Editing changes

Auth Changes are meant to be revised as you learn. Artifacts under .authright/changes/AUTH-YYYY-NNNN-…/ are the source of truth for that unit of work.

What you can edit freely

• intent.md, analysis.md, security.md, contract.md, request.md (immutable verbatim intake — do not overwrite)
• decisions.yaml — mark status: accepted and set type: architecture|technology|engineering (required for --ready). When request.md states non-functional obligations, map preserve/constraint commitments and accepted decisions with links.topic: implementer_nfr (text, nfr_bucket, optional source_quote / source_commitment_id)
• decision-package.yaml — package index + verification_criteria (optional constraints) and mapped engineering_strategy (mode: keep_style only)
• decision-graph.yaml — written by change --analyze; advisory candidates only

Prefer small, explicit edits over regenerating everything blindly.

Ready / export gate

authright change <id> --ready requires:

1. ≥1 accepted decision with type: architecture or technology (or indexes in decision-package.yaml)
2. Non-empty contract.md
3. Real verification content — non-placeholder bullets under ## Verification, or non-empty verification_criteria in decision-package.yaml (values like TBD / (TBD acceptance checks) do not count)
4. Accepted type: engineering and engineering_strategy.mode: keep_style. There is no Keep vs Centralize strategy choose — --ready silently accepts keep_style and fills empty must_preserve / do_not from impact templates. When request.md explicitly asks to relocate/centralize auth, that maps into allowed_improvements (still keep_style) unless must_preserve/do_not (including merged implementer_nfr) forbid it. Pending technology/architecture chooses also block. Recommended is not a default. --skip-human-gate does not skip those chooses. Stock analysis.md Options/Security/Recommendation placeholders warn (stderr / JSON warnings) and do not fail --ready.

Lifecycle moves

authright change AUTH-YYYY-NNNN
authright change AUTH-YYYY-NNNN --ready

Only legal lifecycle moves succeed. Prefer --ready to reach DECIDED on the happy path. DECISION_REQUIRED is manual only—the CLI will not invent that jump for you. See CLI and Concepts.

authright change <id> --analyze refuses changes that are already past ANALYZED—don't expect re-analyze to rewind a decided export.

Re-export

Request match must already be clear or accepted. Then:

authright to-openspec AUTH-YYYY-NNNN

If openspec/changes/<slug>/ already exists, the command fails unless you pass --force. Use force when you intentionally refreshed the handoff package; coordinate with anyone mid-apply.

Agent files out of date

After upgrading the global CLI:

authright update

That regenerates managed skills/commands; it does not rewrite your Auth Change markdown.