# Authorization model, history and mechanics

SKILL.md's own "Authorization" section states the rule; this is the history
and the mechanism behind it.

## Why single-authorization replaced the checkpoint ceremony

This replaced the 4-checkpoint sign-off ceremony after the v0.8.5 cut
(2026-07-17): ~40 minutes of approval relays that produced zero safety, every real protection had already fired deterministically (the
`release-pretag-docs-gate` hook, the pre-push F-N1 trip-wire, the
one-tag-per-push rule, the registry verify). Those deterministic gates are
untouched and remain non-skippable: **an F-N1 error hard-stops
unconditionally, no flag, no instruction wording, bypasses it.**

## Why releases run inline, not dispatched

**Releases run INLINE in the operator's session by default.** Do not
dispatch a subagent to run an interactive release, a dispatched seat cannot
receive the operator's words directly, which the v0.8.5 cut proved
structurally deadlocks on any consent question (the relay-refusal loop). The
`package-release-agent` agent exists for UNATTENDED contexts only
(scheduled/batch/CI cuts), where the dispatch itself carries the operator's
authorization.

## Mechanics

`release-pack.mjs --go` auto-confirms all checkpoints (it equals
`--yes --push --publish`); the evidence blocks still print as a log, the
audit trail survives, nothing waits on input. The granular flags remain for
cautious manual runs; interactive prompts fire for whatever flag is absent.
A cosmetic F-N1 warn still refuses auto-confirmation at the push boundary, with Step 4f (mechanized pre-tag coverage) warns should be extinct, so one
appearing means something novel: treat it as a gate failure, not ceremony.