luanmorenommaciel/brief-spec is a convention project whose goal is to make the handoff format a human receives predictable and singular, even when several AI coding harnesses are attached to one project. Commit f65958d (2026-10-27) newly attached an execution condition to the "Create exact-SHA release authorization" step in this repository's GitHub Actions workflow. This approval step now runs only when the workflow is run manually, or when a release tag whose ref begins with refs/tags/v is pushed.
This step calls scripts/build-release-authorization.py and is responsible for turning a specific commit SHA into a release authorization. According to the commit message, this authorization can succeed only when there is actual E2E (end-to-end) evidence attached to the release candidate. After the change as well, scheduled runs and PRs and pushes to the main branch still run the build and the wheel and sdist clean-room installation smoke steps as before, and only the approval step is skipped. This is a condition that narrows only the approval artifact, not one that blocks the build as a whole.
The fix is a single line in ci.yml, but the same commit adds a new 123-line file, tests/test_ci_release_authorization_gate.py (LUA-40, PR #20). This test parses ci.yml and cross-checks the approval step's condition expression against the combinations of execution triggers (schedule, PR, main push, v tag push, manual run), and also checks whether no condition is attached to the build, metadata verification, and clean-room smoke steps. What can be verified is limited to the condition structure and step placement in the workflow file. How the actual approval procedure connects to any external system does not appear in this commit. That only two execution paths remain for the approval step lays down the premise that a release triggered by neither a tag nor a manual run will not produce an approval artifact.