要提出来的不一致，不是一个可以直接 freeze 的保守默认值。反过来同样是不一致：planning-only 或明确只在本地做的请求，不会因为出厂默认值有发布权限就获得发布权限。每一处收紧都需要一个 operator 认得出来的 source；没有 source 的那一行是 unresolved，不是已决定。
+
 operator 批准具体 design 进入 implementation 后，记录清晰的 header，例如：
 
 ```markdown
@@ -112,7 +114,7 @@ Freeze 语义需求和 acceptance，同时允许 live ledger 持续写入。整
 
 1. 检查 branch、HEAD、status、近期历史和相关运行中的 job。
 2. 完整读取 PR design、填写好的 contract，以及所需的 binding parent 文档。
-3. 核对已批准的 design 身份、implementation 授权、base 和已 merge 的 prerequisites。
+3. 核对已批准的 design 身份、implementation 授权、base 和已 merge 的 prerequisites。读 contract 里的 endpoint authority 并照它执行；source 是 unresolved 的那一行要提给 operator，不要自己再收紧。
 4. 完整读取两个 execution prompt 文件，并检查第一个 milestone 的 source/test。
 5. 按原始 contract 要求的字段，为当前 PR 初始化 handoff。
 
@@ -156,7 +158,7 @@ Freeze 语义需求和 acceptance，同时允许 live ledger 持续写入。整
 
 Compaction 不重置进度，也不初始化新 PR。通过 handoff 恢复 active PR，对照 repository 身份和 branch/base 核验，并按来源权威顺序处理：repository/git/process 事实 → primary design → binding parent 文档 → handoff → emergency snapshot → 对话记忆。
 
-重新完整读取当前 PR design、填写好的 contract 和两个 execution prompt。启动替代任务前先检查 active process 和 CI run。重新打开下一步所需的 source seam，在编辑前核对过时的 checkbox 或 evidence 声明。
+重新完整读取当前 PR design、填写好的 contract 和两个 execution prompt。只出现在 handoff 里、没有 source、contract 里也找不到依据的限制，要报告而不是遵守；operator 新的明确指示优先于它。启动替代任务前先检查 active process 和 CI run。重新打开下一步所需的 source seam，在编辑前核对过时的 checkbox 或 evidence 声明。
 
 计划中的 manual compaction 应先同步 design、handoff、HEAD 和 working-tree fingerprint。不可避免的 automatic compaction 遇到过时的语义 handoff 时，应产生机械恢复 snapshot 和警告，不能造成 compaction deadlock。hook 不得编造 semantic summary。
 

dist/codex/structured-coding/README.md

@@ -75,7 +75,7 @@ A plan describes what you intend to build. It does not, on its own, tell an agen
 
 You do not need to approve every commit. You do need to own the decisions that change the agreement.
 
-After design approval, the agent investigates, implements, validates, reviews, records, and commits. If PR and CI work are authorized, it completes those too without waiting for you to prompt each step.
+After design approval, the agent investigates, implements, validates, reviews, records, and commits. If PR and CI work are authorized, it completes those too without waiting for you to prompt each step. The contract records which endpoints you authorized — commit, push, opening the PR, CI repair — and merge is never one of them. The agent may not quietly narrow that list either: a stopping point you did not ask for is a question for you, not a cautious default it can adopt on your behalf.
 
 A material scope change or an action outside existing authorization comes back to you with evidence and a proposal.
 

dist/codex/structured-coding/README.zh-CN.md

@@ -75,7 +75,7 @@ Do not merge.
 
 不用每次 commit 都点头。但会改变约定的决定，得由你来做。
 
-设计批准以后，agent 自己调查、实现、验证、review、记录并 commit。PR 和 CI 工作如果已经授权，它也会继续做完，不用你一步一步催。
+design 批准之后，agent 自己调查、实现、验证、review、记录并 commit。如果 PR 和 CI 工作已获授权，它也会一并做完，不需要你一步一步催。contract 里记着你授权到哪些 endpoint——commit、push、开 PR、修 CI——merge 永远不在其中。agent 也不许偷偷把这份清单收窄：一个你没要求过的停止点，是要拿来问你的，不是它可以替你采用的保守默认值。
 
 遇到实质性范围变化，或者现有授权以外的操作，agent 带着证据和方案回来找你。
 

dist/codex/structured-coding/prompts/implementation-working-rules.md

@@ -85,6 +85,7 @@ PR CONTEXT INITIALIZATION:
     - working-tree fingerprint;  
     - approved scope;  
     - frozen invariants;  
+    - endpoint authority, with each line's source;  
     - implementation sequence;  
     - validation budget;  
     - current checkpoint;  
@@ -106,6 +107,14 @@ PR CONTEXT AUTHORITY ORDER:
 
   A lower item may never override a higher one.
 
+  An explicit operator instruction in the CURRENT session outranks a recorded  
+  restriction, including one carried in the handoff. Quote the instruction,  
+  update ENDPOINT AUTHORITY with it as the source, and say plainly that it  
+  replaces the earlier line. Do not silently drop either side.
+
+  Merge authority is outside this: it is never inherited, never widened, and  
+  always requires the operator's explicit authorization for this merge.
+
 PR CONTEXT CONTINUITY:  
   During THIS PR:
 
@@ -165,6 +174,31 @@ PR CONTEXT CLOSEOUT:
   The NEXT PR starts from a fresh filled Implementation Working Rules contract  
   and a freshly initialized context.
 
+ENDPOINT AUTHORITY:  
+  Each endpoint is a separate decision. Record the decision and its SOURCE:  
+  an explicit operator instruction, an applicable repository restriction, or  
+  `unresolved`. Caution is not a source: an endpoint you narrowed yourself is  
+  `unresolved`, not the operator's decision, and is settled before freeze.
+
+  - implementation + local validation:  <default: authorized>  
+      source: <...>  
+  - semantic commits:                   <default: authorized; section 14 —  
+                                         no approval before each commit>  
+      source: <...>  
+  - branch push:                        <default: authorized; section 21>  
+      source: <...>  
+  - PR creation / update:               <default: authorized; section 21>  
+      source: <...>  
+  - CI repair to review readiness:      <default: authorized; section 21>  
+      source: <...>  
+  - merge:                              explicit operator authorization only;  
+                                         section 22. No source value changes  
+                                         this line.
+
+  A planning-only or explicitly local-only request restricts publication, and  
+  that restriction has a source: the operator's instruction. The absence of any  
+  instruction does not.
+
 NORMAL STOP CONDITION:  
   <e.g. PR 01a READY FOR OPERATOR REVIEW — DO NOT MERGE>
 
@@ -182,7 +216,17 @@ MERGE AUTHORITY:
 If a field is not applicable, mark it `N/A` rather than inventing a value.
 
 The project-specific contract overrides generic defaults below where it is  
-more restrictive.
+more restrictive **and the restriction records a source**: an explicit operator  
+instruction or an applicable repository restriction.
+
+A restriction with no source is not a project decision and does not override  
+anything. Resolve it with the operator before freeze instead of acting on it.  
+Without this, choosing caution and writing the result into the contract presents  
+an agent's decision as the operator's — and every later session that reads the  
+contract correctly then inherits it as a frozen operator boundary.
+
+This does not work in reverse. An unsourced line is resolved, not widened past  
+the shipped defaults, and merge authority is never widened at all.
 
 # 1. Inspect before asking, guessing, or changing the design