@emilia-protocol/gate 0.1.0 → 0.6.0

package/adapters/github-demo.mjs

@@ -0,0 +1,57 @@
+/**
+ * EMILIA Gate × GitHub — the 60-second "oh shit" demo. Run: node adapters/github-demo.mjs
+ *
+ * An agent tries to delete a production repo. Without a receipt: refused, and the
+ * GitHub API is never called. With a valid human signoff bound to THIS repo: it
+ * runs and produces a reliance packet. Change the target repo after approval:
+ * refused (drift). Replay the receipt: refused. Uses a fake Octokit so it runs
+ * with no credentials; swap in `new Octokit({ auth })` for the real thing.
+ * @license Apache-2.0
+ */
+import crypto from 'node:crypto';
+import { createGate } from '../index.js';
+import { createGithubManifest, guardGithubMutation } from './github.js';
+
+const canon = (v) => (v == null ? JSON.stringify(v)
+  : Array.isArray(v) ? `[${v.map(canon).join(',')}]`
+    : typeof v === 'object' ? `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canon(v[k])).join(',')}}`
+      : JSON.stringify(v));
+const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+const ISSUER = publicKey.export({ type: 'spki', format: 'der' }).toString('base64url');
+let n = 0;
+const mint = (extra = {}) => {
+  const payload = {
+    receipt_id: `gh_${++n}`, subject: 'agent:repo-bot', issuer: 'ep:org:demo', created_at: new Date().toISOString(),
+    claim: { action_type: 'github.repo.delete', owner: 'acme', repo: 'prod', outcome: 'allow_with_signoff', approver: 'ep:approver:cto', ...extra },
+  };
+  return { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value: crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url') } };
+};
+
+const octokit = {
+  repos: { delete: async (p) => { console.log(`        !! GitHub API: repos.delete(${p.owner}/${p.repo}) EXECUTED`); return { status: 204 }; } },
+};
+const gate = createGate({ manifest: createGithubManifest(), trustedKeys: [ISSUER] });
+const G = (s) => `\x1b[32m${s}\x1b[0m`; const R = (s) => `\x1b[31m${s}\x1b[0m`;
+const line = (s) => console.log(s);
+
+async function attempt(label, params, receipt) {
+  try {
+    const { reliance } = await guardGithubMutation(gate, octokit, { op: 'repo.delete', params, receipt });
+    line(`  ${label} -> ${G('ALLOWED')}  reliance=${reliance.verdict.toUpperCase()}`);
+  } catch (e) {
+    line(`  ${label} -> ${R(`REFUSED ${e.status || ''}`)} (${e.gate?.reason || e.message})`);
+  }
+}
+
+line('='.repeat(66));
+line('  EMILIA Gate × GitHub — agent tries to delete the production repo');
+line('='.repeat(66));
+await attempt('1. delete acme/prod, no receipt            ', { owner: 'acme', repo: 'prod' }, null);
+const approval = mint();
+await attempt('2. delete acme/prod, valid human signoff   ', { owner: 'acme', repo: 'prod' }, approval);
+await attempt('3. same receipt replayed                   ', { owner: 'acme', repo: 'prod' }, approval);
+const reAppro = mint();
+await attempt('4. approved acme/prod, but targets staging ', { owner: 'acme', repo: 'staging' }, reAppro);
+line('  ' + '-'.repeat(62));
+line('  No receipt, no mutation. The GitHub API is only reached on an allowed line.');
+line('='.repeat(66));

package/adapters/github.js

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — GitHub System-of-Record adapter.
+ *
+ * "Install this before your agent can touch production GitHub." Wraps destructive
+ * Octokit operations so the mutation NEVER reaches GitHub without a valid,
+ * sufficiently-assured, non-replayed human/quorum receipt bound to THIS repo —
+ * and on success returns a reliance packet proving exactly what was authorized
+ * and what executed.
+ *
+ *   import { Octokit } from '@octokit/rest';
+ *   import { createGate } from '@emilia-protocol/gate';
+ *   import { createGithubManifest, guardGithubMutation } from '@emilia-protocol/gate/adapters/github';
+ *
+ *   const gate = createGate({ manifest: createGithubManifest(), trustedKeys: [ISSUER] });
+ *   const octokit = new Octokit({ auth });
+ *   await guardGithubMutation(gate, octokit, {
+ *     op: 'repo.delete', params: { owner, repo }, receipt,  // throws if no valid receipt
+ *   });
+ *
+ * The receipt's claim must carry the same owner/repo (and username/permission or
+ * branch) as the call — a receipt for repo A cannot authorize deleting repo B.
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const GITHUB_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'github.repo.delete',
+    label: 'GitHub repo delete',
+    action_type: 'github.repo.delete',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'github', tool: 'delete_repo' },
+    why: 'Destroys a repository and its history. Bind owner/repo to a named human approval.',
+    execution_binding: { required_fields: ['action_type', 'owner', 'repo'] },
+  }),
+  Object.freeze({
+    id: 'github.permission.change',
+    label: 'GitHub permission change',
+    action_type: 'github.permission.change',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'quorum',
+    match: { protocol: 'github', tool: 'update_collaborator_permission' },
+    why: 'Changes who can act on the repo. Privilege change deserves the two-person rule.',
+    execution_binding: { required_fields: ['action_type', 'owner', 'repo', 'username', 'permission'] },
+  }),
+  Object.freeze({
+    id: 'github.branch_protection.remove',
+    label: 'GitHub branch-protection removal',
+    action_type: 'github.branch_protection.remove',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'github', tool: 'delete_branch_protection' },
+    why: 'Removes the guard rails on a protected branch.',
+    execution_binding: { required_fields: ['action_type', 'owner', 'repo', 'branch'] },
+  }),
+]);
+
+const OPS = {
+  'repo.delete': {
+    selector: { protocol: 'github', tool: 'delete_repo' },
+    observed: (p) => ({ action_type: 'github.repo.delete', owner: p.owner, repo: p.repo }),
+    perform: (octokit, p) => octokit.repos.delete({ owner: p.owner, repo: p.repo }),
+  },
+  'permission.change': {
+    selector: { protocol: 'github', tool: 'update_collaborator_permission' },
+    observed: (p) => ({
+      action_type: 'github.permission.change',
+      owner: p.owner, repo: p.repo, username: p.username, permission: p.permission,
+    }),
+    perform: (octokit, p) => octokit.repos.addCollaborator({
+      owner: p.owner, repo: p.repo, username: p.username, permission: p.permission,
+    }),
+  },
+  'branch_protection.remove': {
+    selector: { protocol: 'github', tool: 'delete_branch_protection' },
+    observed: (p) => ({ action_type: 'github.branch_protection.remove', owner: p.owner, repo: p.repo, branch: p.branch }),
+    perform: (octokit, p) => octokit.repos.deleteBranchProtection({ owner: p.owner, repo: p.repo, branch: p.branch }),
+  },
+};
+
+const adapter = createAdapter({ system: 'github', ops: OPS });
+export const GITHUB_OPS = adapter.OPS;
+
+/** Build an action-risk manifest for the GitHub destructive ops (plus any extras). */
+export function createGithubManifest(extraActions = []) {
+  return manifestFromPack(GITHUB_ACTION_PACK, extraActions);
+}
+
+/**
+ * Guard a destructive GitHub mutation behind the gate. The call never reaches
+ * GitHub unless a valid, sufficiently-assured, non-replayed receipt bound to
+ * THIS repo is present.
+ * @param {object} gate     a gate built with createGithubManifest()
+ * @param {object} octokit  an Octokit-like client (@octokit/rest or compatible)
+ * @param {object} o
+ * @param {string} o.op     'repo.delete' | 'permission.change' | 'branch_protection.remove'
+ * @param {object} o.params { owner, repo, [username], [permission], [branch] }
+ * @param {object} o.receipt the EMILIA receipt authorizing THIS exact op
+ * @returns {Promise<{ result:any, reliance:object, execution:object }>}
+ * @throws  Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the call never reaches GitHub
+ */
+export function guardGithubMutation(gate, octokit, args) {
+  return adapter.guard(gate, octokit, args);
+}
+
+export default { GITHUB_ACTION_PACK, GITHUB_OPS, createGithubManifest, guardGithubMutation };

package/adapters/k8s.js

@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Kubernetes System-of-Record adapter.
+ *
+ * "Install this before your agent can touch the cluster." Guards the operations
+ * that take a cluster down or hand it away — namespace delete, workload delete,
+ * RBAC binding, secret delete — so they never reach the API server without a
+ * receipt bound to THIS namespace/resource. Client is injected (a @kubernetes/
+ * client-node wrapper or compatible).
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const K8S_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'k8s.namespace.delete', label: 'Delete namespace', action_type: 'k8s.namespace.delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'k8s', tool: 'delete_namespace' },
+    why: 'Deletes an entire namespace and everything in it. Quorum.',
+    execution_binding: { required_fields: ['action_type', 'namespace'] },
+  }),
+  Object.freeze({
+    id: 'k8s.workload.delete', label: 'Delete workload', action_type: 'k8s.workload.delete',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'k8s', tool: 'delete_workload' },
+    why: 'Deletes a deployment/statefulset/job. Bind namespace+kind+name.',
+    execution_binding: { required_fields: ['action_type', 'namespace', 'kind', 'name'] },
+  }),
+  Object.freeze({
+    id: 'k8s.rbac.bind', label: 'RBAC binding', action_type: 'k8s.rbac.bind',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'k8s', tool: 'create_role_binding' },
+    why: 'Grants cluster permissions. Privilege change → two-person rule.',
+    execution_binding: { required_fields: ['action_type', 'subject', 'role', 'namespace'] },
+  }),
+  Object.freeze({
+    id: 'k8s.secret.delete', label: 'Delete secret', action_type: 'k8s.secret.delete',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'k8s', tool: 'delete_secret' },
+    why: 'Destroys a secret. Bind namespace+name.',
+    execution_binding: { required_fields: ['action_type', 'namespace', 'name'] },
+  }),
+]);
+
+const OPS = {
+  'namespace.delete': {
+    selector: { protocol: 'k8s', tool: 'delete_namespace' },
+    observed: (p) => ({ action_type: 'k8s.namespace.delete', namespace: p.namespace }),
+    perform: (c, p) => c.deleteNamespace({ namespace: p.namespace }),
+  },
+  'workload.delete': {
+    selector: { protocol: 'k8s', tool: 'delete_workload' },
+    observed: (p) => ({ action_type: 'k8s.workload.delete', namespace: p.namespace, kind: p.kind, name: p.name }),
+    perform: (c, p) => c.deleteWorkload({ namespace: p.namespace, kind: p.kind, name: p.name }),
+  },
+  'rbac.bind': {
+    selector: { protocol: 'k8s', tool: 'create_role_binding' },
+    observed: (p) => ({ action_type: 'k8s.rbac.bind', subject: p.subject, role: p.role, namespace: p.namespace }),
+    perform: (c, p) => c.createRoleBinding({ subject: p.subject, role: p.role, namespace: p.namespace }),
+  },
+  'secret.delete': {
+    selector: { protocol: 'k8s', tool: 'delete_secret' },
+    observed: (p) => ({ action_type: 'k8s.secret.delete', namespace: p.namespace, name: p.name }),
+    perform: (c, p) => c.deleteSecret({ namespace: p.namespace, name: p.name }),
+  },
+};
+
+const adapter = createAdapter({ system: 'k8s', ops: OPS });
+export const K8S_OPS = adapter.OPS;
+export function createK8sManifest(extraActions = []) { return manifestFromPack(K8S_ACTION_PACK, extraActions); }
+export function guardK8sMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { K8S_ACTION_PACK, K8S_OPS, createK8sManifest, guardK8sMutation };

package/adapters/stripe.js

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Stripe / payments System-of-Record adapter.
+ *
+ * "Install this before your agent can move money." Wraps the destructive Stripe
+ * operations so a payout, refund, or payout-destination change never reaches
+ * Stripe without a valid, sufficiently-assured, non-replayed receipt bound to
+ * THIS amount/destination. A receipt for $100 to acct_A cannot authorize
+ * $10,000 to acct_B.
+ *
+ *   import Stripe from 'stripe';
+ *   import { createGate } from '@emilia-protocol/gate';
+ *   import { createStripeManifest, guardStripeMutation } from '@emilia-protocol/gate/adapters/stripe';
+ *
+ *   const gate = createGate({ manifest: createStripeManifest(), trustedKeys: [ISSUER] });
+ *   await guardStripeMutation(gate, new Stripe(key), {
+ *     op: 'payout.create', params: { amount: 40000, currency: 'usd', destination: 'acct_x' }, receipt,
+ *   });
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const STRIPE_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'stripe.payout.create', label: 'Stripe payout', action_type: 'stripe.payout.create',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'stripe', tool: 'create_payout' },
+    why: 'Moves money out. Bind amount/currency/destination to a named human approval.',
+    execution_binding: { required_fields: ['action_type', 'amount', 'currency', 'destination'] },
+  }),
+  Object.freeze({
+    id: 'stripe.refund.create', label: 'Stripe refund', action_type: 'stripe.refund.create',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'stripe', tool: 'create_refund' },
+    why: 'Returns funds. Bind the payment and amount so a refund cannot be silently inflated.',
+    execution_binding: { required_fields: ['action_type', 'payment_intent', 'amount'] },
+  }),
+  Object.freeze({
+    id: 'stripe.bank_account.change', label: 'Stripe payout-destination change', action_type: 'stripe.bank_account.change',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'stripe', tool: 'update_external_account' },
+    why: 'Changes WHERE future money flows. Quorum: the classic redirect-the-payouts attack.',
+    execution_binding: { required_fields: ['action_type', 'account', 'external_account'] },
+  }),
+]);
+
+const OPS = {
+  'payout.create': {
+    selector: { protocol: 'stripe', tool: 'create_payout' },
+    observed: (p) => ({ action_type: 'stripe.payout.create', amount: p.amount, currency: p.currency, destination: p.destination }),
+    perform: (stripe, p) => stripe.payouts.create({ amount: p.amount, currency: p.currency, destination: p.destination }),
+  },
+  'refund.create': {
+    selector: { protocol: 'stripe', tool: 'create_refund' },
+    observed: (p) => ({ action_type: 'stripe.refund.create', payment_intent: p.payment_intent, amount: p.amount }),
+    perform: (stripe, p) => stripe.refunds.create({ payment_intent: p.payment_intent, amount: p.amount }),
+  },
+  'bank_account.change': {
+    selector: { protocol: 'stripe', tool: 'update_external_account' },
+    observed: (p) => ({ action_type: 'stripe.bank_account.change', account: p.account, external_account: p.external_account }),
+    perform: (stripe, p) => stripe.accounts.updateExternalAccount(p.account, p.external_account, p.update || {}),
+  },
+};
+
+const adapter = createAdapter({ system: 'stripe', ops: OPS });
+export const STRIPE_OPS = adapter.OPS;
+
+export function createStripeManifest(extraActions = []) {
+  return manifestFromPack(STRIPE_ACTION_PACK, extraActions);
+}
+
+/**
+ * Guard a destructive Stripe mutation behind the gate.
+ * @param {object} gate    a gate built with createStripeManifest()
+ * @param {object} stripe  a Stripe-like client (the official `stripe` SDK or compatible)
+ * @param {object} o       { op:'payout.create'|'refund.create'|'bank_account.change', params, receipt }
+ * @throws Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the call never reaches Stripe
+ */
+export function guardStripeMutation(gate, stripe, args) {
+  return adapter.guard(gate, stripe, args);
+}
+
+export default { STRIPE_ACTION_PACK, STRIPE_OPS, createStripeManifest, guardStripeMutation };

package/adapters/supabase.js

@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Supabase / Postgres System-of-Record adapter.
+ *
+ * "Install this before your agent can run destructive SQL." Wraps the dangerous
+ * database operations — destructive SQL (DELETE/DROP/TRUNCATE/UPDATE), bulk
+ * export, and RLS-policy change — so they never execute without a valid,
+ * sufficiently-assured, non-replayed receipt bound to THIS statement/table. The
+ * exact statement is bound by hash, so an approval for one DELETE cannot be
+ * swapped for a DROP.
+ *
+ *   import { createGate } from '@emilia-protocol/gate';
+ *   import { createSupabaseManifest, guardSupabaseMutation, isDestructiveSql } from '@emilia-protocol/gate/adapters/supabase';
+ *
+ *   const gate = createGate({ manifest: createSupabaseManifest(), trustedKeys: [ISSUER] });
+ *   // client: anything with .query(sql) (node-postgres / a Supabase RPC wrapper).
+ *   await guardSupabaseMutation(gate, client, {
+ *     op: 'sql.destructive', params: { sql: 'DELETE FROM payments WHERE id=1', table: 'payments' }, receipt,
+ *   });
+ */
+import { createAdapter, manifestFromPack, hashCanonical } from './_kit.js';
+
+const DESTRUCTIVE = /\b(delete|drop|truncate|alter\s+table)\b/i;
+const UPDATE_NO_WHERE = /\bupdate\b(?:(?!\bwhere\b).)*$/is;
+
+/** Heuristic: is this SQL destructive (DELETE/DROP/TRUNCATE/ALTER, or UPDATE without WHERE)? */
+export function isDestructiveSql(sql) {
+  const s = String(sql || '');
+  return DESTRUCTIVE.test(s) || UPDATE_NO_WHERE.test(s.trim());
+}
+
+/** Canonical hash of a SQL statement, whitespace-collapsed and lowercased. */
+export function statementHash(sql) {
+  return hashCanonical(String(sql || '').replace(/\s+/g, ' ').trim().toLowerCase());
+}
+
+export const SUPABASE_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'supabase.sql.destructive', label: 'Destructive SQL', action_type: 'supabase.sql.destructive',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'supabase', tool: 'execute_sql' },
+    why: 'DELETE/DROP/TRUNCATE/ALTER destroys or rewrites system-of-record state. Bind the exact statement.',
+    execution_binding: { required_fields: ['action_type', 'statement_hash'] },
+  }),
+  Object.freeze({
+    id: 'supabase.data.export', label: 'Bulk data export', action_type: 'supabase.data.export',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'supabase', tool: 'export_table' },
+    why: 'Moves data out of its system of record. Bind table + recipient to the approval.',
+    execution_binding: { required_fields: ['action_type', 'table', 'recipient'] },
+  }),
+  Object.freeze({
+    id: 'supabase.rls.change', label: 'RLS policy change', action_type: 'supabase.rls.change',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'supabase', tool: 'alter_policy' },
+    why: 'Changes who can read/write rows. Row-Level-Security changes deserve the two-person rule.',
+    execution_binding: { required_fields: ['action_type', 'table', 'policy'] },
+  }),
+]);
+
+const OPS = {
+  'sql.destructive': {
+    selector: { protocol: 'supabase', tool: 'execute_sql' },
+    observed: (p) => ({ action_type: 'supabase.sql.destructive', statement_hash: statementHash(p.sql) }),
+    perform: (client, p) => client.query(p.sql),
+  },
+  'data.export': {
+    selector: { protocol: 'supabase', tool: 'export_table' },
+    observed: (p) => ({ action_type: 'supabase.data.export', table: p.table, recipient: p.recipient }),
+    perform: (client, p) => client.export(p.table, p.recipient),
+  },
+  'rls.change': {
+    selector: { protocol: 'supabase', tool: 'alter_policy' },
+    observed: (p) => ({ action_type: 'supabase.rls.change', table: p.table, policy: p.policy }),
+    perform: (client, p) => client.alterPolicy(p.table, p.policy, p.definition),
+  },
+};
+
+const adapter = createAdapter({ system: 'supabase', ops: OPS });
+export const SUPABASE_OPS = adapter.OPS;
+
+export function createSupabaseManifest(extraActions = []) {
+  return manifestFromPack(SUPABASE_ACTION_PACK, extraActions);
+}
+
+/**
+ * Guard a destructive Supabase/Postgres mutation behind the gate.
+ * @param {object} gate    a gate built with createSupabaseManifest()
+ * @param {object} client  a client exposing { query(sql), export(table,recipient), alterPolicy(table,policy,def) }
+ * @param {object} o       { op:'sql.destructive'|'data.export'|'rls.change', params, receipt }
+ * @throws Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the statement never executes
+ */
+export function guardSupabaseMutation(gate, client, args) {
+  return adapter.guard(gate, client, args);
+}
+
+export default {
+  SUPABASE_ACTION_PACK, SUPABASE_OPS, createSupabaseManifest, guardSupabaseMutation,
+  isDestructiveSql, statementHash,
+};

package/adapters/terraform.js

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Terraform System-of-Record adapter.
+ *
+ * "Install this before your agent can destroy infrastructure." Guards the
+ * irreversible Terraform operations — destroy, state rm, workspace delete — so
+ * they never run without a receipt bound to THIS workspace/plan. The destroy
+ * plan is bound by hash, so an approved small destroy cannot be swapped for a
+ * full teardown. Runner is injected (a `terraform`/`tofu` CLI wrapper or Cloud
+ * API client).
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const TERRAFORM_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'terraform.apply.destroy', label: 'Terraform destroy', action_type: 'terraform.apply.destroy',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'terraform', tool: 'destroy' },
+    why: 'Tears down real infrastructure. Bind the workspace + plan hash; quorum.',
+    execution_binding: { required_fields: ['action_type', 'workspace', 'plan_hash'] },
+  }),
+  Object.freeze({
+    id: 'terraform.state.rm', label: 'Terraform state rm', action_type: 'terraform.state.rm',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'terraform', tool: 'state_rm' },
+    why: 'Detaches a resource from state (orphans real infra). Bind workspace+address.',
+    execution_binding: { required_fields: ['action_type', 'workspace', 'address'] },
+  }),
+  Object.freeze({
+    id: 'terraform.workspace.delete', label: 'Terraform workspace delete', action_type: 'terraform.workspace.delete',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'terraform', tool: 'workspace_delete' },
+    why: 'Deletes a workspace and its state. Bind the workspace.',
+    execution_binding: { required_fields: ['action_type', 'workspace'] },
+  }),
+]);
+
+const OPS = {
+  'apply.destroy': {
+    selector: { protocol: 'terraform', tool: 'destroy' },
+    observed: (p) => ({ action_type: 'terraform.apply.destroy', workspace: p.workspace, plan_hash: p.plan_hash }),
+    perform: (r, p) => r.destroy({ workspace: p.workspace, plan_hash: p.plan_hash }),
+  },
+  'state.rm': {
+    selector: { protocol: 'terraform', tool: 'state_rm' },
+    observed: (p) => ({ action_type: 'terraform.state.rm', workspace: p.workspace, address: p.address }),
+    perform: (r, p) => r.stateRm({ workspace: p.workspace, address: p.address }),
+  },
+  'workspace.delete': {
+    selector: { protocol: 'terraform', tool: 'workspace_delete' },
+    observed: (p) => ({ action_type: 'terraform.workspace.delete', workspace: p.workspace }),
+    perform: (r, p) => r.workspaceDelete({ workspace: p.workspace }),
+  },
+};
+
+const adapter = createAdapter({ system: 'terraform', ops: OPS });
+export const TERRAFORM_OPS = adapter.OPS;
+export function createTerraformManifest(extraActions = []) { return manifestFromPack(TERRAFORM_ACTION_PACK, extraActions); }
+export function guardTerraformMutation(gate, runner, args) { return adapter.guard(gate, runner, args); }
+export default { TERRAFORM_ACTION_PACK, TERRAFORM_OPS, createTerraformManifest, guardTerraformMutation };

package/custody-demo.mjs

@@ -0,0 +1,41 @@
+/**
+ * EMILIA Gate — production custody demo. Run: node custody-demo.mjs
+ *
+ * Shows the three custody controls a serious buyer asks for:
+ *   1. ROTATION  — a new issuer key takes over without breaking the old one.
+ *   2. REVOCATION — a compromised issuer key is rejected immediately, live.
+ *   3. RETENTION  — the evidence log classifies hot/cold/expired + exports.
+ * @license Apache-2.0
+ */
+import { createGate, createKeyRegistry, createEg1Harness } from './index.js';
+import { DEFAULT_GATE_MANIFEST } from './action-packs.js';
+
+const SEL = { protocol: 'mcp', tool: 'release_payment' };
+const k1 = createEg1Harness({ idPrefix: 'k1' });
+const k2 = createEg1Harness({ idPrefix: 'k2' });
+const registry = createKeyRegistry([{ kid: 'issuer-1', key: k1.publicKey }]);
+const gate = createGate({ manifest: DEFAULT_GATE_MANIFEST, keyRegistry: registry });
+
+const G = (s) => `\x1b[32m${s}\x1b[0m`; const R = (s) => `\x1b[31m${s}\x1b[0m`;
+const line = (s) => console.log(s);
+async function pay(label, harness) {
+  const out = await gate.run({ selector: SEL, receipt: harness.mint({ outcome: 'allow_with_signoff' }), observedAction: harness.action }, async () => ({ wire: 'ok' }));
+  line(`  ${label} -> ${out.ok ? G('ALLOWED') : R(`REFUSED (${out.authorization.reason})`)}`);
+}
+
+line('='.repeat(64));
+line('  EMILIA Gate — production custody: rotate, revoke, retain');
+line('='.repeat(64));
+await pay('1. payout, issuer-1 (current)            ', k1);
+registry.revoke('issuer-1');
+line('     ↳ issuer-1 reported COMPROMISED — registry.revoke("issuer-1")');
+await pay('2. payout, issuer-1 (revoked)            ', k1);
+registry.add({ kid: 'issuer-2', key: k2.publicKey });
+line('     ↳ rotated in issuer-2 — registry.add(issuer-2)');
+await pay('3. payout, issuer-2 (rotated in)         ', k2);
+
+const exp = gate.retentionExport();
+line('  ' + '-'.repeat(60));
+line(`  retention: ${exp.counts.total} evidence entries (hot ${exp.counts.hot} / cold ${exp.counts.cold} / expired ${exp.counts.expired}), head ${String(exp.evidence_head).slice(0, 12)}…`);
+line('  Revoke a leaked issuer key live. No redeploy. Every decision retained + provable.');
+line('='.repeat(64));

package/demo.mjs

@@ -0,0 +1,57 @@
+/**
+ * EMILIA Gate — end-to-end demo. Run: node demo.mjs
+ * Shows the Trusted Action Firewall refusing and allowing a consequential
+ * action, defeating replay and tampering, and emitting a verifiable audit log.
+ * @license Apache-2.0
+ */
+import crypto from 'node:crypto';
+import { createTrustedActionFirewall } from './index.js';
+
+const canon = (v) => v == null ? JSON.stringify(v)
+  : Array.isArray(v) ? `[${v.map(canon).join(',')}]`
+  : typeof v === 'object' ? `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canon(v[k])).join(',')}}`
+  : JSON.stringify(v);
+const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+const pub = publicKey.export({ type: 'spki', format: 'der' }).toString('base64url');
+let n = 0;
+const action = {
+  action_type: 'payment.release',
+  amount_usd: 40000,
+  currency: 'USD',
+  payment_instruction_id: 'pi_demo_40000',
+  beneficiary_account_hash: 'sha256:demo-beneficiary',
+};
+const receipt = (outcome, extra = {}) => {
+  const payload = { receipt_id: `rcpt_${++n}`, subject: 'agent:finance-bot', issuer: 'ep:org:demo', created_at: new Date().toISOString(), claim: { ...action, outcome, approver: 'ep:approver:cfo', ...extra } };
+  return { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value: crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url') } };
+};
+
+const gate = createTrustedActionFirewall({ trustedKeys: [pub] });
+const PAY = { protocol: 'mcp', tool: 'release_payment' };
+const line = (s) => console.log(s);
+const r = (o) => o.allow ? `\x1b[32mALLOW\x1b[0m` : `\x1b[31mREFUSE ${o.status}\x1b[0m (${o.reason})`;
+
+line('='.repeat(64));
+line('  EMILIA Gate — Trusted Action Firewall  (release_payment, critical)');
+line('='.repeat(64));
+line(`\n  1. read_status (not guarded)             -> ${r(await gate.check({ selector: { protocol: 'mcp', tool: 'read_status' } }))}`);
+line(`  2. release_payment, no receipt          -> ${r(await gate.check({ selector: PAY }))}`);
+line(`  3. release_payment, software receipt    -> ${r(await gate.check({ selector: PAY, receipt: receipt('allow'), observedAction: action }))}   (needs class_a)`);
+const good = receipt('allow_with_signoff');
+line(`  4. release_payment, observed drift      -> ${r(await gate.check({ selector: PAY, receipt: good, observedAction: { ...action, amount_usd: 999999 } }))}`);
+const run = await gate.run({ selector: PAY, receipt: good, observedAction: action }, async () => ({ released: true, id: 'wire_123' }));
+const a4 = run.authorization;
+line(`  5. release_payment, class_a + bound      -> ${r(a4)}`);
+const exec = run.execution;
+line(`     ↳ executed -> execution receipt bound to decision ${exec.authorizes_decision.slice(0, 12)}…`);
+line(`  6. release_payment, SAME receipt again   -> ${r(await gate.check({ selector: PAY, receipt: good, observedAction: action }))}`);
+const bad = receipt('allow_with_signoff'); bad.payload.claim.amount_usd = 9_999_999;
+line(`  7. release_payment, tampered amount      -> ${r(await gate.check({ selector: PAY, receipt: bad, observedAction: action }))}`);
+
+const chain = gate.evidence.verify();
+const packet = run.packet;
+line(`\n  reliance packet: ${packet.verdict.toUpperCase()}  decision=${packet.summary.decision_hash.slice(0, 12)}… execution=${packet.summary.execution_hash.slice(0, 12)}…`);
+line(`  evidence log: ${gate.evidence.all().length} decisions, chain ${chain.ok ? '\x1b[32mINTACT\x1b[0m' : '\x1b[31mBROKEN\x1b[0m'}`);
+line('  ' + '-'.repeat(60));
+line('  Deny by default. No receipt, no execution. Every decision is provable.');
+line('='.repeat(64));