@emilia-protocol/gate 0.11.0 → 0.13.0

package/src/action-packs.ts

@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: Apache-2.0
+// EMILIA Gate default action packs: the high-risk families that should require
+// pre-execution human authorization before a machine mutates the world.
+
+export const ACTION_RISK_MANIFEST_VERSION = 'EP-ACTION-RISK-MANIFEST-v0.1';
+
+/**
+ * Shape of a single action-pack entry. `business_authorization` is not part
+ * of the shipped defaults below but is a legitimate dynamic extension point:
+ * callers (e.g. lib/gate/reference-lab.js) attach it to a manifest entry
+ * after createDefaultActionRiskManifest() returns, before enforcement.
+ */
+type ActionPack = {
+  id: string;
+  label: string;
+  action_type: string;
+  risk?: string;
+  receipt_required: boolean;
+  assurance_class?: string;
+  match: { protocol: string; tool: string };
+  why?: string;
+  execution_binding?: { required_fields: string[]; caid_selector?: { field: string } };
+  business_authorization?: Record<string, any>;
+};
+
+export const HIGH_RISK_ACTION_PACKS: readonly ActionPack[] = Object.freeze([
+  Object.freeze({
+    id: 'money_movement.release',
+    label: 'Money movement',
+    action_type: 'payment.release',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'mcp', tool: 'release_payment' },
+    why: 'Moves funds or releases value. Requires a named human signoff, not an agent-only key.',
+    execution_binding: {
+      required_fields: ['action_type', 'amount_usd', 'currency', 'payment_instruction_id', 'beneficiary_account_hash'],
+      caid_selector: { field: 'action_caid' },
+    },
+  }),
+  Object.freeze({
+    id: 'money_movement.bank_details_change',
+    label: 'Bank-detail change',
+    action_type: 'payment.bank_details.change',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'mcp', tool: 'change_bank_details' },
+    why: 'Changes where future money flows. Treats payee, beneficiary, vendor, and payroll account changes as high-risk by category.',
+    execution_binding: {
+      required_fields: ['action_type', 'account_holder_id', 'payment_instruction_id', 'bank_account_hash'],
+    },
+  }),
+  Object.freeze({
+    id: 'production.deploy',
+    label: 'Production deploy',
+    action_type: 'deploy.production',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'quorum',
+    match: { protocol: 'mcp', tool: 'deploy_production' },
+    why: 'Changes live production behavior. Quorum is the cryptographic two-person rule for hard operational cuts.',
+    execution_binding: {
+      required_fields: ['action_type', 'repo', 'commit_sha', 'environment', 'artifact_digest'],
+    },
+  }),
+  Object.freeze({
+    id: 'permissions.admin_change',
+    label: 'Permission or admin change',
+    action_type: 'permission.admin.change',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'quorum',
+    match: { protocol: 'mcp', tool: 'change_permissions' },
+    why: 'Changes who can act next. Privilege changes deserve stronger proof than the session that requested them.',
+    execution_binding: {
+      required_fields: ['action_type', 'principal_id', 'role', 'scope'],
+    },
+  }),
+  Object.freeze({
+    id: 'data.bulk_export',
+    label: 'Bulk data export',
+    action_type: 'data.export',
+    risk: 'high',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'mcp', tool: 'export_customer_data' },
+    why: 'Moves sensitive data out of its system of record. The recipient and purpose must be bound to the approval.',
+    execution_binding: {
+      required_fields: ['action_type', 'dataset', 'recipient', 'purpose', 'row_count_max'],
+    },
+  }),
+  Object.freeze({
+    id: 'records.delete',
+    label: 'Record deletion',
+    action_type: 'record.delete',
+    risk: 'high',
+    receipt_required: true,
+    assurance_class: 'class_a',
+    match: { protocol: 'mcp', tool: 'delete_record' },
+    why: 'Destroys or hides state. The record identity and pre-state must be bound before deletion.',
+    execution_binding: {
+      required_fields: ['action_type', 'record_type', 'record_id', 'before_state_hash'],
+    },
+  }),
+  Object.freeze({
+    id: 'regulated.decision_override',
+    label: 'Regulated decision override',
+    action_type: 'regulated.decision.override',
+    risk: 'critical',
+    receipt_required: true,
+    assurance_class: 'quorum',
+    match: { protocol: 'mcp', tool: 'override_regulated_decision' },
+    why: 'Changes a decision with legal, benefit, credit, clinical, or safety impact. Requires named accountability.',
+    execution_binding: {
+      required_fields: ['action_type', 'case_id', 'decision_id', 'subject_id', 'override_reason'],
+    },
+  }),
+]);
+
+export const DEFAULT_PASS_THROUGH_ACTIONS: readonly ActionPack[] = Object.freeze([
+  Object.freeze({
+    id: 'observe.read_status',
+    label: 'Read-only status',
+    action_type: 'read.status',
+    receipt_required: false,
+    match: { protocol: 'mcp', tool: 'read_status' },
+  }),
+]);
+
+export function createDefaultActionRiskManifest({
+  includePassThrough = true,
+  extraActions = [],
+}: { includePassThrough?: boolean; extraActions?: ActionPack[] } = {}) {
+  return {
+    '@version': ACTION_RISK_MANIFEST_VERSION,
+    actions: [
+      ...HIGH_RISK_ACTION_PACKS.map((a) => ({
+        ...a,
+        match: { ...a.match },
+        execution_binding: a.execution_binding
+          ? {
+              ...a.execution_binding,
+              required_fields: [...a.execution_binding.required_fields],
+              ...(a.execution_binding.caid_selector
+                ? { caid_selector: { ...a.execution_binding.caid_selector } }
+                : {}),
+            }
+          : undefined,
+      })),
+      ...(includePassThrough ? DEFAULT_PASS_THROUGH_ACTIONS.map((a) => ({ ...a, match: { ...a.match } })) : []),
+      ...extraActions,
+    ],
+  };
+}
+
+export const DEFAULT_GATE_MANIFEST = Object.freeze(createDefaultActionRiskManifest());
+
+export function highRiskActionTypes(actions = HIGH_RISK_ACTION_PACKS) {
+  return actions.filter((a) => a.receipt_required).map((a) => a.action_type);
+}
+
+export default {
+  ACTION_RISK_MANIFEST_VERSION,
+  HIGH_RISK_ACTION_PACKS,
+  DEFAULT_PASS_THROUGH_ACTIONS,
+  DEFAULT_GATE_MANIFEST,
+  createDefaultActionRiskManifest,
+  highRiskActionTypes,
+};

package/src/adapters/_kit.ts

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — System-of-Record adapter kit. One enforcement contract shared by
+ * every adapter (GitHub, Stripe, Supabase, AWS, ...): map a destructive op to a
+ * gate selector + the observed system-of-record fields, run it through
+ * gate.run(), and FAIL CLOSED — if the gate refuses, the real client call is
+ * never made and we throw EMILIA_RECEIPT_REQUIRED.
+ *
+ * An op spec is: { selector, observed(params) -> {fields...},
+ * actuator?(params, observed) -> {fields...}, perform(client, actuator) -> result }.
+ * `observed` must return the same material fields the action pack binds, drawn
+ * from the call params (the system-of-record facts), so a receipt for resource A
+ * cannot authorize a mutation of resource B.
+ */
+import { canonicalize, hashCanonical } from '../execution-binding.js';
+
+export { hashCanonical };
+
+function deepFreeze(value) {
+  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    for (const child of Object.values(value)) deepFreeze(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+
+/** Canonical plain-data snapshot used at the actuator boundary. */
+export function canonicalActuatorObject(value) {
+  return deepFreeze(JSON.parse(canonicalize(value)));
+}
+
+/** Build an EP-ACTION-RISK-MANIFEST-v0.1 from a frozen action pack (deep-copied). */
+export function manifestFromPack(pack, extraActions = []) {
+  return {
+    '@version': 'EP-ACTION-RISK-MANIFEST-v0.1',
+    actions: [
+      ...pack.map((a) => ({
+        ...a,
+        match: { ...a.match },
+        execution_binding: a.execution_binding
+          ? { ...a.execution_binding, required_fields: [...a.execution_binding.required_fields] }
+          : undefined,
+        ...(a.business_authorization
+          ? { business_authorization: canonicalActuatorObject(a.business_authorization) }
+          : {}),
+      })),
+      ...extraActions,
+    ],
+  };
+}
+
+/**
+ * Create an adapter from a system name + op map.
+ * @returns {{ ops:object, OPS:readonly string[], guard:(gate,client,{op,params,receipt})=>Promise<{result,reliance,execution}> }}
+ */
+export function createAdapter({ system, ops }) {
+  if (!system || !ops || typeof ops !== 'object') throw new Error('createAdapter requires { system, ops }');
+  const OPS = Object.freeze(Object.keys(ops));
+
+  /**
+   * @param {object} gate
+   * @param {object} client
+   */
+  async function guard(
+    gate,
+    client,
+    { op, params = {}, receipt = null }: { op?: string; params?: object; receipt?: any } = {},
+  ) {
+    if (!gate || typeof gate.run !== 'function') throw new Error(`${system} adapter requires an EMILIA Gate (with .run)`);
+    const spec = ops[op as string];
+    if (!spec) throw new Error(`${system} adapter: unknown op "${op}" (expected one of: ${OPS.join(', ')})`);
+    if (!receipt) {
+      const refused = await gate.run(
+        { selector: spec.selector, receipt: null, observedAction: null },
+        () => { throw new Error('unreachable_adapter_effect'); },
+      );
+      const e = new Error(`EMILIA Gate refused ${system}:${op} — ${refused.authorization.reason}`) as Error & {
+        code?: string; status?: any; gate?: any; challenge?: any;
+      };
+      e.code = 'EMILIA_RECEIPT_REQUIRED';
+      e.status = refused.status;
+      e.gate = refused.authorization;
+      e.challenge = refused.body;
+      throw e;
+    }
+    // Snapshot before any asynchronous verification. Caller-owned params may be
+    // mutated while gate.run() awaits evidence/storage; neither the observation
+    // nor the eventual provider call may follow that mutable reference.
+    const input = canonicalActuatorObject(params);
+    const observedAction = canonicalActuatorObject(spec.observed(input));
+    // Default to the verified fields only. Operations that need a preimage for a
+    // bound digest (SQL, RLS, secret values, queries) must opt in with an explicit
+    // actuator() constructor. The unrestricted caller object is never passed.
+    const actuator = canonicalActuatorObject(
+      typeof spec.actuator === 'function' ? spec.actuator(input, observedAction) : observedAction,
+    );
+    const out = await gate.run(
+      { selector: spec.selector, receipt, observedAction },
+      () => spec.perform(client, actuator),
+    );
+    if (!out.ok) {
+      const e = new Error(`EMILIA Gate refused ${system}:${op} — ${out.authorization.reason}`) as Error & {
+        code?: string; status?: any; gate?: any; challenge?: any;
+      };
+      e.code = 'EMILIA_RECEIPT_REQUIRED';
+      e.status = out.status;
+      e.gate = out.authorization;
+      e.challenge = out.body;
+      throw e;
+    }
+    return { result: out.result, reliance: out.packet, execution: out.execution };
+  }
+
+  return { ops, OPS, guard };
+}
+
+export default { createAdapter, manifestFromPack, hashCanonical, canonicalActuatorObject };

package/src/adapters/aws.ts

@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — AWS System-of-Record adapter (IAM + network).
+ *
+ * "Install this before your agent can change cloud permissions or open the
+ * network." Wraps the high-blast-radius AWS operations — attach IAM policy,
+ * create access key, delete user, and open a security-group ingress — so they
+ * never reach AWS without a valid, sufficiently-assured, non-replayed receipt
+ * bound to THIS principal/policy/group. Privilege and network changes default
+ * to quorum (the two-person rule).
+ *
+ *   import { IAMClient, EC2Client } from '@aws-sdk/...';
+ *   import { createGate } from '@emilia-protocol/gate';
+ *   import { createAwsManifest, guardAwsMutation } from '@emilia-protocol/gate/adapters/aws';
+ *
+ *   const gate = createGate({ manifest: createAwsManifest(), trustedKeys: [ISSUER], store: sharedConsumptionStore });
+ *   // client: { iam: { attachUserPolicy, createAccessKey, deleteUser }, ec2: { authorizeSecurityGroupIngress } }
+ *   await guardAwsMutation(gate, client, {
+ *     op: 'iam.attach_policy', params: { user: 'svc-bot', policy_arn: 'arn:aws:iam::aws:policy/AdministratorAccess' }, receipt,
+ *   });
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+/**
+ * @typedef {object} AwsIamClient
+ * @property {(input: {UserName: string, PolicyArn: string}) => any} attachUserPolicy
+ * @property {(input: {UserName: string}) => any} createAccessKey
+ * @property {(input: {UserName: string}) => any} deleteUser
+ */
+/**
+ * @typedef {object} AwsEc2Client
+ * @property {(input: {GroupId: string, CidrIp: string, FromPort: number, ToPort: number, IpProtocol: string}) => any} authorizeSecurityGroupIngress
+ */
+/** @typedef {{ iam: AwsIamClient, ec2: AwsEc2Client }} AwsClient */
+
+export const AWS_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'aws.iam.attach_policy', label: 'IAM attach policy', action_type: 'aws.iam.attach_policy',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'aws', tool: 'attach_user_policy' },
+    why: 'Grants permissions. Privilege escalation deserves the two-person rule.',
+    execution_binding: { required_fields: ['action_type', 'user', 'policy_arn'] },
+  }),
+  Object.freeze({
+    id: 'aws.iam.create_access_key', label: 'IAM create access key', action_type: 'aws.iam.create_access_key',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'aws', tool: 'create_access_key' },
+    why: 'Mints long-lived credentials. Bind the user to a named approval.',
+    execution_binding: { required_fields: ['action_type', 'user'] },
+  }),
+  Object.freeze({
+    id: 'aws.iam.delete_user', label: 'IAM delete user', action_type: 'aws.iam.delete_user',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'aws', tool: 'delete_user' },
+    why: 'Destroys an identity. Bind the target user.',
+    execution_binding: { required_fields: ['action_type', 'user'] },
+  }),
+  Object.freeze({
+    id: 'aws.ec2.authorize_ingress', label: 'Open security-group ingress', action_type: 'aws.ec2.authorize_ingress',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'aws', tool: 'authorize_security_group_ingress' },
+    why: 'Opens the network. Bind group/CIDR/port so 0.0.0.0/0:22 cannot slip through.',
+    execution_binding: { required_fields: ['action_type', 'group_id', 'cidr', 'protocol', 'from_port', 'to_port'] },
+  }),
+]);
+
+const OPS = {
+  'iam.attach_policy': {
+    selector: { protocol: 'aws', tool: 'attach_user_policy' },
+    /** @param {{user: string, policy_arn: string}} p */
+    observed: (p) => ({ action_type: 'aws.iam.attach_policy', user: p.user, policy_arn: p.policy_arn }),
+    /**
+     * @param {AwsClient} client
+     * @param {{user: string, policy_arn: string}} p
+     */
+    perform: (client, p) => client.iam.attachUserPolicy({ UserName: p.user, PolicyArn: p.policy_arn }),
+  },
+  'iam.create_access_key': {
+    selector: { protocol: 'aws', tool: 'create_access_key' },
+    /** @param {{user: string}} p */
+    observed: (p) => ({ action_type: 'aws.iam.create_access_key', user: p.user }),
+    /**
+     * @param {AwsClient} client
+     * @param {{user: string}} p
+     */
+    perform: (client, p) => client.iam.createAccessKey({ UserName: p.user }),
+  },
+  'iam.delete_user': {
+    selector: { protocol: 'aws', tool: 'delete_user' },
+    /** @param {{user: string}} p */
+    observed: (p) => ({ action_type: 'aws.iam.delete_user', user: p.user }),
+    /**
+     * @param {AwsClient} client
+     * @param {{user: string}} p
+     */
+    perform: (client, p) => client.iam.deleteUser({ UserName: p.user }),
+  },
+  'ec2.authorize_ingress': {
+    selector: { protocol: 'aws', tool: 'authorize_security_group_ingress' },
+    /** @param {{group_id: string, cidr: string, protocol?: string, from_port: number, to_port?: number}} p */
+    observed: (p) => ({
+      action_type: 'aws.ec2.authorize_ingress',
+      group_id: p.group_id,
+      cidr: p.cidr,
+      protocol: p.protocol ?? 'tcp',
+      from_port: p.from_port,
+      to_port: p.to_port ?? p.from_port,
+    }),
+    /**
+     * @param {AwsClient} client
+     * @param {{group_id: string, cidr: string, protocol: string, from_port: number, to_port: number}} p
+     */
+    perform: (client, p) => client.ec2.authorizeSecurityGroupIngress({
+      GroupId: p.group_id,
+      CidrIp: p.cidr,
+      FromPort: p.from_port,
+      ToPort: p.to_port,
+      IpProtocol: p.protocol,
+    }),
+  },
+};
+
+const adapter = createAdapter({ system: 'aws', ops: OPS });
+export const AWS_OPS = adapter.OPS;
+
+/** @param {object[]} extraActions */
+export function createAwsManifest(extraActions = []) {
+  return manifestFromPack(AWS_ACTION_PACK, extraActions);
+}
+
+/**
+ * Guard a high-blast-radius AWS mutation behind the gate.
+ * @param {object} gate    a gate built with createAwsManifest()
+ * @param {AwsClient} client  { iam: {attachUserPolicy, createAccessKey, deleteUser}, ec2: {authorizeSecurityGroupIngress} }
+ * @param {{ op: string, params?: object, receipt?: any }} args    { op, params, receipt }
+ * @throws Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the call never reaches AWS
+ */
+export function guardAwsMutation(gate, client, args) {
+  return adapter.guard(gate, client, /** @type {{ op: any, params: any, receipt: any }} */ (args));
+}
+
+export default { AWS_ACTION_PACK, AWS_OPS, createAwsManifest, guardAwsMutation };

package/src/adapters/cloudflare.ts

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Cloudflare System-of-Record adapter.
+ * Guards DNS record delete, zone delete, and WAF/firewall disable so they never
+ * reach Cloudflare without a receipt bound to THIS zone. Client injected.
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+/**
+ * @typedef {object} CloudflareClient
+ * @property {(input: {zone: string, recordId: string}) => any} deleteDnsRecord
+ * @property {(input: {zone: string}) => any} deleteZone
+ * @property {(input: {zone: string, ruleId: string, enabled: boolean}) => any} setFirewallRule
+ */
+
+export const CLOUDFLARE_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'cloudflare.dns.delete', label: 'Delete DNS record', action_type: 'cloudflare.dns.delete',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'cloudflare', tool: 'delete_dns_record' },
+    why: 'Removing DNS can take a service offline or enable takeover. Bind zone+record.',
+    execution_binding: { required_fields: ['action_type', 'zone', 'record_id'] },
+  }),
+  Object.freeze({
+    id: 'cloudflare.zone.delete', label: 'Delete zone', action_type: 'cloudflare.zone.delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'cloudflare', tool: 'delete_zone' },
+    why: 'Deletes an entire zone. Quorum.',
+    execution_binding: { required_fields: ['action_type', 'zone'] },
+  }),
+  Object.freeze({
+    id: 'cloudflare.firewall.disable', label: 'Disable firewall rule', action_type: 'cloudflare.firewall.disable',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'cloudflare', tool: 'set_firewall_rule' },
+    why: 'Disabling WAF/firewall opens the perimeter. Quorum + bind zone+rule.',
+    execution_binding: { required_fields: ['action_type', 'zone', 'rule_id'] },
+  }),
+]);
+
+const OPS = {
+  'dns.delete': {
+    selector: { protocol: 'cloudflare', tool: 'delete_dns_record' },
+    /** @param {{zone: string, record_id: string}} p */
+    observed: (p) => ({ action_type: 'cloudflare.dns.delete', zone: p.zone, record_id: p.record_id }),
+    /**
+     * @param {CloudflareClient} c
+     * @param {{zone: string, record_id: string}} p
+     */
+    perform: (c, p) => c.deleteDnsRecord({ zone: p.zone, recordId: p.record_id }),
+  },
+  'zone.delete': {
+    selector: { protocol: 'cloudflare', tool: 'delete_zone' },
+    /** @param {{zone: string}} p */
+    observed: (p) => ({ action_type: 'cloudflare.zone.delete', zone: p.zone }),
+    /**
+     * @param {CloudflareClient} c
+     * @param {{zone: string}} p
+     */
+    perform: (c, p) => c.deleteZone({ zone: p.zone }),
+  },
+  'firewall.disable': {
+    selector: { protocol: 'cloudflare', tool: 'set_firewall_rule' },
+    /** @param {{zone: string, rule_id: string}} p */
+    observed: (p) => ({ action_type: 'cloudflare.firewall.disable', zone: p.zone, rule_id: p.rule_id }),
+    /**
+     * @param {CloudflareClient} c
+     * @param {{zone: string, rule_id: string}} p
+     */
+    perform: (c, p) => c.setFirewallRule({ zone: p.zone, ruleId: p.rule_id, enabled: false }),
+  },
+};
+
+const adapter = createAdapter({ system: 'cloudflare', ops: OPS });
+export const CLOUDFLARE_OPS = adapter.OPS;
+/** @param {object[]} extra */
+export function createCloudflareManifest(extra = []) { return manifestFromPack(CLOUDFLARE_ACTION_PACK, extra); }
+export function guardCloudflareMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { CLOUDFLARE_ACTION_PACK, CLOUDFLARE_OPS, createCloudflareManifest, guardCloudflareMutation };

package/src/adapters/gcp.ts

@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Google Cloud System-of-Record adapter.
+ *
+ * "Install this before your agent can change cloud permissions or delete a
+ * project." Guards the high-blast-radius GCP operations — IAM policy set,
+ * service-account key create, project delete, storage bucket delete — so they
+ * never reach GCP without a receipt bound to THIS resource/member/role. Client
+ * is injected (the @google-cloud SDKs or a thin wrapper).
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const GCP_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'gcp.iam.set_policy', label: 'GCP IAM set policy', action_type: 'gcp.iam.set_policy',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'gcp', tool: 'set_iam_policy' },
+    why: 'Grants cloud permissions. Bind resource+member+role; quorum.',
+    execution_binding: { required_fields: ['action_type', 'resource', 'member', 'role'] },
+  }),
+  Object.freeze({
+    id: 'gcp.sa_key.create', label: 'GCP service-account key create', action_type: 'gcp.sa_key.create',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'gcp', tool: 'create_service_account_key' },
+    why: 'Mints long-lived cloud credentials. Bind the service account.',
+    execution_binding: { required_fields: ['action_type', 'service_account'] },
+  }),
+  Object.freeze({
+    id: 'gcp.project.delete', label: 'GCP project delete', action_type: 'gcp.project.delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'gcp', tool: 'delete_project' },
+    why: 'Deletes an entire project. Quorum.',
+    execution_binding: { required_fields: ['action_type', 'project'] },
+  }),
+  Object.freeze({
+    id: 'gcp.storage.bucket_delete', label: 'GCP bucket delete', action_type: 'gcp.storage.bucket_delete',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'gcp', tool: 'delete_bucket' },
+    why: 'Destroys a storage bucket and its objects. Bind the bucket.',
+    execution_binding: { required_fields: ['action_type', 'bucket'] },
+  }),
+]);
+
+const OPS = {
+  'iam.set_policy': {
+    selector: { protocol: 'gcp', tool: 'set_iam_policy' },
+    observed: (p) => ({ action_type: 'gcp.iam.set_policy', resource: p.resource, member: p.member, role: p.role }),
+    perform: (c, p) => c.setIamPolicy({ resource: p.resource, member: p.member, role: p.role }),
+  },
+  'sa_key.create': {
+    selector: { protocol: 'gcp', tool: 'create_service_account_key' },
+    observed: (p) => ({ action_type: 'gcp.sa_key.create', service_account: p.service_account }),
+    perform: (c, p) => c.createServiceAccountKey({ service_account: p.service_account }),
+  },
+  'project.delete': {
+    selector: { protocol: 'gcp', tool: 'delete_project' },
+    observed: (p) => ({ action_type: 'gcp.project.delete', project: p.project }),
+    perform: (c, p) => c.deleteProject({ project: p.project }),
+  },
+  'storage.bucket_delete': {
+    selector: { protocol: 'gcp', tool: 'delete_bucket' },
+    observed: (p) => ({ action_type: 'gcp.storage.bucket_delete', bucket: p.bucket }),
+    perform: (c, p) => c.deleteBucket({ bucket: p.bucket }),
+  },
+};
+
+const adapter = createAdapter({ system: 'gcp', ops: OPS });
+export const GCP_OPS = adapter.OPS;
+export function createGcpManifest(extraActions = []) { return manifestFromPack(GCP_ACTION_PACK, extraActions); }
+export function guardGcpMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { GCP_ACTION_PACK, GCP_OPS, createGcpManifest, guardGcpMutation };