docs: record the decision to disclose AI authorship

The question kept resurfacing while preparing the repository for publication,
so it is written down as settled rather than re-argued: SelfPost is written by
AI agents under a maintainer's direction and the project says so.

What that commits to is listed explicitly — the Co-Authored-By trailers, the
model routing table, the .cursor rules file, and the agent-facing process notes
in the roadmap all stay, and none of them is an oversight to be tidied away.
The reasoning is that with the trailers already in ~140 commits, removing the
surrounding material would not conceal authorship, only signal an attempt at
it.

The revisit condition is deliberately narrow: a conflict with the licence or a
downstream obligation, not a shift in convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -21,6 +21,11 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   unchanged: same requirements, same accepted risks, same ADR. The reviewing
   model is no longer named in the text; the fact that a pre-release review ran,
   and its date, stay.
+- `docs/development.md` records the decision on authorship: SelfPost is written
+  by AI agents under a maintainer's direction and the project discloses that,
+  so the `Co-Authored-By` trailers, the model routing table, and the agent
+  rules file all stay. Written down to settle the question rather than have it
+  reopened at each release.
 - The README documentation table now points at `SECURITY.md` for reporting a
   vulnerability, and the `docs/security.md` row is renamed *Security design* —
   with two files a reader could reasonably call "security", the table said

docs/development.md

@@ -24,6 +24,34 @@ not duplicated here.
 
 ---
 
+## Authorship and disclosure
+
+**Decided, not open for re-litigation.** SelfPost is written by AI agents under
+a maintainer's direction, and the project says so rather than hiding it.
+
+Concretely, this is what "says so" means, and none of it is an oversight to be
+tidied away later:
+
+- `Co-Authored-By: Claude <model>` trailers stay in commit messages, including
+  the ~140 commits that predate v1.0.
+- The model routing table below is public, in a file the README links to.
+- [.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc) ships in
+  the repository.
+- Process notes written for an agent — "after a context reset, pick an item
+  marked `agreed`" in [roadmap.md](roadmap.md) — stay as they are.
+
+**Why not quietly drop it.** Once the trailers are in the history, removing the
+routing table or the rules file would not conceal authorship, it would only
+make the project look like it was trying to. Partial concealment reads worse
+than the plain statement, and the plain statement costs nothing: the code is
+reviewed, tested, and shipped under the same rules either way, and the
+[security design](security.md) records what was audited and what was accepted.
+
+**Revisit if:** the disclosure ever conflicts with the licence or a downstream
+obligation — not because the convention around AI authorship shifts.
+
+---
+
 ## Model routing
 
 | Kind of work | Model | Examples |