@emilia-protocol/gate 0.16.1 → 0.18.1

package/CHANGELOG.md

@@ -4,6 +4,71 @@
 All notable changes to `@emilia-protocol/gate` are documented here.
 This package follows [Semantic Versioning](https://semver.org/).
 
+## 0.18.1 (2026-07-27)
+
+### Fixed
+
+- Repinned the release dependency to the exact published
+  `@emilia-protocol/verify@3.16.0` registry tarball. No runtime or API behavior
+  changed from 0.18.0; the protected 0.18.0 tag was never published.
+
+## 0.18.0 (2026-07-26)
+
+### Added
+
+- `./gate-qualification-v2`, with pure qualification/AEB/AEC/local-policy
+  composition plus shadow, enforcement, and evidence-only reconciliation
+  orchestration around a protected adapter.
+- `./admission-store`, a unified immutable admission snapshot, CAS-owned
+  lifecycle, one-time execution right, operation/resource fencing,
+  predecessor-digest journal, supersession, and remedy reference contract.
+- `./admission-store-postgres`, a deployment-bound PostgreSQL RPC adapter for
+  the unified store with single-tenant construction, exact output validation,
+  bounded transaction retries, and ambiguous-begin readback handling.
+- Root-package re-exports, generated declarations, compatibility entry points,
+  and focused package tests for the qualification and admission modules.
+
+### Security
+
+- Qualification remains non-authorizing and cannot replace AEB, AEC, or the
+  relying party's local authorization policy.
+- Authority is consumed before provider entry; uncertain outcomes remain
+  reconciliation-required and cannot be blindly retried.
+- The checked-in memory store is an explicit test-only, non-durable reference.
+  The orchestrator and PostgreSQL adapter consume the canonical unified
+  `AdmissionStore` contract.
+- Enforcement requires authoritative immediate remeasurement of the candidate,
+  qualification status, AEB, AEC, local policy, and protected request before
+  transactional consumption. It also requires protected restart-safe custody
+  for owner and reconciliation capabilities; memory custody is test-only.
+- Qualification decisions bind the exact protected-request digest and cannot
+  be replayed across another otherwise-valid admission.
+- The PostgreSQL adapter is a single-tenant public reference. Managed
+  tenant-principal mapping, deployment migrations, federated atomicity, and
+  managed service operation are not claimed.
+
+## 0.17.0 (2026-07-26)
+
+### Added
+
+- `./autonomy-control-plane-profile`, a closed compiler from a human-signed
+  root objective into one existing Gate Trust Program per exact child action.
+- Typed containment for child actions, audiences, expiries, per-child and
+  aggregate sibling budgets, exact code-diff bindings, independent
+  proposer/evaluator/executor roles, pinned fitness evidence, bounded canary
+  promotion, current suspension status, and separately authorized rollback.
+- A bounded TLA+ model and deliberately unsafe self-expansion configuration;
+  the safe model checks authority conservation while the negative control
+  falsifies it when an agent can grant itself a new action and budget.
+
+### Security
+
+- Unknown profile fields, cyclic goal derivation, role collapse, stale or
+  unpinned fitness/status evidence, promotion without canary evidence, and
+  rollback under a reused CAID fail closed.
+- The claim boundary explicitly excludes natural-language goal entailment,
+  provider truth, test adequacy, clocks, storage, and deployment completion.
+
 ## 0.16.1 (2026-07-26)
 
 ### Fixed

package/README.md

@@ -59,6 +59,57 @@ if (!out.ok) throw out.body; // 428 Receipt Required
 console.log(out.packet.verdict); // "rely"
 ```
 
+## Gate Qualification v2
+
+Gate Qualification v2 treats model or agent qualification as one input to a
+consequence-owning Gate. Qualification never substitutes for AEB, AEC, or the
+relying party's local authorization policy.
+
+```js
+import {
+  GateQualificationV2,
+  composeQualificationDecisionV2,
+  createMemoryInvocationAuthorityCustodyV2,
+} from '@emilia-protocol/gate/gate-qualification-v2';
+import {
+  createAdmissionSnapshot,
+  createMemoryAdmissionStore,
+} from '@emilia-protocol/gate/admission-store';
+import {
+  createAdmissionPostgresStore,
+} from '@emilia-protocol/gate/admission-store-postgres';
+```
+
+`composeQualificationDecisionV2()` is pure and non-mutating. In enforcement
+mode, `GateQualificationV2` requires matching qualification, AEB, AEC, and
+local-policy legs. It requires an authoritative invocation remeasurement and
+protected restart-safe capability custody, then atomically consumes authority
+before entering a caller-supplied protected adapter. Provider commitment and observed effect remain separately
+authenticated facts; an uncertain outcome stays reconciliation-required and
+cannot be retried as fresh work.
+
+`createMemoryAdmissionStore()` is a test-only, non-durable, single-process
+reference for the unified immutable snapshot, CAS-owned lifecycle, operation
+and resource fencing, journal, supersession, and remedy contracts.
+It refuses `beginInvocation()` without an explicit currentness oracle;
+`createMemoryInvocationAuthorityCustodyV2()` is likewise test-only and
+non-durable.
+`GateQualificationV2` consumes that canonical `AdmissionStore` contract and
+requires both a durable production store and durable protected authority
+custody unless explicitly constructed for tests.
+
+`createAdmissionPostgresStore()` is a deployment-bound, locally atomic and
+durable adapter to an externally installed PostgreSQL RPC contract. Each store
+instance is bound to exactly one deployment and one tenant. This public
+reference does not provide or claim managed tenant-principal mapping, a
+deployment migration, cross-tenant operation, federated atomicity, or managed
+service operation; callers remain responsible for database roles, RPC
+installation, backups, monitoring, and recovery procedures.
+
+A `QUALIFIED` verifier result by itself is non-authorizing. It does not grant
+permission, reserve or consume authority, invoke a provider, or establish
+legality or business suitability.
+
 ## Proposal to effect
 
 `@emilia-protocol/gate/proposal-to-effect` closes the loop from an agent's
@@ -750,3 +801,17 @@ conformance infrastructure. `createPostgresAuthorityAllocationStore()` and
 `AUTHORITY_ALLOCATION_DDL` define the durable transactional boundary; they are
 reference code and a database contract, not evidence that any deployment uses
 or correctly operates that boundary.
+
+## Autonomy Control Plane
+
+`@emilia-protocol/gate/autonomy-control-plane-profile` compiles a closed,
+human-rooted autonomy profile into one existing Gate Trust Program per exact
+child action. It rejects action/audience/expiry widening, aggregate sibling
+budget expansion, cyclic goals, proposer/evaluator/executor role collapse,
+unpinned fitness evidence, promotion without a bounded canary, stale status,
+and rollback without a new CAID and authorization policy.
+
+The compiler validates typed authority and evidence bindings. It does not infer
+natural-language goal entailment or prove that tests, providers, storage,
+clocks, deployments, or humans are truthful. See
+`docs/protocol/autonomy-control-plane-profile-v1.md` for the complete boundary.

package/admission-store-postgres.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the deployment-bound PostgreSQL admission store.
+export * from './dist/admission-store-postgres.js';
+export { default } from './dist/admission-store-postgres.js';

package/admission-store.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the unified Gate Qualification v2 admission store.
+export * from './dist/admission-store.js';
+export { default } from './dist/admission-store.js';

package/autonomy-control-plane-profile.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+export * from './dist/autonomy-control-plane-profile.js';

package/dist/admission-store-postgres.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Deployment-bound PostgreSQL Admission Store.
+ *
+ * Every mutation is one PostgreSQL function call.  The SQL functions use
+ * explicit row locks and permanent unique fences; this adapter retries only
+ * SQLSTATE 40001 (serialization failure) and 40P01 (deadlock), with the same
+ * caller-generated capabilities.  It never retries an ambiguous provider
+ * effect.  A lost beginInvocation acknowledgement is recovered only when an
+ * authoritative read proves that this exact invocation-token digest committed.
+ */
+import { type AdmissionStore } from './admission-store.js';
+export interface AdmissionPostgresQueryResult {
+    rowCount: number;
+    rows?: Array<Record<string, unknown>>;
+}
+export type AdmissionPostgresQuery = (text: string, params: readonly unknown[]) => Promise<AdmissionPostgresQueryResult>;
+export interface CreateAdmissionPostgresStoreOptions {
+    query: AdmissionPostgresQuery;
+    deploymentId: string;
+    tenantId: string;
+    /** Test seam only. Production callers should use the cryptographic default. */
+    ownerTokenFactory?: () => string;
+    /** Test seam only. Production callers should use the cryptographic default. */
+    invocationTokenFactory?: () => string;
+    /** Number of retries after the first attempt for SQLSTATE 40001/40P01. */
+    maxTransactionRetries?: number;
+}
+export interface AdmissionPostgresStore extends AdmissionStore {
+    readonly guaranteeClass: 'local_atomic';
+    readonly singleTenant: true;
+    readonly deploymentBound: true;
+    readonly managedTenantPrincipalMapping: false;
+    readonly maxTransactionRetries: number;
+}
+export declare const ADMISSION_POSTGRES_SQL: Readonly<{
+    reserve: "SELECT public.ep_gate_admission_reserve($1::text, $2::text, $3::jsonb, $4::text) AS result";
+    release: "SELECT public.ep_gate_admission_release($1::text, $2::text, $3::text, $4::bigint, $5::text, $6::text) AS result";
+    expire: "SELECT public.ep_gate_admission_expire($1::text, $2::text, $3::text, $4::bigint, $5::text) AS result";
+    supersede: "SELECT public.ep_gate_admission_supersede($1::text, $2::text, $3::text, $4::bigint, $5::text, $6::jsonb, $7::text) AS result";
+    beginInvocation: "SELECT public.ep_gate_admission_begin_invocation($1::text, $2::text, $3::text, $4::bigint, $5::text, $6::text) AS result";
+    recoverIndeterminate: "SELECT public.ep_gate_admission_recover_indeterminate($1::text, $2::text, $3::text, $4::text, $5::text) AS result";
+    recordProviderOutcome: "SELECT public.ep_gate_admission_record_provider_outcome($1::text, $2::text, $3::text, $4::bigint, $5::text, $6::text, $7::text, $8::text, $9::text) AS result";
+    recordEffectRelation: "SELECT public.ep_gate_admission_record_effect_relation($1::text, $2::text, $3::text, $4::bigint, $5::text, $6::text, $7::text, $8::text, $9::text) AS result";
+    read: "SELECT public.ep_gate_admission_read($1::text, $2::text, $3::text) AS result";
+    readByOperation: "SELECT public.ep_gate_admission_read_by_operation($1::text, $2::text, $3::text) AS result";
+    readSnapshot: "SELECT public.ep_gate_admission_read_snapshot($1::text, $2::text, $3::text) AS result";
+    journal: "SELECT public.ep_gate_admission_journal($1::text, $2::text, $3::text) AS result";
+    checkInvariants: "SELECT public.ep_gate_admission_check_invariants($1::text, $2::text) AS result";
+}>;
+export declare class AdmissionPostgresProtocolError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare class AdmissionPostgresAmbiguousBeginError extends Error {
+    readonly admissionId: string;
+    constructor(admissionId: string, message: string, options?: ErrorOptions);
+}
+/**
+ * Creates a durable single-tenant store bound to one installed deployment row.
+ * The SQL deliberately has no session-user-to-tenant mapping: database access
+ * is the deployment boundary and every RPC rechecks the singleton binding.
+ */
+export declare function createAdmissionPostgresStore(options: CreateAdmissionPostgresStoreOptions): AdmissionPostgresStore;
+/** Compatibility alias following the noun-first naming used by some stores. */
+export declare const createPostgresAdmissionStore: typeof createAdmissionPostgresStore;
+export default createAdmissionPostgresStore;
+//# sourceMappingURL=admission-store-postgres.d.ts.map

package/dist/admission-store-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-store-postgres.d.ts","sourceRoot":"","sources":["../src/admission-store-postgres.ts"],"names":[],"mappings":"AACA;;;;;;;;;GASG;AAIH,OAAO,EAoBL,KAAK,cAAc,EAIpB,MAAM,sBAAsB,CAAC;AAI9B,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,sBAAsB,GAAG,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,OAAO,EAAE,KACvB,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAE3C,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,sBAAsB,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,+EAA+E;IAC/E,sBAAsB,CAAC,EAAE,MAAM,MAAM,CAAC;IACtC,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,QAAQ,CAAC,6BAA6B,EAAE,KAAK,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;EAcjC,CAAC;AAQH,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED,qBAAa,oCAAqC,SAAQ,KAAK;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBACjB,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAKzE;AAoMD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,mCAAmC,GAC3C,sBAAsB,CA0XxB;AAED,+EAA+E;AAC/E,eAAO,MAAM,4BAA4B,qCAA+B,CAAC;AAEzE,eAAe,4BAA4B,CAAC"}