V29 Gate 7: Organization Permission Authority#26
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
c10c2db to
698946a
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c10c2db370
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const allowed = | ||
| interfaceAction && | ||
| (role || permissionGrant) && | ||
| walletBinding && |
There was a problem hiding this comment.
The decision logic can return allowed even when organizationRole is missing, because allowed only checks (role || permissionGrant). In this case a caller can supply a matching permission grant (for example reading:request) and pass actions like request_read without any role evidence, despite this function explicitly tagging missing role as a denial reason and the spec’s fail-closed expectation for missing org role. The allow predicate should include an explicit role-present check (or otherwise make missing role a hard deny).
Useful? React with 👍 / 👎.
698946a to
8937f62
Compare
8937f62 to
80e3153
Compare
80e3153 to
b829a20
Compare
b829a20 to
74d127d
Compare
Adds package-owned BTD organization/interface authority decisions with holdings, read-license usage, source visibility, and proof roots. Wires JSON-safe API/UAPI decisions, MCP required interface authority, ChatGPT App write admission, sandbox harness evidence, and Terminal Authority detail projection. Updates V29 spec/parity/docs, gate-quality CI, Gate 7 checker, lockfile, and focused BTD/API/MCP/ChatGPT/pipeline-host/UAPI coverage.
74d127d to
fcb6706
Compare
…andbox host durability Spec (NOTES #26 + parity matrix #26–31; QA runbook cancel/sandbox): - Exhaustive cancel law (row authority, cooperative abort, sandbox stop, UI) - Sandbox deposit: ephemeral boxes, OIDC/token auth fail-closed, sandboxId on context Implementation: - POST /api/executions/[runId]/cancel + execution-cancel helper - Deposit route polls cancel; sandbox shouldAbort + non-persistent create - VercelSandboxPipelineHost abort/cancel outcome; assertVercelSandboxAuthAvailable - Deposit UI Cancel run control + deposit_synthesis_cancelled analytics - Tests for cancel API, host abort, harness result shape, provisioning
1 participant
Summary
Validation
pnpm --filter @bitcode/btd typecheckpnpm --filter @bitcode/api buildpnpm --dir packages/executions-mcp/src/mcp-server run type-checkpnpm --dir packages/chatgptapp exec tsc --noEmit --pretty falsepnpm --filter @bitcode/pipeline-hosts typecheckpnpm run check:v29-gate7pnpm --filter @bitcode/btd test -- --runTestsByPath __tests__/btd.test.tspnpm --filter @bitcode/btd testpnpm --filter @bitcode/api exec jest --config jest.config.cjs --runTestsByPath src/routes/__tests__/btd-crypto.test.ts --runInBandpnpm --dir packages/executions-mcp/src/mcp-server run test:mcp -- --runTestsByPath src/__tests__/unit/auth.test.ts --runInBandpnpm --dir packages/chatgptapp exec jest --runTestsByPath src/__tests__/tools.test.ts --runInBandpnpm --filter @bitcode/pipeline-hosts exec jest --config jest.config.cjs --runTestsByPath src/__tests__/asset-pack-harness.test.ts --runInBandpnpm --dir uapi exec jest --runTestsByPath tests/api/readReviewRoute.test.ts tests/api/pipelineHarnessRoute.test.ts tests/terminalPipelineHarnessClient.test.ts tests/terminalDepositReadWorkbench.test.ts tests/terminalTransactionQuery.test.ts tests/terminalTransactionReadModel.test.ts tests/terminalWalletBtcOperation.test.ts tests/terminalJournalReconciliation.test.ts tests/terminalOrganizationAuthority.test.ts tests/terminalTransactionDetailCards.test.tsx tests/terminalTransactionDetailSnapshot.test.ts tests/pipelineExecutionLogHeader.test.tsx --runInBandbash scripts/find-uppercase-raw-promptparts.shbash scripts/check-import-casing.shpnpm test:qa:v28:pipeline-readbackpnpm --filter @bitcode/pipeline-asset-pack exec jest --config jest.config.cjs --passWithNoTests --forceExitpnpm --filter @bitcode/pipeline-asset-pack exec jest --config jest.config.cjs --runTestsByPath src/__tests__/reading-pipeline-observability.test.ts src/__tests__/reading-pipeline-contract.test.ts --runInBandpnpm --filter @bitcode/pipeline-asset-pack exec jest --config jest.config.cjs --runTestsByPath src/__tests__/asset-pack-disclosure.test.ts src/__tests__/postprocess.test.ts src/__tests__/read-need.test.ts --runInBandnpm --prefix protocol-demonstration testnpm --prefix protocol-demonstration run test:v28-mvp-qagit diff --check