@emilia-protocol/gate 0.1.0 → 0.7.0

package/index.js

@@ -21,7 +21,7 @@
  * adds the three things a firewall needs over a bare verifier: assurance-tier
  * enforcement, replay defense, and the evidence log. Fails closed.
  */
-import {
+const {
   verifyEmiliaReceipt,
   receiptChallenge,
   receiptRequiredHeader,
@@ -29,11 +29,27 @@ import {
   findActionRequirement,
   RECEIPT_REQUIRED_STATUS,
   RECEIPT_REQUIRED_HEADER,
-} from '../require-receipt/index.js';
+} = await import('@emilia-protocol/require-receipt').catch(() => import('../require-receipt/index.js'));
 import { MemoryConsumptionStore } from './store.js';
 import { createEvidenceLog } from './evidence.js';
+import { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest } from './action-packs.js';
+import { hashCanonical, verifyExecutionBinding } from './execution-binding.js';
+import { buildReliancePacket } from './reliance-packet.js';
+import { createEg1Harness, makeGateInvoke, runEg1, EG1_DEFAULT_SELECTOR } from './eg1-conformance.js';
+import { createKeyRegistry, asKeyRegistry } from './key-registry.js';
+import { classifyRetention, buildRetentionExport } from './retention.js';
 
 export { MemoryConsumptionStore, createEvidenceLog };
+export { createDurableConsumptionStore, createMemoryBackend } from './store.js';
+export { createKeyRegistry, asKeyRegistry } from './key-registry.js';
+export { classifyRetention, buildRetentionExport, RETENTION_EXPORT_VERSION } from './retention.js';
+export { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest };
+export { EXECUTION_BINDING_VERSION, canonicalize, hashCanonical, materialFieldsFor, verifyExecutionBinding } from './execution-binding.js';
+export { RELIANCE_PACKET_VERSION, buildReliancePacket } from './reliance-packet.js';
+export {
+  EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR,
+  createEg1Harness, makeGateInvoke, runEg1,
+} from './eg1-conformance.js';
 export const ASSURANCE_TIERS = ['software', 'class_a', 'quorum'];
 const TIER_RANK = { software: 0, class_a: 1, quorum: 2 };
 
@@ -64,8 +80,15 @@ export function receiptAssuranceTier(doc) {
  * @param {object} [opts.store]         consumption store (default in-memory)
  * @param {object} [opts.log]           evidence log (default in-memory, hash-chained)
  * @param {boolean} [opts.allowInlineKey=false] accept the receipt's own key (integrity, NOT trust)
+ * @param {object} [opts.keyRegistry] a key registry (createKeyRegistry) for rotation + revocation;
+ *   if given it supersedes trustedKeys — a receipt is verified only against keys valid (and not
+ *   revoked) at its issuance time.
  */
-export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now } = {}) {
+export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null } = {}) {
+  // Production key custody: a registry (rotation + revocation) supersedes a flat
+  // trustedKeys list. A flat list is coerced to an always-valid registry, so
+  // existing callers are unchanged.
+  const registry = keyRegistry ? asKeyRegistry(keyRegistry) : (trustedKeys.length ? asKeyRegistry(trustedKeys) : null);
   if (manifest) {
     const m = validateActionRiskManifest(manifest);
     if (!m.ok) throw new Error('EMILIA Gate: invalid action-risk manifest: ' + m.errors.join('; '));
@@ -88,10 +111,11 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
   }
   const evidence = log || createEvidenceLog({ strict: strictEvidence });
 
-  async function check({ selector = {}, receipt = null } = {}) {
+  async function check({ selector = {}, receipt = null, observedAction = null, consumptionMode = 'consume' } = {}) {
     const requirement = manifest ? findActionRequirement(manifest, selector) : null;
     const action = requirement?.action_type || selector.action_type || selector.action || null;
     const requiredTier = requirement?.assurance_class || selector.assurance_class || 'software';
+    const observed = observedAction || selector.observedAction || selector.actionDetails || null;
 
     async function decide(allow, status, reason, extra = {}) {
       const entry = {
@@ -105,6 +129,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
         required_tier: requiredTier,
         receipt_id: receipt?.payload?.receipt_id ?? null,
         subject: receipt?.payload?.subject ?? null,
+        observed_action_hash: observed ? hashCanonical(observed) : null,
         ...extra,
       };
       let record;
@@ -144,8 +169,14 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!receipt) {
       return decide(false, RECEIPT_REQUIRED_STATUS, 'receipt_required');
     }
-    // Signature / freshness / action-binding / outcome.
-    const v = verifyEmiliaReceipt(receipt, { trustedKeys, allowInlineKey, action, maxAgeSec });
+    // Signature / freshness / action-binding / outcome. Production key custody:
+    // resolve the issuer keys valid (and not revoked) at THIS receipt's issuance
+    // time. A revoked or out-of-window key is excluded, so its signature does not
+    // verify and the action is refused (fail closed).
+    const effectiveKeys = registry
+      ? registry.keysValidAt(receipt?.payload?.created_at)
+      : trustedKeys;
+    const v = verifyEmiliaReceipt(receipt, { trustedKeys: effectiveKeys, allowInlineKey, action, maxAgeSec });
     if (!v.ok) {
       return decide(false, RECEIPT_REQUIRED_STATUS, `receipt_rejected:${v.reason}`, { rejected: v });
     }
@@ -154,6 +185,13 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if ((TIER_RANK[have] ?? 0) < (TIER_RANK[requiredTier] ?? 0)) {
       return decide(false, RECEIPT_REQUIRED_STATUS, 'assurance_too_low', { have_tier: have, need_tier: requiredTier });
     }
+    // The high-risk action packs define material fields that must be observed
+    // by the executor from the system of record. A signed, harmless-looking
+    // claim cannot authorize a different real mutation.
+    const executionBinding = verifyExecutionBinding({ requirement, receipt, observedAction: observed });
+    if (!executionBinding.ok) {
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'execution_binding_failed', { execution_binding: executionBinding, have_tier: have });
+    }
     // One-time consumption (replay defense). Require a stable, issuer-generated
     // receipt_id — never fall back to a content hash, whose canonicalization can
     // differ across language implementations and silently break replay detection
@@ -162,11 +200,21 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!receiptId) {
       return decide(false, RECEIPT_REQUIRED_STATUS, 'receipt_rejected:missing_receipt_id');
     }
-    const fresh = await consumption.consume(receiptId);
+    let fresh;
+    if (consumptionMode === 'reserve') {
+      if (typeof consumption.reserve !== 'function') {
+        return decide(false, RECEIPT_REQUIRED_STATUS, 'consumption_store_lacks_reserve', { consumption_key: receiptId });
+      }
+      fresh = await consumption.reserve(receiptId);
+    } else if (consumptionMode === 'none') {
+      fresh = true;
+    } else {
+      fresh = await consumption.consume(receiptId);
+    }
     if (!fresh) {
       return decide(false, RECEIPT_REQUIRED_STATUS, 'replay_refused', { consumption_key: receiptId });
     }
-    return decide(true, 200, 'allow', { signer: v.signer, outcome: v.outcome, have_tier: have });
+    return decide(true, 200, 'allow', { signer: v.signer, outcome: v.outcome, have_tier: have, execution_binding: executionBinding, consumption_mode: consumptionMode });
   }
 
   /** Express/Connect middleware: refuse the route unless a sufficient receipt is present. */
@@ -180,7 +228,10 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
       const hdr = req.headers?.['x-emilia-receipt'];
       if (hdr) { try { doc = JSON.parse(Buffer.from(hdr, 'base64').toString('utf8')); } catch { /* fallthrough */ } }
       if (!doc && req.body?.emilia_receipt) doc = req.body.emilia_receipt;
-      const out = await check({ selector, receipt: doc });
+      const observedAction = typeof opts.observedAction === 'function'
+        ? opts.observedAction(req)
+        : (opts.observedAction || req.emiliaObservedAction || null);
+      const out = await check({ selector, receipt: doc, observedAction });
       if (!out.allow) {
         res.setHeader(RECEIPT_REQUIRED_HEADER, out.header);
         return res.status(out.status).json(out.challenge);
@@ -196,7 +247,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
    * commits to the exact authorization decision (`authorizes_decision` = that
    * decision's evidence hash), so authorization and execution are one chain.
    */
-  async function recordExecution({ authorization, outcome = 'executed', detail } = {}) {
+  async function recordExecution({ authorization, outcome = 'executed', detail, observedAction = null, executionBinding = null } = {}) {
     const auth = authorization?.evidence || authorization || {};
     return evidence.record({
       kind: 'execution',
@@ -205,10 +256,47 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
       action: authorization?.action ?? auth.action ?? null,
       receipt_id: auth.receipt_id ?? null,
       outcome, // 'executed' | 'failed'
+      observed_action_hash: observedAction ? hashCanonical(observedAction) : null,
+      execution_binding: executionBinding || authorization?.evidence?.execution_binding || authorization?.execution_binding || null,
       ...(detail !== undefined ? { detail } : {}),
     });
   }
 
+  /**
+   * Recommended end-to-end path. Reserves the receipt, runs the side effect,
+   * commits one-time consumption only after success, and records execution.
+   * If the side effect throws, the reservation is released so the approval can
+   * be retried safely.
+   */
+  async function run({ selector = {}, receipt = null, observedAction = null } = {}, fn, opts = {}) {
+    if (typeof fn !== 'function') throw new Error('EMILIA Gate run(): fn is required');
+    const authorization = await check({ selector, receipt, observedAction, consumptionMode: 'reserve' });
+    if (!authorization.allow) {
+      return { ok: false, status: authorization.status, body: authorization.challenge, authorization };
+    }
+    const receiptId = authorization.evidence?.receipt_id;
+    let actionRan = false;
+    try {
+      const result = await fn(authorization);
+      actionRan = true;
+      if (typeof consumption.commit === 'function') await consumption.commit(receiptId);
+      if (opts.recordExecution === false) return { ok: true, result, authorization, execution: null, packet: null };
+      const execution = await recordExecution({ authorization, outcome: 'executed', observedAction });
+      return { ok: true, result, authorization, execution, packet: reliancePacket({ authorization, execution }) };
+    } catch (e) {
+      if (!actionRan && typeof consumption.release === 'function') await consumption.release(receiptId);
+      if (opts.recordExecution !== false) {
+        await recordExecution({
+          authorization,
+          outcome: 'failed',
+          detail: actionRan ? `post_execution_failure:${String(e?.message ?? e)}` : String(e?.message ?? e),
+          observedAction,
+        });
+      }
+      throw e;
+    }
+  }
+
   /**
    * Wrap any function so it runs only behind a passing gate check, and (unless
    * disabled) emits an execution receipt after it runs — the full firewall loop:
@@ -218,26 +306,97 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     return async function guarded(...args) {
       const selector = typeof opts.selector === 'function' ? opts.selector(...args) : (opts.selector || {});
       const receipt = typeof opts.receipt === 'function' ? opts.receipt(...args) : (opts.receipt ?? null);
-      const out = await check({ selector, receipt });
-      if (!out.allow) {
-        const e = new Error(`EMILIA Gate refused (${out.reason})`);
+      const observedAction = typeof opts.observedAction === 'function'
+        ? opts.observedAction(...args)
+        : (opts.observedAction || selector.observedAction || null);
+      const out = await run({ selector, receipt, observedAction }, () => fn(...args), { recordExecution: opts.recordExecution });
+      if (!out.ok) {
+        const e = new Error(`EMILIA Gate refused (${out.authorization.reason})`);
         e.code = 'EMILIA_RECEIPT_REQUIRED';
-        e.gate = out;
-        throw e;
-      }
-      if (opts.recordExecution === false) return fn(...args);
-      try {
-        const result = await fn(...args);
-        await recordExecution({ authorization: out, outcome: 'executed' });
-        return result;
-      } catch (e) {
-        await recordExecution({ authorization: out, outcome: 'failed', detail: String(e?.message ?? e) });
+        e.gate = out.authorization;
         throw e;
       }
+      return out.result;
     };
   }
 
-  return { check, recordExecution, middleware, guard, evidence, store: consumption };
+  function reliancePacket({ authorization, execution = null, binding = null } = {}) {
+    return buildReliancePacket({
+      decision: authorization,
+      execution,
+      evidence,
+      manifest,
+      binding,
+    });
+  }
+
+  /** Retention classification over this gate's evidence log (hot/cold/expired/legal-hold). */
+  function retention(opts = {}) {
+    return classifyRetention(evidence.all(), opts);
+  }
+  /** The auditor/SIEM export manifest for this gate's evidence log. */
+  function retentionExport(opts = {}) {
+    return buildRetentionExport(evidence.all(), opts);
+  }
+
+  return {
+    check, run, recordExecution, middleware, guard, reliancePacket, evidence,
+    store: consumption, keyRegistry: registry, retention, retentionExport,
+  };
+}
+
+export function createTrustedActionFirewall(opts = {}) {
+  const { manifest = createDefaultActionRiskManifest(), ...rest } = opts;
+  return createGate({ ...rest, manifest });
+}
+
+/**
+ * EG-1 conformance for an existing gate. The gate MUST have been built trusting
+ * `harness.publicKey` (otherwise every valid receipt is rejected and the gate
+ * cannot earn EG-1). Returns the EG-1 JSON report.
+ * @param {object} o
+ * @param {object} o.gate     an EMILIA Gate (createGate/createTrustedActionFirewall)
+ * @param {object} o.harness  the harness whose key the gate trusts (createEg1Harness)
+ * @param {object} [o.action] the high-risk action to exercise
+ * @param {object} [o.selector] the manifest selector for that action
+ */
+export async function gateConformance({ gate, harness, action, selector = EG1_DEFAULT_SELECTOR } = {}) {
+  if (!gate || typeof gate.run !== 'function') {
+    throw new Error('gateConformance requires a gate built trusting harness.publicKey');
+  }
+  if (!harness) throw new Error('gateConformance requires the harness whose key the gate trusts');
+  const act = action || harness.action;
+  const invoke = makeGateInvoke(gate, { selector, action: act });
+  return runEg1({ invoke, harness, action: act });
+}
+
+/**
+ * Self-certify the reference gate: build a default Trusted Action Firewall that
+ * trusts a fresh EG-1 harness key, then run all eight checks. This is the
+ * canonical "EMILIA Gate earns EG-1" proof — runnable as a CLI (`eg1.mjs`),
+ * shown on /gate, and the template an adopter copies for their integration.
+ */
+export async function gateConformanceSelfTest({ now } = {}) {
+  const harness = createEg1Harness({ now });
+  const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey], now });
+  return gateConformance({ gate, harness });
 }
 
-export default { createGate, receiptAssuranceTier, MemoryConsumptionStore, createEvidenceLog, ASSURANCE_TIERS };
+export default {
+  createGate,
+  createTrustedActionFirewall,
+  receiptAssuranceTier,
+  MemoryConsumptionStore,
+  createEvidenceLog,
+  ASSURANCE_TIERS,
+  DEFAULT_GATE_MANIFEST,
+  HIGH_RISK_ACTION_PACKS,
+  gateConformance,
+  gateConformanceSelfTest,
+  createEg1Harness,
+  runEg1,
+  createKeyRegistry,
+  asKeyRegistry,
+  classifyRetention,
+  buildRetentionExport,
+};

package/key-registry.js

@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — issuer key registry (production key custody for the VERIFIER).
+ *
+ * A flat `trustedKeys: string[]` cannot express the two things a production
+ * deployment needs:
+ *   1. ROTATION — an issuer key is valid only for a window; a new key overlaps
+ *      the old one, then the old one retires, without rejecting receipts that
+ *      were legitimately issued while it was current.
+ *   2. REVOCATION — a COMPROMISED issuer key must be rejected immediately, for
+ *      every receipt, regardless of the issuance time the (now-untrusted) key
+ *      claims. Fail closed: once revoked, the key signs nothing the gate accepts.
+ *
+ * The registry resolves, for a given receipt issuance time, the set of public
+ * keys the gate should verify against — excluding revoked keys entirely and
+ * windowed keys whose [not_before, not_after] does not contain that time. The
+ * gate passes that resolved set to the receipt verifier, so an excluded key's
+ * signature simply does not verify and the action is refused.
+ *
+ * A key with no window and no revocation behaves exactly like a flat trustedKeys
+ * entry (back-compatible).
+ */
+
+function toMs(t) {
+  if (t == null) return null;
+  const ms = typeof t === 'number' ? t : Date.parse(t);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+/**
+ * @param {Array<object>} entries each: {
+ *   kid?: string, key: string (base64url SPKI-DER public key),
+ *   not_before?: string|number, not_after?: string|number, revoked_at?: string|number
+ * }
+ */
+export function createKeyRegistry(entries = []) {
+  const list = [];
+  function normalize(e) {
+    if (!e || !e.key || typeof e.key !== 'string') throw new Error('key registry entry requires a base64url SPKI key');
+    return {
+      kid: e.kid || e.key.slice(0, 16),
+      key: e.key,
+      not_before: toMs(e.not_before),
+      not_after: toMs(e.not_after),
+      revoked_at: toMs(e.revoked_at),
+    };
+  }
+  for (const e of entries) list.push(normalize(e));
+
+  /** Is this entry usable to verify a receipt issued at `atMs`? */
+  function entryActiveAt(entry, atMs) {
+    if (entry.revoked_at != null) return false; // HARD revocation: never trust a revoked key
+    if (entry.not_before != null && atMs != null && atMs < entry.not_before) return false;
+    if (entry.not_after != null && atMs != null && atMs > entry.not_after) return false;
+    // A windowed key with an unknown issuance time cannot be safely placed in
+    // its window — fail closed and exclude it. An unwindowed key still applies.
+    if ((entry.not_before != null || entry.not_after != null) && atMs == null) return false;
+    return true;
+  }
+
+  return {
+    /** The base64url public keys to verify a receipt issued at `at` (ISO or ms). */
+    keysValidAt(at) {
+      const atMs = toMs(at);
+      return list.filter((e) => entryActiveAt(e, atMs)).map((e) => e.key);
+    },
+    /** Mark a kid revoked as of `at` (default: now-as-supplied). Fail-closed thereafter. */
+    revoke(kid, at) {
+      let n = 0;
+      for (const e of list) {
+        if (e.kid === kid && e.revoked_at == null) { e.revoked_at = toMs(at) ?? 0; n += 1; }
+      }
+      if (n === 0) throw new Error(`key registry: no active key with kid "${kid}" to revoke`);
+      return n;
+    },
+    /** Add/rotate in a new key. */
+    add(entry) { list.push(normalize(entry)); return this; },
+    /** Operational snapshot (no private material; keys are public). */
+    status(at) {
+      const atMs = toMs(at);
+      return list.map((e) => ({
+        kid: e.kid,
+        revoked: e.revoked_at != null,
+        active: entryActiveAt(e, atMs),
+        not_before: e.not_before,
+        not_after: e.not_after,
+        revoked_at: e.revoked_at,
+      }));
+    },
+    get size() { return list.length; },
+  };
+}
+
+/** Coerce a flat trustedKeys[] OR a registry into a registry (back-compat). */
+export function asKeyRegistry(trustedKeysOrRegistry) {
+  if (trustedKeysOrRegistry && typeof trustedKeysOrRegistry.keysValidAt === 'function') {
+    return trustedKeysOrRegistry;
+  }
+  const keys = Array.isArray(trustedKeysOrRegistry) ? trustedKeysOrRegistry : [];
+  return createKeyRegistry(keys.map((key) => ({ key })));
+}
+
+export default { createKeyRegistry, asKeyRegistry };

package/mcp.js

@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — MCP drop-in. The lowest-friction place to put the firewall:
+ * agents already live at the MCP tool-call boundary, and a single wrapper turns
+ * a dangerous MCP tool into a receipt-required one.
+ *
+ *   import { createTrustedActionFirewall } from '@emilia-protocol/gate';
+ *   import { gateMcpTool } from '@emilia-protocol/gate/mcp';
+ *   const gate = createTrustedActionFirewall({ trustedKeys: [ISSUER] });
+ *
+ *   server.tool('release_payment',
+ *     gateMcpTool(gate, { tool: 'release_payment' }, async (args) => actuallyPay(args)));
+ *
+ * A guarded call with no valid, sufficiently-assured, non-replayed receipt
+ * returns a structured MCP error (isError) carrying the Receipt-Required
+ * challenge, so the agent knows to go get a human/quorum to authorize THIS exact
+ * action. On success the tool runs and an execution proof + reliance packet are
+ * attached under `_emilia`.
+ *
+ * Receipt resolution order (override with opts.receipt): args._emilia_receipt,
+ * args.emilia_receipt, then a base64 string in args._emilia_receipt_b64.
+ */
+
+function resolveReceipt(args, opts) {
+  if (typeof opts.receipt === 'function') return opts.receipt(args);
+  if (opts.receipt) return opts.receipt;
+  if (args && typeof args === 'object') {
+    if (args._emilia_receipt) return args._emilia_receipt;
+    if (args.emilia_receipt) return args.emilia_receipt;
+    if (typeof args._emilia_receipt_b64 === 'string') {
+      try { return JSON.parse(Buffer.from(args._emilia_receipt_b64, 'base64').toString('utf8')); } catch { return null; }
+    }
+  }
+  return null;
+}
+
+/**
+ * Wrap a single MCP tool handler so it runs only behind a passing gate check.
+ * @param {object} gate     an EMILIA Gate (createGate/createTrustedActionFirewall)
+ * @param {object} o
+ * @param {string} o.tool   the MCP tool name (matched against the manifest)
+ * @param {string} [o.protocol='mcp']
+ * @param {string} [o.action] explicit action_type (else resolved by the manifest from {protocol,tool})
+ * @param {object|function} [o.observedAction] the system-of-record facts to bind (default: the tool args)
+ * @param {object|function} [o.receipt] override receipt resolution
+ * @param {function} handler the real tool implementation (args, extra) => result
+ * @returns {function} a gated MCP tool handler
+ */
+export function gateMcpTool(gate, o = {}, handler) {
+  if (!gate || typeof gate.run !== 'function') throw new Error('gateMcpTool requires an EMILIA Gate (with .run)');
+  if (typeof handler !== 'function') throw new Error('gateMcpTool requires a tool handler function');
+  const { tool, protocol = 'mcp', action } = o;
+  if (!tool) throw new Error('gateMcpTool requires { tool }');
+
+  return async function gatedTool(args = {}, extra) {
+    const selector = { protocol, tool, ...(action ? { action_type: action } : {}) };
+    const receipt = resolveReceipt(args, o);
+    const observedAction = typeof o.observedAction === 'function'
+      ? o.observedAction(args, extra)
+      : (o.observedAction ?? args);
+
+    const out = await gate.run({ selector, receipt, observedAction }, () => handler(args, extra));
+    if (!out.ok) {
+      return {
+        isError: true,
+        content: [{
+          type: 'text',
+          text: `EMILIA Gate refused "${tool}": ${out.authorization.reason}. `
+            + 'This is a high-risk action; present a valid, sufficiently-assured, unused human/quorum receipt.',
+        }],
+        _emilia: {
+          gate: 'refused',
+          status: out.status,
+          reason: out.authorization.reason,
+          challenge: out.body,
+        },
+      };
+    }
+    const result = out.result;
+    // Attach the proof without clobbering a structured tool result.
+    if (result && typeof result === 'object' && !Array.isArray(result)) {
+      return { ...result, _emilia: { gate: 'allowed', execution: out.execution, reliance: out.packet } };
+    }
+    return { result, _emilia: { gate: 'allowed', execution: out.execution, reliance: out.packet } };
+  };
+}
+
+/**
+ * Convenience: wrap a map of { toolName: handler } in one call. Tools not named
+ * in the manifest still pass through the gate (which lets non-guarded tools run).
+ */
+export function gateMcpTools(gate, handlers = {}, opts = {}) {
+  const wrapped = {};
+  for (const [tool, handler] of Object.entries(handlers)) {
+    wrapped[tool] = gateMcpTool(gate, { ...opts, tool }, handler);
+  }
+  return wrapped;
+}
+
+export default { gateMcpTool, gateMcpTools };

package/package.json

@@ -1,17 +1,37 @@
 {
   "name": "@emilia-protocol/gate",
-  "version": "0.1.0",
-  "description": "EMILIA Gate — the Trusted Action Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), and a tamper-evident evidence log. Framework-agnostic, fails closed. Reference implementation, experimental.",
+  "version": "0.7.0",
+  "description": "EMILIA Gate — the Trusted Action Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), a tamper-evident evidence log, default high-risk action packs, execution-field binding, reliance packets, an MCP drop-in, a GitHub system-of-record adapter, and EG-1 conformance. Framework-agnostic, fails closed. Reference implementation, experimental.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "index.js",
-  "files": ["index.js", "store.js", "evidence.js", "README.md"],
+  "exports": {
+    ".": "./index.js",
+    "./mcp": "./mcp.js",
+    "./adapters/github": "./adapters/github.js",
+    "./adapters/stripe": "./adapters/stripe.js",
+    "./adapters/supabase": "./adapters/supabase.js",
+    "./adapters/aws": "./adapters/aws.js",
+    "./adapters/k8s": "./adapters/k8s.js",
+    "./adapters/terraform": "./adapters/terraform.js",
+    "./adapters/gcp": "./adapters/gcp.js",
+    "./adapters/vercel": "./adapters/vercel.js",
+    "./adapters/cloudflare": "./adapters/cloudflare.js",
+    "./adapters/linear": "./adapters/linear.js",
+    "./adapters/jira": "./adapters/jira.js",
+    "./adapters/salesforce": "./adapters/salesforce.js",
+    "./key-registry": "./key-registry.js",
+    "./retention": "./retention.js",
+    "./package.json": "./package.json"
+  },
+  "files": ["index.js", "store.js", "evidence.js", "action-packs.js", "execution-binding.js", "reliance-packet.js", "key-registry.js", "retention.js", "eg1-conformance.js", "eg1.mjs", "mcp.js", "adapters/_kit.js", "adapters/github.js", "adapters/github-demo.mjs", "adapters/stripe.js", "adapters/supabase.js", "adapters/aws.js", "adapters/k8s.js", "adapters/terraform.js", "adapters/gcp.js", "adapters/vercel.js", "adapters/cloudflare.js", "adapters/linear.js", "adapters/jira.js", "adapters/salesforce.js", "demo.mjs", "custody-demo.mjs", "README.md"],
   "scripts": {
     "test": "node --test",
-    "demo": "node demo.mjs"
+    "demo": "node demo.mjs",
+    "eg1": "node eg1.mjs"
   },
   "dependencies": {
-    "@emilia-protocol/require-receipt": "^0.1.0"
+    "@emilia-protocol/require-receipt": "^0.4.1"
   },
   "keywords": ["emilia", "authorization", "receipt", "firewall", "trusted-action-firewall", "agent", "mcp", "gate", "policy-enforcement-point", "ai-safety"]
 }

package/reliance-packet.js

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: Apache-2.0
+// Auditor / insurer-facing reliance packet for an EMILIA Gate decision.
+
+export const RELIANCE_PACKET_VERSION = 'EP-GATE-RELIANCE-PACKET-v1';
+
+function evidenceStatus(evidence) {
+  if (!evidence) return { ok: null, length: null, head: null };
+  if (typeof evidence.verify === 'function') return evidence.verify();
+  return evidence;
+}
+
+function check(id, ok, detail = null) {
+  return { id, ok, ...(detail ? { detail } : {}) };
+}
+
+export function buildReliancePacket({
+  decision,
+  execution = null,
+  evidence = null,
+  manifest = null,
+  binding = null,
+  verifier = '@emilia-protocol/gate',
+} = {}) {
+  const evidenceCheck = evidenceStatus(evidence);
+  const decisionHash = decision?.evidence?.hash || decision?.hash || null;
+  const executionBound = !execution || (execution.kind === 'execution' && execution.authorizes_decision === decisionHash);
+  const bindingCheck = binding || decision?.evidence?.execution_binding || decision?.execution_binding || null;
+  const allowed = decision?.allow === true;
+  const evidenceOk = evidenceCheck.ok !== false;
+  const bindingOk = bindingCheck ? bindingCheck.ok === true : true;
+  const verdict = allowed && executionBound && evidenceOk && bindingOk ? 'rely' : 'do_not_rely';
+
+  return {
+    '@version': RELIANCE_PACKET_VERSION,
+    product: 'EMILIA Gate',
+    verifier,
+    verdict,
+    summary: {
+      action: decision?.action || null,
+      receipt_id: decision?.evidence?.receipt_id || decision?.receipt_id || null,
+      subject: decision?.evidence?.subject || null,
+      required_tier: decision?.evidence?.required_tier || decision?.required_tier || null,
+      observed_tier: decision?.evidence?.have_tier || decision?.have_tier || null,
+      decision_hash: decisionHash,
+      execution_hash: execution?.hash || null,
+      evidence_head: evidenceCheck.head || null,
+    },
+    checks: [
+      check('receipt_present_and_valid', allowed && !String(decision?.reason || '').startsWith('receipt_rejected'), decision?.reason || null),
+      check('assurance_sufficient', allowed || decision?.reason !== 'assurance_too_low', decision?.reason === 'assurance_too_low' ? 'receipt tier below action requirement' : null),
+      check('receipt_one_time_consumed', allowed || decision?.reason === 'replay_refused' ? decision?.reason !== 'replay_refused' : null),
+      check('execution_fields_bound', bindingCheck ? bindingCheck.ok === true : null, bindingCheck ? { missing_observed_fields: bindingCheck.missing_observed_fields || [], mismatched_fields: bindingCheck.mismatched_fields || [] } : 'no material execution-field binding required by this action'),
+      check('execution_attests_decision', execution ? executionBound : null, execution ? null : 'no execution record supplied'),
+      check('evidence_log_intact', evidenceCheck.ok === undefined ? null : evidenceCheck.ok, evidenceCheck.reason || null),
+    ],
+    manifest_version: manifest?.['@version'] || null,
+    limitations: [
+      'The packet proves the gate verified a receipt and enforced its configured policy; it does not prove the human made a wise decision.',
+      'Identity, authority enrollment, and key custody remain external trust roots that must be operated correctly.',
+      'For execution-field binding, observedAction must come from the system of record, not from attacker-controlled request input.',
+    ],
+  };
+}
+
+export default { RELIANCE_PACKET_VERSION, buildReliancePacket };