@emilia-protocol/gate 0.18.2 → 0.20.0

package/src/gate-qualification-v2.ts

@@ -6,6 +6,7 @@
  * immutable AdmissionSnapshot may cross the one-time invocation boundary.
  */
 
+import crypto from 'node:crypto';
 import { createAdmissionSnapshot } from './admission-store.js';
 import type {
   AdmissionSnapshot,
@@ -30,6 +31,14 @@ const REQUIRED_QUALIFICATION_CHECKS = Object.freeze([
   'assignment_in_scope',
   'protected_request_bound',
 ] as const);
+const GATE_QUALIFICATION_V2_PROGRAM_DIGEST = `sha256:${crypto
+  .createHash('sha256')
+  .update(JSON.stringify({
+    version: GATE_QUALIFICATION_V2_VERSION,
+    checks: REQUIRED_QUALIFICATION_CHECKS,
+    requirements: ['qualification', 'aeb', 'aec', 'local_policy'],
+  }))
+  .digest('hex')}` as const;
 const DEFAULT_ADAPTER_TIMEOUT_MS = 30_000;
 const MAX_ADAPTER_TIMEOUT_MS = 300_000;
 
@@ -56,6 +65,8 @@ export interface BoundRequirementDecisionV2 {
 export interface BoundLocalPolicyDecisionV2 {
   readonly decision: 'allow' | 'deny';
   readonly policyId: string;
+  /** Digest of the relying-party authorization policy that made this decision. */
+  readonly policyDigest?: AdmissionDigestV2;
   readonly caid: string;
   readonly actionDigest: AdmissionDigestV2;
   readonly evidenceDigest: AdmissionDigestV2;
@@ -85,6 +96,7 @@ export interface GateQualificationDecisionV2 {
   readonly caid: string;
   readonly actionDigest: string;
   readonly snapshotDigest: string;
+  readonly programDigest: AdmissionDigestV2;
   readonly effectKey: string;
   readonly requirements: Readonly<{
     qualificationEvidenceDigest: string;
@@ -222,6 +234,7 @@ export type GateQualificationExecutionResultV2 =
   | {
       readonly status: 'refused';
       readonly reason: string;
+      readonly programDigest: AdmissionDigestV2;
       readonly decision?: Readonly<GateQualificationDecisionV2>;
     }
   | {
@@ -505,6 +518,11 @@ function validateLocalPolicy(
   if (!validString(leg.policyId)) {
     addReason(reasons, 'localPolicy_policy_missing');
   }
+  if (!validDigest(leg.policyDigest)) {
+    addReason(reasons, 'localPolicy_program_digest_missing');
+  } else if (leg.policyDigest !== snapshot.body.authorization_policy_digest) {
+    addReason(reasons, 'localPolicy_program_digest_mismatch');
+  }
   if (leg.caid !== snapshot.body.caid
       || leg.actionDigest !== snapshot.body.action_digest) {
     addReason(reasons, 'localPolicy_binding_mismatch');
@@ -580,6 +598,7 @@ function emptyDecision(reasons: readonly string[]): GateQualificationDecisionV2
     caid: '',
     actionDigest: '',
     snapshotDigest: '',
+    programDigest: GATE_QUALIFICATION_V2_PROGRAM_DIGEST,
     effectKey: '',
     requirements: deepFreeze({
       qualificationEvidenceDigest: '',
@@ -613,6 +632,7 @@ function composeCanonical(
     caid: snapshot.body.caid,
     actionDigest: snapshot.body.action_digest,
     snapshotDigest: snapshot.snapshot_digest,
+    programDigest: snapshot.body.authorization_policy_digest,
     effectKey: actuationKey(snapshot),
     requirements: deepFreeze({
       qualificationEvidenceDigest:
@@ -785,6 +805,20 @@ function reconciliationRequired(
   return deepFreeze({ status: 'reconciliation_required', reason, admissionId });
 }
 
+function refused(
+  reason: string,
+  decision?: Readonly<GateQualificationDecisionV2>,
+  programDigest: AdmissionDigestV2 = decision?.programDigest
+    ?? GATE_QUALIFICATION_V2_PROGRAM_DIGEST,
+): Readonly<GateQualificationExecutionResultV2> {
+  return deepFreeze({
+    status: 'refused',
+    reason,
+    programDigest,
+    ...(decision ? { decision } : {}),
+  });
+}
+
 export class GateQualificationV2 {
   readonly mode: QualificationModeV2;
   readonly #store?: AdmissionStore;
@@ -1022,7 +1056,7 @@ export class GateQualificationV2 {
     decision: Readonly<GateQualificationDecisionV2>,
   ): Promise<GateQualificationExecutionResultV2> {
     if (storeReason !== 'admission_exists') {
-      return deepFreeze({ status: 'refused', reason: storeReason, decision });
+      return refused(storeReason, decision);
     }
     try {
       const record = await this.#store!.read(reference(snapshot));
@@ -1037,7 +1071,7 @@ export class GateQualificationV2 {
         'admission_read_ambiguous',
       );
     }
-    return deepFreeze({ status: 'refused', reason: storeReason, decision });
+    return refused(storeReason, decision);
   }
 
   async #verifyProviderEvidence(
@@ -1228,11 +1262,10 @@ export class GateQualificationV2 {
       : emptyDecision(['admission_snapshot_invalid']);
     if (this.mode === 'shadow') return this.#shadow(input, decision);
     if (!checked.ok || !decision.allow) {
-      return deepFreeze({
-        status: 'refused',
-        reason: decision.reasons[0] ?? 'qualification_refused',
+      return refused(
+        decision.reasons[0] ?? 'qualification_refused',
         decision,
-      });
+      );
     }
 
     const snapshot = checked.snapshot;
@@ -1240,11 +1273,7 @@ export class GateQualificationV2 {
     try {
       reserved = await this.#store!.reserve(snapshot);
     } catch {
-      return deepFreeze({
-        status: 'refused',
-        reason: 'admission_reserve_failed',
-        decision,
-      });
+      return refused('admission_reserve_failed', decision);
     }
     if (!reserved.ok) {
       return this.#existingAdmissionResult(snapshot, reserved.reason, decision);
@@ -1263,11 +1292,7 @@ export class GateQualificationV2 {
       } catch {
         // No provider entry occurred; the reservation remains closed.
       }
-      return deepFreeze({
-        status: 'refused',
-        reason: 'reserve_snapshot_mismatch',
-        decision,
-      });
+      return refused('reserve_snapshot_mismatch', decision);
     }
 
     // Reread the candidate, qualification status, AEB, AEC, local policy and
@@ -1290,11 +1315,7 @@ export class GateQualificationV2 {
       } catch {
         // No execution right was consumed and no provider entry occurred.
       }
-      return deepFreeze({
-        status: 'refused',
-        reason: 'invocation_remeasurement_failed',
-        decision,
-      });
+      return refused('invocation_remeasurement_failed', decision);
     }
     const refreshedDecision = composeCanonical(
       reserved.snapshot,
@@ -1310,12 +1331,10 @@ export class GateQualificationV2 {
       } catch {
         // No execution right was consumed and no provider entry occurred.
       }
-      return deepFreeze({
-        status: 'refused',
-        reason: refreshedDecision.reasons[0]
-          ?? 'invocation_remeasurement_refused',
-        decision: refreshedDecision,
-      });
+      return refused(
+        refreshedDecision.reasons[0] ?? 'invocation_remeasurement_refused',
+        refreshedDecision,
+      );
     }
 
     let begun: Awaited<ReturnType<AdmissionStore['beginInvocation']>>;
@@ -1333,11 +1352,7 @@ export class GateQualificationV2 {
           || begun.reason === 'revision_conflict') {
         return this.#beginAmbiguity(reserved.snapshot, reserved.owner_token);
       }
-      return deepFreeze({
-        status: 'refused',
-        reason: begun.reason,
-        decision,
-      });
+      return refused(begun.reason, decision);
     }
 
     const begunSnapshot = canonicalSnapshot(begun.snapshot);
@@ -1404,14 +1419,11 @@ export class GateQualificationV2 {
     >>,
   ): Promise<GateQualificationExecutionResultV2> {
     if (this.mode !== 'enforce') {
-      return deepFreeze({
-        status: 'refused',
-        reason: 'reconciliation_unavailable_in_shadow',
-      });
+      return refused('reconciliation_unavailable_in_shadow');
     }
     if (!input || !validString(input.tenant_id)
         || !validString(input.admission_id)) {
-      return deepFreeze({ status: 'refused', reason: 'admission_reference_invalid' });
+      return refused('admission_reference_invalid');
     }
 
     let record: StoreRecordV2 | null;
@@ -1424,13 +1436,10 @@ export class GateQualificationV2 {
       );
     }
     if (!record) {
-      return deepFreeze({ status: 'refused', reason: 'admission_not_found' });
+      return refused('admission_not_found');
     }
     if (record.execution_right !== 'CONSUMED') {
-      return deepFreeze({
-        status: 'refused',
-        reason: 'reconciliation_not_required',
-      });
+      return refused('reconciliation_not_required');
     }
 
     let snapshot: Readonly<AdmissionSnapshot> | null;
@@ -1499,10 +1508,11 @@ export class GateQualificationV2 {
     const effectUnresolved = !record.effect_relation
       || record.effect_relation.value === 'INDETERMINATE';
     if (!providerUnresolved && !effectUnresolved) {
-      return deepFreeze({
-        status: 'refused',
-        reason: 'reconciliation_not_required',
-      });
+      return refused(
+        'reconciliation_not_required',
+        undefined,
+        snapshot.body.authorization_policy_digest,
+      );
     }
 
     const base = protectedInvocation(snapshot, authority.invocationToken);

package/src/index.ts

@@ -238,6 +238,13 @@ export * from './admission-store-postgres.js';
 export * from './gate-qualification-v2.js';
 export * from './referee.js';
 export * from './referee-runner.js';
+export * from './loss-allocation-schedule.js';
+export * from './action-refusal-statement.js';
+export * from './open-exposure-ledger.js';
+export * from './open-exposure-ledger-postgres.js';
+export * from './coverage-reconciliation-attestation.js';
+export * from './receipt-census.js';
+export * from './loss-experience-feed.js';
 export {
   ZK_RANGE_RECEIPT_VERSION,
   ZK_RANGE_SCHEME,

package/src/loss-allocation-schedule.ts

@@ -0,0 +1,427 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EP-LOSS-ALLOCATION-SCHEDULE-v1.
+ *
+ * A separately signed, status-gated record of responsibility terms for one
+ * relying party and one exact Reliance Program. It does not adjudicate legal
+ * liability, prove solvency or coverage, authorize an action, or move money.
+ */
+import { canonicalize } from './execution-binding.js';
+import {
+  RISK_DIGEST,
+  riskDigest,
+  riskExact,
+  riskFreeze,
+  riskIdentifier,
+  riskInstant,
+  riskRecord,
+  signRiskBody,
+  verifyRiskBody,
+  type RiskRecord,
+  type TrustedRiskKeys,
+} from './reliance-risk-crypto.js';
+
+export const LOSS_ALLOCATION_SCHEDULE_VERSION = 'EP-LOSS-ALLOCATION-SCHEDULE-v1';
+export const LOSS_ALLOCATION_SCHEDULE_CLAIM_BOUNDARY =
+  'signed_terms_not_legal_liability_adjudication_enforceability_insurance_coverage_solvency_authorization_or_payment';
+
+const SOURCE_KEYS = [
+  'schedule_id', 'relying_party_id', 'program', 'issued_at', 'valid_from',
+  'expires_at', 'status_target', 'rules', 'claim_boundary',
+] as const;
+const BODY_KEYS = ['@version', ...SOURCE_KEYS, 'issuer'] as const;
+const PROGRAM_KEYS = ['program_id', 'version', 'source_digest', 'program_digest'] as const;
+const STATUS_TARGET_KEYS = ['type', 'usage'] as const;
+const RULE_KEYS = [
+  'failure_class', 'responsible_party_id', 'allocation', 'terms_digest',
+  'dispute_endpoint',
+] as const;
+const ALLOCATION_KEYS = ['currency', 'max_amount_minor'] as const;
+const ISSUER_KEYS = ['id', 'key_id'] as const;
+const STATUS_KEYS = ['outcome', 'target_digest'] as const;
+const FAILURE_CLASS = /^[a-z][a-z0-9._-]{0,127}$/;
+const CURRENCY = /^[A-Z]{3}$/;
+const MINOR_AMOUNT = /^(0|[1-9][0-9]*)$/;
+const MAX_RULES = 256;
+const ADMISSIBILITY_VERDICTS = Object.freeze([
+  'unverifiable', 'conflicted', 'stale', 'missing_evidence', 'admissible',
+]);
+
+export interface LossAllocationProgramBinding {
+  program_id: string;
+  version: number;
+  source_digest: string;
+  program_digest: string;
+}
+
+export interface LossAllocationStatusResult {
+  outcome: 'current_not_revoked' | 'revoked' | 'unavailable';
+  target_digest: string;
+}
+
+export interface VerifyLossAllocationScheduleOptions {
+  trusted_keys?: TrustedRiskKeys;
+  expected_relying_party_id?: string;
+  expected_program?: LossAllocationProgramBinding;
+  status?: LossAllocationStatusResult;
+  now?: string | number | Date;
+}
+
+export interface LossAllocationSigner {
+  issuer_id: string;
+  key_id: string;
+  private_key: any;
+}
+
+export class LossAllocationScheduleValidationError extends TypeError {
+  readonly code: string;
+
+  constructor(code: string, message: string) {
+    super(message);
+    this.name = 'LossAllocationScheduleValidationError';
+    this.code = code;
+  }
+}
+
+function refuse(code: string, message: string): never {
+  throw new LossAllocationScheduleValidationError(code, message);
+}
+
+function validateProgram(value: unknown): value is RiskRecord {
+  return riskExact(value, PROGRAM_KEYS)
+    && riskIdentifier(value.program_id)
+    && Number.isSafeInteger(value.version) && value.version >= 1
+    && typeof value.source_digest === 'string' && RISK_DIGEST.test(value.source_digest)
+    && typeof value.program_digest === 'string' && RISK_DIGEST.test(value.program_digest);
+}
+
+function httpsEndpoint(value: unknown): boolean {
+  if (value === null) return true;
+  if (typeof value !== 'string' || value.length > 2048) return false;
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === 'https:' && parsed.username === '' && parsed.password === '';
+  } catch {
+    return false;
+  }
+}
+
+function validateRules(value: unknown): asserts value is RiskRecord[] {
+  if (!Array.isArray(value) || value.length < 1 || value.length > MAX_RULES) {
+    refuse('schedule_rules_invalid', 'loss-allocation rules must be a bounded non-empty array');
+  }
+  const classes = new Map<string, string>();
+  let previousFailureClass: string | null = null;
+  for (const rule of value) {
+    if (!riskExact(rule, RULE_KEYS)
+        || typeof rule.failure_class !== 'string' || !FAILURE_CLASS.test(rule.failure_class)
+        || !riskIdentifier(rule.responsible_party_id)
+        || !riskExact(rule.allocation, ALLOCATION_KEYS)
+        || typeof rule.allocation.currency !== 'string' || !CURRENCY.test(rule.allocation.currency)
+        || typeof rule.allocation.max_amount_minor !== 'string'
+        || !MINOR_AMOUNT.test(rule.allocation.max_amount_minor)
+        || typeof rule.terms_digest !== 'string' || !RISK_DIGEST.test(rule.terms_digest)
+        || !httpsEndpoint(rule.dispute_endpoint)) {
+      refuse('failure_rule_invalid', 'failure rule or decimal monetary allocation is invalid');
+    }
+    const canonicalRule = canonicalize(rule);
+    const previous = classes.get(rule.failure_class);
+    if (previous !== undefined) {
+      refuse(previous === canonicalRule ? 'duplicate_failure_rule' : 'conflicting_failure_rule',
+        'duplicate or conflicting failure class is not allowed');
+    }
+    if (previousFailureClass !== null && previousFailureClass > rule.failure_class) {
+      refuse('rules_not_canonical_order', 'failure rules must be strictly ordered by ASCII failure class');
+    }
+    previousFailureClass = rule.failure_class;
+    classes.set(rule.failure_class, canonicalRule);
+  }
+}
+
+function validateTimes(value: RiskRecord): void {
+  const issuedAt = riskInstant(value.issued_at);
+  const validFrom = riskInstant(value.valid_from);
+  const expiresAt = riskInstant(value.expires_at);
+  if (!Number.isFinite(issuedAt) || !Number.isFinite(validFrom) || !Number.isFinite(expiresAt)
+      || expiresAt <= validFrom || issuedAt > expiresAt) {
+    refuse('schedule_validity_invalid', 'schedule issuance and validity window are invalid');
+  }
+}
+
+function validateSource(value: unknown): asserts value is RiskRecord {
+  try {
+    canonicalize(value);
+  } catch {
+    refuse('schedule_not_canonical', 'loss-allocation source is not canonicalizable JSON');
+  }
+  if (!riskExact(value, SOURCE_KEYS)
+      || !riskIdentifier(value.schedule_id)
+      || !riskIdentifier(value.relying_party_id)
+      || !validateProgram(value.program)
+      || !riskExact(value.status_target, STATUS_TARGET_KEYS)
+      || value.status_target.type !== 'loss-allocation-schedule'
+      || value.status_target.usage !== 'reliance') {
+    refuse('schedule_schema_invalid', 'loss-allocation source is not a closed v1 object');
+  }
+  validateTimes(value);
+  validateRules(value.rules);
+  if (value.claim_boundary !== LOSS_ALLOCATION_SCHEDULE_CLAIM_BOUNDARY) {
+    refuse('claim_boundary_invalid', 'loss-allocation claim boundary is missing or changed');
+  }
+}
+
+function validateBody(value: unknown): asserts value is RiskRecord {
+  try {
+    canonicalize(value);
+  } catch {
+    refuse('schedule_not_canonical', 'signed loss-allocation body is not canonicalizable JSON');
+  }
+  if (!riskExact(value, BODY_KEYS)
+      || value['@version'] !== LOSS_ALLOCATION_SCHEDULE_VERSION
+      || !riskExact(value.issuer, ISSUER_KEYS)
+      || !riskIdentifier(value.issuer.id)
+      || !riskIdentifier(value.issuer.key_id)) {
+    refuse('schedule_schema_invalid', 'signed loss-allocation body is not a closed v1 object');
+  }
+  const { '@version': _version, issuer: _issuer, ...source } = value;
+  validateSource(source);
+}
+
+function signedParts(artifact: unknown): { artifact: RiskRecord; body: RiskRecord } {
+  if (!riskRecord(artifact) || !riskRecord(artifact.proof)) {
+    refuse('artifact_shape_invalid', 'signed loss-allocation artifact is malformed');
+  }
+  const { proof: _proof, ...body } = artifact;
+  validateBody(body);
+  return { artifact, body };
+}
+
+function verificationTime(value: unknown): number {
+  if (value === undefined) return Date.now();
+  if (value instanceof Date) return value.getTime();
+  if (typeof value === 'number') return Number.isFinite(value) ? value : NaN;
+  return riskInstant(value);
+}
+
+function sameProgram(actual: RiskRecord, expected: LossAllocationProgramBinding): boolean {
+  return actual.program_id === expected.program_id
+    && actual.version === expected.version
+    && actual.source_digest === expected.source_digest
+    && actual.program_digest === expected.program_digest;
+}
+
+/** Digest of the complete signed artifact, including its proof. */
+export function lossAllocationScheduleDigest(artifact: unknown): string {
+  const signed = signedParts(artifact);
+  return riskDigest(signed.artifact);
+}
+
+/** Digest of the exact versioned failure-class rules, excluding program pins. */
+export function lossAllocationRulesDigest(artifact: unknown): string {
+  const signed = signedParts(artifact);
+  return riskDigest({
+    '@version': LOSS_ALLOCATION_SCHEDULE_VERSION,
+    rules: signed.body.rules,
+  });
+}
+
+/**
+ * Compact digest pin for an RP-owned Admissibility Profile. Status remains a
+ * separate required input; this reference does not claim global freshness.
+ */
+export function lossAllocationScheduleProfileReference(artifact: unknown): RiskRecord {
+  return riskFreeze({
+    artifact_type: LOSS_ALLOCATION_SCHEDULE_VERSION,
+    artifact_digest: lossAllocationScheduleDigest(artifact),
+    required_status: true,
+  });
+}
+
+/** Sign a closed schedule under the shared JCS/Ed25519 risk-artifact proof. */
+export function signLossAllocationSchedule(
+  input: unknown,
+  signer: LossAllocationSigner,
+): RiskRecord {
+  validateSource(input);
+  if (!riskRecord(signer)
+      || !riskIdentifier(signer.issuer_id)
+      || !riskIdentifier(signer.key_id)
+      || !Object.hasOwn(signer, 'private_key')) {
+    refuse('signing_key_invalid', 'loss-allocation signer is invalid');
+  }
+  const body = {
+    '@version': LOSS_ALLOCATION_SCHEDULE_VERSION,
+    ...(input as RiskRecord),
+    issuer: { id: signer.issuer_id, key_id: signer.key_id },
+  };
+  validateBody(body);
+  try {
+    return signRiskBody(LOSS_ALLOCATION_SCHEDULE_VERSION, body, signer);
+  } catch {
+    refuse('signing_key_invalid', 'loss-allocation signing key must be Ed25519');
+  }
+}
+
+/** Verify signature, RP/program pins, external current status, and validity. */
+export function verifyLossAllocationSchedule(
+  artifact: unknown,
+  options: VerifyLossAllocationScheduleOptions = {},
+): RiskRecord {
+  const fail = (
+    reason: string,
+    verified = false,
+    scheduleDigest: string | null = null,
+  ) => ({
+    accepted: false,
+    verified,
+    reason,
+    schedule_digest: scheduleDigest,
+    rules_digest: null,
+    claim_boundary: LOSS_ALLOCATION_SCHEDULE_CLAIM_BOUNDARY,
+  });
+
+  const signed = verifyRiskBody(
+    artifact,
+    LOSS_ALLOCATION_SCHEDULE_VERSION,
+    options.trusted_keys,
+  );
+  if (!signed.valid || !signed.body || !signed.artifact_digest) {
+    return fail(signed.reason ?? 'schedule_invalid');
+  }
+  try {
+    validateBody(signed.body);
+  } catch (error) {
+    return fail(error instanceof LossAllocationScheduleValidationError
+      ? error.code : 'schedule_schema_invalid');
+  }
+  const body = signed.body;
+  const artifactDigest = signed.artifact_digest;
+
+  if (!riskExact(options.status, STATUS_KEYS)
+      || typeof options.status.target_digest !== 'string'
+      || !RISK_DIGEST.test(options.status.target_digest)) {
+    return fail('schedule_status_required', true, artifactDigest);
+  }
+  if (options.status.target_digest !== artifactDigest) {
+    return fail('status_target_mismatch', true, artifactDigest);
+  }
+  if (options.status.outcome === 'revoked') {
+    return fail('schedule_revoked', true, artifactDigest);
+  }
+  if (options.status.outcome !== 'current_not_revoked') {
+    return fail('schedule_status_not_current', true, artifactDigest);
+  }
+
+  const now = verificationTime(options.now);
+  if (!Number.isFinite(now)) return fail('verification_time_invalid', true, artifactDigest);
+  if (now < riskInstant(body.issued_at)) {
+    return fail('schedule_not_yet_issued', true, artifactDigest);
+  }
+  if (now < riskInstant(body.valid_from)) {
+    return fail('schedule_not_yet_valid', true, artifactDigest);
+  }
+  if (now >= riskInstant(body.expires_at)) {
+    return fail('schedule_stale', true, artifactDigest);
+  }
+
+  if (options.expected_relying_party_id === undefined) {
+    return fail('relying_party_binding_required', true, artifactDigest);
+  }
+  if (!riskIdentifier(options.expected_relying_party_id)
+      || options.expected_relying_party_id !== body.relying_party_id) {
+    return fail('relying_party_binding_mismatch', true, artifactDigest);
+  }
+  if (options.expected_program === undefined) {
+    return fail('program_binding_required', true, artifactDigest);
+  }
+  if (!validateProgram(options.expected_program)) {
+    return fail('expected_program_invalid', true, artifactDigest);
+  }
+  if (!sameProgram(body.program, options.expected_program)) {
+    return fail('reliance_program_binding_mismatch', true, artifactDigest);
+  }
+
+  return riskFreeze({
+    accepted: true,
+    verified: true,
+    reason: null,
+    schedule_digest: artifactDigest,
+    rules_digest: lossAllocationRulesDigest(artifact),
+    schedule_id: body.schedule_id,
+    relying_party_id: body.relying_party_id,
+    program_id: body.program.program_id,
+    program_version: body.program.version,
+    source_digest: body.program.source_digest,
+    program_digest: body.program.program_digest,
+    issuer_id: body.issuer.id,
+    key_id: body.issuer.key_id,
+    status: 'current_not_revoked',
+    claim_boundary: LOSS_ALLOCATION_SCHEDULE_CLAIM_BOUNDARY,
+  });
+}
+
+/**
+ * Build a standard self-hashed Admissibility Profile and its unchanged
+ * Reliance Program v1 profile reference. Only schedule identity, RP, issuer,
+ * and exact rules are pinned here; final program digests are deliberately
+ * excluded to avoid a profile/program/schedule digest cycle.
+ */
+export function createLossAllocationAdmissibilityProfilePin(
+  artifact: unknown,
+  {
+    profileId,
+    evaluationMaxAgeSec,
+  }: {
+    profileId: string;
+    evaluationMaxAgeSec: number;
+  },
+  verification: VerifyLossAllocationScheduleOptions,
+): RiskRecord {
+  const signed = signedParts(artifact);
+  const verified = verifyLossAllocationSchedule(artifact, verification);
+  if (verified.accepted !== true) {
+    refuse('schedule_verification_required', `cannot pin an unaccepted schedule: ${verified.reason}`);
+  }
+  if (!riskIdentifier(profileId)
+      || !Number.isSafeInteger(evaluationMaxAgeSec)
+      || evaluationMaxAgeSec < 1 || evaluationMaxAgeSec > 31_536_000) {
+    refuse('admissibility_profile_pin_invalid', 'profile id and evaluation age must be bounded');
+  }
+  const profileBody = {
+    id: profileId,
+    version: 1,
+    authored_by: signed.body.relying_party_id,
+    requires: [{
+      evidence: 'loss_allocation_schedule',
+      max_staleness_sec: evaluationMaxAgeSec,
+      checks: [
+        'signature_valid',
+        'reliance_program_binding_valid',
+        'rules_digest_matches',
+        'status_current',
+      ],
+    }],
+    verdicts: [...ADMISSIBILITY_VERDICTS],
+    loss_allocation_schedule: {
+      artifact_version: LOSS_ALLOCATION_SCHEDULE_VERSION,
+      schedule_id: signed.body.schedule_id,
+      relying_party_id: signed.body.relying_party_id,
+      issuer_id: signed.body.issuer.id,
+      issuer_key_id: signed.body.issuer.key_id,
+      rules_digest: lossAllocationRulesDigest(artifact),
+    },
+  };
+  const profile = {
+    ...profileBody,
+    profile_hash: riskDigest(profileBody),
+  };
+  return riskFreeze({
+    profile,
+    reference: {
+      profile_id: profile.id,
+      profile_hash: profile.profile_hash,
+      evaluation_max_age_sec: evaluationMaxAgeSec,
+      revocation_required: true,
+    },
+  });
+}