@emilia-protocol/gate 0.6.0 → 0.8.0

package/README.md

@@ -210,6 +210,10 @@ challenge. The Gate composes that and adds the three things a firewall needs:
 
 - **Assurance tiers** — `software` < `class_a` (device signoff) < `quorum` (m-of-n). A `critical`
   action can demand `class_a` or `quorum`; a lower-assurance receipt is refused (`assurance_too_low`).
+  In the lightweight EP-RECEIPT-v1 gate, the tier is an issuer-attested claim
+  inside a receipt signed by a pinned issuer key. For independent verification
+  of every embedded device/quorum signature, use the EP §6.2 trust-receipt
+  verifier in `@emilia-protocol/verify`.
 - **One-time consumption** — a receipt authorizes one action, once. Replays are refused
   (`replay_refused`). Default store is in-memory; swap in Redis/DB for a fleet.
 - **Evidence log** — every decision is hash-chained (`evidence.verify()` detects any alteration).

package/action-control-manifest.js

@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// EP Action Control Manifest: the missing control-plane waist between agent
+// runtimes, receipt formats, transparency logs, and system-of-record adapters.
+//
+// A receipt proves an authorization event. This manifest tells an executor
+// when a receipt is required, what assurance tier is required, which material
+// fields must be observed from the system of record, and what evidence must be
+// emitted after the effect boundary.
+
+import { HIGH_RISK_ACTION_PACKS, DEFAULT_PASS_THROUGH_ACTIONS } from './action-packs.js';
+
+export const ACTION_CONTROL_MANIFEST_VERSION = 'EP-ACTION-CONTROL-MANIFEST-v0.2';
+export const ACTION_CONTROL_SCHEMA_URL = 'https://www.emiliaprotocol.ai/docs/schemas/agent-action-control-manifest-v0.2.schema.json';
+export const ACTION_CONTROL_CONFORMANCE_LEVEL = 'EG-1';
+
+const RISK_LEVELS = new Set(['low', 'medium', 'high', 'critical']);
+const ASSURANCE_CLASSES = new Set(['software', 'class_a', 'quorum']);
+const ENFORCEMENT_POINTS = new Set(['pre_execution', 'pre_effect_commit']);
+
+export const ACTION_CONTROL_DEFAULTS = Object.freeze({
+  decision_point: 'pre_effect_commit',
+  missing_receipt: 'refuse',
+  invalid_receipt: 'refuse',
+  stale_receipt: 'refuse',
+  replay: 'one_time_consumption',
+  evidence_log: 'strict',
+});
+
+export const ACTION_CONTROL_EVIDENCE_PROFILES = Object.freeze({
+  authorization_receipt: 'EP-RECEIPT-v1',
+  execution_attestation: 'EP-EXECUTION-ATTESTATION-v1',
+  reliance_packet: 'EP-RELIANCE-PACKET-v1',
+  transparency: 'SCITT-compatible Signed Statement',
+});
+
+export const ACTION_CONTROL_CONFORMANCE_CHECKS = Object.freeze([
+  'missing_receipt_refused',
+  'software_on_classA_refused',
+  'execution_drift_refused',
+  'valid_classA_runs',
+  'replay_refused',
+  'tampered_refused',
+  'execution_proof_binds',
+  'reliance_packet_rely',
+]);
+
+function cloneJson(value) {
+  return value == null ? value : JSON.parse(JSON.stringify(value));
+}
+
+function normalizeRisk(risk) {
+  return RISK_LEVELS.has(risk) ? risk : 'high';
+}
+
+function normalizeAssurance(value) {
+  return ASSURANCE_CLASSES.has(value) ? value : 'software';
+}
+
+function defaultControlForAction(action) {
+  const requiredFields = action.execution_binding?.required_fields || [];
+  if (!action.receipt_required) {
+    return {
+      enforcement_point: 'none',
+      authorization_receipt: { required: false },
+      evidence_output: { audit_event: true },
+    };
+  }
+  return {
+    enforcement_point: 'pre_effect_commit',
+    status: 428,
+    challenge_header: 'Receipt-Required',
+    proof_header: 'X-EMILIA-Receipt',
+    authorization_receipt: {
+      required: true,
+      profile: 'EP-RECEIPT-v1',
+      signature: 'Ed25519 over RFC 8785 canonical JSON',
+      verifier: 'offline',
+    },
+    replay: {
+      mode: 'one_time_consumption',
+      receipt_id_required: true,
+    },
+    execution_binding: {
+      required: true,
+      source: 'system_of_record',
+      required_fields: [...requiredFields],
+    },
+    transparency: {
+      mode: 'registerable',
+      profile: 'SCITT Signed Statement',
+      required: false,
+    },
+    evidence_output: {
+      audit_event: true,
+      execution_attestation: true,
+      reliance_packet: true,
+      blocked_attempts: true,
+    },
+  };
+}
+
+export function toActionControl(action) {
+  const out = {
+    id: action.id,
+    label: action.label || action.description || action.id,
+    action_type: action.action_type,
+    risk: normalizeRisk(action.risk || (action.receipt_required ? 'high' : 'low')),
+    receipt_required: !!action.receipt_required,
+    assurance_class: normalizeAssurance(action.assurance_class),
+    max_age_sec: action.max_age_sec || 900,
+    match: cloneJson(action.match || {}),
+    why: action.why || action.description || null,
+    control: cloneJson(action.control || defaultControlForAction(action)),
+    conformance: {
+      level: ACTION_CONTROL_CONFORMANCE_LEVEL,
+      checks: [...ACTION_CONTROL_CONFORMANCE_CHECKS],
+      ...(action.conformance || {}),
+    },
+  };
+  if (action.quorum) out.quorum = cloneJson(action.quorum);
+  return out;
+}
+
+export function createDefaultActionControlManifest({
+  service = {},
+  includePassThrough = true,
+  extraActions = [],
+} = {}) {
+  const actions = [
+    ...HIGH_RISK_ACTION_PACKS.map(toActionControl),
+    ...(includePassThrough ? DEFAULT_PASS_THROUGH_ACTIONS.map(toActionControl) : []),
+    ...extraActions.map(toActionControl),
+  ];
+  return {
+    '@version': ACTION_CONTROL_MANIFEST_VERSION,
+    '$schema': ACTION_CONTROL_SCHEMA_URL,
+    profile: 'emilia.action-control',
+    service: {
+      name: service.name || 'EMILIA Gate default action controls',
+      issuer: service.issuer || 'https://www.emiliaprotocol.ai',
+      manifest_url: service.manifest_url || 'https://www.emiliaprotocol.ai/.well-known/agent-action-control.json',
+      ...service,
+    },
+    defaults: { ...ACTION_CONTROL_DEFAULTS },
+    evidence_profiles: { ...ACTION_CONTROL_EVIDENCE_PROFILES },
+    actions,
+  };
+}
+
+function selectorMatches(match = {}, selector = {}) {
+  if (!match || typeof match !== 'object') return false;
+  return Object.entries(match).every(([k, v]) => selector[k] === v);
+}
+
+export function findActionControl(manifest, selector = {}) {
+  if (!manifest || !Array.isArray(manifest.actions)) return null;
+  return manifest.actions.find((action) => {
+    if (selector.action_type && action.action_type === selector.action_type) return true;
+    return selectorMatches(action.match, selector);
+  }) || null;
+}
+
+export function validateActionControlManifest(manifest) {
+  const errors = [];
+  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
+    return { ok: false, errors: ['manifest must be an object'] };
+  }
+  if (manifest['@version'] !== ACTION_CONTROL_MANIFEST_VERSION) {
+    errors.push(`@version must be ${ACTION_CONTROL_MANIFEST_VERSION}`);
+  }
+  if (manifest.profile !== 'emilia.action-control') {
+    errors.push('profile must be emilia.action-control');
+  }
+  if (!manifest.service || typeof manifest.service !== 'object') {
+    errors.push('service object is required');
+  }
+  if (!manifest.defaults || typeof manifest.defaults !== 'object') {
+    errors.push('defaults object is required');
+  }
+  if (!Array.isArray(manifest.actions) || manifest.actions.length === 0) {
+    errors.push('actions must be a non-empty array');
+  }
+  for (const [idx, action] of (manifest.actions || []).entries()) {
+    const prefix = `actions[${idx}]`;
+    if (!action || typeof action !== 'object') {
+      errors.push(`${prefix} must be an object`);
+      continue;
+    }
+    if (!action.id || typeof action.id !== 'string') errors.push(`${prefix}.id is required`);
+    if (!action.action_type || typeof action.action_type !== 'string') errors.push(`${prefix}.action_type is required`);
+    if (!action.match || typeof action.match !== 'object') errors.push(`${prefix}.match is required`);
+    if (typeof action.receipt_required !== 'boolean') errors.push(`${prefix}.receipt_required must be boolean`);
+    if (!RISK_LEVELS.has(action.risk)) errors.push(`${prefix}.risk must be low|medium|high|critical`);
+    if (!ASSURANCE_CLASSES.has(action.assurance_class)) errors.push(`${prefix}.assurance_class must be software|class_a|quorum`);
+    if (action.receipt_required) {
+      if (!Number.isFinite(action.max_age_sec) || action.max_age_sec <= 0) errors.push(`${prefix}.max_age_sec must be positive`);
+      const control = action.control;
+      if (!control || typeof control !== 'object') {
+        errors.push(`${prefix}.control is required when receipt_required=true`);
+        continue;
+      }
+      if (!ENFORCEMENT_POINTS.has(control.enforcement_point)) {
+        errors.push(`${prefix}.control.enforcement_point must be pre_execution or pre_effect_commit`);
+      }
+      if (control.status !== 428) errors.push(`${prefix}.control.status must be 428`);
+      if (control.authorization_receipt?.required !== true) errors.push(`${prefix}.control.authorization_receipt.required must be true`);
+      if (control.authorization_receipt?.profile !== 'EP-RECEIPT-v1') errors.push(`${prefix}.control.authorization_receipt.profile must be EP-RECEIPT-v1`);
+      if (control.authorization_receipt?.verifier !== 'offline') errors.push(`${prefix}.control.authorization_receipt.verifier must be offline`);
+      if (control.replay?.mode !== 'one_time_consumption') errors.push(`${prefix}.control.replay.mode must be one_time_consumption`);
+      if (control.replay?.receipt_id_required !== true) errors.push(`${prefix}.control.replay.receipt_id_required must be true`);
+      const fields = control.execution_binding?.required_fields;
+      if (control.execution_binding?.required !== true) errors.push(`${prefix}.control.execution_binding.required must be true`);
+      if (control.execution_binding?.source !== 'system_of_record') errors.push(`${prefix}.control.execution_binding.source must be system_of_record`);
+      if (!Array.isArray(fields) || fields.length === 0 || fields.some((f) => typeof f !== 'string' || !f)) {
+        errors.push(`${prefix}.control.execution_binding.required_fields must be a non-empty string array`);
+      }
+      if (control.evidence_output?.execution_attestation !== true) errors.push(`${prefix}.control.evidence_output.execution_attestation must be true`);
+      if (control.evidence_output?.reliance_packet !== true) errors.push(`${prefix}.control.evidence_output.reliance_packet must be true`);
+      if (action.conformance?.level !== ACTION_CONTROL_CONFORMANCE_LEVEL) errors.push(`${prefix}.conformance.level must be ${ACTION_CONTROL_CONFORMANCE_LEVEL}`);
+    }
+  }
+  return { ok: errors.length === 0, errors };
+}
+
+export default {
+  ACTION_CONTROL_MANIFEST_VERSION,
+  ACTION_CONTROL_SCHEMA_URL,
+  ACTION_CONTROL_CONFORMANCE_LEVEL,
+  ACTION_CONTROL_DEFAULTS,
+  ACTION_CONTROL_EVIDENCE_PROFILES,
+  ACTION_CONTROL_CONFORMANCE_CHECKS,
+  toActionControl,
+  createDefaultActionControlManifest,
+  findActionControl,
+  validateActionControlManifest,
+};

package/adapters/cloudflare.js

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Cloudflare System-of-Record adapter.
+ * Guards DNS record delete, zone delete, and WAF/firewall disable so they never
+ * reach Cloudflare without a receipt bound to THIS zone. Client injected.
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const CLOUDFLARE_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'cloudflare.dns.delete', label: 'Delete DNS record', action_type: 'cloudflare.dns.delete',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'cloudflare', tool: 'delete_dns_record' },
+    why: 'Removing DNS can take a service offline or enable takeover. Bind zone+record.',
+    execution_binding: { required_fields: ['action_type', 'zone', 'record_id'] },
+  }),
+  Object.freeze({
+    id: 'cloudflare.zone.delete', label: 'Delete zone', action_type: 'cloudflare.zone.delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'cloudflare', tool: 'delete_zone' },
+    why: 'Deletes an entire zone. Quorum.',
+    execution_binding: { required_fields: ['action_type', 'zone'] },
+  }),
+  Object.freeze({
+    id: 'cloudflare.firewall.disable', label: 'Disable firewall rule', action_type: 'cloudflare.firewall.disable',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'cloudflare', tool: 'set_firewall_rule' },
+    why: 'Disabling WAF/firewall opens the perimeter. Quorum + bind zone+rule.',
+    execution_binding: { required_fields: ['action_type', 'zone', 'rule_id'] },
+  }),
+]);
+
+const OPS = {
+  'dns.delete': {
+    selector: { protocol: 'cloudflare', tool: 'delete_dns_record' },
+    observed: (p) => ({ action_type: 'cloudflare.dns.delete', zone: p.zone, record_id: p.record_id }),
+    perform: (c, p) => c.deleteDnsRecord({ zone: p.zone, recordId: p.record_id }),
+  },
+  'zone.delete': {
+    selector: { protocol: 'cloudflare', tool: 'delete_zone' },
+    observed: (p) => ({ action_type: 'cloudflare.zone.delete', zone: p.zone }),
+    perform: (c, p) => c.deleteZone({ zone: p.zone }),
+  },
+  'firewall.disable': {
+    selector: { protocol: 'cloudflare', tool: 'set_firewall_rule' },
+    observed: (p) => ({ action_type: 'cloudflare.firewall.disable', zone: p.zone, rule_id: p.rule_id }),
+    perform: (c, p) => c.setFirewallRule({ zone: p.zone, ruleId: p.rule_id, enabled: false }),
+  },
+};
+
+const adapter = createAdapter({ system: 'cloudflare', ops: OPS });
+export const CLOUDFLARE_OPS = adapter.OPS;
+export function createCloudflareManifest(extra = []) { return manifestFromPack(CLOUDFLARE_ACTION_PACK, extra); }
+export function guardCloudflareMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { CLOUDFLARE_ACTION_PACK, CLOUDFLARE_OPS, createCloudflareManifest, guardCloudflareMutation };

package/adapters/jira.js

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Jira System-of-Record adapter.
+ * Guards bulk issue delete, project delete, and permission grants so they never
+ * reach Jira without a receipt bound to THIS resource. Client injected.
+ */
+import { createAdapter, manifestFromPack, hashCanonical } from './_kit.js';
+
+export const JIRA_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'jira.issue.bulk_delete', label: 'Bulk delete issues', action_type: 'jira.issue.bulk_delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'jira', tool: 'bulk_delete_issues' },
+    why: 'Mass-destroys issues. Bind the exact JQL.',
+    execution_binding: { required_fields: ['action_type', 'project', 'jql_hash'] },
+  }),
+  Object.freeze({
+    id: 'jira.project.delete', label: 'Delete project', action_type: 'jira.project.delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'jira', tool: 'delete_project' },
+    why: 'Deletes a project and its issues. Quorum.',
+    execution_binding: { required_fields: ['action_type', 'project_key'] },
+  }),
+  Object.freeze({
+    id: 'jira.permission.grant', label: 'Grant permission', action_type: 'jira.permission.grant',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'jira', tool: 'grant_permission' },
+    why: 'Changes who can act. Quorum + bind project/principal/role.',
+    execution_binding: { required_fields: ['action_type', 'project', 'principal', 'role'] },
+  }),
+]);
+
+const OPS = {
+  'issue.bulk_delete': {
+    selector: { protocol: 'jira', tool: 'bulk_delete_issues' },
+    observed: (p) => ({ action_type: 'jira.issue.bulk_delete', project: p.project, jql_hash: hashCanonical(String(p.jql || '').trim()) }),
+    perform: (c, p) => c.bulkDeleteIssues({ project: p.project, jql: p.jql }),
+  },
+  'project.delete': {
+    selector: { protocol: 'jira', tool: 'delete_project' },
+    observed: (p) => ({ action_type: 'jira.project.delete', project_key: p.project_key }),
+    perform: (c, p) => c.deleteProject({ projectKey: p.project_key }),
+  },
+  'permission.grant': {
+    selector: { protocol: 'jira', tool: 'grant_permission' },
+    observed: (p) => ({ action_type: 'jira.permission.grant', project: p.project, principal: p.principal, role: p.role }),
+    perform: (c, p) => c.grantPermission({ project: p.project, principal: p.principal, role: p.role }),
+  },
+};
+
+const adapter = createAdapter({ system: 'jira', ops: OPS });
+export const JIRA_OPS = adapter.OPS;
+export function createJiraManifest(extra = []) { return manifestFromPack(JIRA_ACTION_PACK, extra); }
+export function guardJiraMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { JIRA_ACTION_PACK, JIRA_OPS, createJiraManifest, guardJiraMutation };

package/adapters/linear.js

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Linear System-of-Record adapter.
+ * Guards issue deletion, bulk delete, and team deletion so they never reach
+ * Linear without a receipt bound to THIS resource. Client injected.
+ */
+import { createAdapter, manifestFromPack, hashCanonical } from './_kit.js';
+
+export const LINEAR_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'linear.issue.delete', label: 'Delete issue', action_type: 'linear.issue.delete',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'linear', tool: 'delete_issue' },
+    why: 'Destroys an issue. Bind the issue id.',
+    execution_binding: { required_fields: ['action_type', 'issue_id'] },
+  }),
+  Object.freeze({
+    id: 'linear.issue.bulk_delete', label: 'Bulk delete issues', action_type: 'linear.issue.bulk_delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'linear', tool: 'bulk_delete_issues' },
+    why: 'Mass-destroys issues. Bind the exact query.',
+    execution_binding: { required_fields: ['action_type', 'team', 'query_hash'] },
+  }),
+  Object.freeze({
+    id: 'linear.team.delete', label: 'Delete team', action_type: 'linear.team.delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'linear', tool: 'delete_team' },
+    why: 'Deletes a team and its issues. Quorum.',
+    execution_binding: { required_fields: ['action_type', 'team_id'] },
+  }),
+]);
+
+const OPS = {
+  'issue.delete': {
+    selector: { protocol: 'linear', tool: 'delete_issue' },
+    observed: (p) => ({ action_type: 'linear.issue.delete', issue_id: p.issue_id }),
+    perform: (c, p) => c.deleteIssue({ issueId: p.issue_id }),
+  },
+  'issue.bulk_delete': {
+    selector: { protocol: 'linear', tool: 'bulk_delete_issues' },
+    observed: (p) => ({ action_type: 'linear.issue.bulk_delete', team: p.team, query_hash: hashCanonical(String(p.query || '').trim()) }),
+    perform: (c, p) => c.bulkDeleteIssues({ team: p.team, query: p.query }),
+  },
+  'team.delete': {
+    selector: { protocol: 'linear', tool: 'delete_team' },
+    observed: (p) => ({ action_type: 'linear.team.delete', team_id: p.team_id }),
+    perform: (c, p) => c.deleteTeam({ teamId: p.team_id }),
+  },
+};
+
+const adapter = createAdapter({ system: 'linear', ops: OPS });
+export const LINEAR_OPS = adapter.OPS;
+export function createLinearManifest(extra = []) { return manifestFromPack(LINEAR_ACTION_PACK, extra); }
+export function guardLinearMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { LINEAR_ACTION_PACK, LINEAR_OPS, createLinearManifest, guardLinearMutation };

package/adapters/salesforce.js

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Salesforce System-of-Record adapter.
+ * Guards bulk record delete, data export, and permission-set assignment so they
+ * never reach Salesforce without a receipt bound to THIS object. Client injected.
+ */
+import { createAdapter, manifestFromPack, hashCanonical } from './_kit.js';
+
+export const SALESFORCE_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'salesforce.records.bulk_delete', label: 'Bulk delete records', action_type: 'salesforce.records.bulk_delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'salesforce', tool: 'bulk_delete' },
+    why: 'Mass-destroys CRM records. Bind object + the exact SOQL.',
+    execution_binding: { required_fields: ['action_type', 'object', 'soql_hash'] },
+  }),
+  Object.freeze({
+    id: 'salesforce.data.export', label: 'Bulk data export', action_type: 'salesforce.data.export',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'salesforce', tool: 'export' },
+    why: 'Exfiltrates CRM data. Bind object + recipient.',
+    execution_binding: { required_fields: ['action_type', 'object', 'recipient'] },
+  }),
+  Object.freeze({
+    id: 'salesforce.permission_set.assign', label: 'Assign permission set', action_type: 'salesforce.permission_set.assign',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'salesforce', tool: 'assign_permission_set' },
+    why: 'Grants privileges. Quorum + bind user + permission set.',
+    execution_binding: { required_fields: ['action_type', 'user', 'permission_set'] },
+  }),
+]);
+
+const OPS = {
+  'records.bulk_delete': {
+    selector: { protocol: 'salesforce', tool: 'bulk_delete' },
+    observed: (p) => ({ action_type: 'salesforce.records.bulk_delete', object: p.object, soql_hash: hashCanonical(String(p.soql || '').trim()) }),
+    perform: (c, p) => c.bulkDelete({ object: p.object, soql: p.soql }),
+  },
+  'data.export': {
+    selector: { protocol: 'salesforce', tool: 'export' },
+    observed: (p) => ({ action_type: 'salesforce.data.export', object: p.object, recipient: p.recipient }),
+    perform: (c, p) => c.export({ object: p.object, recipient: p.recipient }),
+  },
+  'permission_set.assign': {
+    selector: { protocol: 'salesforce', tool: 'assign_permission_set' },
+    observed: (p) => ({ action_type: 'salesforce.permission_set.assign', user: p.user, permission_set: p.permission_set }),
+    perform: (c, p) => c.assignPermissionSet({ user: p.user, permissionSet: p.permission_set }),
+  },
+};
+
+const adapter = createAdapter({ system: 'salesforce', ops: OPS });
+export const SALESFORCE_OPS = adapter.OPS;
+export function createSalesforceManifest(extra = []) { return manifestFromPack(SALESFORCE_ACTION_PACK, extra); }
+export function guardSalesforceMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { SALESFORCE_ACTION_PACK, SALESFORCE_OPS, createSalesforceManifest, guardSalesforceMutation };

package/adapters/vercel.js

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Vercel System-of-Record adapter.
+ * Guards promote-to-production, project delete, and env/secret changes so they
+ * never reach Vercel without a receipt bound to THIS project. Client injected
+ * (the Vercel REST client or a thin wrapper).
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+
+export const VERCEL_ACTION_PACK = Object.freeze([
+  Object.freeze({
+    id: 'vercel.deploy.promote', label: 'Promote to production', action_type: 'vercel.deploy.promote',
+    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+    match: { protocol: 'vercel', tool: 'promote_deployment' },
+    why: 'Changes live production. Quorum for the prod cutover.',
+    execution_binding: { required_fields: ['action_type', 'project', 'deployment_id'] },
+  }),
+  Object.freeze({
+    id: 'vercel.project.delete', label: 'Delete project', action_type: 'vercel.project.delete',
+    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'vercel', tool: 'delete_project' },
+    why: 'Destroys a project and its deployments. Bind the project.',
+    execution_binding: { required_fields: ['action_type', 'project'] },
+  }),
+  Object.freeze({
+    id: 'vercel.env.set', label: 'Set env / secret', action_type: 'vercel.env.set',
+    risk: 'high', receipt_required: true, assurance_class: 'class_a',
+    match: { protocol: 'vercel', tool: 'upsert_env' },
+    why: 'Changes production secrets/config. Bind project+key+target.',
+    execution_binding: { required_fields: ['action_type', 'project', 'key', 'target'] },
+  }),
+]);
+
+const OPS = {
+  'deploy.promote': {
+    selector: { protocol: 'vercel', tool: 'promote_deployment' },
+    observed: (p) => ({ action_type: 'vercel.deploy.promote', project: p.project, deployment_id: p.deployment_id }),
+    perform: (c, p) => c.promoteDeployment({ project: p.project, deploymentId: p.deployment_id }),
+  },
+  'project.delete': {
+    selector: { protocol: 'vercel', tool: 'delete_project' },
+    observed: (p) => ({ action_type: 'vercel.project.delete', project: p.project }),
+    perform: (c, p) => c.deleteProject({ project: p.project }),
+  },
+  'env.set': {
+    selector: { protocol: 'vercel', tool: 'upsert_env' },
+    observed: (p) => ({ action_type: 'vercel.env.set', project: p.project, key: p.key, target: p.target }),
+    perform: (c, p) => c.upsertEnv({ project: p.project, key: p.key, value: p.value, target: p.target }),
+  },
+};
+
+const adapter = createAdapter({ system: 'vercel', ops: OPS });
+export const VERCEL_OPS = adapter.OPS;
+export function createVercelManifest(extra = []) { return manifestFromPack(VERCEL_ACTION_PACK, extra); }
+export function guardVercelMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { VERCEL_ACTION_PACK, VERCEL_OPS, createVercelManifest, guardVercelMutation };

package/cf1-conformance.js

@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * CF-1 Consequence Firewall Conformance — the category badge above EG-1.
+ *
+ * EG-1 answers "does this integration ENFORCE the gate?" (eight runtime checks).
+ * CF-1 answers the category question "is this a Consequence Firewall?" — EG-1's
+ * eight checks PLUS the three that make the category claim honest:
+ *
+ *   - consequential_action_declared: the action is declared high-risk /
+ *     receipt-required by policy or manifest, not gated only by default-deny.
+ *   - wrong_authority_refused: a gate pinned to the WRONG issuer key cannot be
+ *     talked into authorizing — trust is pinned by the relying party, never
+ *     taken from the receipt-carried signer.
+ *   - evidence_verifies_offline: an allowed run emits a reliance packet a third
+ *     party can verify offline (verdict "rely" + the execution proof binds the
+ *     authorization decision, recomputable without trusting the operator).
+ *
+ * Pure module: composes eg1-conformance.js only (no import of index.js, so no
+ * cycle). `runCf1` is param-driven (an `invoke` for the gate under test, a
+ * `wrongInvoke` for a sibling gate pinned to the wrong key, the harness, and the
+ * resolved manifest requirement). `cf1Conformance` / `cf1ConformanceSelfTest`
+ * in index.js wire real gates to it.
+ */
+import { EG1_CHECKS, runEg1 } from './eg1-conformance.js';
+
+export const CF1_VERSION = 'CF-1';
+
+// The nine CF-1 checks: the declaration bookend, the eight EG-1 runtime checks,
+// then the two that distinguish a firewall from an enforced gate.
+export const CF1_CHECKS = Object.freeze([
+  { id: 'consequential_action_declared', title: 'action declared consequential (receipt required by policy/manifest)' },
+  ...EG1_CHECKS.map((c) => ({ id: c.id, title: c.title })),
+  { id: 'wrong_authority_refused', title: 'gate pinned to the wrong authority cannot authorize' },
+  { id: 'evidence_verifies_offline', title: 'allowed run emits reliance evidence verifiable offline' },
+]);
+
+/**
+ * Drive a subject through the CF-1 checks and return a JSON report.
+ * @param {object} o
+ * @param {(scenario:object)=>Promise<object>} o.invoke   the gate under test
+ * @param {(scenario:object)=>Promise<object>} [o.wrongInvoke] a sibling gate pinned to a DIFFERENT (wrong) issuer key
+ * @param {object} o.harness      from createEg1Harness()
+ * @param {object} [o.action]     the high-risk action (defaults to the harness action)
+ * @param {object} [o.requirement] the manifest requirement resolved for this action (findActionRequirement)
+ */
+export async function runCf1({ invoke, wrongInvoke, harness, action, requirement } = {}) {
+  if (typeof invoke !== 'function') throw new Error('runCf1 requires an invoke(scenario) function');
+  if (!harness || typeof harness.mint !== 'function') throw new Error('runCf1 requires a harness from createEg1Harness()');
+  const act = action || harness.action;
+
+  // The eight EG-1 runtime checks (missing / weak-assurance / execution-drift /
+  // valid-runs / replay / tamper / execution-proof / reliance-packet).
+  const eg1 = await runEg1({ invoke, harness, action: act });
+  const results = {};
+  for (const c of eg1.checks) results[c.id] = { pass: c.pass, observed: c.observed };
+
+  // consequential_action_declared — policy/manifest classifies the action as
+  // requiring a receipt (not merely caught by a default-deny fallback).
+  results.consequential_action_declared = {
+    pass: requirement ? requirement.receipt_required === true : false,
+    observed: {
+      receipt_required: requirement?.receipt_required ?? null,
+      assurance_class: requirement?.assurance_class ?? null,
+      action_type: requirement?.action_type ?? null,
+    },
+  };
+
+  // wrong_authority_refused — a gate pinned to a different key rejects a valid
+  // receipt. Proves trust is pinned by the relying party, not receipt-carried.
+  let wrongPass = false;
+  let wrongObserved = { skipped: true };
+  if (typeof wrongInvoke === 'function') {
+    const rr = await wrongInvoke({ receipt: harness.mint({ outcome: 'allow_with_signoff' }), observedAction: act });
+    wrongPass = rr.allowed === false;
+    wrongObserved = { allowed: !!rr.allowed, status: rr.status ?? null, reason: rr.reason ?? null };
+  }
+  results.wrong_authority_refused = { pass: wrongPass, observed: wrongObserved };
+
+  // evidence_verifies_offline — a fresh valid run yields a "rely" reliance
+  // packet whose execution proof binds the authorization decision. A third
+  // party recomputes that binding offline; no operator trust required.
+  const vr = await invoke({ receipt: harness.mint({ outcome: 'allow_with_signoff' }), observedAction: act });
+  const binds = !!vr.execution?.authorizes_decision && !!vr.decisionHash
+    && vr.execution.authorizes_decision === vr.decisionHash;
+  const offlineOk = vr.allowed === true
+    && String(vr.packet?.verdict || '').toLowerCase() === 'rely'
+    && binds;
+  results.evidence_verifies_offline = {
+    pass: offlineOk,
+    observed: { allowed: !!vr.allowed, verdict: vr.packet?.verdict ?? null, binds },
+  };
+
+  const checks = CF1_CHECKS.map((c) => ({ id: c.id, title: c.title, ...results[c.id] }));
+  const passedCount = checks.filter((c) => c.pass).length;
+  const passed = passedCount === checks.length;
+  return {
+    standard: CF1_VERSION,
+    passed,
+    badge: passed ? 'CF-1 Enforced' : 'CF-1 not earned',
+    summary: { passed: passedCount, total: checks.length },
+    eg1: { passed: eg1.passed, summary: eg1.summary },
+    checks,
+    generated_at: new Date(harness.now ? harness.now() : Date.now()).toISOString(),
+  };
+}
+
+export default { CF1_VERSION, CF1_CHECKS, runCf1 };

package/cf1.mjs

@@ -0,0 +1,45 @@
+/**
+ * CF-1 Consequence Firewall Conformance — runnable proof. Run: node cf1.mjs [--json]
+ *
+ * Self-certifies the reference EMILIA Gate against the CF-1 checks: the eight
+ * EG-1 runtime checks plus the three category checks (action declared
+ * consequential, wrong-authority refused, evidence verifiable offline).
+ *
+ * An adopter earns CF-1 by pointing this at THEIR integration: build your gate
+ * trusting `harness.publicKey`, a sibling gate trusting a different key, and
+ * pass both to cf1Conformance():
+ *
+ *   import { createEg1Harness, cf1Conformance, createTrustedActionFirewall,
+ *            createDefaultActionRiskManifest } from '@emilia-protocol/gate';
+ *   const harness = createEg1Harness();
+ *   const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey] });
+ *   const wrongGate = createTrustedActionFirewall({ trustedKeys: [createEg1Harness().publicKey] });
+ *   const report = await cf1Conformance({ gate, wrongGate, harness, manifest: createDefaultActionRiskManifest() });
+ *
+ * Exit code is 0 only if all checks pass — CI-friendly.
+ * @license Apache-2.0
+ */
+import { cf1ConformanceSelfTest } from './index.js';
+
+const report = await cf1ConformanceSelfTest();
+
+if (process.argv.includes('--json')) {
+  // eslint-disable-next-line no-console
+  console.log(JSON.stringify(report, null, 2));
+  process.exit(report.passed ? 0 : 1);
+}
+
+const G = (s) => `\x1b[32m${s}\x1b[0m`;
+const R = (s) => `\x1b[31m${s}\x1b[0m`;
+const line = (s) => console.log(s);
+
+line('='.repeat(66));
+line('  CF-1 Conformance — is this integration a Consequence Firewall?');
+line('='.repeat(66));
+for (const c of report.checks) {
+  line(`  ${c.pass ? G('PASS') : R('FAIL')}  ${c.title}`);
+}
+line('  ' + '-'.repeat(62));
+line(`  ${report.passed ? G(`✓ ${report.badge}`) : R(`✗ ${report.badge}`)}  (${report.summary.passed}/${report.summary.total})`);
+line('='.repeat(66));
+process.exit(report.passed ? 0 : 1);

package/eg1-conformance.js

@@ -40,6 +40,8 @@ const canon = (v) => (v == null ? JSON.stringify(v)
   : Array.isArray(v) ? `[${v.map(canon).join(',')}]`
     : typeof v === 'object' ? `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canon(v[k])).join(',')}}`
       : JSON.stringify(v));
+const sha256Hex = (v) => crypto.createHash('sha256').update(v, 'utf8').digest('hex');
+const sha256Bytes = (v) => crypto.createHash('sha256').update(v).digest();
 
 // The default high-risk action EG-1 exercises: a Class-A money movement, which
 // the default gate manifest guards (selector { protocol:'mcp', tool:'release_payment' }).
@@ -70,9 +72,71 @@ export const EG1_CHECKS = Object.freeze([
 export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION, idPrefix = 'eg1' } = {}) {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
   const pub = publicKey.export({ type: 'spki', format: 'der' }).toString('base64url');
+  const approverA = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+  const approverB = crypto.generateKeyPairSync('ed25519');
+  const approverKeys = {
+    'ep:key:eg1:class-a': {
+      public_key: approverA.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+      key_class: 'A',
+    },
+    'ep:key:eg1:controller': {
+      public_key: approverB.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+      key_class: 'B',
+    },
+  };
   let counter = 0;
   const nowMs = () => (typeof now === 'function' ? now() : now);
 
+  function assuranceContext(payload) {
+    return {
+      '@version': 'EP-ASSURANCE-CONTEXT-v1',
+      receipt_id: payload.receipt_id,
+      claim_hash: `sha256:${sha256Hex(canon(payload.claim))}`,
+    };
+  }
+
+  function classASignoff(digest) {
+    const challenge = Buffer.from(digest).toString('base64url');
+    const clientDataJSON = Buffer.from(JSON.stringify({ type: 'webauthn.get', challenge, origin: 'https://www.emiliaprotocol.ai' }), 'utf8');
+    const rpIdHash = crypto.createHash('sha256').update('www.emiliaprotocol.ai').digest();
+    const authData = Buffer.concat([rpIdHash, Buffer.from([0x05]), Buffer.from([0, 0, 0, 0])]); // UP + UV
+    const signedData = Buffer.concat([authData, sha256Bytes(clientDataJSON)]);
+    return {
+      approver: 'ep:approver:eg1:cfo',
+      approver_key_id: 'ep:key:eg1:class-a',
+      key_class: 'A',
+      webauthn: {
+        authenticator_data: authData.toString('base64url'),
+        client_data_json: clientDataJSON.toString('base64url'),
+        signature: crypto.sign('sha256', signedData, approverA.privateKey).toString('base64url'),
+      },
+    };
+  }
+
+  function softwareSignoff(digest) {
+    return {
+      approver: 'ep:approver:eg1:controller',
+      approver_key_id: 'ep:key:eg1:controller',
+      key_class: 'B',
+      signature: crypto.sign(null, digest, approverB.privateKey).toString('base64url'),
+    };
+  }
+
+  function assuranceProof(payload, quorum) {
+    const context = assuranceContext(payload);
+    const contextHash = `sha256:${sha256Hex(canon(context))}`;
+    const digest = Buffer.from(contextHash.replace(/^sha256:/, ''), 'hex');
+    const threshold = Number(quorum?.threshold ?? quorum?.m ?? 1);
+    const signoffs = [classASignoff(digest)];
+    if (threshold >= 2) signoffs.push(softwareSignoff(digest));
+    return {
+      '@version': 'EP-ASSURANCE-PROOF-v1',
+      context_hash: contextHash,
+      threshold: threshold >= 2 ? threshold : 1,
+      signoffs,
+    };
+  }
+
   /**
    * Mint a scenario receipt.
    * @param {object} o
@@ -94,13 +158,16 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
         ...extra,
       },
     };
+    if (outcome === 'allow_with_signoff' || quorum) {
+      payload.assurance_proof = assuranceProof(payload, quorum);
+    }
     const value = crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url');
     const receipt = { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value } };
     if (tamper) Object.assign(receipt.payload.claim, tamper); // tamper AFTER signing -> signature no longer binds
     return receipt;
   }
 
-  return { publicKey: pub, mint, action, now: nowMs };
+  return { publicKey: pub, approverKeys, mint, action, now: nowMs };
 }
 
 /**

package/index.js

@@ -27,6 +27,8 @@ const {
   receiptRequiredHeader,
   validateActionRiskManifest,
   findActionRequirement,
+  evaluateReceiptAssurance,
+  receiptAssuranceTier: receiptAssuranceTierFromProof,
   RECEIPT_REQUIRED_STATUS,
   RECEIPT_REQUIRED_HEADER,
 } = await import('@emilia-protocol/require-receipt').catch(() => import('../require-receipt/index.js'));
@@ -36,39 +38,44 @@ import { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskM
 import { hashCanonical, verifyExecutionBinding } from './execution-binding.js';
 import { buildReliancePacket } from './reliance-packet.js';
 import { createEg1Harness, makeGateInvoke, runEg1, EG1_DEFAULT_SELECTOR } from './eg1-conformance.js';
+import { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
 import { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 import { classifyRetention, buildRetentionExport } from './retention.js';
+import { createDefaultActionControlManifest, findActionControl, validateActionControlManifest } from './action-control-manifest.js';
 
 export { MemoryConsumptionStore, createEvidenceLog };
 export { createDurableConsumptionStore, createMemoryBackend } from './store.js';
 export { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 export { classifyRetention, buildRetentionExport, RETENTION_EXPORT_VERSION } from './retention.js';
 export { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest };
+export {
+  ACTION_CONTROL_MANIFEST_VERSION,
+  ACTION_CONTROL_SCHEMA_URL,
+  ACTION_CONTROL_CONFORMANCE_LEVEL,
+  ACTION_CONTROL_DEFAULTS,
+  ACTION_CONTROL_EVIDENCE_PROFILES,
+  ACTION_CONTROL_CONFORMANCE_CHECKS,
+  toActionControl,
+  createDefaultActionControlManifest,
+  findActionControl,
+  validateActionControlManifest,
+} from './action-control-manifest.js';
 export { EXECUTION_BINDING_VERSION, canonicalize, hashCanonical, materialFieldsFor, verifyExecutionBinding } from './execution-binding.js';
 export { RELIANCE_PACKET_VERSION, buildReliancePacket } from './reliance-packet.js';
 export {
   EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR,
   createEg1Harness, makeGateInvoke, runEg1,
 } from './eg1-conformance.js';
+export { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
 export const ASSURANCE_TIERS = ['software', 'class_a', 'quorum'];
 const TIER_RANK = { software: 0, class_a: 1, quorum: 2 };
 
 /**
- * The assurance tier a receipt demonstrably meets. Conservative / fail-closed:
- * if a higher tier's structure is not present, the receipt only earns the lower
- * tier, and a guard that needs more will refuse it.
- *   quorum   — a quorum block with >= 2 distinct signers and threshold >= 2.
- *   class_a  — a device signoff (or claim.outcome === 'allow_with_signoff').
- *   software — any otherwise-valid receipt (a software-held key).
+ * Return the proof-backed assurance tier. Without pinned approver keys or a
+ * caller-supplied verifier, higher tiers are not inferred from receipt fields.
  */
-export function receiptAssuranceTier(doc) {
-  const p = doc?.payload || {};
-  const q = p.quorum || p.claim?.quorum;
-  const signers = q && (q.signers || q.approvers);
-  const threshold = q && (q.m ?? q.threshold ?? (Array.isArray(signers) ? signers.length : 0));
-  if (q && Array.isArray(signers) && signers.length >= 2 && threshold >= 2) return 'quorum';
-  if (p.signoff || p.claim?.outcome === 'allow_with_signoff') return 'class_a';
-  return 'software';
+export function receiptAssuranceTier(doc, opts = {}) {
+  return receiptAssuranceTierFromProof(doc, opts);
 }
 
 /**
@@ -84,7 +91,7 @@ export function receiptAssuranceTier(doc) {
  *   if given it supersedes trustedKeys — a receipt is verified only against keys valid (and not
  *   revoked) at its issuance time.
  */
-export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null } = {}) {
+export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null } = {}) {
   // Production key custody: a registry (rotation + revocation) supersedes a flat
   // trustedKeys list. A flat list is coerced to an always-valid registry, so
   // existing callers are unchanged.
@@ -180,17 +187,28 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!v.ok) {
       return decide(false, RECEIPT_REQUIRED_STATUS, `receipt_rejected:${v.reason}`, { rejected: v });
     }
-    // Assurance tier.
-    const have = receiptAssuranceTier(receipt);
-    if ((TIER_RANK[have] ?? 0) < (TIER_RANK[requiredTier] ?? 0)) {
-      return decide(false, RECEIPT_REQUIRED_STATUS, 'assurance_too_low', { have_tier: have, need_tier: requiredTier });
+    // Assurance tier: proof-backed only. A receipt's issuer may describe a human
+    // signoff, but high-tier enforcement requires pinned approver proof or an
+    // explicit verifier hook. Self-asserted `allow_with_signoff` / `quorum`
+    // fields are software-tier until proven.
+    const assurance = evaluateReceiptAssurance(receipt, requiredTier, {
+      approverKeys: approver_keys || approverKeys,
+      verifyAssurance,
+    });
+    const have = assurance.have;
+    if (!assurance.ok || (TIER_RANK[have] ?? 0) < (TIER_RANK[requiredTier] ?? 0)) {
+      return decide(false, RECEIPT_REQUIRED_STATUS, assurance.reason || 'assurance_too_low', {
+        have_tier: have,
+        need_tier: requiredTier,
+        assurance_tier_source: 'proof',
+      });
     }
     // The high-risk action packs define material fields that must be observed
     // by the executor from the system of record. A signed, harmless-looking
     // claim cannot authorize a different real mutation.
     const executionBinding = verifyExecutionBinding({ requirement, receipt, observedAction: observed });
     if (!executionBinding.ok) {
-      return decide(false, RECEIPT_REQUIRED_STATUS, 'execution_binding_failed', { execution_binding: executionBinding, have_tier: have });
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'execution_binding_failed', { execution_binding: executionBinding, have_tier: have, assurance_tier_source: 'proof' });
     }
     // One-time consumption (replay defense). Require a stable, issuer-generated
     // receipt_id — never fall back to a content hash, whose canonicalization can
@@ -214,7 +232,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!fresh) {
       return decide(false, RECEIPT_REQUIRED_STATUS, 'replay_refused', { consumption_key: receiptId });
     }
-    return decide(true, 200, 'allow', { signer: v.signer, outcome: v.outcome, have_tier: have, execution_binding: executionBinding, consumption_mode: consumptionMode });
+    return decide(true, 200, 'allow', { signer: v.signer, outcome: v.outcome, have_tier: have, assurance_tier_source: 'proof', execution_binding: executionBinding, consumption_mode: consumptionMode });
   }
 
   /** Express/Connect middleware: refuse the route unless a sufficient receipt is present. */
@@ -378,10 +396,52 @@ export async function gateConformance({ gate, harness, action, selector = EG1_DE
  */
 export async function gateConformanceSelfTest({ now } = {}) {
   const harness = createEg1Harness({ now });
-  const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey], now });
+  const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey], approverKeys: harness.approverKeys, now });
   return gateConformance({ gate, harness });
 }
 
+/**
+ * CF-1 (Consequence Firewall) conformance for an existing gate. Runs the eight
+ * EG-1 runtime checks plus the three CF-1 category checks: the action is
+ * declared consequential by the manifest, a gate pinned to the WRONG issuer key
+ * refuses a valid receipt, and the allowed run emits offline-verifiable reliance
+ * evidence. The `gate` MUST trust `harness.publicKey`; `wrongGate` MUST trust a
+ * DIFFERENT key (otherwise wrong_authority_refused cannot be demonstrated).
+ * @param {object} o
+ * @param {object} o.gate       an EMILIA Gate trusting harness.publicKey
+ * @param {object} [o.wrongGate] a sibling gate trusting a different (wrong) key
+ * @param {object} o.harness    from createEg1Harness()
+ * @param {object} [o.manifest] the action-risk manifest (to resolve the requirement)
+ * @param {object} [o.selector] the manifest selector for the action
+ * @param {object} [o.action]   the high-risk action to exercise
+ */
+export async function cf1Conformance({ gate, wrongGate, harness, manifest = null, selector = EG1_DEFAULT_SELECTOR, action } = {}) {
+  if (!gate || typeof gate.run !== 'function') throw new Error('cf1Conformance requires a gate built trusting harness.publicKey');
+  if (!harness) throw new Error('cf1Conformance requires the harness whose key the gate trusts');
+  const act = action || harness.action;
+  const invoke = makeGateInvoke(gate, { selector, action: act });
+  const wrongInvoke = (wrongGate && typeof wrongGate.run === 'function')
+    ? makeGateInvoke(wrongGate, { selector, action: act }) : undefined;
+  const requirement = manifest ? findActionRequirement(manifest, selector) : null;
+  return runCf1({ invoke, wrongInvoke, harness, action: act, requirement });
+}
+
+/**
+ * Self-certify the reference gate against CF-1: a default Trusted Action
+ * Firewall trusting a fresh harness key, a sibling firewall trusting a DIFFERENT
+ * key (for wrong_authority_refused), and the default action-risk manifest (for
+ * consequential_action_declared). The canonical "reference gate earns CF-1"
+ * proof — runnable as a CLI (`cf1.mjs`).
+ */
+export async function cf1ConformanceSelfTest({ now } = {}) {
+  const harness = createEg1Harness({ now });
+  const manifest = createDefaultActionRiskManifest();
+  const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey], approverKeys: harness.approverKeys, now });
+  const wrongHarness = createEg1Harness({ now });
+  const wrongGate = createTrustedActionFirewall({ trustedKeys: [wrongHarness.publicKey], approverKeys: wrongHarness.approverKeys, now });
+  return cf1Conformance({ gate, wrongGate, harness, manifest, selector: EG1_DEFAULT_SELECTOR, action: harness.action });
+}
+
 export default {
   createGate,
   createTrustedActionFirewall,
@@ -393,10 +453,18 @@ export default {
   HIGH_RISK_ACTION_PACKS,
   gateConformance,
   gateConformanceSelfTest,
+  cf1Conformance,
+  cf1ConformanceSelfTest,
+  CF1_VERSION,
+  CF1_CHECKS,
+  runCf1,
   createEg1Harness,
   runEg1,
   createKeyRegistry,
   asKeyRegistry,
   classifyRetention,
   buildRetentionExport,
+  createDefaultActionControlManifest,
+  findActionControl,
+  validateActionControlManifest,
 };

package/mcp.js

@@ -52,29 +52,37 @@ export function gateMcpTool(gate, o = {}, handler) {
   const { tool, protocol = 'mcp', action } = o;
   if (!tool) throw new Error('gateMcpTool requires { tool }');
 
+  const refused = (reason, body = null) => ({
+    isError: true,
+    content: [{
+      type: 'text',
+      text: `EMILIA Gate refused "${tool}": ${reason}. `
+        + 'This is a high-risk action; present a valid, sufficiently-assured, unused human/quorum receipt.',
+    }],
+    _emilia: {
+      gate: 'refused',
+      status: 428,
+      reason,
+      challenge: body,
+    },
+  });
+
   return async function gatedTool(args = {}, extra) {
     const selector = { protocol, tool, ...(action ? { action_type: action } : {}) };
-    const receipt = resolveReceipt(args, o);
-    const observedAction = typeof o.observedAction === 'function'
-      ? o.observedAction(args, extra)
-      : (o.observedAction ?? args);
+    let receipt;
+    let observedAction;
+    try {
+      receipt = resolveReceipt(args, o);
+      observedAction = typeof o.observedAction === 'function'
+        ? o.observedAction(args, extra)
+        : (o.observedAction ?? args);
+    } catch {
+      return refused('receipt_boundary_failed');
+    }
 
     const out = await gate.run({ selector, receipt, observedAction }, () => handler(args, extra));
     if (!out.ok) {
-      return {
-        isError: true,
-        content: [{
-          type: 'text',
-          text: `EMILIA Gate refused "${tool}": ${out.authorization.reason}. `
-            + 'This is a high-risk action; present a valid, sufficiently-assured, unused human/quorum receipt.',
-        }],
-        _emilia: {
-          gate: 'refused',
-          status: out.status,
-          reason: out.authorization.reason,
-          challenge: out.body,
-        },
-      };
+      return refused(out.authorization.reason, out.body);
     }
     const result = out.result;
     // Attach the proof without clobbering a structured tool result.

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@emilia-protocol/gate",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "EMILIA Gate — the Trusted Action Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), a tamper-evident evidence log, default high-risk action packs, execution-field binding, reliance packets, an MCP drop-in, a GitHub system-of-record adapter, and EG-1 conformance. Framework-agnostic, fails closed. Reference implementation, experimental.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "index.js",
   "exports": {
     ".": "./index.js",
+    "./action-control-manifest": "./action-control-manifest.js",
     "./mcp": "./mcp.js",
     "./adapters/github": "./adapters/github.js",
     "./adapters/stripe": "./adapters/stripe.js",
@@ -15,18 +16,67 @@
     "./adapters/k8s": "./adapters/k8s.js",
     "./adapters/terraform": "./adapters/terraform.js",
     "./adapters/gcp": "./adapters/gcp.js",
+    "./adapters/vercel": "./adapters/vercel.js",
+    "./adapters/cloudflare": "./adapters/cloudflare.js",
+    "./adapters/linear": "./adapters/linear.js",
+    "./adapters/jira": "./adapters/jira.js",
+    "./adapters/salesforce": "./adapters/salesforce.js",
     "./key-registry": "./key-registry.js",
     "./retention": "./retention.js",
     "./package.json": "./package.json"
   },
-  "files": ["index.js", "store.js", "evidence.js", "action-packs.js", "execution-binding.js", "reliance-packet.js", "key-registry.js", "retention.js", "eg1-conformance.js", "eg1.mjs", "mcp.js", "adapters/_kit.js", "adapters/github.js", "adapters/github-demo.mjs", "adapters/stripe.js", "adapters/supabase.js", "adapters/aws.js", "adapters/k8s.js", "adapters/terraform.js", "adapters/gcp.js", "demo.mjs", "custody-demo.mjs", "README.md"],
+  "files": [
+    "index.js",
+    "store.js",
+    "evidence.js",
+    "action-packs.js",
+    "action-control-manifest.js",
+    "execution-binding.js",
+    "reliance-packet.js",
+    "key-registry.js",
+    "retention.js",
+    "eg1-conformance.js",
+    "eg1.mjs",
+    "cf1-conformance.js",
+    "cf1.mjs",
+    "mcp.js",
+    "adapters/_kit.js",
+    "adapters/github.js",
+    "adapters/github-demo.mjs",
+    "adapters/stripe.js",
+    "adapters/supabase.js",
+    "adapters/aws.js",
+    "adapters/k8s.js",
+    "adapters/terraform.js",
+    "adapters/gcp.js",
+    "adapters/vercel.js",
+    "adapters/cloudflare.js",
+    "adapters/linear.js",
+    "adapters/jira.js",
+    "adapters/salesforce.js",
+    "demo.mjs",
+    "custody-demo.mjs",
+    "README.md"
+  ],
   "scripts": {
     "test": "node --test",
     "demo": "node demo.mjs",
-    "eg1": "node eg1.mjs"
+    "eg1": "node eg1.mjs",
+    "cf1": "node cf1.mjs"
   },
   "dependencies": {
-    "@emilia-protocol/require-receipt": "^0.4.1"
+    "@emilia-protocol/require-receipt": "^0.5.0"
   },
-  "keywords": ["emilia", "authorization", "receipt", "firewall", "trusted-action-firewall", "agent", "mcp", "gate", "policy-enforcement-point", "ai-safety"]
+  "keywords": [
+    "emilia",
+    "authorization",
+    "receipt",
+    "firewall",
+    "trusted-action-firewall",
+    "agent",
+    "mcp",
+    "gate",
+    "policy-enforcement-point",
+    "ai-safety"
+  ]
 }