@emilia-protocol/gate 0.1.0 → 0.7.0

package/README.md

@@ -18,32 +18,191 @@ action* before the world is mutated.
 ## Run it
 
 ```bash
-node --test        # 10 tests
-node demo.mjs       # end-to-end: passthrough -> 428 -> too-low -> allow -> replay -> tamper
+node --test                       # Gate + red-team + EG-1 + MCP + adapter tests
+node demo.mjs                     # end-to-end: passthrough -> 428 -> too-low -> drift -> allow -> replay -> tamper -> reliance packet
+node eg1.mjs                      # EG-1 conformance: 8/8 -> "EG-1 Enforced"
+node adapters/github-demo.mjs     # an agent tries to delete a prod repo (refused without a receipt)
+node custody-demo.mjs             # rotate, revoke a compromised issuer key live, retention export
 ```
 
 ## Use it
 
 ```js
-import { createGate } from '@emilia-protocol/gate';
+import { createTrustedActionFirewall } from '@emilia-protocol/gate';
 
-const gate = createGate({
-  manifest,             // EP-ACTION-RISK-MANIFEST-v0.1: which actions are guarded + their tier
-  trustedKeys: [ISSUER_PUBKEY_B64U],   // pin the issuers you trust
+const gate = createTrustedActionFirewall({
+  trustedKeys: [ISSUER_PUBKEY_B64U], // pin the issuers you trust
   maxAgeSec: 900,
 });
 
-// 1) Framework-agnostic check
-const out = await gate.check({ selector: { protocol: 'mcp', tool: 'release_payment' }, receipt });
-if (!out.allow) throw out.challenge;   // 428 Receipt-Required
+// Facts from the system of record, not from attacker-controlled request input.
+const observedAction = {
+  action_type: 'payment.release',
+  amount_usd: 40000,
+  currency: 'USD',
+  payment_instruction_id: 'pi_123',
+  beneficiary_account_hash: 'sha256:...',
+};
+
+const out = await gate.run({
+  selector: { protocol: 'mcp', tool: 'release_payment' },
+  receipt,
+  observedAction,
+}, async () => {
+  // Only reached after receipt verification, assurance enforcement, field
+  // binding, and one-time reservation.
+  return releasePayment(observedAction);
+});
+
+if (!out.ok) throw out.body; // 428 Receipt Required
+console.log(out.packet.verdict); // "rely"
+```
+
+## Default action packs
+
+`createTrustedActionFirewall()` ships with high-risk defaults. These are category-based, not just
+amount-based:
+
+- `payment.release` — money movement, `class_a`
+- `payment.bank_details.change` — bank-detail / beneficiary change, `class_a`
+- `deploy.production` — production deploy, `quorum`
+- `permission.admin.change` — permission / admin change, `quorum`
+- `data.export` — bulk sensitive-data export, `class_a`
+- `record.delete` — destructive record deletion, `class_a`
+- `regulated.decision.override` — regulated decision override, `quorum`
+
+Each pack also defines `execution_binding.required_fields`. The executor must pass those observed
+fields from the real system of record. If the signed claim and observed mutation differ, the gate
+refuses with `execution_binding_failed` before consuming the receipt.
+
+Prefer `gate.run(...)` for mutations: it reserves the receipt, runs the side effect, commits
+one-time consumption only after success, releases the reservation if the action fails before
+mutation, and emits the execution receipt + reliance packet. Use lower-level `gate.check(...)` only
+when your framework has to separate authorization from execution.
+
+Use your own manifest when you need custom policy:
+
+```js
+import { createGate } from '@emilia-protocol/gate';
+
+const gate = createGate({ manifest, trustedKeys: [ISSUER_PUBKEY_B64U] });
+```
+
+## Framework adapters
+
+```js
+// 1) Express / Connect middleware
+app.post(
+  '/payments',
+  gate.middleware({
+    selector: { protocol: 'http', method: 'POST', path: '/payments' },
+    observedAction: (req) => req.paymentFromSystemOfRecord,
+  }),
+  handler,
+);
+
+// 2) Wrap any function
+const release = gate.guard(reallyRelease, {
+  selector: () => ({ tool: 'release_payment', protocol: 'mcp' }),
+  receipt: (_amount, r) => r,
+  observedAction: (amount) => ({
+    action_type: 'payment.release',
+    amount_usd: amount,
+    currency: 'USD',
+    payment_instruction_id: 'pi_123',
+    beneficiary_account_hash: 'sha256:...',
+  }),
+});
+```
+
+## MCP drop-in
+
+Agents live at the MCP tool-call boundary. One wrapper turns a dangerous tool into a
+receipt-required one:
 
-// 2) Express / Connect middleware
-app.post('/payments', gate.middleware({ action: 'payment.release' }), handler);
+```js
+import { createTrustedActionFirewall } from '@emilia-protocol/gate';
+import { gateMcpTool } from '@emilia-protocol/gate/mcp';
+
+const gate = createTrustedActionFirewall({ trustedKeys: [ISSUER_PUBKEY_B64U] });
 
-// 3) Wrap any function
-const release = gate.guard(reallyRelease, { selector: () => ({ tool: 'release_payment', protocol: 'mcp' }), receipt: (args, r) => r });
+server.tool('release_payment', gateMcpTool(
+  gate,
+  { tool: 'release_payment', observedAction: (args) => paymentSystem.describe(args) },
+  async (args) => paymentSystem.release(args),
+));
+// No valid receipt -> a structured MCP error ({ isError, _emilia.challenge }).
+// On success -> the tool result with { _emilia: { execution, reliance } } attached.
 ```
 
+## System-of-record adapters
+
+Adoption happens where the mutation happens — *"install this before your agent can touch
+production."* Each adapter guards the destructive operations of a real system so the mutation never
+reaches it without a receipt bound to **this** resource (a receipt for resource A cannot authorize
+mutating B). All share one fail-closed contract (`adapters/_kit.js`).
+
+```js
+import { createGate } from '@emilia-protocol/gate';
+import { createGithubManifest, guardGithubMutation } from '@emilia-protocol/gate/adapters/github';
+
+const gate = createGate({ manifest: createGithubManifest(), trustedKeys: [ISSUER_PUBKEY_B64U] });
+await guardGithubMutation(gate, octokit, {
+  op: 'repo.delete',                 // | 'permission.change' | 'branch_protection.remove'
+  params: { owner: 'acme', repo: 'prod' },
+  receipt,                           // throws EMILIA_RECEIPT_REQUIRED if absent/invalid/replayed/drifted
+});
+```
+
+| Adapter | Import | Guarded ops (assurance) |
+|---|---|---|
+| **GitHub** | `@emilia-protocol/gate/adapters/github` | repo.delete `class_a`, permission.change `quorum`, branch_protection.remove `class_a` |
+| **Stripe** | `@emilia-protocol/gate/adapters/stripe` | payout.create `class_a`, refund.create `class_a`, bank_account.change `quorum` |
+| **Supabase / Postgres** | `@emilia-protocol/gate/adapters/supabase` | sql.destructive `class_a`, data.export `class_a`, rls.change `quorum` |
+| **AWS (IAM + network)** | `@emilia-protocol/gate/adapters/aws` | iam.attach_policy `quorum`, iam.create_access_key `class_a`, iam.delete_user `class_a`, ec2.authorize_ingress `quorum` |
+
+```js
+import { createStripeManifest, guardStripeMutation } from '@emilia-protocol/gate/adapters/stripe';
+const gate = createGate({ manifest: createStripeManifest(), trustedKeys: [ISSUER_PUBKEY_B64U] });
+await guardStripeMutation(gate, stripe, { op: 'payout.create', params: { amount: 40000, currency: 'usd', destination: 'acct_x' }, receipt });
+// Supabase: guardSupabaseMutation(gate, db, { op: 'sql.destructive', params: { sql }, receipt })  // binds the exact statement
+// AWS:      guardAwsMutation(gate, client, { op: 'iam.attach_policy', params: { user, policy_arn }, receipt })
+```
+
+Clients are injected (the real `@octokit/rest`, `stripe`, a `pg`/Supabase client, or the AWS SDK), so
+the adapters are testable without credentials. Adding an adapter is ~40 lines: a frozen action pack
+(selectors + tiers + `execution_binding.required_fields`) and an op map (`selector`, `observed(params)`,
+`perform(client, params)`) passed to `createAdapter()`.
+
+## Earn EG-1
+
+**EG-1 conformance** answers the only question that matters for adoption: *does your integration
+actually enforce the gate, or are you just claiming it?* An integration earns **EG-1 Enforced** only
+if it demonstrably passes all eight checks:
+
+1. missing receipt → 428
+2. software receipt on a Class-A action → refused
+3. observed execution drift → refused
+4. valid Class-A / quorum receipt → runs
+5. same receipt replay → refused
+6. tampered receipt → refused
+7. execution proof binds to the authorization decision
+8. reliance packet returns verdict `rely`
+
+```js
+import { createTrustedActionFirewall, createEg1Harness, gateConformance } from '@emilia-protocol/gate';
+
+const harness = createEg1Harness();
+const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey] });
+const report = await gateConformance({ gate, harness });
+// report.passed === true; report.badge === 'EG-1 Enforced'
+```
+
+For a custom integration (an HTTP service, another language), provide your own `invoke` to
+`runEg1({ invoke, harness })` — it drives the same eight scenarios. `node eg1.mjs` self-certifies the
+reference gate and exits non-zero on any failure, so it drops straight into CI. This turns an open PR
+into a crisp claim: *"this PR makes `delete_row` earn EG-1."*
+
 ## What it adds over a bare verifier
 
 `@emilia-protocol/require-receipt` already does manifest matching, offline verification, and the 428
@@ -55,6 +214,52 @@ challenge. The Gate composes that and adds the three things a firewall needs:
   (`replay_refused`). Default store is in-memory; swap in Redis/DB for a fleet.
 - **Evidence log** — every decision is hash-chained (`evidence.verify()` detects any alteration).
   This is the compliance / insurance artifact.
+- **Execution-field binding** — for high-risk packs, the signed claim must match the executor's
+  observed mutation fields (`amount_usd`, `commit_sha`, `principal_id`, `record_id`, etc.). This
+  closes "approved harmless X, executed dangerous Y."
+- **Reliance packet** — `gate.reliancePacket()` turns the decision, execution receipt, field binding,
+  and evidence head into the compact artifact an auditor, insurer, or investigator can review.
+
+## Production custody
+
+The three things a serious buyer (CISO, auditor, insurer) asks after the demo:
+
+**Issuer key rotation + revocation.** A flat `trustedKeys` list can't revoke a leaked key
+or rotate without downtime. A key registry can — a receipt is verified only against keys
+valid (and not revoked) at its issuance time. Revocation is fail-closed and immediate.
+
+```js
+import { createGate, createKeyRegistry } from '@emilia-protocol/gate';
+
+const registry = createKeyRegistry([
+  { kid: 'issuer-1', key: KEY1 },
+  { kid: 'issuer-2', key: KEY2, not_before: '2026-07-01T00:00:00Z' }, // rotation window
+]);
+const gate = createGate({ manifest, keyRegistry: registry });
+registry.revoke('issuer-1'); // compromised — refused immediately, live, no redeploy
+```
+
+**Fleet-safe replay defense.** The in-memory store is per-process. In production, back the
+consumption store with a shared key-value store whose insert-if-absent is atomic:
+
+```js
+import { createDurableConsumptionStore } from '@emilia-protocol/gate';
+const store = createDurableConsumptionStore(redisBackend); // backend.addIfAbsent MUST be atomic (Redis SET NX)
+const gate = createGate({ manifest, keyRegistry, store });
+// A receipt consumed on one pod cannot be replayed on another.
+```
+
+**Evidence retention.** Classify the evidence log into hot/cold/expired with legal hold, and
+export the auditor/SIEM manifest (tied to the evidence head). `EP_AUDIT_HOT_DAYS` /
+`EP_AUDIT_COLD_DAYS` set the horizons.
+
+```js
+gate.retention({ hotDays: 365, coldDays: 2190, legalHold: ['<evidence-hash>'] });
+gate.retentionExport();  // EP-GATE-RETENTION-EXPORT-v1 manifest
+```
+
+Issuer-side **KMS/HSM signing custody** (production mode refuses dev-local private keys) lives in
+EP core (`lib/key-custody.js`, `assertProductionKeyCustody` / `createExternalCustodySigner`).
 
 ## Boundary
 

package/action-packs.js

@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: Apache-2.0
+// EMILIA Gate default action packs: the high-risk families that should require
+// pre-execution human authorization before a machine mutates the world.
+
+export const ACTION_RISK_MANIFEST_VERSION = 'EP-ACTION-RISK-MANIFEST-v0.1';
+
+export const HIGH_RISK_ACTION_PACKS = Object.freeze([
+  Object.freeze({
+    id: 'money_movement.release',
+    label: 'Money movement',
+    action_type: 'payment.release',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'mcp', tool: 'release_payment' },
+    why: 'Moves funds or releases value. Requires a named human signoff, not an agent-only key.',
+    execution_binding: {
+      required_fields: ['action_type', 'amount_usd', 'currency', 'payment_instruction_id', 'beneficiary_account_hash'],
+    },
+  }),
+  Object.freeze({
+    id: 'money_movement.bank_details_change',
+    label: 'Bank-detail change',
+    action_type: 'payment.bank_details.change',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'mcp', tool: 'change_bank_details' },
+    why: 'Changes where future money flows. Treats payee, beneficiary, vendor, and payroll account changes as high-risk by category.',
+    execution_binding: {
+      required_fields: ['action_type', 'account_holder_id', 'payment_instruction_id', 'bank_account_hash'],
+    },
+  }),
+  Object.freeze({
+    id: 'production.deploy',
+    label: 'Production deploy',
+    action_type: 'deploy.production',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'quorum',
+    match: { protocol: 'mcp', tool: 'deploy_production' },
+    why: 'Changes live production behavior. Quorum is the cryptographic two-person rule for hard operational cuts.',
+    execution_binding: {
+      required_fields: ['action_type', 'repo', 'commit_sha', 'environment', 'artifact_digest'],
+    },
+  }),
+  Object.freeze({
+    id: 'permissions.admin_change',
+    label: 'Permission or admin change',
+    action_type: 'permission.admin.change',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'quorum',
+    match: { protocol: 'mcp', tool: 'change_permissions' },
+    why: 'Changes who can act next. Privilege changes deserve stronger proof than the session that requested them.',
+    execution_binding: {
+      required_fields: ['action_type', 'principal_id', 'role', 'scope'],
+    },
+  }),
+  Object.freeze({
+    id: 'data.bulk_export',
+    label: 'Bulk data export',
+    action_type: 'data.export',
+    risk: 'high',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'mcp', tool: 'export_customer_data' },
+    why: 'Moves sensitive data out of its system of record. The recipient and purpose must be bound to the approval.',
+    execution_binding: {
+      required_fields: ['action_type', 'dataset', 'recipient', 'purpose', 'row_count_max'],
+    },
+  }),
+  Object.freeze({
+    id: 'records.delete',
+    label: 'Record deletion',
+    action_type: 'record.delete',
+    risk: 'high',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'mcp', tool: 'delete_record' },
+    why: 'Destroys or hides state. The record identity and pre-state must be bound before deletion.',
+    execution_binding: {
+      required_fields: ['action_type', 'record_type', 'record_id', 'before_state_hash'],
+    },
+  }),
+  Object.freeze({
+    id: 'regulated.decision_override',
+    label: 'Regulated decision override',
+    action_type: 'regulated.decision.override',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'quorum',
+    match: { protocol: 'mcp', tool: 'override_regulated_decision' },
+    why: 'Changes a decision with legal, benefit, credit, clinical, or safety impact. Requires named accountability.',
+    execution_binding: {
+      required_fields: ['action_type', 'case_id', 'decision_id', 'subject_id', 'override_reason'],
+    },
+  }),
+]);
+
+export const DEFAULT_PASS_THROUGH_ACTIONS = Object.freeze([
+  Object.freeze({
+    id: 'observe.read_status',
+    label: 'Read-only status',
+    action_type: 'read.status',
+    receipt_required: false,
+    match: { protocol: 'mcp', tool: 'read_status' },
+  }),
+]);
+
+export function createDefaultActionRiskManifest({ includePassThrough = true, extraActions = [] } = {}) {
+  return {
+    '@version': ACTION_RISK_MANIFEST_VERSION,
+    actions: [
+      ...HIGH_RISK_ACTION_PACKS.map((a) => ({
+        ...a,
+        match: { ...a.match },
+        execution_binding: a.execution_binding
+          ? { ...a.execution_binding, required_fields: [...a.execution_binding.required_fields] }
+          : undefined,
+      })),
+      ...(includePassThrough ? DEFAULT_PASS_THROUGH_ACTIONS.map((a) => ({ ...a, match: { ...a.match } })) : []),
+      ...extraActions,
+    ],
+  };
+}
+
+export const DEFAULT_GATE_MANIFEST = Object.freeze(createDefaultActionRiskManifest());
+
+export function highRiskActionTypes(actions = HIGH_RISK_ACTION_PACKS) {
+  return actions.filter((a) => a.receipt_required).map((a) => a.action_type);
+}
+
+export default {
+  ACTION_RISK_MANIFEST_VERSION,
+  HIGH_RISK_ACTION_PACKS,
+  DEFAULT_PASS_THROUGH_ACTIONS,
+  DEFAULT_GATE_MANIFEST,
+  createDefaultActionRiskManifest,
+  highRiskActionTypes,
+};

package/adapters/_kit.js

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — System-of-Record adapter kit. One enforcement contract shared by
+ * every adapter (GitHub, Stripe, Supabase, AWS, ...): map a destructive op to a
+ * gate selector + the observed system-of-record fields, run it through
+ * gate.run(), and FAIL CLOSED — if the gate refuses, the real client call is
+ * never made and we throw EMILIA_RECEIPT_REQUIRED.
+ *
+ * An op spec is: { selector, observed(params) -> {fields...}, perform(client, params) -> result }.
+ * `observed` must return the same material fields the action pack binds, drawn
+ * from the call params (the system-of-record facts), so a receipt for resource A
+ * cannot authorize a mutation of resource B.
+ */
+import { hashCanonical } from '../execution-binding.js';
+
+export { hashCanonical };
+
+/** Build an EP-ACTION-RISK-MANIFEST-v0.1 from a frozen action pack (deep-copied). */
+export function manifestFromPack(pack, extraActions = []) {
+  return {
+    '@version': 'EP-ACTION-RISK-MANIFEST-v0.1',
+    actions: [
+      ...pack.map((a) => ({
+        ...a,
+        match: { ...a.match },
+        execution_binding: a.execution_binding
+          ? { ...a.execution_binding, required_fields: [...a.execution_binding.required_fields] }
+          : undefined,
+      })),
+      ...extraActions,
+    ],
+  };
+}
+
+/**
+ * Create an adapter from a system name + op map.
+ * @returns {{ ops:object, OPS:string[], guard:(gate,client,{op,params,receipt})=>Promise<{result,reliance,execution}> }}
+ */
+export function createAdapter({ system, ops }) {
+  if (!system || !ops || typeof ops !== 'object') throw new Error('createAdapter requires { system, ops }');
+  const OPS = Object.freeze(Object.keys(ops));
+
+  async function guard(gate, client, { op, params = {}, receipt = null } = {}) {
+    if (!gate || typeof gate.run !== 'function') throw new Error(`${system} adapter requires an EMILIA Gate (with .run)`);
+    const spec = ops[op];
+    if (!spec) throw new Error(`${system} adapter: unknown op "${op}" (expected one of: ${OPS.join(', ')})`);
+    const observedAction = spec.observed(params);
+    const out = await gate.run({ selector: spec.selector, receipt, observedAction }, () => spec.perform(client, params));
+    if (!out.ok) {
+      const e = new Error(`EMILIA Gate refused ${system}:${op} — ${out.authorization.reason}`);
+      e.code = 'EMILIA_RECEIPT_REQUIRED';
+      e.status = out.status;
+      e.gate = out.authorization;
+      e.challenge = out.body;
+      throw e;
+    }
+    return { result: out.result, reliance: out.packet, execution: out.execution };
+  }
+
+  return { ops, OPS, guard };
+}
+
+export default { createAdapter, manifestFromPack, hashCanonical };

package/adapters/aws.js

@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — AWS System-of-Record adapter (IAM + network).
+ *
+ * "Install this before your agent can change cloud permissions or open the
+ * network." Wraps the high-blast-radius AWS operations — attach IAM policy,
+ * create access key, delete user, and open a security-group ingress — so they
+ * never reach AWS without a valid, sufficiently-assured, non-replayed receipt
+ * bound to THIS principal/policy/group. Privilege and network changes default
+ * to quorum (the two-person rule).
+ *
+ *   import { IAMClient, EC2Client } from '@aws-sdk/...';
+ *   import { createGate } from '@emilia-protocol/gate';
+ *   import { createAwsManifest, guardAwsMutation } from '@emilia-protocol/gate/adapters/aws';
+ *
+ *   const gate = createGate({ manifest: createAwsManifest(), trustedKeys: [ISSUER] });
+ *   // client: { iam: { attachUserPolicy, createAccessKey, deleteUser }, ec2: { authorizeSecurityGroupIngress } }
+ *   await guardAwsMutation(gate, client, {
+ *     op: 'iam.attach_policy', params: { user: 'svc-bot', policy_arn: 'arn:aws:iam::aws:policy/AdministratorAccess' }, receipt,
+ *   });
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const AWS_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'aws.iam.attach_policy', label: 'IAM attach policy', action_type: 'aws.iam.attach_policy',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'aws', tool: 'attach_user_policy' },
+    why: 'Grants permissions. Privilege escalation deserves the two-person rule.',
+    execution_binding: { required_fields: ['action_type', 'user', 'policy_arn'] },
+  }),
+  Object.freeze({
+    id: 'aws.iam.create_access_key', label: 'IAM create access key', action_type: 'aws.iam.create_access_key',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'aws', tool: 'create_access_key' },
+    why: 'Mints long-lived credentials. Bind the user to a named approval.',
+    execution_binding: { required_fields: ['action_type', 'user'] },
+  }),
+  Object.freeze({
+    id: 'aws.iam.delete_user', label: 'IAM delete user', action_type: 'aws.iam.delete_user',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'aws', tool: 'delete_user' },
+    why: 'Destroys an identity. Bind the target user.',
+    execution_binding: { required_fields: ['action_type', 'user'] },
+  }),
+  Object.freeze({
+    id: 'aws.ec2.authorize_ingress', label: 'Open security-group ingress', action_type: 'aws.ec2.authorize_ingress',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'aws', tool: 'authorize_security_group_ingress' },
+    why: 'Opens the network. Bind group/CIDR/port so 0.0.0.0/0:22 cannot slip through.',
+    execution_binding: { required_fields: ['action_type', 'group_id', 'cidr', 'from_port'] },
+  }),
+]);
+
+const OPS = {
+  'iam.attach_policy': {
+    selector: { protocol: 'aws', tool: 'attach_user_policy' },
+    observed: (p) => ({ action_type: 'aws.iam.attach_policy', user: p.user, policy_arn: p.policy_arn }),
+    perform: (client, p) => client.iam.attachUserPolicy({ UserName: p.user, PolicyArn: p.policy_arn }),
+  },
+  'iam.create_access_key': {
+    selector: { protocol: 'aws', tool: 'create_access_key' },
+    observed: (p) => ({ action_type: 'aws.iam.create_access_key', user: p.user }),
+    perform: (client, p) => client.iam.createAccessKey({ UserName: p.user }),
+  },
+  'iam.delete_user': {
+    selector: { protocol: 'aws', tool: 'delete_user' },
+    observed: (p) => ({ action_type: 'aws.iam.delete_user', user: p.user }),
+    perform: (client, p) => client.iam.deleteUser({ UserName: p.user }),
+  },
+  'ec2.authorize_ingress': {
+    selector: { protocol: 'aws', tool: 'authorize_security_group_ingress' },
+    observed: (p) => ({ action_type: 'aws.ec2.authorize_ingress', group_id: p.group_id, cidr: p.cidr, from_port: p.from_port }),
+    perform: (client, p) => client.ec2.authorizeSecurityGroupIngress({
+      GroupId: p.group_id, CidrIp: p.cidr, FromPort: p.from_port, ToPort: p.to_port ?? p.from_port, IpProtocol: p.protocol ?? 'tcp',
+    }),
+  },
+};
+
+const adapter = createAdapter({ system: 'aws', ops: OPS });
+export const AWS_OPS = adapter.OPS;
+
+export function createAwsManifest(extraActions = []) {
+  return manifestFromPack(AWS_ACTION_PACK, extraActions);
+}
+
+/**
+ * Guard a high-blast-radius AWS mutation behind the gate.
+ * @param {object} gate    a gate built with createAwsManifest()
+ * @param {object} client  { iam: {attachUserPolicy, createAccessKey, deleteUser}, ec2: {authorizeSecurityGroupIngress} }
+ * @param {object} o       { op, params, receipt }
+ * @throws Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the call never reaches AWS
+ */
+export function guardAwsMutation(gate, client, args) {
+  return adapter.guard(gate, client, args);
+}
+
+export default { AWS_ACTION_PACK, AWS_OPS, createAwsManifest, guardAwsMutation };

package/adapters/cloudflare.js

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Cloudflare System-of-Record adapter.
+ * Guards DNS record delete, zone delete, and WAF/firewall disable so they never
+ * reach Cloudflare without a receipt bound to THIS zone. Client injected.
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const CLOUDFLARE_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'cloudflare.dns.delete', label: 'Delete DNS record', action_type: 'cloudflare.dns.delete',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'cloudflare', tool: 'delete_dns_record' },
+    why: 'Removing DNS can take a service offline or enable takeover. Bind zone+record.',
+    execution_binding: { required_fields: ['action_type', 'zone', 'record_id'] },
+  }),
+  Object.freeze({
+    id: 'cloudflare.zone.delete', label: 'Delete zone', action_type: 'cloudflare.zone.delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'cloudflare', tool: 'delete_zone' },
+    why: 'Deletes an entire zone. Quorum.',
+    execution_binding: { required_fields: ['action_type', 'zone'] },
+  }),
+  Object.freeze({
+    id: 'cloudflare.firewall.disable', label: 'Disable firewall rule', action_type: 'cloudflare.firewall.disable',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'cloudflare', tool: 'set_firewall_rule' },
+    why: 'Disabling WAF/firewall opens the perimeter. Quorum + bind zone+rule.',
+    execution_binding: { required_fields: ['action_type', 'zone', 'rule_id'] },
+  }),
+]);
+
+const OPS = {
+  'dns.delete': {
+    selector: { protocol: 'cloudflare', tool: 'delete_dns_record' },
+    observed: (p) => ({ action_type: 'cloudflare.dns.delete', zone: p.zone, record_id: p.record_id }),
+    perform: (c, p) => c.deleteDnsRecord({ zone: p.zone, recordId: p.record_id }),
+  },
+  'zone.delete': {
+    selector: { protocol: 'cloudflare', tool: 'delete_zone' },
+    observed: (p) => ({ action_type: 'cloudflare.zone.delete', zone: p.zone }),
+    perform: (c, p) => c.deleteZone({ zone: p.zone }),
+  },
+  'firewall.disable': {
+    selector: { protocol: 'cloudflare', tool: 'set_firewall_rule' },
+    observed: (p) => ({ action_type: 'cloudflare.firewall.disable', zone: p.zone, rule_id: p.rule_id }),
+    perform: (c, p) => c.setFirewallRule({ zone: p.zone, ruleId: p.rule_id, enabled: false }),
+  },
+};
+
+const adapter = createAdapter({ system: 'cloudflare', ops: OPS });
+export const CLOUDFLARE_OPS = adapter.OPS;
+export function createCloudflareManifest(extra = []) { return manifestFromPack(CLOUDFLARE_ACTION_PACK, extra); }
+export function guardCloudflareMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { CLOUDFLARE_ACTION_PACK, CLOUDFLARE_OPS, createCloudflareManifest, guardCloudflareMutation };