Grant Codex autonomous release authority (tag + GitHub Release)

Codex now cuts releases autonomously instead of handing off to the
maintainer for tag/publish: version.rb bump, CHANGELOG.md versioning
with a "Phase <N> - <short title>" release title (phase sourced from
this repo's own ROADMAP.md), a v<version> git tag, and a GitHub
Release published via gh, for every release-ready [Unreleased]
section — without waiting for per-release approval.

RubyGems publishing (gem push) remains Bradley Potts's sole
authority; Codex does not run gem push.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: bradpotts

AGENTS.md

@@ -24,11 +24,17 @@ and Google Jules — have full commit, push, and tag authority in this
 repository, effective 2026-07-25 by explicit direction from Bradley Potts —
 see the Commit Policy section in each agent's own guide
 ([CLAUDE.md](CLAUDE.md), [CODEX.md](CODEX.md), [COPILOT.md](COPILOT.md),
-[JULES.md](JULES.md)). Bradley Potts retains ultimate ownership and holds
-final authority for merges, publishing, and releases. This grant covers git
-operations within each agent's own scope of work as defined above — it does
-not expand what any agent is authorized to decide. ChatGPT has no repository
-access and is excluded.
+[JULES.md](JULES.md)). **OpenAI Codex** additionally has release authority:
+Codex cuts releases autonomously — version bump, changelog versioning,
+`v<version>` git tag, and GitHub Release publish via `gh` — for every
+release-ready `CHANGELOG.md [Unreleased]` section, without waiting for
+per-release approval; see `CODEX.md` "Release Mechanics" for the full
+procedure. **RubyGems publishing (`gem push`) remains Bradley Potts's sole
+authority** — no agent pushes the gem. Bradley Potts retains ultimate
+ownership and holds final authority for merges and publishing. This grant
+covers git and release operations within each agent's own scope of work as
+defined above — it does not expand what any agent is authorized to decide
+otherwise. ChatGPT has no repository access and is excluded.
 
 ## Cross-Repo Access
 

CLAUDE.md

@@ -92,11 +92,12 @@ Update:
 
 ## Release Procedure
 
-1. Update `lib/ruby_api_pack_core/version.rb`.
-2. Move changelog notes from `[Unreleased]` into a dated version section.
-3. Run the validation gate described in [AGENTS.md](AGENTS.md).
-4. Confirm `ruby_api_pack_active_campaign`, `ruby_api_pack_cloudways`, and
-   `ruby_api_pack_wordpress` still pass their own validation gates against the
-   new version before publishing, if the change is anything other than
-   additive.
-5. Build and publish only when the maintainer explicitly approves.
+Claude Code implements features and fixes with a `CHANGELOG.md [Unreleased]`
+entry per change. Cutting the release itself — version bump, changelog
+versioning, `v<version>` tag, and GitHub Release — is Codex's job; see
+`CODEX.md` "Release Mechanics" for the full procedure. That procedure
+includes confirming `ruby_api_pack_active_campaign`, `ruby_api_pack_cloudways`,
+and `ruby_api_pack_wordpress` still pass their own validation gates against
+the new version before any breaking or non-additive change ships, since
+those three gems depend on this one. `gem push` (RubyGems publish) stays
+with Bradley Potts regardless of who prepares the release.

CODEX.md

@@ -4,8 +4,10 @@
 
 Codex owns documentation standardization, release readiness, repo hygiene,
 production stabilization, and configuration consistency for this Ruby gem.
-Claude Code leads implementation changes. Human maintainers own final commit,
-merge, tag, publish, and release decisions.
+Claude Code leads implementation changes. Codex has commit, push, and tag
+authority for its own scope of work, including cutting the release itself
+(see "Release Mechanics" below). `gem push` (RubyGems publish) and merge
+decisions stay with Bradley Potts.
 
 ## Default Workflow
 
@@ -49,12 +51,40 @@ When reviewing changes, Codex checks:
 
 ## Validation Commands
 
-Run the validation gate described in [AGENTS.md](AGENTS.md).
+Run the validation gate described in [AGENTS.md](AGENTS.md), plus:
+
+```bash
+gem build ruby_api_pack_core.gemspec
+```
+
+## Release Mechanics
+
+1. Update `lib/ruby_api_pack_core/version.rb` to the new version.
+2. Move `[Unreleased]` notes in `CHANGELOG.md` into a new versioned entry:
+   `## [<version>] - <YYYY-MM-DD>`, with a release title line in the format
+   `**Release Title:** Phase <N> - <short title>`, where `Phase <N>` is the
+   active phase name from this repo's own `ROADMAP.md` and `<short title>`
+   is a concise summary of what shipped. If the release spans no single
+   ROADMAP phase, state that explicitly instead of inventing one.
+3. Run the validation gate described in [AGENTS.md](AGENTS.md) plus
+   `gem build ruby_api_pack_core.gemspec` — must pass clean.
+4. If the release is anything other than additive, confirm
+   `ruby_api_pack_active_campaign`, `ruby_api_pack_cloudways`, and
+   `ruby_api_pack_wordpress` still pass their own validation gates against
+   the new version before proceeding — those three gems depend on this one.
+5. Stage and commit the version bump and changelog update.
+6. Create the git tag: `git tag v<version>` (matching `version.rb` exactly),
+   then push the commit and tag.
+7. Publish the GitHub Release from that tag: `gh release create v<version>
+   --title "v<version>: Phase <N> - <short title>" --notes-file` (extract the
+   new version's changelog section, or `--notes` inline for a short release).
+8. `gem push` is **not** run by Codex — that stays with Bradley Potts.
 
 ## Hard Limits
 
-- Do not publish the gem unless explicitly asked.
-- Codex has commit, push, and tag authority for its own scope of work; do not publish the gem or cut releases unless explicitly asked.
+- Commit, tag, and GitHub Release authority is granted per "Release
+  Mechanics" above; do not run `gem push` or merge PRs unless explicitly
+  asked.
 - Do not overwrite unrelated local changes.
 - Do not add vendor-specific knowledge, real credentials, or sensitive
   payloads to documentation or tests.