V31 Gate 6: Add organization policy authority

Own the organization/team/role/policy authority projection in @bitcode/btd, map it through Auxillaries contracts, and share it with Auxillaries Profile and Terminal detail surfaces.

Add fail-closed BTD tests, API contract coverage, UI projection tests, Gate 6 spec/docs updates, and the Gate 6 checker/workflow hook.

Author: geraldarthurdavis

.github/workflows/bitcode-gate-quality.yml

@@ -100,6 +100,7 @@ jobs:
             node scripts/check-v31-gate3-profile-account-state.mjs --skip-branch-check
             node scripts/check-v31-gate4-connects-provider-readiness.mjs --skip-branch-check
             node scripts/check-v31-gate5-wallet-btd-pane-readiness.mjs --skip-branch-check
+            node scripts/check-v31-gate6-organization-team-role-policy-authority.mjs --skip-branch-check
           else
             echo "Unexpected BITCODE_SPEC.txt pointer: $POINTER" >&2
             exit 1

BITCODE_SPEC_V31.md

@@ -261,6 +261,8 @@ Gate 6 policy precision:
 - Organization authority binds organization id, team/member id, role, grant set, wallet binding requirement, policy id/hash, action, decision, denial reason, and recovery route.
 - Multi-sig posture may be represented as readiness and required-action state; it is not value-bearing mainnet approval.
 - Protected-source actions fail closed unless account, organization, role, grant, wallet, policy, settlement, and interface admission state all admit them.
+- `@bitcode/btd` owns `BtdOrganizationPolicyAuthority`. It wraps the existing `BtdOrganizationInterfaceAuthorityDecision` with account admission, team/member identity, explicit grant set, policy id/hash, wallet binding state, multi-sig posture, policy-level decision, denial reasons, recovery route, source-visibility state, and aggregate authority root.
+- `packages/api` maps `BtdOrganizationPolicyAuthority` into `OrganizationPolicyAuthority` for `/api/auxillaries/data`; Auxillaries panes and Terminal detail projections consume that object and may not rederive organization policy law locally.
 
 Gate 7 Interfaces precision:
 
@@ -588,6 +590,11 @@ Organization permission authority is a BTD primitive, not a per-interface conven
 The canonical decision is `BtdOrganizationInterfaceAuthorityDecision`.
 It binds actor id, organization id, organization role, organization permission grants, interface surface, action, wallet binding, registry read-access decision, settlement state, explicit confirmation state, repair approval state, target anchor, source visibility, and proof roots.
 
+V31 Gate 6 adds the package-owned `BtdOrganizationPolicyAuthority` projection as the user and support-plane carrier around that decision.
+The projection binds actor/account admission, organization id, team id, member id, role, raw permission grants, explicit grant set for the action, wallet-binding requirement/state, policy id/hash, interface surface, action, multi-sig readiness, policy decision, denial reason(s), recovery route, source visibility, and authority root.
+Settlement-adjacent and protected-source actions fail closed when any of account admission, organization, role, explicit grant, wallet binding, policy identity/hash, multi-sig readiness, settlement/read-license state, confirmation, repair approval, or interface admission is missing or denied.
+Auxillaries Profile/organization support and Terminal selected-activity authority must read the same object so support UI, transaction cockpit, telemetry, and proof hooks explain one shared policy state.
+
 Gate 7 defines the current action set:
 
 - `read_transaction`

BITCODE_SPEC_V31_DELTA.md

@@ -161,6 +161,14 @@ Closure acceptance:
 - protected-source and settlement-adjacent actions fail closed unless all authority inputs admit them;
 - Terminal organization authority and Auxillaries organization surfaces consume the same package-owned authority object.
 
+Gate 6 implementation centers:
+
+- `packages/btd/src/authority.ts` owns `BtdOrganizationPolicyAuthority`, `BtdOrganizationPolicyMultiSigInput`, and `buildBtdOrganizationPolicyAuthority`, deriving policy-level admission from account admission, organization/team/member identity, role, explicit grants, wallet binding, policy id/hash, multi-sig readiness, settlement/read-license/confirmation posture, interface admission, denial reasons, recovery route, source visibility, and aggregate authority root;
+- `packages/api/src/routes/auxillaries-contract.ts` maps the BTD authority projection into `OrganizationPolicyAuthority` for `/api/auxillaries/data` so route handlers serialize one JSON-safe authority object instead of route-local role heuristics;
+- `uapi/app/auxillaries/components/AuxillariesProfilePane.tsx` renders organization authority, team/member, wallet binding, policy action/hash, multi-sig posture, explicit grants, denial reasons, recovery route, and authority root from the package object;
+- `uapi/app/terminal/terminal-organization-authority.ts` projects both the policy wrapper and underlying interface decision so selected-activity detail, blockers, proof roots, and raw payload inspection agree with Auxillaries;
+- focused BTD, API, Profile pane, and Terminal tests prove allowed settlement-adjacent posture, protected-source fail-closed behavior, JSON-safe route emission, shared UI consumption, multi-sig readiness, and proof roots.
+
 ### Gate 7: Interfaces Pane Admission And Cross-Surface Contracts
 
 Gate 7 makes the Interfaces pane a source-safe admission catalog.

BITCODE_SPEC_V31_NOTES.md

@@ -102,3 +102,11 @@ Gate 5 is closed only when Wallet/BTD support is package-owned and source-safe.
 `@bitcode/btd` must derive no-custody wallet capability, signer posture, network readiness, BTD range/read-right counts, account treasury posture, settlement blockers, and support roots.
 `packages/api` may map that projection into `AuxillariesWalletBtdPaneState`, but UI and routes must not rederive BTD read-access, settlement, rights-transfer, or no-custody law locally.
 The Wallet pane must consume `walletBtdPaneState` from `/api/auxillaries/data`, render signer/network/range/read-right/settlement/treasury readiness, keep protected source invisible before paid unlock, and state that account treasury support is not Exchange market state.
+
+## Gate 6 closure note
+
+Gate 6 is closed only when organization policy authority is package-owned, source-safe, and shared by Auxillaries and Terminal.
+`@bitcode/btd` must own `BtdOrganizationPolicyAuthority` and derive it from account admission, organization/team/member identity, role, explicit grants, wallet binding, policy id/hash, multi-sig readiness, interface surface, action, settlement/read-license/confirmation posture, denial reasons, recovery route, source visibility, and proof root.
+Protected-source and settlement-adjacent actions must fail closed unless every required authority input admits the action.
+`packages/api` may map the BTD object into `OrganizationPolicyAuthority`, but routes, Profile panes, Terminal detail cards, telemetry, and proof hooks must not rederive the authority decision from local heuristics.
+The support UI may show policy measurements, blockers, recovery routes, and roots; it must not reveal protected source or treat multi-sig readiness as value-bearing mainnet approval.

BITCODE_SPEC_V31_PARITY_MATRIX.md

@@ -59,9 +59,9 @@ No `_legacy/` source is active source truth.
 | Roadmap truth | Gate 1 | `SPECIFICATIONS_ROADMAP.md`, README, PR template, workflow posture | drafted | Roadmap states V30 active, V31 draft, and coherent V32-V37 responsibilities. |
 | Auxillaries package and route contracts | Gate 2 | `packages/api/src/routes/auxillaries-contract.ts`, `packages/api/src/routes/auxillaries.ts`, package docs, route tests | drafted | Shared Profile, Connects, Interfaces, Wallet, BTD, organization, readiness, and recovery objects are package-owned and JSON-safe. |
 | Profile and account state | Gate 3 | `packages/api/src/routes/auxillaries-contract.ts`, `packages/api/src/routes/auxillaries.ts`, `uapi/app/auxillaries/components/AuxillariesProfilePane.tsx`, route/pane tests | drafted | Profile, account identity, wallet binding, preferences, notification posture, and completeness blockers are typed and recoverable. |
-| Connects provider readiness and recovery | Gate 4 | Provider packages, connection routes, readiness/recovery tests | pending | Provider readiness names credential posture without secrets, scopes class, readback status, blocker, repair action, and before/after roots. |
-| Wallet and BTD pane readiness | Gate 5 | `packages/btd`, Wallet/BTD panes, settlement/read-right tests | pending | Wallet and BTD panes consume V30 no-custody, signer, read-right, treasury, and settlement-readiness primitives. |
-| Organization team role policy authority | Gate 6 | Organization packages/routes, policy authority tests, Terminal/Auxillaries projections | pending | Organization, team, role, grants, multi-sig readiness, policy decisions, denials, and recovery routes are typed and fail closed. |
+| Connects provider readiness and recovery | Gate 4 | Provider packages, connection routes, readiness/recovery tests | drafted | Provider readiness names credential posture without secrets, scopes class, readback status, blocker, repair action, and before/after roots. |
+| Wallet and BTD pane readiness | Gate 5 | `packages/btd`, Wallet/BTD panes, settlement/read-right tests | drafted | Wallet and BTD panes consume V30 no-custody, signer, read-right, treasury, and settlement-readiness primitives. |
+| Organization team role policy authority | Gate 6 | `packages/btd/src/authority.ts`, `packages/api/src/routes/auxillaries-contract.ts`, `uapi/app/auxillaries/components/AuxillariesProfilePane.tsx`, `uapi/app/terminal/terminal-organization-authority.ts`, focused BTD/API/UI tests | drafted | Organization, team, role, grants, multi-sig readiness, policy decisions, denials, and recovery routes are typed and fail closed. |
 | Interfaces pane admission and cross-surface contracts | Gate 7 | Interfaces pane, API/MCP/ChatGPT App interface records, tests | pending | Interface admission records name auth mode, supported actions, policy constraints, source-safety class, blockers, and readiness. |
 | Auxillaries UX accessibility and responsive proof | Gate 8 | Auxillaries components, focused Jest/Playwright/a11y evidence | pending | Guided low-detail and expandable audit UX works across Profile, Connects, Interfaces, Wallet/BTD, and organization panes. |
 | Auxillaries telemetry proof and recovery runs | Gate 9 | Telemetry/proof packages, recovery routes, readback tests | pending | Profile, connection, interface, wallet, BTD, organization, policy, readiness, and recovery events emit source-safe proof hooks. |
@@ -129,9 +129,10 @@ No `_legacy/` source is active source truth.
 
 | Requirement | Source evidence | Current V31 judgment |
 | --- | --- | --- |
-| Organization authority is package-owned | organization/policy packages and route tests | pending |
-| Role, grants, policy, wallet binding, and denial reasons are typed | package tests and Auxillaries organization pane tests | pending |
-| Protected actions fail closed unless all authority inputs admit them | policy/authorization tests | pending |
+| Organization authority is package-owned | `BtdOrganizationPolicyAuthority` and `buildBtdOrganizationPolicyAuthority` in `packages/btd/src/authority.ts`; `OrganizationPolicyAuthority` aliases that object in `packages/api/src/routes/auxillaries-contract.ts` | drafted |
+| Role, grants, policy, wallet binding, and denial reasons are typed | BTD tests cover allowed settlement-adjacent policy authority and protected-source denial; API tests assert organization/team/member/grant/policy/multi-sig route emission; Profile pane tests render the shared authority object | drafted |
+| Protected actions fail closed unless all authority inputs admit them | `packages/btd/__tests__/btd.test.ts` covers missing grant, wallet, policy, interface admission, multi-sig, settlement, read access, and confirmation denial reasons with blocked source visibility | drafted |
+| Terminal and Auxillaries consume one authority object | `uapi/hooks/useUserData.ts`, `uapi/app/auxillaries/components/AuxillariesSurface.tsx`, `uapi/app/auxillaries/components/AuxillariesProfilePane.tsx`, and `uapi/app/terminal/terminal-organization-authority.ts` consume/project `organizationAuthority` without route-local policy rederivation | drafted |
 
 ## Gate 7 Parity
 

SPECIFICATIONS_ROADMAP.md

@@ -5,7 +5,7 @@
 - Current active canonical pointer: `BITCODE_SPEC.txt` -> `V30`
 - Current active canon: `BITCODE_SPEC_V30.md`
 - Current draft target: `BITCODE_SPEC_V31.md`
-- Current working gate: V31 Gate 5 Wallet and BTD pane readiness, which connects Auxillaries Wallet/BTD UI to package-owned V30 wallet, signer, network, BTD range, read-right, treasury, no-custody, and settlement-readiness projections without protected source leakage or Exchange market inference.
+- Current working gate: V31 Gate 6 Organization Team Role Policy Authority, which binds account, organization, team, member, role, explicit grants, wallet binding, policy id/hash, multi-sig readiness, policy decision, denial reason, and recovery route into one package-owned authority object consumed by Auxillaries and Terminal.
 - Purpose: concise running index of Bitcode/ENGI specification history, current work, and planned work.
 
 This roadmap is not an active system specification.

package.json

@@ -69,6 +69,7 @@
     "check:v31-gate3": "node scripts/check-v31-gate3-profile-account-state.mjs",
     "check:v31-gate4": "node scripts/check-v31-gate4-connects-provider-readiness.mjs",
     "check:v31-gate5": "node scripts/check-v31-gate5-wallet-btd-pane-readiness.mjs",
+    "check:v31-gate6": "node scripts/check-v31-gate6-organization-team-role-policy-authority.mjs",
     "check:spec-quality": "node scripts/run-bitcode-spec-quality.mjs --mode basic",
     "check:spec-quality:title": "node scripts/run-bitcode-spec-quality.mjs --mode strict-from-title",
     "check:spec-quality:v24": "node scripts/run-bitcode-spec-quality.mjs --mode strict-version --version V24",

packages/api/README.md

@@ -50,6 +50,14 @@ come from the BTD projection. API responses must keep protected AssetPack source
 hidden, keep wallet private material out of JSON, and mark the Wallet/BTD
 treasury support state as separate from Exchange market state.
 
+Organization authority state is package-owned through `@bitcode/btd` and mapped
+here as `OrganizationPolicyAuthority`. Route payloads may hydrate organization,
+team, member, role, grants, wallet, policy, and multi-sig facts, but
+`buildBtdOrganizationPolicyAuthority` owns the policy decision, fail-closed
+denial reasons, source visibility, recovery route, and proof root. API
+responses must expose only the source-safe authority object shared by
+Auxillaries and Terminal.
+
 In V26 fourth-gate this package is where merged-world Bitcode becomes concrete:
 - `/conversations` continuity
 - `/executions` compatibility and pipeline-run APIs

packages/api/src/routes/__tests__/auxillaries-contract.test.ts

@@ -20,6 +20,15 @@ describe('Auxillaries package route contracts', () => {
         is_verified: true,
         company_name: 'Bitcode',
         role: 'admin',
+        organization_id: 'org-bitcode',
+        team_id: 'team-core',
+        member_id: 'member-operator',
+        organization_permission_grants: ['settlement:pay_btc_fee'],
+        organization_policy_confirmed: true,
+        multi_sig_required: true,
+        multi_sig_required_signatures: 2,
+        multi_sig_present_signatures: 2,
+        multi_sig_approver_ids: ['member-operator', 'member-reviewer'],
         wallet_binding: {
           address: 'tb1pauxcontract',
           provider: 'leather',
@@ -186,7 +195,34 @@ describe('Auxillaries package route contracts', () => {
       settlementReadiness: 'ready',
       settlementBlockers: [],
     });
-    expect(payload.organizationAuthority.policyDecision).toBe('allowed');
+    expect(payload.organizationAuthority).toMatchObject({
+      kind: 'btd_organization_policy_authority',
+      organizationId: 'org-bitcode',
+      teamId: 'team-core',
+      memberId: 'member-operator',
+      role: 'admin',
+      explicitGrantSet: ['settlement:pay_btc_fee'],
+      walletBindingRequired: true,
+      walletBindingState: 'bound',
+      policyDecision: 'allowed',
+      denialReason: null,
+      sourceSafetyClass: 'source_safe',
+      policy: {
+        policyId: 'org-bitcode:auxillaries-policy',
+        action: 'pay_btc_fee',
+        interfaceSurface: 'terminal',
+      },
+      multiSigPosture: {
+        state: 'ready',
+        required: true,
+        requiredSignatures: 2,
+        presentSignatures: 2,
+        requiredAction: 'none',
+      },
+    });
+    expect(payload.organizationAuthority.policy.policyHash).toMatch(/^[0-9a-f]{64}$/);
+    expect(payload.organizationAuthority.actionDecision?.decision).toBe('allowed');
+    expect(payload.organizationAuthority.authorityRoot).toMatch(/^btd-proof-root:organization-policy-authority:/);
     expect(payload.auxillariesContract.contractVersion).toBe(AUXILLARIES_CONTRACT_VERSION);
     expect(validateAuxillariesContractSnapshot(payload.auxillariesContract)).toEqual({
       valid: true,