@emilia-protocol/gate 0.1.0 → 0.7.0

package/adapters/supabase.js

@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Supabase / Postgres System-of-Record adapter.
+ *
+ * "Install this before your agent can run destructive SQL." Wraps the dangerous
+ * database operations — destructive SQL (DELETE/DROP/TRUNCATE/UPDATE), bulk
+ * export, and RLS-policy change — so they never execute without a valid,
+ * sufficiently-assured, non-replayed receipt bound to THIS statement/table. The
+ * exact statement is bound by hash, so an approval for one DELETE cannot be
+ * swapped for a DROP.
+ *
+ *   import { createGate } from '@emilia-protocol/gate';
+ *   import { createSupabaseManifest, guardSupabaseMutation, isDestructiveSql } from '@emilia-protocol/gate/adapters/supabase';
+ *
+ *   const gate = createGate({ manifest: createSupabaseManifest(), trustedKeys: [ISSUER] });
+ *   // client: anything with .query(sql) (node-postgres / a Supabase RPC wrapper).
+ *   await guardSupabaseMutation(gate, client, {
+ *     op: 'sql.destructive', params: { sql: 'DELETE FROM payments WHERE id=1', table: 'payments' }, receipt,
+ *   });
+ */
+import { createAdapter, manifestFromPack, hashCanonical } from './_kit.js';
+
+const DESTRUCTIVE = /\b(delete|drop|truncate|alter\s+table)\b/i;
+const UPDATE_NO_WHERE = /\bupdate\b(?:(?!\bwhere\b).)*$/is;
+
+/** Heuristic: is this SQL destructive (DELETE/DROP/TRUNCATE/ALTER, or UPDATE without WHERE)? */
+export function isDestructiveSql(sql) {
+  const s = String(sql || '');
+  return DESTRUCTIVE.test(s) || UPDATE_NO_WHERE.test(s.trim());
+}
+
+/** Canonical hash of a SQL statement, whitespace-collapsed and lowercased. */
+export function statementHash(sql) {
+  return hashCanonical(String(sql || '').replace(/\s+/g, ' ').trim().toLowerCase());
+}
+
+export const SUPABASE_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'supabase.sql.destructive', label: 'Destructive SQL', action_type: 'supabase.sql.destructive',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'supabase', tool: 'execute_sql' },
+    why: 'DELETE/DROP/TRUNCATE/ALTER destroys or rewrites system-of-record state. Bind the exact statement.',
+    execution_binding: { required_fields: ['action_type', 'statement_hash'] },
+  }),
+  Object.freeze({
+    id: 'supabase.data.export', label: 'Bulk data export', action_type: 'supabase.data.export',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'supabase', tool: 'export_table' },
+    why: 'Moves data out of its system of record. Bind table + recipient to the approval.',
+    execution_binding: { required_fields: ['action_type', 'table', 'recipient'] },
+  }),
+  Object.freeze({
+    id: 'supabase.rls.change', label: 'RLS policy change', action_type: 'supabase.rls.change',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'supabase', tool: 'alter_policy' },
+    why: 'Changes who can read/write rows. Row-Level-Security changes deserve the two-person rule.',
+    execution_binding: { required_fields: ['action_type', 'table', 'policy'] },
+  }),
+]);
+
+const OPS = {
+  'sql.destructive': {
+    selector: { protocol: 'supabase', tool: 'execute_sql' },
+    observed: (p) => ({ action_type: 'supabase.sql.destructive', statement_hash: statementHash(p.sql) }),
+    perform: (client, p) => client.query(p.sql),
+  },
+  'data.export': {
+    selector: { protocol: 'supabase', tool: 'export_table' },
+    observed: (p) => ({ action_type: 'supabase.data.export', table: p.table, recipient: p.recipient }),
+    perform: (client, p) => client.export(p.table, p.recipient),
+  },
+  'rls.change': {
+    selector: { protocol: 'supabase', tool: 'alter_policy' },
+    observed: (p) => ({ action_type: 'supabase.rls.change', table: p.table, policy: p.policy }),
+    perform: (client, p) => client.alterPolicy(p.table, p.policy, p.definition),
+  },
+};
+
+const adapter = createAdapter({ system: 'supabase', ops: OPS });
+export const SUPABASE_OPS = adapter.OPS;
+
+export function createSupabaseManifest(extraActions = []) {
+  return manifestFromPack(SUPABASE_ACTION_PACK, extraActions);
+}
+
+/**
+ * Guard a destructive Supabase/Postgres mutation behind the gate.
+ * @param {object} gate    a gate built with createSupabaseManifest()
+ * @param {object} client  a client exposing { query(sql), export(table,recipient), alterPolicy(table,policy,def) }
+ * @param {object} o       { op:'sql.destructive'|'data.export'|'rls.change', params, receipt }
+ * @throws Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the statement never executes
+ */
+export function guardSupabaseMutation(gate, client, args) {
+  return adapter.guard(gate, client, args);
+}
+
+export default {
+  SUPABASE_ACTION_PACK, SUPABASE_OPS, createSupabaseManifest, guardSupabaseMutation,
+  isDestructiveSql, statementHash,
+};

package/adapters/terraform.js

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Terraform System-of-Record adapter.
+ *
+ * "Install this before your agent can destroy infrastructure." Guards the
+ * irreversible Terraform operations — destroy, state rm, workspace delete — so
+ * they never run without a receipt bound to THIS workspace/plan. The destroy
+ * plan is bound by hash, so an approved small destroy cannot be swapped for a
+ * full teardown. Runner is injected (a `terraform`/`tofu` CLI wrapper or Cloud
+ * API client).
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const TERRAFORM_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'terraform.apply.destroy', label: 'Terraform destroy', action_type: 'terraform.apply.destroy',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'terraform', tool: 'destroy' },
+    why: 'Tears down real infrastructure. Bind the workspace + plan hash; quorum.',
+    execution_binding: { required_fields: ['action_type', 'workspace', 'plan_hash'] },
+  }),
+  Object.freeze({
+    id: 'terraform.state.rm', label: 'Terraform state rm', action_type: 'terraform.state.rm',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'terraform', tool: 'state_rm' },
+    why: 'Detaches a resource from state (orphans real infra). Bind workspace+address.',
+    execution_binding: { required_fields: ['action_type', 'workspace', 'address'] },
+  }),
+  Object.freeze({
+    id: 'terraform.workspace.delete', label: 'Terraform workspace delete', action_type: 'terraform.workspace.delete',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'terraform', tool: 'workspace_delete' },
+    why: 'Deletes a workspace and its state. Bind the workspace.',
+    execution_binding: { required_fields: ['action_type', 'workspace'] },
+  }),
+]);
+
+const OPS = {
+  'apply.destroy': {
+    selector: { protocol: 'terraform', tool: 'destroy' },
+    observed: (p) => ({ action_type: 'terraform.apply.destroy', workspace: p.workspace, plan_hash: p.plan_hash }),
+    perform: (r, p) => r.destroy({ workspace: p.workspace, plan_hash: p.plan_hash }),
+  },
+  'state.rm': {
+    selector: { protocol: 'terraform', tool: 'state_rm' },
+    observed: (p) => ({ action_type: 'terraform.state.rm', workspace: p.workspace, address: p.address }),
+    perform: (r, p) => r.stateRm({ workspace: p.workspace, address: p.address }),
+  },
+  'workspace.delete': {
+    selector: { protocol: 'terraform', tool: 'workspace_delete' },
+    observed: (p) => ({ action_type: 'terraform.workspace.delete', workspace: p.workspace }),
+    perform: (r, p) => r.workspaceDelete({ workspace: p.workspace }),
+  },
+};
+
+const adapter = createAdapter({ system: 'terraform', ops: OPS });
+export const TERRAFORM_OPS = adapter.OPS;
+export function createTerraformManifest(extraActions = []) { return manifestFromPack(TERRAFORM_ACTION_PACK, extraActions); }
+export function guardTerraformMutation(gate, runner, args) { return adapter.guard(gate, runner, args); }
+export default { TERRAFORM_ACTION_PACK, TERRAFORM_OPS, createTerraformManifest, guardTerraformMutation };

package/adapters/vercel.js

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Vercel System-of-Record adapter.
+ * Guards promote-to-production, project delete, and env/secret changes so they
+ * never reach Vercel without a receipt bound to THIS project. Client injected
+ * (the Vercel REST client or a thin wrapper).
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const VERCEL_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'vercel.deploy.promote', label: 'Promote to production', action_type: 'vercel.deploy.promote',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'vercel', tool: 'promote_deployment' },
+    why: 'Changes live production. Quorum for the prod cutover.',
+    execution_binding: { required_fields: ['action_type', 'project', 'deployment_id'] },
+  }),
+  Object.freeze({
+    id: 'vercel.project.delete', label: 'Delete project', action_type: 'vercel.project.delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'vercel', tool: 'delete_project' },
+    why: 'Destroys a project and its deployments. Bind the project.',
+    execution_binding: { required_fields: ['action_type', 'project'] },
+  }),
+  Object.freeze({
+    id: 'vercel.env.set', label: 'Set env / secret', action_type: 'vercel.env.set',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'vercel', tool: 'upsert_env' },
+    why: 'Changes production secrets/config. Bind project+key+target.',
+    execution_binding: { required_fields: ['action_type', 'project', 'key', 'target'] },
+  }),
+]);
+
+const OPS = {
+  'deploy.promote': {
+    selector: { protocol: 'vercel', tool: 'promote_deployment' },
+    observed: (p) => ({ action_type: 'vercel.deploy.promote', project: p.project, deployment_id: p.deployment_id }),
+    perform: (c, p) => c.promoteDeployment({ project: p.project, deploymentId: p.deployment_id }),
+  },
+  'project.delete': {
+    selector: { protocol: 'vercel', tool: 'delete_project' },
+    observed: (p) => ({ action_type: 'vercel.project.delete', project: p.project }),
+    perform: (c, p) => c.deleteProject({ project: p.project }),
+  },
+  'env.set': {
+    selector: { protocol: 'vercel', tool: 'upsert_env' },
+    observed: (p) => ({ action_type: 'vercel.env.set', project: p.project, key: p.key, target: p.target }),
+    perform: (c, p) => c.upsertEnv({ project: p.project, key: p.key, value: p.value, target: p.target }),
+  },
+};
+
+const adapter = createAdapter({ system: 'vercel', ops: OPS });
+export const VERCEL_OPS = adapter.OPS;
+export function createVercelManifest(extra = []) { return manifestFromPack(VERCEL_ACTION_PACK, extra); }
+export function guardVercelMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { VERCEL_ACTION_PACK, VERCEL_OPS, createVercelManifest, guardVercelMutation };

package/custody-demo.mjs

@@ -0,0 +1,41 @@
+/**
+ * EMILIA Gate — production custody demo. Run: node custody-demo.mjs
+ *
+ * Shows the three custody controls a serious buyer asks for:
+ *   1. ROTATION  — a new issuer key takes over without breaking the old one.
+ *   2. REVOCATION — a compromised issuer key is rejected immediately, live.
+ *   3. RETENTION  — the evidence log classifies hot/cold/expired + exports.
+ * @license Apache-2.0
+ */
+import { createGate, createKeyRegistry, createEg1Harness } from './index.js';
+import { DEFAULT_GATE_MANIFEST } from './action-packs.js';
+
+const SEL = { protocol: 'mcp', tool: 'release_payment' };
+const k1 = createEg1Harness({ idPrefix: 'k1' });
+const k2 = createEg1Harness({ idPrefix: 'k2' });
+const registry = createKeyRegistry([{ kid: 'issuer-1', key: k1.publicKey }]);
+const gate = createGate({ manifest: DEFAULT_GATE_MANIFEST, keyRegistry: registry });
+
+const G = (s) => `\x1b[32m${s}\x1b[0m`; const R = (s) => `\x1b[31m${s}\x1b[0m`;
+const line = (s) => console.log(s);
+async function pay(label, harness) {
+  const out = await gate.run({ selector: SEL, receipt: harness.mint({ outcome: 'allow_with_signoff' }), observedAction: harness.action }, async () => ({ wire: 'ok' }));
+  line(`  ${label} -> ${out.ok ? G('ALLOWED') : R(`REFUSED (${out.authorization.reason})`)}`);
+}
+
+line('='.repeat(64));
+line('  EMILIA Gate — production custody: rotate, revoke, retain');
+line('='.repeat(64));
+await pay('1. payout, issuer-1 (current)            ', k1);
+registry.revoke('issuer-1');
+line('     ↳ issuer-1 reported COMPROMISED — registry.revoke("issuer-1")');
+await pay('2. payout, issuer-1 (revoked)            ', k1);
+registry.add({ kid: 'issuer-2', key: k2.publicKey });
+line('     ↳ rotated in issuer-2 — registry.add(issuer-2)');
+await pay('3. payout, issuer-2 (rotated in)         ', k2);
+
+const exp = gate.retentionExport();
+line('  ' + '-'.repeat(60));
+line(`  retention: ${exp.counts.total} evidence entries (hot ${exp.counts.hot} / cold ${exp.counts.cold} / expired ${exp.counts.expired}), head ${String(exp.evidence_head).slice(0, 12)}…`);
+line('  Revoke a leaked issuer key live. No redeploy. Every decision retained + provable.');
+line('='.repeat(64));

package/demo.mjs

@@ -0,0 +1,57 @@
+/**
+ * EMILIA Gate — end-to-end demo. Run: node demo.mjs
+ * Shows the Trusted Action Firewall refusing and allowing a consequential
+ * action, defeating replay and tampering, and emitting a verifiable audit log.
+ * @license Apache-2.0
+ */
+import crypto from 'node:crypto';
+import { createTrustedActionFirewall } from './index.js';
+
+const canon = (v) => v == null ? JSON.stringify(v)
+  : Array.isArray(v) ? `[${v.map(canon).join(',')}]`
+  : typeof v === 'object' ? `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canon(v[k])).join(',')}}`
+  : JSON.stringify(v);
+const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+const pub = publicKey.export({ type: 'spki', format: 'der' }).toString('base64url');
+let n = 0;
+const action = {
+  action_type: 'payment.release',
+  amount_usd: 40000,
+  currency: 'USD',
+  payment_instruction_id: 'pi_demo_40000',
+  beneficiary_account_hash: 'sha256:demo-beneficiary',
+};
+const receipt = (outcome, extra = {}) => {
+  const payload = { receipt_id: `rcpt_${++n}`, subject: 'agent:finance-bot', issuer: 'ep:org:demo', created_at: new Date().toISOString(), claim: { ...action, outcome, approver: 'ep:approver:cfo', ...extra } };
+  return { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value: crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url') } };
+};
+
+const gate = createTrustedActionFirewall({ trustedKeys: [pub] });
+const PAY = { protocol: 'mcp', tool: 'release_payment' };
+const line = (s) => console.log(s);
+const r = (o) => o.allow ? `\x1b[32mALLOW\x1b[0m` : `\x1b[31mREFUSE ${o.status}\x1b[0m (${o.reason})`;
+
+line('='.repeat(64));
+line('  EMILIA Gate — Trusted Action Firewall  (release_payment, critical)');
+line('='.repeat(64));
+line(`\n  1. read_status (not guarded)             -> ${r(await gate.check({ selector: { protocol: 'mcp', tool: 'read_status' } }))}`);
+line(`  2. release_payment, no receipt          -> ${r(await gate.check({ selector: PAY }))}`);
+line(`  3. release_payment, software receipt    -> ${r(await gate.check({ selector: PAY, receipt: receipt('allow'), observedAction: action }))}   (needs class_a)`);
+const good = receipt('allow_with_signoff');
+line(`  4. release_payment, observed drift      -> ${r(await gate.check({ selector: PAY, receipt: good, observedAction: { ...action, amount_usd: 999999 } }))}`);
+const run = await gate.run({ selector: PAY, receipt: good, observedAction: action }, async () => ({ released: true, id: 'wire_123' }));
+const a4 = run.authorization;
+line(`  5. release_payment, class_a + bound      -> ${r(a4)}`);
+const exec = run.execution;
+line(`     ↳ executed -> execution receipt bound to decision ${exec.authorizes_decision.slice(0, 12)}…`);
+line(`  6. release_payment, SAME receipt again   -> ${r(await gate.check({ selector: PAY, receipt: good, observedAction: action }))}`);
+const bad = receipt('allow_with_signoff'); bad.payload.claim.amount_usd = 9_999_999;
+line(`  7. release_payment, tampered amount      -> ${r(await gate.check({ selector: PAY, receipt: bad, observedAction: action }))}`);
+
+const chain = gate.evidence.verify();
+const packet = run.packet;
+line(`\n  reliance packet: ${packet.verdict.toUpperCase()}  decision=${packet.summary.decision_hash.slice(0, 12)}… execution=${packet.summary.execution_hash.slice(0, 12)}…`);
+line(`  evidence log: ${gate.evidence.all().length} decisions, chain ${chain.ok ? '\x1b[32mINTACT\x1b[0m' : '\x1b[31mBROKEN\x1b[0m'}`);
+line('  ' + '-'.repeat(60));
+line('  Deny by default. No receipt, no execution. Every decision is provable.');
+line('='.repeat(64));

package/eg1-conformance.js

@@ -0,0 +1,206 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EG-1 Conformance — the binary artifact that turns "we adopted EMILIA Gate"
+ * from a claim into a test result.
+ *
+ * The question EG-1 answers: *does your integration actually ENFORCE the gate,
+ * or are you only claiming it?* An integration earns EG-1 only if it
+ * demonstrably:
+ *   1. refuses a high-risk action with NO receipt (428);
+ *   2. refuses a software-tier receipt on a Class-A action;
+ *   3. refuses when the observed execution drifts from the authorized fields;
+ *   4. RUNS the action for a valid Class-A/quorum receipt;
+ *   5. refuses a replay of the same receipt;
+ *   6. refuses a tampered receipt;
+ *   7. emits an execution proof bound to the authorization decision;
+ *   8. produces a reliance packet whose verdict is "rely".
+ *
+ * This module is pure (no dependency on index.js, so no import cycle): it owns a
+ * throwaway issuer keypair, mints the scenario receipts, and drives any
+ * "subject" through the eight checks. A subject is an async `invoke` function
+ * representing one attempt at the guarded dangerous action:
+ *
+ *   invoke({ receipt, observedAction }) -> {
+ *     allowed: boolean, status: number, reason: string,
+ *     // present only on an allowed run:
+ *     decisionHash?: string, execution?: { authorizes_decision }, packet?: { verdict }
+ *   }
+ *
+ * For integrations built on @emilia-protocol/gate, `makeGateInvoke(gate, ...)`
+ * produces a conformant `invoke` from `gate.run()`. Custom integrations (an HTTP
+ * service, a different language) implement `invoke` themselves and configure
+ * their gate to trust `harness.publicKey` for the run.
+ */
+import crypto from 'node:crypto';
+
+export const EG1_VERSION = 'EG-1';
+
+// Same sorted-key canonical JSON the receipt signature is computed over.
+const canon = (v) => (v == null ? JSON.stringify(v)
+  : Array.isArray(v) ? `[${v.map(canon).join(',')}]`
+    : typeof v === 'object' ? `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canon(v[k])).join(',')}}`
+      : JSON.stringify(v));
+
+// The default high-risk action EG-1 exercises: a Class-A money movement, which
+// the default gate manifest guards (selector { protocol:'mcp', tool:'release_payment' }).
+export const EG1_DEFAULT_SELECTOR = Object.freeze({ protocol: 'mcp', tool: 'release_payment' });
+export const EG1_DEFAULT_ACTION = Object.freeze({
+  action_type: 'payment.release',
+  amount_usd: 40000,
+  currency: 'USD',
+  payment_instruction_id: 'pi_eg1_40000',
+  beneficiary_account_hash: 'sha256:eg1-beneficiary',
+});
+
+export const EG1_CHECKS = Object.freeze([
+  { id: 'missing_receipt_refused', title: 'missing receipt → 428' },
+  { id: 'software_on_classA_refused', title: 'software receipt on Class-A action → refused' },
+  { id: 'execution_drift_refused', title: 'observed execution drift → refused' },
+  { id: 'valid_classA_runs', title: 'valid Class-A/quorum receipt → runs' },
+  { id: 'replay_refused', title: 'same receipt replay → refused' },
+  { id: 'tampered_refused', title: 'tampered receipt → refused' },
+  { id: 'execution_proof_binds', title: 'execution proof binds to authorization decision' },
+  { id: 'reliance_packet_rely', title: 'reliance packet returns verdict "rely"' },
+]);
+
+/**
+ * Create an EG-1 harness: a throwaway issuer key + a receipt minter for the
+ * scenarios. Configure the subject's gate to trust `publicKey` for the run.
+ */
+export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION, idPrefix = 'eg1' } = {}) {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  const pub = publicKey.export({ type: 'spki', format: 'der' }).toString('base64url');
+  let counter = 0;
+  const nowMs = () => (typeof now === 'function' ? now() : now);
+
+  /**
+   * Mint a scenario receipt.
+   * @param {object} o
+   * @param {'allow'|'allow_with_signoff'} [o.outcome] 'allow'=software, 'allow_with_signoff'=Class-A
+   * @param {object} [o.quorum] a quorum block (signers/threshold) -> quorum tier
+   * @param {object} [o.tamper] fields assigned to the claim AFTER signing (breaks the signature)
+   */
+  function mint({ outcome = 'allow_with_signoff', quorum = null, tamper = null, extra = {} } = {}) {
+    const payload = {
+      receipt_id: `${idPrefix}_${++counter}`,
+      subject: 'agent:eg1-conformance',
+      issuer: 'ep:org:eg1',
+      created_at: new Date(nowMs()).toISOString(),
+      claim: {
+        ...action,
+        outcome,
+        approver: 'ep:approver:eg1',
+        ...(quorum ? { quorum } : {}),
+        ...extra,
+      },
+    };
+    const value = crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url');
+    const receipt = { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value } };
+    if (tamper) Object.assign(receipt.payload.claim, tamper); // tamper AFTER signing -> signature no longer binds
+    return receipt;
+  }
+
+  return { publicKey: pub, mint, action, now: nowMs };
+}
+
+/**
+ * Adapt an @emilia-protocol/gate instance into an EG-1 `invoke`. The gate must
+ * have been built trusting the harness public key. Uses gate.run() so the
+ * execution proof + reliance packet are produced on the allowed path.
+ */
+export function makeGateInvoke(gate, { selector = EG1_DEFAULT_SELECTOR, action = EG1_DEFAULT_ACTION } = {}) {
+  if (!gate || typeof gate.run !== 'function') {
+    throw new Error('makeGateInvoke requires an EMILIA Gate instance (with .run)');
+  }
+  return async ({ receipt, observedAction }) => {
+    const out = await gate.run(
+      { selector, receipt, observedAction: observedAction ?? action },
+      async () => ({ eg1: 'side-effect-ran' }),
+    );
+    if (!out.ok) {
+      return { allowed: false, status: out.status, reason: out.authorization?.reason ?? 'refused' };
+    }
+    return {
+      allowed: true,
+      status: 200,
+      reason: out.authorization?.reason ?? 'allow',
+      decisionHash: out.authorization?.evidence?.hash ?? null,
+      execution: out.execution ?? null,
+      packet: out.packet ?? null,
+    };
+  };
+}
+
+const pick = (r) => ({ allowed: !!r.allowed, status: r.status ?? null, reason: r.reason ?? null });
+
+/**
+ * Drive a subject through the eight EG-1 checks and return a JSON report.
+ * @param {object} o
+ * @param {(scenario:object)=>Promise<object>} o.invoke the integration under test
+ * @param {object} o.harness from createEg1Harness()
+ * @param {object} [o.action] the high-risk action (defaults to the harness action)
+ */
+export async function runEg1({ invoke, harness, action } = {}) {
+  if (typeof invoke !== 'function') throw new Error('runEg1 requires an invoke(scenario) function');
+  if (!harness || typeof harness.mint !== 'function') throw new Error('runEg1 requires a harness from createEg1Harness()');
+  const act = action || harness.action || EG1_DEFAULT_ACTION;
+  const observed = act;
+  const drift = { ...act, amount_usd: Number(act.amount_usd ?? 0) + 1 };
+
+  const results = {};
+  const set = (id, pass, observed_) => { results[id] = { pass: !!pass, observed: observed_ }; };
+
+  // 1. missing receipt → 428
+  let r = await invoke({ receipt: null, observedAction: observed });
+  set('missing_receipt_refused', !r.allowed && r.status === 428, pick(r));
+
+  // 2. software receipt on a Class-A action → refused
+  r = await invoke({ receipt: harness.mint({ outcome: 'allow' }), observedAction: observed });
+  set('software_on_classA_refused', !r.allowed && /assurance/i.test(r.reason || ''), pick(r));
+
+  // 3. observed execution drift → refused
+  r = await invoke({ receipt: harness.mint({ outcome: 'allow_with_signoff' }), observedAction: drift });
+  set('execution_drift_refused', !r.allowed && /binding/i.test(r.reason || ''), pick(r));
+
+  // 4. valid Class-A receipt → runs (capture for 5/7/8)
+  const valid = harness.mint({ outcome: 'allow_with_signoff' });
+  r = await invoke({ receipt: valid, observedAction: observed });
+  const validAllowed = r.allowed === true;
+  set('valid_classA_runs', validAllowed, pick(r));
+
+  // 7. execution proof binds to the authorization decision
+  const boundOk = validAllowed
+    && !!r.execution && !!r.execution.authorizes_decision
+    && !!r.decisionHash && r.execution.authorizes_decision === r.decisionHash;
+  set('execution_proof_binds', boundOk, {
+    authorizes_decision: r.execution?.authorizes_decision ?? null,
+    decision_hash: r.decisionHash ?? null,
+  });
+
+  // 8. reliance packet verdict "rely"
+  set('reliance_packet_rely', validAllowed && String(r.packet?.verdict || '').toLowerCase() === 'rely', {
+    verdict: r.packet?.verdict ?? null,
+  });
+
+  // 5. same receipt replay → refused
+  r = await invoke({ receipt: valid, observedAction: observed });
+  set('replay_refused', !r.allowed && /replay/i.test(r.reason || ''), pick(r));
+
+  // 6. tampered receipt → refused
+  r = await invoke({ receipt: harness.mint({ outcome: 'allow_with_signoff', tamper: { amount_usd: 9_999_999 } }), observedAction: observed });
+  set('tampered_refused', !r.allowed && r.status === 428, pick(r));
+
+  const checks = EG1_CHECKS.map((c) => ({ id: c.id, title: c.title, ...results[c.id] }));
+  const passedCount = checks.filter((c) => c.pass).length;
+  const passed = passedCount === checks.length;
+  return {
+    standard: EG1_VERSION,
+    passed,
+    badge: passed ? 'EG-1 Enforced' : 'EG-1 not earned',
+    summary: { passed: passedCount, total: checks.length },
+    checks,
+    generated_at: new Date(harness.now ? harness.now() : Date.now()).toISOString(),
+  };
+}
+
+export default { EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR, createEg1Harness, makeGateInvoke, runEg1 };

package/eg1.mjs

@@ -0,0 +1,40 @@
+/**
+ * EG-1 Conformance — runnable proof. Run: node eg1.mjs [--json]
+ *
+ * Self-certifies the reference EMILIA Gate against the eight EG-1 checks. An
+ * adopter earns EG-1 by pointing this harness at THEIR integration: build your
+ * gate trusting `harness.publicKey`, pass it to gateConformance(), and ship the
+ * JSON report + the "EG-1 Enforced" badge.
+ *
+ *   import { createEg1Harness, gateConformance } from '@emilia-protocol/gate';
+ *   const harness = createEg1Harness();
+ *   const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey] });
+ *   const report = await gateConformance({ gate, harness });
+ *
+ * Exit code is 0 only if all eight checks pass — CI-friendly.
+ * @license Apache-2.0
+ */
+import { gateConformanceSelfTest } from './index.js';
+
+const report = await gateConformanceSelfTest();
+
+if (process.argv.includes('--json')) {
+  // eslint-disable-next-line no-console
+  console.log(JSON.stringify(report, null, 2));
+  process.exit(report.passed ? 0 : 1);
+}
+
+const G = (s) => `\x1b[32m${s}\x1b[0m`;
+const R = (s) => `\x1b[31m${s}\x1b[0m`;
+const line = (s) => console.log(s);
+
+line('='.repeat(64));
+line('  EG-1 Conformance — does this integration ENFORCE EMILIA Gate?');
+line('='.repeat(64));
+for (const c of report.checks) {
+  line(`  ${c.pass ? G('PASS') : R('FAIL')}  ${c.title}`);
+}
+line('  ' + '-'.repeat(60));
+line(`  ${report.passed ? G(`✓ ${report.badge}`) : R(`✗ ${report.badge}`)}  (${report.summary.passed}/${report.summary.total})`);
+line('='.repeat(64));
+process.exit(report.passed ? 0 : 1);

package/execution-binding.js

@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: Apache-2.0
+// Execution-field binding for EMILIA Gate. This is the executor-side control
+// that prevents "the signed claim said X, the system mutated Y".
+
+import crypto from 'node:crypto';
+
+export const EXECUTION_BINDING_VERSION = 'EP-GATE-EXECUTION-BINDING-v1';
+
+export function canonicalize(v) {
+  if (v === null || v === undefined) return JSON.stringify(v);
+  if (Array.isArray(v)) return `[${v.map(canonicalize).join(',')}]`;
+  if (typeof v === 'object') {
+    return `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonicalize(v[k])).join(',')}}`;
+  }
+  return JSON.stringify(v);
+}
+
+export function hashCanonical(v) {
+  return crypto.createHash('sha256').update(canonicalize(v)).digest('hex');
+}
+
+function hasValue(v) {
+  return v !== undefined && v !== null;
+}
+
+function normalize(v) {
+  if (Array.isArray(v)) return [...new Set(v.map((x) => String(x)))].sort();
+  if (v && typeof v === 'object') {
+    return Object.fromEntries(Object.keys(v).sort().map((k) => [k, normalize(v[k])]));
+  }
+  return v;
+}
+
+function equalValue(a, b) {
+  return hashCanonical(normalize(a)) === hashCanonical(normalize(b));
+}
+
+export function materialFieldsFor(requirement) {
+  const fields = requirement?.execution_binding?.required_fields;
+  return Array.isArray(fields) ? [...new Set(fields.filter(Boolean))] : [];
+}
+
+/**
+ * Verifies that the signed claim and the executor-observed mutation fields
+ * match for the action pack. The executor must pass `observedAction` from the
+ * system of record, not from the agent request body.
+ */
+export function verifyExecutionBinding({ requirement, receipt, observedAction } = {}) {
+  const requiredFields = materialFieldsFor(requirement);
+  if (requiredFields.length === 0) {
+    return { ok: true, required: false, required_fields: [], signed_hash: null, observed_hash: null };
+  }
+
+  const signed = receipt?.payload?.claim || {};
+  const observed = observedAction || {};
+  const missingSigned = [];
+  const missingObserved = [];
+  const mismatched = [];
+  const signedValues = {};
+  const observedValues = {};
+
+  for (const field of requiredFields) {
+    const expected = signed[field];
+    const actual = observed[field];
+    if (!hasValue(expected)) {
+      missingSigned.push(field);
+      continue;
+    }
+    signedValues[field] = normalize(expected);
+    if (!hasValue(actual)) {
+      missingObserved.push(field);
+      continue;
+    }
+    observedValues[field] = normalize(actual);
+    if (!equalValue(expected, actual)) mismatched.push(field);
+  }
+
+  return {
+    '@version': EXECUTION_BINDING_VERSION,
+    ok: missingSigned.length === 0 && missingObserved.length === 0 && mismatched.length === 0,
+    required: true,
+    required_fields: requiredFields,
+    missing_signed_fields: missingSigned,
+    missing_observed_fields: missingObserved,
+    mismatched_fields: mismatched,
+    signed_hash: hashCanonical(signedValues),
+    observed_hash: hashCanonical(observedValues),
+    note: 'Executor MUST provide observedAction from the system of record; request-body fields are not a trust source.',
+  };
+}
+
+export default {
+  EXECUTION_BINDING_VERSION,
+  canonicalize,
+  hashCanonical,
+  materialFieldsFor,
+  verifyExecutionBinding,
+};