@emilia-protocol/gate 0.11.0 → 0.14.0

package/CHANGELOG.md

@@ -4,6 +4,86 @@
 All notable changes to `@emilia-protocol/gate` are documented here.
 This package follows [Semantic Versioning](https://semver.org/).
 
+## 0.14.0 (2026-07-22)
+
+### Added
+
+- `./proposal-to-effect`, an orchestration profile over CAID, the existing
+  `EP-APPROVAL-v1` acquisition rail, signed AEB evaluation, Gate authorization,
+  durable operation reservation, exact effect invocation, and authenticated
+  reconciliation.
+- An executable end-to-end example and profile vectors covering exact-action
+  mutation, stale evidence, one-time replay, indeterminate effects, and
+  post-effect commit failure.
+
+### Security
+
+- A proposal is explicitly non-authoritative and carries no signature, permit,
+  or presenter-controlled authorization decision.
+- AEB and Gate make independent, fail-closed decisions over the same operation,
+  initiator, CAID, normalized action, and relying-party pins.
+- Once an effect may have executed, failed bookkeeping cannot release its AEB
+  reservation. The operation remains frozen until authenticated provider
+  evidence proves `COMMITTED` or `NOT_COMMITTED`.
+
+## 0.13.0 (2026-07-20)
+
+### Added
+
+- A receipt-program execution kernel that composes CAID matching, Gate
+  authorization, bounded capability reservation, provider execution,
+  execution evidence, and an operator-signed content-addressed certificate.
+- Offline certificate verification under a separately pinned operator key,
+  context, and evidence record, including CAID re-performance, exact schemas and
+  instruction sequencing, result digest, action/operation binding, and Gate
+  evidence-record references.
+- A tenant-bound Trust Program kernel for staged, ordered or threshold
+  authorization ceremonies, with durable Postgres state, revocation handling,
+  exact predecessor/evidence bindings, and tenant-wide replay refusal.
+- Explicit `executed`, `refused`, and `indeterminate` terminal states. Provider
+  timeout and non-canonical provider output halt the operation without restoring
+  replay authority.
+
+### Security
+
+- Production construction requires both a durable atomic evidence log and a
+  durable capability store, an external KMS/HSM signer, pinned certificate
+  context, pinned result projector, and finite provider deadline. Process-local
+  state and keys are available only behind an explicit test/demo opt-in.
+- CAID resolution, operation-id field selection, certificate signing and
+  context, result projection, deadline, clock, and Gate trust are
+  constructor-pinned; runtime requests cannot replace them.
+- Provider code receives deep-frozen snapshots rather than Gate's live
+  authorization objects. Complete certificates are appended to the atomic
+  evidence log, and signer/persistence failures preserve Gate's terminal state
+  without issuing contradictory proof.
+- The certificate is an operator-signed integrity and binding artifact. It is
+  not a zero-knowledge proof and does not attest that an external provider's
+  statement is truthful.
+
+## 0.12.0 (2026-07-18)
+
+### Added
+
+- A distinct contractor release-template profile that requires a signed
+  `project_record_snapshot_digest` while preserving the closed legacy profile.
+- A contractor evidence-package profile that carries and re-verifies the exact
+  project-record sidecar bytes under a relying-party-owned verifier.
+- A read-only Procore change-order source adapter with complete pagination and
+  stable double-fetch snapshots.
+
+### Security
+
+- A project-system source record cannot become agreement acceptance or release
+  authority. Replacing its committed snapshot changes the action digest and
+  fails closed.
+- Existing Action Escrow templates without a project source remain valid under
+  their original closed profile; new contractor artifacts use an explicit
+  version boundary and cannot be silently downgraded.
+- Unmarked project-bound artifacts from the unreleased `0.11.1` preview remain
+  readable only through the contractor package path, which requires the exact
+  project-record sidecar and a relying-party-owned source verifier.
+
 ## 0.11.0 (2026-07-17)
 
 ### Added

package/README.md

@@ -59,6 +59,64 @@ if (!out.ok) throw out.body; // 428 Receipt Required
 console.log(out.packet.verdict); // "rely"
 ```
 
+## Proposal to effect
+
+`@emilia-protocol/gate/proposal-to-effect` closes the loop from an agent's
+proposal to a controlled consequence without minting another authorization
+format. The proposal is an unsigned, short-lived request; authority remains in
+`EP-RECEIPT-v1` and the relying party's pinned AEB requirement.
+
+```js
+import { createProposalToEffect } from '@emilia-protocol/gate/proposal-to-effect';
+
+const controller = createProposalToEffect({
+  gate,
+  profiles: {
+    'payment-release': {
+      id: 'payment-release',
+      action_type: 'payment.release',
+      selector: { protocol: 'mcp', tool: 'release_payment' },
+      required_fields: [
+        'action_type', 'amount_usd', 'currency',
+        'payment_instruction_id', 'beneficiary_account_hash',
+      ],
+      authorization: {
+        authorization_endpoint: 'https://authorize.example/v1/approvals',
+        flow: 'EP-APPROVAL-v1',
+      },
+      aeb_requirement_ref: 'requirement:payment-release',
+      ttl_sec: 300,
+      canonicalize_action: deriveCanonicalPaymentActionAndCaid,
+    },
+  },
+  aeb: {
+    config: pinnedAebConfig,
+    adapters: pinnedAebAdapters,
+    store: durableOperationStore,
+    resolve_artifacts,
+    verify_provider_evidence,
+  },
+});
+
+const proposal = controller.prepare({
+  proposal_id, profile_id: 'payment-release', operation_id,
+  initiator_id: authenticatedAgentId, action: paymentFromSystemOfRecord,
+});
+
+const result = await controller.execute(
+  { proposal, receipt, evaluation: signedAebEvaluation },
+  ({ action }) => paymentProvider.release(action),
+);
+```
+
+The controller re-verifies the signed AEB evaluation, runs Gate policy,
+reserves the operation before invoking the effect, and consumes it after
+success. An uncertain provider result remains reserved; only authenticated
+provider evidence bound to the same operation, CAID, and action digest can
+reconcile it. See
+[`docs/protocol/proposal-to-effect-profile-v1.md`](../../docs/protocol/proposal-to-effect-profile-v1.md)
+and run `node examples/proposal-to-effect/demo.mjs` from the repository root.
+
 ## Three-plane deployment
 
 High-consequence infrastructure separates three jobs instead of asking one
@@ -295,6 +353,245 @@ challenge. The Gate composes that and adds the lifecycle controls a firewall nee
   can establish a declared surface as `gated`; a passive network witness alone is always
   `witness_only`. Inventory completeness remains an explicit relying-party assumption.
 
+## Formal-to-runtime bridge
+
+Every Gate has an explicit runtime lifecycle monitor. It mirrors the load-bearing
+state ordering behind the formal model: authorization must precede the effect,
+consumption is one-way, and execution evidence follows the effect attempt. A
+divergence emits a bounded `SPEC_DIVERGENCE` event and moves the Gate into
+fail-closed safe mode. In safe mode, pass-through is disabled and a receipt must
+earn at least Class-A assurance before execution.
+
+```js
+import { createRuntimeMonitor, createTrustedActionFirewall } from '@emilia-protocol/gate';
+
+const monitor = createRuntimeMonitor({
+  onDivergence: (event) => siem.append(event),
+  authorizeRecovery: (request) => operatorApproval.verify(request),
+});
+const gate = createTrustedActionFirewall({ runtimeMonitor: monitor, /* ... */ });
+```
+
+Recovery is explicit and operator-authorized; it never re-authorizes a prior
+receipt. The repository's `check:runtime-bridge` gate binds each monitor
+theorem to an invariant declared in `formal/ep_handshake.cfg`, so a renamed or
+removed formal source cannot silently leave the runtime map stale. This is a
+machine-checked coverage binding, not a claim that TLA+ is automatically
+compiled into JavaScript: the formal specifications remain the source of the
+invariants and the monitor's transition table is covered by its own tests.
+
+## Capability receipts
+
+`capability-receipt.js` adds an issuer-signed capability envelope around an
+ordinary EP receipt. The envelope binds a secret preimage, an integer budget,
+currency, expiry, a signed delegation chain, and an optional `m-of-n` Shamir
+threshold. The envelope's `consumed` field is only an issuance invariant; spend
+state lives in an atomic capability store and is never trusted from the bearer
+object.
+
+```js
+import {
+  createMemoryCapabilityStore,
+  executeWithCapability,
+  mintCapabilityReceipt,
+} from '@emilia-protocol/gate/capability-receipt';
+
+const minted = mintCapabilityReceipt(baseReceipt, {
+  issuerPrivateKey,
+  budget: { amount: 1_000_000, currency: 'USD' },
+  expiry: '2026-12-31T00:00:00.000Z',
+  scope: {
+    profile: CAPABILITY_SCOPE_PROFILE,
+    operation_id_field: 'payment_instruction_id',
+    action_digests: allowedPaymentActions.map(capabilityActionDigest),
+  },
+});
+const store = createMemoryCapabilityStore(); // tests only; use Postgres in production
+store.registerCapability(minted.capabilityReceipt);
+await executeWithCapability({
+  capabilityReceipt: minted.capabilityReceipt,
+  secret: minted.secret,
+  action: { amount: 10_000, currency: 'USD' },
+  observedAction: actionFromTheSystemOfRecord,
+  store,
+  gate,
+  trustedIssuerKeys: [capabilityIssuerPublicKey],
+  operationId: 'provider-idempotency-key',
+  executeAction: sendPayment,
+});
+```
+
+The production adapter requires a transaction callback and locks the capability
+state row before reserving budget. If the external effect throws, the reserved
+amount is committed as indeterminate; it is never silently reopened. The
+capability path is separate from ordinary receipt consumption: the capability
+store owns replay and budget state for each explicitly supplied operation ID.
+The verifier requires a pinned capability issuer key. Every operation must
+match one exact signed action digest, and the caller's stable operation ID must
+equal the signed scope's field in the executor-observed action. The same digest
+is persisted with the reservation. The separate budget projection must match
+the amount and currency in that verified action, and the effect callback
+receives a clone of the verified action—not the projection. A new operation ID
+therefore cannot relabel the same payment instruction after a timeout.
+
+The built-in `urn:emilia:scope:action-digest-set-v1` profile is exact-byte
+scope. `urn:emilia:scope:caid-set-v1` is also supported for interoperable
+material-action scope, but only when the deployment supplies its pinned CAID
+resolver as `capabilityCaidResolver`; a missing, unknown, or non-matching CAID
+fails closed. CAID correlates content here—it does not replace issuer trust,
+human authorization, holder proof, or durable budget state.
+
+### Gate-integrated capability enforcement
+
+For an action that must be both human-authorized and budget-limited, pass the
+capability store when constructing the Gate and supply a capability to `run()`
+or `guard()`:
+
+```js
+const gate = createTrustedActionFirewall({
+  capabilityStore: postgresCapabilityStore,
+  capabilityTrustedIssuerKeys: [capabilityIssuerPublicKey],
+  capabilityCaidResolver: resolveWithPinnedCaidRegistry, // for caid-set scopes
+  // ...the ordinary Gate trust and durable evidence configuration
+});
+
+const result = await gate.run({
+  selector: { protocol: 'mcp', tool: 'release_payment' },
+  observedAction: actionFromTheSystemOfRecord,
+  capability: {
+    capabilityReceipt,
+    secret,
+    action: { amount: 10_000, currency: 'USD' },
+    operationId: 'provider-idempotency-key',
+  },
+}, (authorization, operation) => sendPayment(actionFromTheSystemOfRecord, {
+  idempotencyKey: operation.providerIdempotencyKey,
+  authorization,
+}));
+```
+
+The Gate verifies the ordinary receipt first without consuming it, requires the
+capability amount and currency to equal the observed action's `amount` or
+`amount_usd` and `currency`, checks the signed exact-action scope, reserves the
+budget and action digest before calling `sendPayment`, and passes the stable
+operation ID to the provider adapter as its idempotency key. A replay,
+out-of-scope action, operation relabel, overspend, missing registration, or
+envelope mismatch never enters the effect. An exception after the effect begins
+commits the amount as `indeterminate` and keeps the operation closed for
+authenticated reconciliation. Capability issuer keys are pinned separately
+from the ordinary receipt trust list.
+
+Delegation is issuer-authorized and budget-backed: `delegateCapabilityReceipt`
+atomically reserves and commits the child budget against the parent before the
+child is registered. A failed child registration is reported for
+reconciliation; it never creates spendable budget out of thin air. A holder
+cannot edit `delegation_chain` or enlarge a child because the issuer signs the
+entire envelope.
+
+## Receipt programs
+
+`createReceiptProgramKernel()` composes CAID, the Gate capability path, and the
+evidence log into one bounded instruction surface. The instruction descriptor
+and certificate encoding are deterministic; external effects are not. It does not create a
+second ledger or bypass Gate. A successful run emits an Ed25519-signed
+certificate over the exact program, provider result projection, execution
+steps, and compact Gate evidence references.
+
+```js
+import {
+  createReceiptProgramKernel,
+  verifyReceiptProgramCertificate,
+} from '@emilia-protocol/gate/receipt-program';
+
+const certificateContext = {
+  issuer: 'emilia-operator',
+  tenant: 'acme',
+  environment: 'production',
+  audience: 'acme-audit',
+  key_id: 'kms://receipt-program-1',
+};
+
+const kernel = createReceiptProgramKernel({
+  gate,                              // already configured production Gate
+  resolveCaid,                       // relying-party-pinned synchronous resolver
+  operationIdField: 'payment_instruction_id',
+  certificateSigner: {
+    keyId: 'kms://receipt-program-1',
+    custody: 'kms',
+    publicKey: operatorPublicKey,
+    sign: (bytes) => signWithKms(bytes),
+  },
+  certificateContext,
+  projectResult: (raw) => ({
+    provider: raw.provider,
+    provider_operation_id: raw.provider_operation_id,
+    status: raw.status,
+  }),
+  effectTimeoutMs: 15_000,
+});
+
+const run = await kernel.run({
+  programId: 'delegated-payment-v1',
+  instructionId: 'release-milestone-1',
+  caid,
+  selector: { protocol: 'mcp', tool: 'release_payment' },
+  observedAction: actionFromTheSystemOfRecord,
+  capability: {
+    capabilityReceipt,
+    secret,
+    action: { amount: 50, currency: 'USD' },
+    operationId: actionFromTheSystemOfRecord.payment_instruction_id,
+  },
+}, async (_authorization, operation) => ({
+  provider: 'licensed-custodian',
+  provider_operation_id: operation.providerIdempotencyKey,
+  status: await releaseWithIdempotency(operation.providerIdempotencyKey),
+}));
+
+const checked = verifyReceiptProgramCertificate(run.certificate, {
+  trustedCertificateKeys: {
+    'kms://receipt-program-1': operatorPublicKey,
+  },
+  resolveCaid,
+  expectedContext: certificateContext,
+  certificateEvidence: run.certificate_evidence,
+  // Must check this exact record against the relying party's pinned stream,
+  // authenticated snapshot, or inclusion proof. Rehashing the object is not enough.
+  verifyCertificateInclusion: verifyInPinnedEvidenceStream,
+  requireAtomicCertificateEvidence: true,
+});
+```
+
+Production construction requires a durable atomic evidence log and durable
+capability store, external KMS/HSM signing custody, an exact certificate
+context, and a pinned disclosure projector. Provider code receives only frozen
+copies of authorization and operation data. A provider exception, real deadline
+expiry, or invalid result projection after invocation becomes `indeterminate`
+and leaves the operation closed to blind replay. A certificate is returned as
+durable proof only after signing and complete-certificate evidence append
+succeed; typed signer/persistence failures preserve Gate's terminal outcome.
+`checked.ok` means certificate validity, not provider success—inspect
+`checked.outcome` and `checked.execution_succeeded`. The certificate proves
+operator-signed integrity and binding; it is not a zero-knowledge proof or
+independent proof of provider truth. See the runnable `examples/receipt-program/` reference and the
+[architecture profile](../../docs/architecture/RECEIPT-PROGRAM-EXECUTION-KERNEL.md).
+
+## Zero-knowledge range receipts
+
+`zk-range-proof.js` provides `EP-ZK-RANGE-RECEIPT-v1`. It uses Bulletproofs over
+Ristretto255 to prove a hidden integer `v` satisfies `0 <= v <= max` without
+revealing `v` or its blinding factor. The second commitment proves the upper
+bound relation `max - v` without relying on a mutable claim. The envelope
+binds a public policy hash, predicate, base-receipt digest, issuer key, and
+nonce. The ordinary EP receipt signature must still be verified separately.
+
+The cryptographic engine is an explicit optional backend:
+`@aptos-labs/confidential-asset-bindings@1.1.2`. It is not pulled into the
+default Gate install because its WASM/mobile distribution is large. A
+deployment enabling ZK receipts must pin, audit, and pass the backend's own
+proof tests. This v1 is a genuine hidden-range proof; it is not a claim that
+the repository automatically compiles all TLA+ invariants into R1CS.
+
 ## Action Escrow
 
 Action Escrow is the Gate profile for a two-party agreement whose downstream
@@ -315,6 +612,19 @@ adjudicate disputes, or make an agreement legally enforceable. An ambiguous
 provider outcome enters reconciliation and is never retried as though nothing
 happened.
 
+Construction and contractor integrations use the explicit
+`EP-ACTION-ESCROW-CONTRACTOR-TEMPLATE-v1` profile. Build its DAB verifier with
+`createActionEscrowContractorDocumentBindingVerifier()` and its portable
+six-row package with `assembleActionEscrowContractorEvidencePackage()`. The
+package carries the exact project-system sidecar bytes beside the PDF and
+re-performs both under relying-party-owned verifiers. A project record is
+source evidence only: it cannot fill agreement-acceptance, release-approval,
+or custodian-effect rows. The legacy template and package APIs refuse the
+contractor profile instead of silently ignoring its project-source binding.
+Unmarked project-bound artifacts from the unreleased `0.11.1` preview remain
+verifiable only through the contractor package path, including its exact
+sidecar and relying-party-owned project-source verifier.
+
 ## Production custody
 
 The three things a serious buyer (CISO, auditor, insurer) asks after the demo:

package/action-control-manifest.js

@@ -1,269 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-//
-// EP Action Control Manifest: the missing control-plane waist between agent
-// runtimes, receipt formats, transparency logs, and system-of-record adapters.
-//
-// A receipt proves an authorization event. This manifest tells an executor
-// when a receipt is required, what assurance tier is required, which material
-// fields must be observed from the system of record, and what evidence must be
-// emitted after the effect boundary.
-
-import { HIGH_RISK_ACTION_PACKS, DEFAULT_PASS_THROUGH_ACTIONS } from './action-packs.js';
-
-export const ACTION_CONTROL_MANIFEST_VERSION = 'EP-ACTION-CONTROL-MANIFEST-v0.2';
-export const ACTION_CONTROL_SCHEMA_URL = 'https://www.emiliaprotocol.ai/docs/schemas/agent-action-control-manifest-v0.2.schema.json';
-export const ACTION_CONTROL_CONFORMANCE_LEVEL = 'EG-1';
-
-const RISK_LEVELS = new Set(['low', 'medium', 'high', 'critical']);
-const ASSURANCE_CLASSES = new Set(['software', 'class_a', 'quorum']);
-const ENFORCEMENT_POINTS = new Set(['pre_execution', 'pre_effect_commit']);
-
-export const ACTION_CONTROL_DEFAULTS = Object.freeze({
-  decision_point: 'pre_effect_commit',
-  missing_receipt: 'refuse',
-  invalid_receipt: 'refuse',
-  stale_receipt: 'refuse',
-  replay: 'one_time_consumption',
-  evidence_log: 'strict',
-});
-
-export const ACTION_CONTROL_EVIDENCE_PROFILES = Object.freeze({
-  authorization_receipt: 'EP-RECEIPT-v1',
-  execution_attestation: 'EP-EXECUTION-ATTESTATION-v1',
-  reliance_packet: 'EP-RELIANCE-PACKET-v1',
-  transparency: 'SCITT-compatible Signed Statement',
-});
-
-export const ACTION_CONTROL_CONFORMANCE_CHECKS = Object.freeze([
-  'missing_receipt_refused',
-  'software_on_classA_refused',
-  'execution_drift_refused',
-  'valid_classA_runs',
-  'replay_refused',
-  'tampered_refused',
-  'execution_proof_binds',
-  'reliance_packet_rely',
-]);
-
-function cloneJson(value) {
-  return value == null ? value : JSON.parse(JSON.stringify(value));
-}
-
-function normalizeRisk(risk) {
-  return RISK_LEVELS.has(risk) ? risk : 'high';
-}
-
-function normalizeAssurance(value) {
-  return ASSURANCE_CLASSES.has(value) ? value : 'software';
-}
-
-function defaultControlForAction(action) {
-  const requiredFields = action.execution_binding?.required_fields || [];
-  if (!action.receipt_required) {
-    return {
-      enforcement_point: 'none',
-      authorization_receipt: { required: false },
-      evidence_output: { audit_event: true },
-    };
-  }
-  return {
-    enforcement_point: 'pre_effect_commit',
-    status: 428,
-    challenge_header: 'Receipt-Required',
-    proof_header: 'X-EMILIA-Receipt',
-    authorization_receipt: {
-      required: true,
-      profile: 'EP-RECEIPT-v1',
-      signature: 'Ed25519 over RFC 8785 canonical JSON',
-      verifier: 'offline',
-    },
-    replay: {
-      mode: 'one_time_consumption',
-      receipt_id_required: true,
-    },
-    execution_binding: {
-      required: true,
-      source: 'system_of_record',
-      required_fields: [...requiredFields],
-    },
-    transparency: {
-      mode: 'registerable',
-      profile: 'SCITT Signed Statement',
-      required: false,
-    },
-    evidence_output: {
-      audit_event: true,
-      execution_attestation: true,
-      reliance_packet: true,
-      blocked_attempts: true,
-    },
-  };
-}
-
-export function toActionControl(action) {
-  const out = {
-    id: action.id,
-    label: action.label || action.description || action.id,
-    action_type: action.action_type,
-    risk: normalizeRisk(action.risk || (action.receipt_required ? 'high' : 'low')),
-    receipt_required: !!action.receipt_required,
-    assurance_class: normalizeAssurance(action.assurance_class),
-    max_age_sec: action.max_age_sec || 900,
-    match: cloneJson(action.match || {}),
-    why: action.why || action.description || null,
-    control: cloneJson(action.control || defaultControlForAction(action)),
-    conformance: {
-      level: ACTION_CONTROL_CONFORMANCE_LEVEL,
-      checks: [...ACTION_CONTROL_CONFORMANCE_CHECKS],
-      ...(action.conformance || {}),
-    },
-  };
-  if (action.quorum) out.quorum = cloneJson(action.quorum);
-  if (action.business_authorization || action.businessAuthorization) {
-    out.business_authorization = cloneJson(action.business_authorization || action.businessAuthorization);
-  }
-  return out;
-}
-
-export function createDefaultActionControlManifest({
-  service = {},
-  includePassThrough = true,
-  extraActions = [],
-} = {}) {
-  const actions = [
-    ...HIGH_RISK_ACTION_PACKS.map(toActionControl),
-    ...(includePassThrough ? DEFAULT_PASS_THROUGH_ACTIONS.map(toActionControl) : []),
-    ...extraActions.map(toActionControl),
-  ];
-  return {
-    '@version': ACTION_CONTROL_MANIFEST_VERSION,
-    '$schema': ACTION_CONTROL_SCHEMA_URL,
-    profile: 'agent-action-control',
-    service: {
-      name: service.name || 'EMILIA Gate default action controls',
-      issuer: service.issuer || 'https://www.emiliaprotocol.ai',
-      manifest_url: service.manifest_url || 'https://www.emiliaprotocol.ai/.well-known/agent-action-control.json',
-      ...service,
-    },
-    defaults: { ...ACTION_CONTROL_DEFAULTS },
-    evidence_profiles: { ...ACTION_CONTROL_EVIDENCE_PROFILES },
-    actions,
-  };
-}
-
-function selectorMatches(match = {}, selector = {}) {
-  if (!match || typeof match !== 'object') return false;
-  return Object.entries(match).every(([k, v]) => selector[k] === v);
-}
-
-export function findActionControl(manifest, selector = {}) {
-  if (!manifest || !Array.isArray(manifest.actions)) return null;
-  return manifest.actions.find((action) => {
-    if (selector.action_type && action.action_type === selector.action_type) return true;
-    return selectorMatches(action.match, selector);
-  }) || null;
-}
-
-export function validateActionControlManifest(manifest) {
-  const errors = [];
-  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
-    return { ok: false, errors: ['manifest must be an object'] };
-  }
-  if (manifest['@version'] !== ACTION_CONTROL_MANIFEST_VERSION) {
-    errors.push(`@version must be ${ACTION_CONTROL_MANIFEST_VERSION}`);
-  }
-  if (manifest.profile !== 'agent-action-control' && manifest.profile !== 'emilia.action-control') {
-    errors.push('profile must be agent-action-control (or the deployed alias emilia.action-control)');
-  }
-  if (!manifest.service || typeof manifest.service !== 'object') {
-    errors.push('service object is required');
-  }
-  if (!manifest.defaults || typeof manifest.defaults !== 'object') {
-    errors.push('defaults object is required');
-  }
-  if (!Array.isArray(manifest.actions) || manifest.actions.length === 0) {
-    errors.push('actions must be a non-empty array');
-  }
-  for (const [idx, action] of (manifest.actions || []).entries()) {
-    const prefix = `actions[${idx}]`;
-    if (!action || typeof action !== 'object') {
-      errors.push(`${prefix} must be an object`);
-      continue;
-    }
-    if (!action.id || typeof action.id !== 'string') errors.push(`${prefix}.id is required`);
-    if (!action.action_type || typeof action.action_type !== 'string') errors.push(`${prefix}.action_type is required`);
-    if (!action.match || typeof action.match !== 'object') errors.push(`${prefix}.match is required`);
-    if (typeof action.receipt_required !== 'boolean') errors.push(`${prefix}.receipt_required must be boolean`);
-    if (!RISK_LEVELS.has(action.risk)) errors.push(`${prefix}.risk must be low|medium|high|critical`);
-    if (!ASSURANCE_CLASSES.has(action.assurance_class)) errors.push(`${prefix}.assurance_class must be software|class_a|quorum`);
-    // Key-class floor: a critical action must be bound to a human key. normalizeAssurance()
-    // defaults a missing or unrecognized tier to the weakest 'software', so this also fails
-    // closed on a critical action whose tier was omitted rather than silently downgrading it.
-    if (action.receipt_required && action.risk === 'critical' && action.assurance_class === 'software') {
-      errors.push(`${prefix}.assurance_class must be class_a or quorum when risk is critical`);
-    }
-    if (action.receipt_required) {
-      if (!Number.isFinite(action.max_age_sec) || action.max_age_sec <= 0) errors.push(`${prefix}.max_age_sec must be positive`);
-      const control = action.control;
-      if (!control || typeof control !== 'object') {
-        errors.push(`${prefix}.control is required when receipt_required=true`);
-        continue;
-      }
-      if (!ENFORCEMENT_POINTS.has(control.enforcement_point)) {
-        errors.push(`${prefix}.control.enforcement_point must be pre_execution or pre_effect_commit`);
-      }
-      if (control.status !== 428) errors.push(`${prefix}.control.status must be 428`);
-      if (control.authorization_receipt?.required !== true) errors.push(`${prefix}.control.authorization_receipt.required must be true`);
-      if (control.authorization_receipt?.profile !== 'EP-RECEIPT-v1') errors.push(`${prefix}.control.authorization_receipt.profile must be EP-RECEIPT-v1`);
-      if (control.authorization_receipt?.verifier !== 'offline') errors.push(`${prefix}.control.authorization_receipt.verifier must be offline`);
-      if (control.replay?.mode !== 'one_time_consumption') errors.push(`${prefix}.control.replay.mode must be one_time_consumption`);
-      if (control.replay?.receipt_id_required !== true) errors.push(`${prefix}.control.replay.receipt_id_required must be true`);
-      const fields = control.execution_binding?.required_fields;
-      if (control.execution_binding?.required !== true) errors.push(`${prefix}.control.execution_binding.required must be true`);
-      if (control.execution_binding?.source !== 'system_of_record') errors.push(`${prefix}.control.execution_binding.source must be system_of_record`);
-      if (!Array.isArray(fields) || fields.length === 0 || fields.some((f) => typeof f !== 'string' || !f)) {
-        errors.push(`${prefix}.control.execution_binding.required_fields must be a non-empty string array`);
-      }
-      if (control.evidence_output?.execution_attestation !== true) errors.push(`${prefix}.control.evidence_output.execution_attestation must be true`);
-      if (control.evidence_output?.reliance_packet !== true) errors.push(`${prefix}.control.evidence_output.reliance_packet must be true`);
-      if (action.conformance?.level !== ACTION_CONTROL_CONFORMANCE_LEVEL) errors.push(`${prefix}.conformance.level must be ${ACTION_CONTROL_CONFORMANCE_LEVEL}`);
-      if (action.business_authorization !== undefined) {
-        const business = action.business_authorization;
-        const policy = business?.policy;
-        const approvers = business?.allowed_approvers;
-        if (!business || typeof business !== 'object' || Array.isArray(business)) {
-          errors.push(`${prefix}.business_authorization must be an object`);
-        } else {
-          if (!policy || typeof policy !== 'object' || Array.isArray(policy)
-              || typeof policy.id !== 'string' || !policy.id
-              || typeof policy.hash !== 'string' || !policy.hash) {
-            errors.push(`${prefix}.business_authorization.policy must pin non-empty id and hash`);
-          }
-          if (typeof business.tenant_id !== 'string' || !business.tenant_id) {
-            errors.push(`${prefix}.business_authorization.tenant_id must be a non-empty string`);
-          }
-          if (!Array.isArray(approvers) || approvers.length === 0
-              || approvers.some((entry) => !entry || typeof entry !== 'object'
-                || typeof entry.subject !== 'string' || !entry.subject
-                || typeof entry.role !== 'string' || !entry.role)) {
-            errors.push(`${prefix}.business_authorization.allowed_approvers must name subject and role`);
-          }
-        }
-      }
-    }
-  }
-  return { ok: errors.length === 0, errors };
-}
-
-export default {
-  ACTION_CONTROL_MANIFEST_VERSION,
-  ACTION_CONTROL_SCHEMA_URL,
-  ACTION_CONTROL_CONFORMANCE_LEVEL,
-  ACTION_CONTROL_DEFAULTS,
-  ACTION_CONTROL_EVIDENCE_PROFILES,
-  ACTION_CONTROL_CONFORMANCE_CHECKS,
-  toActionControl,
-  createDefaultActionControlManifest,
-  findActionControl,
-  validateActionControlManifest,
-};
+// Compatibility entry point for the TypeScript action-control manifest.
+export * from './dist/action-control-manifest.js';
+export { default } from './dist/action-control-manifest.js';