Skip to content

Commit ce56620

Browse files
geraldarthurdavisgeraldarthurdavis
authored
Merge pull request #70 from engineeredsoftware/v33/gate-5-interface-authorization-policy-fail-closed
V33 Gate 5: Interface Authorization Policy Fail Closed
2 parents 604f26a + 10a4133 commit ce56620

28 files changed

Lines changed: 2211 additions & 27 deletions

‎.bitcode/v33-chatgpt-app-action-contracts.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -443,7 +443,7 @@
443443
]
444444
},
445445
{
446-
"digest": "sha256:088af1a5895656f9d3e5f7bac544cf6549b87c6575b0388914f3695090e4599b",
446+
"digest": "sha256:01098e7c683c6394a4ff691826030685ad237675e71f4335fd60373bdfc4f563",
447447
"relativePath": "packages/chatgptapp/src/tools.ts",
448448
"requiredTokens": [
449449
{
@@ -471,11 +471,11 @@
471471
"relativePath": "packages/btd/src/chatgpt-app-action-contract.ts"
472472
},
473473
{
474-
"digest": "sha256:813ac51681b167fda157744124a260e5ec7436b8864c6a742f953102b7a00a08",
474+
"digest": "sha256:a718fd3ec8e9ccac14a04f5f3b5a0bde99863841be8a1f742b9d461bfb32b431",
475475
"relativePath": "packages/btd/src/index.ts"
476476
},
477477
{
478-
"digest": "sha256:088af1a5895656f9d3e5f7bac544cf6549b87c6575b0388914f3695090e4599b",
478+
"digest": "sha256:01098e7c683c6394a4ff691826030685ad237675e71f4335fd60373bdfc4f563",
479479
"relativePath": "packages/chatgptapp/src/tools.ts"
480480
}
481481
],
@@ -528,7 +528,7 @@
528528
"relativePath": "packages/chatgptapp/src/__tests__/chatgpt-action-contract.test.ts"
529529
},
530530
{
531-
"digest": "sha256:1196162b7949e519c7277b0387c6506abc0813dcc6dad0aea73df7cfbab9e834",
531+
"digest": "sha256:e61c9a25b23d7ee7751ebb7f616c6df5ea5f3ee2975ad797c0d74635aa4fff12",
532532
"relativePath": "packages/chatgptapp/src/__tests__/tools.test.ts"
533533
},
534534
{

‎.bitcode/v33-interface-authorization-policy.json‎

Lines changed: 283 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,283 @@
1+
{
2+
"artifactId": "v33-interface-authorization-policy",
3+
"artifactRoot": "v33-interface-authorization-policy-artifact:fe21a2248fa8fef9fc2e5f15",
4+
"coverage": {
5+
"assetPackRights": true,
6+
"authIssuer": true,
7+
"credentialsSerialized": false,
8+
"missingOrStaleAuthorityFailsClosed": true,
9+
"organizationTeamRole": true,
10+
"protectedSourceDisclosure": true,
11+
"protectedSourceVisible": false,
12+
"readLicensePosture": true,
13+
"repairPosture": true,
14+
"sharedFixturesAcrossApiMcpChatGptAndTerminal": true,
15+
"walletCapability": true
16+
},
17+
"currentTarget": "V32",
18+
"docsEvidence": [
19+
{
20+
"digest": "sha256:eefb1a2efc409ef74941c3740ede3028259d8f39f42c35c062d7fd1a2c90bc40",
21+
"relativePath": "BITCODE_SPEC_V33.md",
22+
"requiredTokens": [
23+
{
24+
"present": true,
25+
"token": "InterfaceAuthorizationPolicy"
26+
},
27+
{
28+
"present": true,
29+
"token": "Gate 5"
30+
}
31+
]
32+
},
33+
{
34+
"digest": "sha256:0303e818a46e788357bb574f631dd77ab5fee43857889d0bfdd6cbdfa1ef6c98",
35+
"relativePath": "BITCODE_SPEC_V33_DELTA.md",
36+
"requiredTokens": [
37+
{
38+
"present": true,
39+
"token": "Interface Authorization Policy Fail-Closed"
40+
}
41+
]
42+
},
43+
{
44+
"digest": "sha256:cb82b6710dba08a1c70a7932d641c0dbbf17e481cbf6b15ffb22eac8f65eda7c",
45+
"relativePath": "BITCODE_SPEC_V33_PARITY_MATRIX.md",
46+
"requiredTokens": [
47+
{
48+
"present": true,
49+
"token": "Interface authorization policy"
50+
}
51+
]
52+
},
53+
{
54+
"digest": "sha256:642b916a0458ca10669748da3a2dfc92998ea8c2802c19a81215de6ff5090a75",
55+
"relativePath": "SPECIFICATIONS_ROADMAP.md",
56+
"requiredTokens": [
57+
{
58+
"present": true,
59+
"token": "V33 Gate 5 Interface Authorization Policy Fail-Closed"
60+
}
61+
]
62+
}
63+
],
64+
"docsEvidenceComplete": true,
65+
"fixtureRows": [
66+
{
67+
"action": "request_read",
68+
"expectedDecision": "allowed",
69+
"expectedDenialCodes": [],
70+
"fixtureId": "api-request-read-allowed",
71+
"interfaceSurface": "api",
72+
"policyRoot": "v33-interface-authorization-policy:75c90ac8e842c13ed235703b"
73+
},
74+
{
75+
"action": "request_finding_fits",
76+
"expectedDecision": "allowed",
77+
"expectedDenialCodes": [],
78+
"fixtureId": "mcp-finding-fits-allowed",
79+
"interfaceSurface": "mcp",
80+
"policyRoot": "v33-interface-authorization-policy:538adf9779e618fcc19b8296"
81+
},
82+
{
83+
"action": "deliver_asset_pack",
84+
"expectedDecision": "allowed",
85+
"expectedDenialCodes": [],
86+
"fixtureId": "chatgpt-delivery-allowed",
87+
"interfaceSurface": "chatgpt_app",
88+
"policyRoot": "v33-interface-authorization-policy:d0d5ae959fcaa711014271d3"
89+
},
90+
{
91+
"action": "pay_btc_fee",
92+
"expectedDecision": "allowed",
93+
"expectedDenialCodes": [],
94+
"fixtureId": "terminal-btc-fee-allowed",
95+
"interfaceSurface": "terminal",
96+
"policyRoot": "v33-interface-authorization-policy:da91cd0c4011a990e53b3e13"
97+
},
98+
{
99+
"action": "pay_btc_fee",
100+
"expectedDecision": "denied",
101+
"expectedDenialCodes": [
102+
"STALE_AUTHORITY"
103+
],
104+
"fixtureId": "terminal-stale-authority-denied",
105+
"interfaceSurface": "terminal",
106+
"policyRoot": "v33-interface-authorization-policy:99e13431d7db5ec9aea2c13a"
107+
},
108+
{
109+
"action": "deliver_asset_pack",
110+
"expectedDecision": "denied",
111+
"expectedDenialCodes": [
112+
"READ_LICENSE_REQUIRED",
113+
"ASSET_PACK_RIGHTS_REQUIRED",
114+
"PROTECTED_SOURCE_DISCLOSURE_BLOCKED"
115+
],
116+
"fixtureId": "chatgpt-unpaid-delivery-denied",
117+
"interfaceSurface": "chatgpt_app",
118+
"policyRoot": "v33-interface-authorization-policy:391b538ba07da19428363f97"
119+
}
120+
],
121+
"generatedAt": "2026-05-22T00:00:00.000Z",
122+
"missingSurfaces": [],
123+
"observedSurfaces": [
124+
"api",
125+
"chatgpt_app",
126+
"mcp",
127+
"terminal"
128+
],
129+
"passed": true,
130+
"requiredDenialCodes": [
131+
"MISSING_AUTH_ISSUER",
132+
"STALE_AUTHORITY",
133+
"MISSING_ACTOR",
134+
"MISSING_ORGANIZATION",
135+
"MISSING_TEAM",
136+
"MISSING_ROLE",
137+
"ORGANIZATION_AUTHORITY_DENIED",
138+
"WALLET_CAPABILITY_REQUIRED",
139+
"READ_LICENSE_REQUIRED",
140+
"ASSET_PACK_RIGHTS_REQUIRED",
141+
"PROTECTED_SOURCE_DISCLOSURE_BLOCKED",
142+
"REPAIR_APPROVAL_REQUIRED"
143+
],
144+
"requiredSurfaces": [
145+
"api",
146+
"mcp",
147+
"chatgpt_app",
148+
"terminal"
149+
],
150+
"schemaId": "bitcode.v33.interfaceAuthorizationPolicy.v1",
151+
"sourceEvidence": [
152+
{
153+
"digest": "sha256:0186e2a2fde98ef264a6e68436a188fa036b2490ddaa6f39d5cd1d082290f40c",
154+
"relativePath": "packages/btd/src/interface-authorization-policy.ts",
155+
"requiredTokens": [
156+
{
157+
"present": true,
158+
"token": "buildBtdInterfaceAuthorizationPolicy"
159+
},
160+
{
161+
"present": true,
162+
"token": "buildBtdInterfaceAuthorizationPolicyFixtures"
163+
},
164+
{
165+
"present": true,
166+
"token": "renderBtdInterfaceAuthorizationDeniedState"
167+
},
168+
{
169+
"present": true,
170+
"token": "STALE_AUTHORITY"
171+
},
172+
{
173+
"present": true,
174+
"token": "PROTECTED_SOURCE_DISCLOSURE_BLOCKED"
175+
}
176+
]
177+
},
178+
{
179+
"digest": "sha256:01098e7c683c6394a4ff691826030685ad237675e71f4335fd60373bdfc4f563",
180+
"relativePath": "packages/chatgptapp/src/tools.ts",
181+
"requiredTokens": [
182+
{
183+
"present": true,
184+
"token": "buildBtdInterfaceAuthorizationPolicy"
185+
},
186+
{
187+
"present": true,
188+
"token": "interfaceAuthorizationPolicy"
189+
},
190+
{
191+
"present": true,
192+
"token": "Bitcode ChatGPT App write admission denied by interface authorization policy"
193+
}
194+
]
195+
},
196+
{
197+
"digest": "sha256:017f8c2535f2b7370fd74046958245e5f7dd43773bbfdef9070db087b8397126",
198+
"relativePath": "packages/executions-mcp/src/mcp-server/src/tools/pipeline-tools.ts",
199+
"requiredTokens": [
200+
{
201+
"present": true,
202+
"token": "buildBtdInterfaceAuthorizationPolicy"
203+
},
204+
{
205+
"present": true,
206+
"token": "mcp-pipeline-create-request-finding-fits"
207+
},
208+
{
209+
"present": true,
210+
"token": "interfaceAuthorizationPolicy"
211+
}
212+
]
213+
}
214+
],
215+
"sourceEvidenceComplete": true,
216+
"sourceSafetyVerdict": "source-safe-interface-authorization-policy-metadata",
217+
"testEvidence": [
218+
{
219+
"digest": "sha256:f5c511f19bd9c4b7c945a3588958083f65e3d953cf43cd50587d37e0e4776159",
220+
"relativePath": "packages/btd/__tests__/interface-authorization-policy.test.ts",
221+
"requiredTokens": [
222+
{
223+
"present": true,
224+
"token": "publishes shared policy fixtures for API, MCP, ChatGPT App, and Terminal"
225+
},
226+
{
227+
"present": true,
228+
"token": "fails closed with readable repair posture for stale authority"
229+
},
230+
{
231+
"present": true,
232+
"token": "fails closed before locked AssetPack delivery"
233+
}
234+
]
235+
},
236+
{
237+
"digest": "sha256:e58de6e13efe30106121ecdaf760c426630d5a98fed09b763d858acfa80e6301",
238+
"relativePath": "packages/api/src/routes/__tests__/btd-crypto.test.ts",
239+
"requiredTokens": [
240+
{
241+
"present": true,
242+
"token": "shares the package-owned InterfaceAuthorizationPolicy fixture for API request admission"
243+
}
244+
]
245+
},
246+
{
247+
"digest": "sha256:415091f36d1faa66a2f59485d6d596173b86e57b5dea252542d9adb4b6439bf9",
248+
"relativePath": "packages/executions-mcp/src/mcp-server/src/__tests__/unit/pipeline-ingress-contract.test.ts",
249+
"requiredTokens": [
250+
{
251+
"present": true,
252+
"token": "shares the package-owned InterfaceAuthorizationPolicy fixture for MCP Finding Fits admission"
253+
}
254+
]
255+
},
256+
{
257+
"digest": "sha256:e61c9a25b23d7ee7751ebb7f616c6df5ea5f3ee2975ad797c0d74635aa4fff12",
258+
"relativePath": "packages/chatgptapp/src/__tests__/tools.test.ts",
259+
"requiredTokens": [
260+
{
261+
"present": true,
262+
"token": "shares the package-owned InterfaceAuthorizationPolicy fixture for ChatGPT App delivery"
263+
}
264+
]
265+
},
266+
{
267+
"digest": "sha256:d3e23b4f4074e45ea8f932bd51056f67eac765f4f3df405593b74af455a86556",
268+
"relativePath": "uapi/tests/terminalOrganizationAuthority.test.ts",
269+
"requiredTokens": [
270+
{
271+
"present": true,
272+
"token": "shares the package-owned InterfaceAuthorizationPolicy fixture for Terminal BTC fee admission"
273+
},
274+
{
275+
"present": true,
276+
"token": "renders stale Terminal authority as a readable fail-closed denial"
277+
}
278+
]
279+
}
280+
],
281+
"testEvidenceComplete": true,
282+
"version": "V33"
283+
}

‎.bitcode/v33-interface-contract-catalog.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@
222222
]
223223
},
224224
{
225-
"digest": "sha256:813ac51681b167fda157744124a260e5ec7436b8864c6a742f953102b7a00a08",
225+
"digest": "sha256:a718fd3ec8e9ccac14a04f5f3b5a0bde99863841be8a1f742b9d461bfb32b431",
226226
"relativePath": "packages/btd/src/index.ts",
227227
"requiredTokens": [
228228
{
@@ -232,7 +232,7 @@
232232
]
233233
},
234234
{
235-
"digest": "sha256:2b08cbe4ee9fade97e19398dbec9e84323df3248a220e7f6060c134bf0409c23",
235+
"digest": "sha256:eefb1a2efc409ef74941c3740ede3028259d8f39f42c35c062d7fd1a2c90bc40",
236236
"relativePath": "BITCODE_SPEC_V33.md",
237237
"requiredTokens": [
238238
{

‎.bitcode/v33-mcp-api-tool-contracts.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@
151151
]
152152
},
153153
{
154-
"digest": "sha256:7ebd19411892562e1dacc38ba2187bd56ef62e95be89c0b9419d85b70331ae7e",
154+
"digest": "sha256:017f8c2535f2b7370fd74046958245e5f7dd43773bbfdef9070db087b8397126",
155155
"relativePath": "packages/executions-mcp/src/mcp-server/src/tools/pipeline-tools.ts",
156156
"requiredTokens": [
157157
{
@@ -230,7 +230,7 @@
230230
]
231231
},
232232
{
233-
"digest": "sha256:c09f752e418c23b85c4bb583aab39a5e36037602d10ffbcde0ca58def6343144",
233+
"digest": "sha256:415091f36d1faa66a2f59485d6d596173b86e57b5dea252542d9adb4b6439bf9",
234234
"relativePath": "packages/executions-mcp/src/mcp-server/src/__tests__/unit/pipeline-ingress-contract.test.ts",
235235
"requiredTokens": [
236236
{

‎.github/workflows/bitcode-gate-quality.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,7 @@ jobs:
133133
node scripts/check-v33-gate2-interface-contract-catalog.mjs --skip-branch-check
134134
node scripts/check-v33-gate3-mcp-api-tool-contracts.mjs --skip-branch-check
135135
node scripts/check-v33-gate4-chatgpt-app-action-contracts.mjs --skip-branch-check
136+
node scripts/check-v33-gate5-interface-authorization-policy.mjs --skip-branch-check
136137
else
137138
echo "Unexpected BITCODE_SPEC.txt pointer: $POINTER" >&2
138139
exit 1
@@ -163,6 +164,7 @@ jobs:
163164
pnpm --filter @bitcode/btd test -- --runTestsByPath __tests__/interface-contract-catalog.test.ts
164165
pnpm --filter @bitcode/btd test -- --runTestsByPath __tests__/mcp-tool-contract.test.ts
165166
pnpm --filter @bitcode/btd test -- --runTestsByPath __tests__/chatgpt-app-action-contract.test.ts
167+
pnpm --filter @bitcode/btd test -- --runTestsByPath __tests__/interface-authorization-policy.test.ts
166168
pnpm --filter @bitcode/btd test -- --runTestsByPath __tests__/v32-testnet-mainnet-readiness-rehearsal.test.ts
167169
pnpm --dir packages/protocol exec node --test --test-force-exit test/v32-promotion-proof-generation.test.js
168170
pnpm --filter @bitcode/api exec jest --config jest.config.cjs --runTestsByPath src/routes/__tests__/btd-crypto.test.ts --runInBand

0 commit comments

Comments
 (0)