Reviewing decisions

Before to-openspec, treat the Auth Change as a plan you are willing to lock. After implementation, authright review checks for silent inversions.

Before export (human pass)

1. Decisions are accepted in decisions.yaml (and narrative in decisions.md as needed). Edit files deliberately.
2. Contract is filled (contract.md) with implementable constraints.
3. Lock when export-ready:

authright change AUTH-YYYY-NNNN --ready

4. Request match — the locked plan must still match what you asked. Export waits until this check passes:

authright request-match AUTH-YYYY-NNNN

5. Export:

authright to-openspec AUTH-YYYY-NNNN

If something is still fuzzy, fix analysis/decisions first—exporting a vague package only moves confusion into OpenSpec or Plan mode.

After implementation (authright review)

Write .authright/reviews/<id>/semantic.md first (implementation + handoff Binding package — OpenSpec or agent-plan/requirements.md — vs accepted decisions). Then:

authright review AUTH-YYYY-NNNN
authright review AUTH-YYYY-NNNN --no-source

• Allowed from EXPORTED (and implementing states)
• Writes .authright/reviews/<id>/ (report.md, result.yaml; records semantic_review only if semantic.md already existed)
• Does not mutate application source
• CLI = deterministic heuristics (decision mentions, contract fragments, security keyword checklist)—not a full audit. Mechanical PASS is not proof that code honors Decision Lock.
• Host semantic.md is judgment, not a lifecycle flip: semantic FAIL does not change VERIFIED / VERIFICATION_FAILED
• Default source-signal: missing required aliases for locked architecture/technology → FAIL. --no-source skips.

Decision Lock: accepted Auth Decisions must not be silently inverted during handoff implementation. Review is how you catch that cheaply.

Related

• Editing changes
• OpenSpec
• Agent Plan-mode
• CLI