@emilia-protocol/gate 0.7.0 → 0.9.0

package/README.md

@@ -75,6 +75,13 @@ Each pack also defines `execution_binding.required_fields`. The executor must pa
 fields from the real system of record. If the signed claim and observed mutation differ, the gate
 refuses with `execution_binding_failed` before consuming the receipt.
 
+Execution-parameter binding is therefore a **Gate** guarantee that holds **only when you supply a
+system-of-record `observedAction`**: it is the Gate — not receipt verification on its own — that
+proves the executed parameters matched what was authorized. If a required field is declared but no
+`observedAction` is provided, the check fails closed (`execution_binding_failed`), never silently
+passes. A bare `@emilia-protocol/require-receipt` gate binds the action type/target only; reach for
+this package when parameter drift (amount, beneficiary, commit, role, …) must be caught.
+
 Prefer `gate.run(...)` for mutations: it reserves the receipt, runs the side effect, commits
 one-time consumption only after success, releases the reservation if the action fails before
 mutation, and emits the execution receipt + reliance packet. Use lower-level `gate.check(...)` only
@@ -210,6 +217,10 @@ challenge. The Gate composes that and adds the three things a firewall needs:
 
 - **Assurance tiers** — `software` < `class_a` (device signoff) < `quorum` (m-of-n). A `critical`
   action can demand `class_a` or `quorum`; a lower-assurance receipt is refused (`assurance_too_low`).
+  In the lightweight EP-RECEIPT-v1 gate, the tier is an issuer-attested claim
+  inside a receipt signed by a pinned issuer key. For independent verification
+  of every embedded device/quorum signature, use the EP §6.2 trust-receipt
+  verifier in `@emilia-protocol/verify`.
 - **One-time consumption** — a receipt authorizes one action, once. Replays are refused
   (`replay_refused`). Default store is in-memory; swap in Redis/DB for a fleet.
 - **Evidence log** — every decision is hash-chained (`evidence.verify()` detects any alteration).

package/action-control-manifest.js

@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// EP Action Control Manifest: the missing control-plane waist between agent
+// runtimes, receipt formats, transparency logs, and system-of-record adapters.
+//
+// A receipt proves an authorization event. This manifest tells an executor
+// when a receipt is required, what assurance tier is required, which material
+// fields must be observed from the system of record, and what evidence must be
+// emitted after the effect boundary.
+
+import { HIGH_RISK_ACTION_PACKS, DEFAULT_PASS_THROUGH_ACTIONS } from './action-packs.js';
+
+export const ACTION_CONTROL_MANIFEST_VERSION = 'EP-ACTION-CONTROL-MANIFEST-v0.2';
+export const ACTION_CONTROL_SCHEMA_URL = 'https://www.emiliaprotocol.ai/docs/schemas/agent-action-control-manifest-v0.2.schema.json';
+export const ACTION_CONTROL_CONFORMANCE_LEVEL = 'EG-1';
+
+const RISK_LEVELS = new Set(['low', 'medium', 'high', 'critical']);
+const ASSURANCE_CLASSES = new Set(['software', 'class_a', 'quorum']);
+const ENFORCEMENT_POINTS = new Set(['pre_execution', 'pre_effect_commit']);
+
+export const ACTION_CONTROL_DEFAULTS = Object.freeze({
+  decision_point: 'pre_effect_commit',
+  missing_receipt: 'refuse',
+  invalid_receipt: 'refuse',
+  stale_receipt: 'refuse',
+  replay: 'one_time_consumption',
+  evidence_log: 'strict',
+});
+
+export const ACTION_CONTROL_EVIDENCE_PROFILES = Object.freeze({
+  authorization_receipt: 'EP-RECEIPT-v1',
+  execution_attestation: 'EP-EXECUTION-ATTESTATION-v1',
+  reliance_packet: 'EP-RELIANCE-PACKET-v1',
+  transparency: 'SCITT-compatible Signed Statement',
+});
+
+export const ACTION_CONTROL_CONFORMANCE_CHECKS = Object.freeze([
+  'missing_receipt_refused',
+  'software_on_classA_refused',
+  'execution_drift_refused',
+  'valid_classA_runs',
+  'replay_refused',
+  'tampered_refused',
+  'execution_proof_binds',
+  'reliance_packet_rely',
+]);
+
+function cloneJson(value) {
+  return value == null ? value : JSON.parse(JSON.stringify(value));
+}
+
+function normalizeRisk(risk) {
+  return RISK_LEVELS.has(risk) ? risk : 'high';
+}
+
+function normalizeAssurance(value) {
+  return ASSURANCE_CLASSES.has(value) ? value : 'software';
+}
+
+function defaultControlForAction(action) {
+  const requiredFields = action.execution_binding?.required_fields || [];
+  if (!action.receipt_required) {
+    return {
+      enforcement_point: 'none',
+      authorization_receipt: { required: false },
+      evidence_output: { audit_event: true },
+    };
+  }
+  return {
+    enforcement_point: 'pre_effect_commit',
+    status: 428,
+    challenge_header: 'Receipt-Required',
+    proof_header: 'X-EMILIA-Receipt',
+    authorization_receipt: {
+      required: true,
+      profile: 'EP-RECEIPT-v1',
+      signature: 'Ed25519 over RFC 8785 canonical JSON',
+      verifier: 'offline',
+    },
+    replay: {
+      mode: 'one_time_consumption',
+      receipt_id_required: true,
+    },
+    execution_binding: {
+      required: true,
+      source: 'system_of_record',
+      required_fields: [...requiredFields],
+    },
+    transparency: {
+      mode: 'registerable',
+      profile: 'SCITT Signed Statement',
+      required: false,
+    },
+    evidence_output: {
+      audit_event: true,
+      execution_attestation: true,
+      reliance_packet: true,
+      blocked_attempts: true,
+    },
+  };
+}
+
+export function toActionControl(action) {
+  const out = {
+    id: action.id,
+    label: action.label || action.description || action.id,
+    action_type: action.action_type,
+    risk: normalizeRisk(action.risk || (action.receipt_required ? 'high' : 'low')),
+    receipt_required: !!action.receipt_required,
+    assurance_class: normalizeAssurance(action.assurance_class),
+    max_age_sec: action.max_age_sec || 900,
+    match: cloneJson(action.match || {}),
+    why: action.why || action.description || null,
+    control: cloneJson(action.control || defaultControlForAction(action)),
+    conformance: {
+      level: ACTION_CONTROL_CONFORMANCE_LEVEL,
+      checks: [...ACTION_CONTROL_CONFORMANCE_CHECKS],
+      ...(action.conformance || {}),
+    },
+  };
+  if (action.quorum) out.quorum = cloneJson(action.quorum);
+  return out;
+}
+
+export function createDefaultActionControlManifest({
+  service = {},
+  includePassThrough = true,
+  extraActions = [],
+} = {}) {
+  const actions = [
+    ...HIGH_RISK_ACTION_PACKS.map(toActionControl),
+    ...(includePassThrough ? DEFAULT_PASS_THROUGH_ACTIONS.map(toActionControl) : []),
+    ...extraActions.map(toActionControl),
+  ];
+  return {
+    '@version': ACTION_CONTROL_MANIFEST_VERSION,
+    '$schema': ACTION_CONTROL_SCHEMA_URL,
+    profile: 'emilia.action-control',
+    service: {
+      name: service.name || 'EMILIA Gate default action controls',
+      issuer: service.issuer || 'https://www.emiliaprotocol.ai',
+      manifest_url: service.manifest_url || 'https://www.emiliaprotocol.ai/.well-known/agent-action-control.json',
+      ...service,
+    },
+    defaults: { ...ACTION_CONTROL_DEFAULTS },
+    evidence_profiles: { ...ACTION_CONTROL_EVIDENCE_PROFILES },
+    actions,
+  };
+}
+
+function selectorMatches(match = {}, selector = {}) {
+  if (!match || typeof match !== 'object') return false;
+  return Object.entries(match).every(([k, v]) => selector[k] === v);
+}
+
+export function findActionControl(manifest, selector = {}) {
+  if (!manifest || !Array.isArray(manifest.actions)) return null;
+  return manifest.actions.find((action) => {
+    if (selector.action_type && action.action_type === selector.action_type) return true;
+    return selectorMatches(action.match, selector);
+  }) || null;
+}
+
+export function validateActionControlManifest(manifest) {
+  const errors = [];
+  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
+    return { ok: false, errors: ['manifest must be an object'] };
+  }
+  if (manifest['@version'] !== ACTION_CONTROL_MANIFEST_VERSION) {
+    errors.push(`@version must be ${ACTION_CONTROL_MANIFEST_VERSION}`);
+  }
+  if (manifest.profile !== 'emilia.action-control') {
+    errors.push('profile must be emilia.action-control');
+  }
+  if (!manifest.service || typeof manifest.service !== 'object') {
+    errors.push('service object is required');
+  }
+  if (!manifest.defaults || typeof manifest.defaults !== 'object') {
+    errors.push('defaults object is required');
+  }
+  if (!Array.isArray(manifest.actions) || manifest.actions.length === 0) {
+    errors.push('actions must be a non-empty array');
+  }
+  for (const [idx, action] of (manifest.actions || []).entries()) {
+    const prefix = `actions[${idx}]`;
+    if (!action || typeof action !== 'object') {
+      errors.push(`${prefix} must be an object`);
+      continue;
+    }
+    if (!action.id || typeof action.id !== 'string') errors.push(`${prefix}.id is required`);
+    if (!action.action_type || typeof action.action_type !== 'string') errors.push(`${prefix}.action_type is required`);
+    if (!action.match || typeof action.match !== 'object') errors.push(`${prefix}.match is required`);
+    if (typeof action.receipt_required !== 'boolean') errors.push(`${prefix}.receipt_required must be boolean`);
+    if (!RISK_LEVELS.has(action.risk)) errors.push(`${prefix}.risk must be low|medium|high|critical`);
+    if (!ASSURANCE_CLASSES.has(action.assurance_class)) errors.push(`${prefix}.assurance_class must be software|class_a|quorum`);
+    if (action.receipt_required) {
+      if (!Number.isFinite(action.max_age_sec) || action.max_age_sec <= 0) errors.push(`${prefix}.max_age_sec must be positive`);
+      const control = action.control;
+      if (!control || typeof control !== 'object') {
+        errors.push(`${prefix}.control is required when receipt_required=true`);
+        continue;
+      }
+      if (!ENFORCEMENT_POINTS.has(control.enforcement_point)) {
+        errors.push(`${prefix}.control.enforcement_point must be pre_execution or pre_effect_commit`);
+      }
+      if (control.status !== 428) errors.push(`${prefix}.control.status must be 428`);
+      if (control.authorization_receipt?.required !== true) errors.push(`${prefix}.control.authorization_receipt.required must be true`);
+      if (control.authorization_receipt?.profile !== 'EP-RECEIPT-v1') errors.push(`${prefix}.control.authorization_receipt.profile must be EP-RECEIPT-v1`);
+      if (control.authorization_receipt?.verifier !== 'offline') errors.push(`${prefix}.control.authorization_receipt.verifier must be offline`);
+      if (control.replay?.mode !== 'one_time_consumption') errors.push(`${prefix}.control.replay.mode must be one_time_consumption`);
+      if (control.replay?.receipt_id_required !== true) errors.push(`${prefix}.control.replay.receipt_id_required must be true`);
+      const fields = control.execution_binding?.required_fields;
+      if (control.execution_binding?.required !== true) errors.push(`${prefix}.control.execution_binding.required must be true`);
+      if (control.execution_binding?.source !== 'system_of_record') errors.push(`${prefix}.control.execution_binding.source must be system_of_record`);
+      if (!Array.isArray(fields) || fields.length === 0 || fields.some((f) => typeof f !== 'string' || !f)) {
+        errors.push(`${prefix}.control.execution_binding.required_fields must be a non-empty string array`);
+      }
+      if (control.evidence_output?.execution_attestation !== true) errors.push(`${prefix}.control.evidence_output.execution_attestation must be true`);
+      if (control.evidence_output?.reliance_packet !== true) errors.push(`${prefix}.control.evidence_output.reliance_packet must be true`);
+      if (action.conformance?.level !== ACTION_CONTROL_CONFORMANCE_LEVEL) errors.push(`${prefix}.conformance.level must be ${ACTION_CONTROL_CONFORMANCE_LEVEL}`);
+    }
+  }
+  return { ok: errors.length === 0, errors };
+}
+
+export default {
+  ACTION_CONTROL_MANIFEST_VERSION,
+  ACTION_CONTROL_SCHEMA_URL,
+  ACTION_CONTROL_CONFORMANCE_LEVEL,
+  ACTION_CONTROL_DEFAULTS,
+  ACTION_CONTROL_EVIDENCE_PROFILES,
+  ACTION_CONTROL_CONFORMANCE_CHECKS,
+  toActionControl,
+  createDefaultActionControlManifest,
+  findActionControl,
+  validateActionControlManifest,
+};

package/cf1-conformance.js

@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * CF-1 Consequence Firewall Conformance — the category badge above EG-1.
+ *
+ * EG-1 answers "does this integration ENFORCE the gate?" (eight runtime checks).
+ * CF-1 answers the category question "is this a Consequence Firewall?" — EG-1's
+ * eight checks PLUS the three that make the category claim honest:
+ *
+ *   - consequential_action_declared: the action is declared high-risk /
+ *     receipt-required by policy or manifest, not gated only by default-deny.
+ *   - wrong_authority_refused: a gate pinned to the WRONG issuer key cannot be
+ *     talked into authorizing — trust is pinned by the relying party, never
+ *     taken from the receipt-carried signer.
+ *   - evidence_verifies_offline: an allowed run emits a reliance packet a third
+ *     party can verify offline (verdict "rely" + the execution proof binds the
+ *     authorization decision, recomputable without trusting the operator).
+ *
+ * Pure module: composes eg1-conformance.js only (no import of index.js, so no
+ * cycle). `runCf1` is param-driven (an `invoke` for the gate under test, a
+ * `wrongInvoke` for a sibling gate pinned to the wrong key, the harness, and the
+ * resolved manifest requirement). `cf1Conformance` / `cf1ConformanceSelfTest`
+ * in index.js wire real gates to it.
+ */
+import { EG1_CHECKS, runEg1 } from './eg1-conformance.js';
+
+export const CF1_VERSION = 'CF-1';
+
+// The nine CF-1 checks: the declaration bookend, the eight EG-1 runtime checks,
+// then the two that distinguish a firewall from an enforced gate.
+export const CF1_CHECKS = Object.freeze([
+  { id: 'consequential_action_declared', title: 'action declared consequential (receipt required by policy/manifest)' },
+  ...EG1_CHECKS.map((c) => ({ id: c.id, title: c.title })),
+  { id: 'wrong_authority_refused', title: 'gate pinned to the wrong authority cannot authorize' },
+  { id: 'evidence_verifies_offline', title: 'allowed run emits reliance evidence verifiable offline' },
+]);
+
+/**
+ * Drive a subject through the CF-1 checks and return a JSON report.
+ * @param {object} o
+ * @param {(scenario:object)=>Promise<object>} o.invoke   the gate under test
+ * @param {(scenario:object)=>Promise<object>} [o.wrongInvoke] a sibling gate pinned to a DIFFERENT (wrong) issuer key
+ * @param {object} o.harness      from createEg1Harness()
+ * @param {object} [o.action]     the high-risk action (defaults to the harness action)
+ * @param {object} [o.requirement] the manifest requirement resolved for this action (findActionRequirement)
+ */
+export async function runCf1({ invoke, wrongInvoke, harness, action, requirement } = {}) {
+  if (typeof invoke !== 'function') throw new Error('runCf1 requires an invoke(scenario) function');
+  if (!harness || typeof harness.mint !== 'function') throw new Error('runCf1 requires a harness from createEg1Harness()');
+  const act = action || harness.action;
+
+  // The eight EG-1 runtime checks (missing / weak-assurance / execution-drift /
+  // valid-runs / replay / tamper / execution-proof / reliance-packet).
+  const eg1 = await runEg1({ invoke, harness, action: act });
+  const results = {};
+  for (const c of eg1.checks) results[c.id] = { pass: c.pass, observed: c.observed };
+
+  // consequential_action_declared — policy/manifest classifies the action as
+  // requiring a receipt (not merely caught by a default-deny fallback).
+  results.consequential_action_declared = {
+    pass: requirement ? requirement.receipt_required === true : false,
+    observed: {
+      receipt_required: requirement?.receipt_required ?? null,
+      assurance_class: requirement?.assurance_class ?? null,
+      action_type: requirement?.action_type ?? null,
+    },
+  };
+
+  // wrong_authority_refused — a gate pinned to a different key rejects a valid
+  // receipt. Proves trust is pinned by the relying party, not receipt-carried.
+  let wrongPass = false;
+  let wrongObserved = { skipped: true };
+  if (typeof wrongInvoke === 'function') {
+    const rr = await wrongInvoke({ receipt: harness.mint({ outcome: 'allow_with_signoff' }), observedAction: act });
+    wrongPass = rr.allowed === false;
+    wrongObserved = { allowed: !!rr.allowed, status: rr.status ?? null, reason: rr.reason ?? null };
+  }
+  results.wrong_authority_refused = { pass: wrongPass, observed: wrongObserved };
+
+  // evidence_verifies_offline — a fresh valid run yields a "rely" reliance
+  // packet whose execution proof binds the authorization decision. A third
+  // party recomputes that binding offline; no operator trust required.
+  const vr = await invoke({ receipt: harness.mint({ outcome: 'allow_with_signoff' }), observedAction: act });
+  const binds = !!vr.execution?.authorizes_decision && !!vr.decisionHash
+    && vr.execution.authorizes_decision === vr.decisionHash;
+  const offlineOk = vr.allowed === true
+    && String(vr.packet?.verdict || '').toLowerCase() === 'rely'
+    && binds;
+  results.evidence_verifies_offline = {
+    pass: offlineOk,
+    observed: { allowed: !!vr.allowed, verdict: vr.packet?.verdict ?? null, binds },
+  };
+
+  const checks = CF1_CHECKS.map((c) => ({ id: c.id, title: c.title, ...results[c.id] }));
+  const passedCount = checks.filter((c) => c.pass).length;
+  const passed = passedCount === checks.length;
+  return {
+    standard: CF1_VERSION,
+    passed,
+    badge: passed ? 'CF-1 Enforced' : 'CF-1 not earned',
+    summary: { passed: passedCount, total: checks.length },
+    eg1: { passed: eg1.passed, summary: eg1.summary },
+    checks,
+    generated_at: new Date(harness.now ? harness.now() : Date.now()).toISOString(),
+  };
+}
+
+export default { CF1_VERSION, CF1_CHECKS, runCf1 };

package/cf1.mjs

@@ -0,0 +1,45 @@
+/**
+ * CF-1 Consequence Firewall Conformance — runnable proof. Run: node cf1.mjs [--json]
+ *
+ * Self-certifies the reference EMILIA Gate against the CF-1 checks: the eight
+ * EG-1 runtime checks plus the three category checks (action declared
+ * consequential, wrong-authority refused, evidence verifiable offline).
+ *
+ * An adopter earns CF-1 by pointing this at THEIR integration: build your gate
+ * trusting `harness.publicKey`, a sibling gate trusting a different key, and
+ * pass both to cf1Conformance():
+ *
+ *   import { createEg1Harness, cf1Conformance, createTrustedActionFirewall,
+ *            createDefaultActionRiskManifest } from '@emilia-protocol/gate';
+ *   const harness = createEg1Harness();
+ *   const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey] });
+ *   const wrongGate = createTrustedActionFirewall({ trustedKeys: [createEg1Harness().publicKey] });
+ *   const report = await cf1Conformance({ gate, wrongGate, harness, manifest: createDefaultActionRiskManifest() });
+ *
+ * Exit code is 0 only if all checks pass — CI-friendly.
+ * @license Apache-2.0
+ */
+import { cf1ConformanceSelfTest } from './index.js';
+
+const report = await cf1ConformanceSelfTest();
+
+if (process.argv.includes('--json')) {
+  // eslint-disable-next-line no-console
+  console.log(JSON.stringify(report, null, 2));
+  process.exit(report.passed ? 0 : 1);
+}
+
+const G = (s) => `\x1b[32m${s}\x1b[0m`;
+const R = (s) => `\x1b[31m${s}\x1b[0m`;
+const line = (s) => console.log(s);
+
+line('='.repeat(66));
+line('  CF-1 Conformance — is this integration a Consequence Firewall?');
+line('='.repeat(66));
+for (const c of report.checks) {
+  line(`  ${c.pass ? G('PASS') : R('FAIL')}  ${c.title}`);
+}
+line('  ' + '-'.repeat(62));
+line(`  ${report.passed ? G(`✓ ${report.badge}`) : R(`✗ ${report.badge}`)}  (${report.summary.passed}/${report.summary.total})`);
+line('='.repeat(66));
+process.exit(report.passed ? 0 : 1);

package/demo.mjs

@@ -5,7 +5,7 @@
  * @license Apache-2.0
  */
 import crypto from 'node:crypto';
-import { createTrustedActionFirewall } from './index.js';
+import { createTrustedActionFirewall, mintDeviceSignoff } from './index.js';
 
 const canon = (v) => v == null ? JSON.stringify(v)
   : Array.isArray(v) ? `[${v.map(canon).join(',')}]`
@@ -21,8 +21,17 @@ const action = {
   payment_instruction_id: 'pi_demo_40000',
   beneficiary_account_hash: 'sha256:demo-beneficiary',
 };
+// action_hash the CFO's device assertion is bound to.
+const actionHash = crypto.createHash('sha256').update(canon(action), 'utf8').digest('hex');
 const receipt = (outcome, extra = {}) => {
   const payload = { receipt_id: `rcpt_${++n}`, subject: 'agent:finance-bot', issuer: 'ep:org:demo', created_at: new Date().toISOString(), claim: { ...action, outcome, approver: 'ep:approver:cfo', ...extra } };
+  // class_a is EARNED by a genuine WebAuthn device signoff, not by the outcome
+  // string. A software receipt (outcome 'allow') carries no signoff.
+  if (outcome === 'allow_with_signoff') {
+    const s = mintDeviceSignoff({ actionHash, approver: 'ep:approver:cfo' });
+    payload.signoff = s.signoff;
+    payload.approver_public_key = s.approver_public_key;
+  }
   return { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value: crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url') } };
 };
 

package/eg1-conformance.js

@@ -40,6 +40,82 @@ const canon = (v) => (v == null ? JSON.stringify(v)
   : Array.isArray(v) ? `[${v.map(canon).join(',')}]`
     : typeof v === 'object' ? `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canon(v[k])).join(',')}}`
       : JSON.stringify(v));
+const sha256Hex = (v) => crypto.createHash('sha256').update(v, 'utf8').digest('hex');
+const sha256Bytes = (v) => crypto.createHash('sha256').update(v).digest();
+
+const RP_ID = 'emiliaprotocol.ai';
+
+/**
+ * Mint a GENUINE WebAuthn ECDSA-P256 device signoff over an authorization
+ * context — the same structure @emilia-protocol/verify verifyWebAuthnSignoff
+ * checks. This is what earns a receipt its class_a tier: a real per-signer
+ * assertion, not a self-asserted `outcome` string. Used to build the Class-A and
+ * quorum evidence the EG-1 harness embeds so the Gate can CRYPTOGRAPHICALLY
+ * credit the tier.
+ */
+export function mintDeviceSignoff({ actionHash, approver, issuedAtMs = Date.now(), nonce, prevContextHash = undefined } = {}) {
+  const signer = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+  const context = {
+    ep_version: '1.0', context_type: 'ep.signoff.v1',
+    action_hash: actionHash,
+    policy: 'policy_eg1',
+    nonce: nonce || ('sig_' + crypto.randomBytes(16).toString('hex')),
+    approver,
+    initiator: 'ent_agent_eg1',
+    issued_at: new Date(issuedAtMs).toISOString(),
+    expires_at: new Date(issuedAtMs + 5 * 60_000).toISOString(),
+    ...(prevContextHash !== undefined ? { prev_context_hash: prevContextHash } : {}),
+  };
+  const challenge = crypto.createHash('sha256').update(canon(context), 'utf8').digest().toString('base64url');
+  const clientData = Buffer.from(JSON.stringify({ type: 'webauthn.get', challenge, origin: `https://www.${RP_ID}` }), 'utf8');
+  const authData = Buffer.concat([
+    crypto.createHash('sha256').update(RP_ID, 'utf8').digest(),
+    Buffer.from([0x05]), // UP | UV
+    Buffer.from([0, 0, 0, 1]),
+  ]);
+  const signed = Buffer.concat([authData, crypto.createHash('sha256').update(clientData).digest()]);
+  const signature = crypto.sign('sha256', signed, signer.privateKey).toString('base64url');
+  return {
+    signoff: {
+      '@type': 'ep.signoff',
+      context,
+      webauthn: {
+        authenticator_data: authData.toString('base64url'),
+        client_data_json: clientData.toString('base64url'),
+        signature,
+      },
+      approver_public_key: signer.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+    },
+    approver_public_key: signer.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+    context,
+  };
+}
+
+/**
+ * Mint a GENUINE EP-QUORUM-v1 evidence document: N distinct humans, each on a
+ * distinct device key, each with a real WebAuthn assertion bound to the SAME
+ * action_hash, within a window. verifyQuorum returns valid for it. This is what
+ * earns a receipt its `quorum` tier — never a bare {signers,threshold} block.
+ */
+export function mintQuorumEvidence({ actionHash, threshold = 2, approvers, issuedAtMs = Date.now() } = {}) {
+  const people = approvers || Array.from({ length: threshold }, (_, i) => ({ role: `approver_${i + 1}`, approver: `ep:approver:eg1_${i + 1}` }));
+  const members = people.map((p, i) => {
+    const s = mintDeviceSignoff({ actionHash, approver: p.approver, issuedAtMs: issuedAtMs + i * 1000 });
+    return { role: p.role, approver_public_key: s.approver_public_key, signoff: { '@type': s.signoff['@type'], context: s.signoff.context, webauthn: s.signoff.webauthn } };
+  });
+  return {
+    '@type': 'ep.quorum',
+    action_hash: actionHash,
+    policy: {
+      mode: 'threshold',
+      required: threshold,
+      approvers: people,
+      distinct_humans: true,
+      window_sec: 900,
+    },
+    members,
+  };
+}
 
 // The default high-risk action EG-1 exercises: a Class-A money movement, which
 // the default gate manifest guards (selector { protocol:'mcp', tool:'release_payment' }).
@@ -70,37 +146,126 @@ export const EG1_CHECKS = Object.freeze([
 export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION, idPrefix = 'eg1' } = {}) {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
   const pub = publicKey.export({ type: 'spki', format: 'der' }).toString('base64url');
+  const approverA = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+  const approverB = crypto.generateKeyPairSync('ed25519');
+  const approverKeys = {
+    'ep:key:eg1:class-a': {
+      public_key: approverA.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+      key_class: 'A',
+    },
+    'ep:key:eg1:controller': {
+      public_key: approverB.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+      key_class: 'B',
+    },
+  };
   let counter = 0;
   const nowMs = () => (typeof now === 'function' ? now() : now);
 
+  // The action_hash the self-contained human device assertions are bound to.
+  // Derived from the action so the signoff/quorum evidence is about THIS action.
+  const actionHash = crypto.createHash('sha256').update(canon(action), 'utf8').digest('hex');
+
+  function assuranceContext(payload) {
+    return {
+      '@version': 'EP-ASSURANCE-CONTEXT-v1',
+      receipt_id: payload.receipt_id,
+      claim_hash: `sha256:${sha256Hex(canon(payload.claim))}`,
+    };
+  }
+
+  function classASignoff(digest) {
+    const challenge = Buffer.from(digest).toString('base64url');
+    const clientDataJSON = Buffer.from(JSON.stringify({ type: 'webauthn.get', challenge, origin: 'https://www.emiliaprotocol.ai' }), 'utf8');
+    const rpIdHash = crypto.createHash('sha256').update('www.emiliaprotocol.ai').digest();
+    const authData = Buffer.concat([rpIdHash, Buffer.from([0x05]), Buffer.from([0, 0, 0, 0])]); // UP + UV
+    const signedData = Buffer.concat([authData, sha256Bytes(clientDataJSON)]);
+    return {
+      approver: 'ep:approver:eg1:cfo',
+      approver_key_id: 'ep:key:eg1:class-a',
+      key_class: 'A',
+      webauthn: {
+        authenticator_data: authData.toString('base64url'),
+        client_data_json: clientDataJSON.toString('base64url'),
+        signature: crypto.sign('sha256', signedData, approverA.privateKey).toString('base64url'),
+      },
+    };
+  }
+
+  function softwareSignoff(digest) {
+    return {
+      approver: 'ep:approver:eg1:controller',
+      approver_key_id: 'ep:key:eg1:controller',
+      key_class: 'B',
+      signature: crypto.sign(null, digest, approverB.privateKey).toString('base64url'),
+    };
+  }
+
+  function assuranceProof(payload, quorum) {
+    const context = assuranceContext(payload);
+    const contextHash = `sha256:${sha256Hex(canon(context))}`;
+    const digest = Buffer.from(contextHash.replace(/^sha256:/, ''), 'hex');
+    const threshold = Number(quorum?.threshold ?? quorum?.m ?? 1);
+    const signoffs = [classASignoff(digest)];
+    if (threshold >= 2) signoffs.push(softwareSignoff(digest));
+    return {
+      '@version': 'EP-ASSURANCE-PROOF-v1',
+      context_hash: contextHash,
+      threshold: threshold >= 2 ? threshold : 1,
+      signoffs,
+    };
+  }
+
   /**
    * Mint a scenario receipt.
    * @param {object} o
-   * @param {'allow'|'allow_with_signoff'} [o.outcome] 'allow'=software, 'allow_with_signoff'=Class-A
-   * @param {object} [o.quorum] a quorum block (signers/threshold) -> quorum tier
+   * @param {'allow'|'allow_with_signoff'} [o.outcome] 'allow'=software; 'allow_with_signoff'
+   *   embeds a REAL WebAuthn device signoff so the receipt cryptographically earns class_a.
+   * @param {object|boolean} [o.quorum] request quorum-tier evidence. Truthy -> a REAL
+   *   EP-QUORUM-v1 doc (distinct humans + distinct keys + per-signer assertions). If an
+   *   object with `threshold`/`signers`, its size sets the quorum size.
+   * @param {boolean} [o.fakeQuorum] embed an UNVERIFIABLE self-asserted quorum block
+   *   ({signers,threshold}) with no per-signer signatures — used to prove the Gate
+   *   REFUSES it (must NOT be credited quorum). For adversarial tests only.
    * @param {object} [o.tamper] fields assigned to the claim AFTER signing (breaks the signature)
    */
-  function mint({ outcome = 'allow_with_signoff', quorum = null, tamper = null, extra = {} } = {}) {
+  function mint({ outcome = 'allow_with_signoff', quorum = null, fakeQuorum = false, tamper = null, extra = {} } = {}) {
+    const claim = { ...action, outcome, approver: 'ep:approver:eg1', ...extra };
     const payload = {
       receipt_id: `${idPrefix}_${++counter}`,
       subject: 'agent:eg1-conformance',
       issuer: 'ep:org:eg1',
       created_at: new Date(nowMs()).toISOString(),
-      claim: {
-        ...action,
-        outcome,
-        approver: 'ep:approver:eg1',
-        ...(quorum ? { quorum } : {}),
-        ...extra,
-      },
+      claim,
     };
+    if (fakeQuorum) {
+      // Self-asserted ONLY — NO members / NO signatures / NO pinned proof. The
+      // Gate must refuse to credit this as quorum (assurance_too_low). For
+      // adversarial tests that prove payload claims are never trusted.
+      payload.quorum = { signers: ['ep:a', 'ep:b'], threshold: 2 };
+    } else if (outcome === 'allow_with_signoff' || quorum) {
+      // Genuine, per-signer-verifiable evidence. The PRIMARY proof is the pinned
+      // EP-ASSURANCE-PROOF-v1 (verified against the harness's pinned approverKeys),
+      // which is what the EG-1 gate/custody path checks. We ALSO embed self-contained
+      // evidence (EP-QUORUM-v1 / WebAuthn device signoff) so a relying party that
+      // does NOT pin keys can still cryptographically credit the tier (DoD audit fix).
+      payload.assurance_proof = assuranceProof(payload, quorum);
+      if (quorum) {
+        const threshold = Number.isInteger(quorum.threshold) ? quorum.threshold
+          : (Array.isArray(quorum.signers) ? quorum.signers.length : 2);
+        payload.quorum = mintQuorumEvidence({ actionHash, threshold, issuedAtMs: nowMs() });
+      } else {
+        const s = mintDeviceSignoff({ actionHash, approver: 'ep:approver:eg1', issuedAtMs: nowMs() });
+        payload.signoff = s.signoff;
+        payload.approver_public_key = s.approver_public_key;
+      }
+    }
     const value = crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url');
     const receipt = { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value } };
     if (tamper) Object.assign(receipt.payload.claim, tamper); // tamper AFTER signing -> signature no longer binds
     return receipt;
   }
 
-  return { publicKey: pub, mint, action, now: nowMs };
+  return { publicKey: pub, approverKeys, mint, action, actionHash, now: nowMs };
 }
 
 /**
@@ -203,4 +368,4 @@ export async function runEg1({ invoke, harness, action } = {}) {
   };
 }
 
-export default { EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR, createEg1Harness, makeGateInvoke, runEg1 };
+export default { EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR, createEg1Harness, makeGateInvoke, runEg1, mintDeviceSignoff, mintQuorumEvidence };

package/index.js

@@ -6,8 +6,12 @@
  * action runs ONLY if it arrives with a receipt that is:
  *   1. valid          — Ed25519 over canonical JSON, signed by a pinned issuer;
  *   2. in-scope       — bound to the exact action the manifest guards;
- *   3. sufficiently   — meets the action's required assurance tier
- *      assured           (software / class_a device signoff / quorum);
+ *   3. sufficiently   — meets the action's required assurance tier, and the
+ *      assured           credited tier is CRYPTOGRAPHICALLY VERIFIED, not read
+ *                        from self-asserted payload fields: class_a requires a
+ *                        valid WebAuthn device signoff, quorum requires a valid
+ *                        EP-QUORUM-v1 (distinct humans + distinct keys +
+ *                        threshold + per-signer assertions);
  *   4. fresh          — within max age; and
  *   5. unused         — not a replay (one-time consumption).
  * Otherwise it is refused with a machine-readable Receipt-Required challenge
@@ -27,48 +31,143 @@ const {
   receiptRequiredHeader,
   validateActionRiskManifest,
   findActionRequirement,
+  evaluateReceiptAssurance,
+  receiptAssuranceTier: receiptAssuranceTierFromProof,
   RECEIPT_REQUIRED_STATUS,
   RECEIPT_REQUIRED_HEADER,
 } = await import('@emilia-protocol/require-receipt').catch(() => import('../require-receipt/index.js'));
+// The real per-signer verifiers (WebAuthn device-signoff + M-of-N quorum). The
+// Gate MUST use these to CREDIT class_a / quorum — a receipt's self-asserted
+// outcome string or a fabricated quorum block is NOT proof. Same resolution
+// pattern as require-receipt: prefer the published package, fall back to the
+// in-repo source so the monorepo test/build works without a node_modules link.
+const { verifyWebAuthnSignoff, verifyQuorum } = await import('@emilia-protocol/verify')
+  .catch(() => import('../verify/index.js'));
 import { MemoryConsumptionStore } from './store.js';
 import { createEvidenceLog } from './evidence.js';
 import { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest } from './action-packs.js';
 import { hashCanonical, verifyExecutionBinding } from './execution-binding.js';
 import { buildReliancePacket } from './reliance-packet.js';
-import { createEg1Harness, makeGateInvoke, runEg1, EG1_DEFAULT_SELECTOR } from './eg1-conformance.js';
+import { createEg1Harness, makeGateInvoke, runEg1, EG1_DEFAULT_SELECTOR, mintDeviceSignoff, mintQuorumEvidence } from './eg1-conformance.js';
+import { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
 import { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 import { classifyRetention, buildRetentionExport } from './retention.js';
+import { createDefaultActionControlManifest, findActionControl, validateActionControlManifest } from './action-control-manifest.js';
 
 export { MemoryConsumptionStore, createEvidenceLog };
 export { createDurableConsumptionStore, createMemoryBackend } from './store.js';
 export { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 export { classifyRetention, buildRetentionExport, RETENTION_EXPORT_VERSION } from './retention.js';
 export { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest };
+export {
+  ACTION_CONTROL_MANIFEST_VERSION,
+  ACTION_CONTROL_SCHEMA_URL,
+  ACTION_CONTROL_CONFORMANCE_LEVEL,
+  ACTION_CONTROL_DEFAULTS,
+  ACTION_CONTROL_EVIDENCE_PROFILES,
+  ACTION_CONTROL_CONFORMANCE_CHECKS,
+  toActionControl,
+  createDefaultActionControlManifest,
+  findActionControl,
+  validateActionControlManifest,
+} from './action-control-manifest.js';
 export { EXECUTION_BINDING_VERSION, canonicalize, hashCanonical, materialFieldsFor, verifyExecutionBinding } from './execution-binding.js';
 export { RELIANCE_PACKET_VERSION, buildReliancePacket } from './reliance-packet.js';
 export {
   EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR,
-  createEg1Harness, makeGateInvoke, runEg1,
+  createEg1Harness, makeGateInvoke, runEg1, mintDeviceSignoff, mintQuorumEvidence,
 } from './eg1-conformance.js';
+export { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
 export const ASSURANCE_TIERS = ['software', 'class_a', 'quorum'];
 const TIER_RANK = { software: 0, class_a: 1, quorum: 2 };
 
 /**
- * The assurance tier a receipt demonstrably meets. Conservative / fail-closed:
- * if a higher tier's structure is not present, the receipt only earns the lower
- * tier, and a guard that needs more will refuse it.
- *   quorum   — a quorum block with >= 2 distinct signers and threshold >= 2.
- *   class_a  — a device signoff (or claim.outcome === 'allow_with_signoff').
- *   software — any otherwise-valid receipt (a software-held key).
+ * The assurance tier a receipt has CRYPTOGRAPHICALLY EARNED.
+ *
+ * SECURITY: the credited tier is NEVER inferred from self-asserted payload
+ * fields. A bare `quorum:{signers,threshold}` block or an `outcome:
+ * 'allow_with_signoff'` string with no verifiable signature earns only
+ * `software` — it will be refused `assurance_too_low` by any guard that needs
+ * more. Fail-closed by construction.
+ *
+ * Two independent cryptographic proof shapes are accepted; a receipt earns the
+ * HIGHEST tier any of them proves:
+ *
+ *  (a) Pinned assurance proof (`payload.assurance_proof`, EP-ASSURANCE-PROOF-v1):
+ *      per-signer signatures verified against PINNED approver keys (opts.approverKeys)
+ *      or a caller-supplied verifier (opts.verifyAssurance). This is the primary,
+ *      strongest model — the verifier never trusts a key that travels inside the
+ *      receipt. Delegated to require-receipt's receiptAssuranceTierFromProof.
+ *
+ *  (b) Self-contained embedded evidence (DoD audit fix): a full EP-QUORUM-v1
+ *      document (payload.quorum) whose per-signer WebAuthn assertions verify via
+ *      verifyQuorum (distinct humans + distinct keys + threshold + action-binding
+ *      + window) earns `quorum`; a WebAuthn device signoff (payload.signoff =
+ *      {context, webauthn}) that verifies against the approver's own key via
+ *      verifyWebAuthnSignoff earns `class_a`. Used where the approver keys travel
+ *      with the receipt rather than being pinned by the relying party.
+ *
+ * @param {object} doc  the EP-RECEIPT-v1 document
+ * @param {object} [opts]
+ * @param {object} [opts.approverKeys] pinned approver keys for path (a)
+ * @param {function} [opts.verifyAssurance] custom assurance verifier for path (a)
+ * @param {string} [opts.rpId]  bind embedded device assertions to this WebAuthn RP id (path b)
+ * @param {boolean} [opts.detail] return a {tier, quorum, signoff} object instead of the string
+ * @returns {'software'|'class_a'|'quorum'|object} the highest tier proven
  */
-export function receiptAssuranceTier(doc) {
+export function receiptAssuranceTier(doc, opts = {}) {
+  const detail = { tier: 'software', quorum: null, signoff: null };
+
+  // --- Path (a): pinned assurance proof / caller-supplied verifier. ---
+  // Never inferred from receipt fields without a pinned key or explicit verifier.
+  let proofTier = 'software';
+  try {
+    proofTier = receiptAssuranceTierFromProof(doc, opts) || 'software';
+  } catch { proofTier = 'software'; }
+  if ((TIER_RANK[proofTier] ?? 0) > (TIER_RANK[detail.tier] ?? 0)) detail.tier = proofTier;
+
+  // --- Path (b): self-contained embedded per-signer evidence (DoD audit fix). ---
   const p = doc?.payload || {};
+  const verifyOpts = opts.rpId ? { rpId: opts.rpId } : {};
+
+  // quorum: a real, self-contained EP-QUORUM-v1 evidence document. Accept it
+  // under payload.quorum or payload.claim.quorum. It only counts if it is a full
+  // quorum document (policy + members with WebAuthn signoffs) AND verifyQuorum
+  // returns valid. A bare {signers,threshold} block has no members to verify and
+  // therefore CANNOT be credited quorum.
   const q = p.quorum || p.claim?.quorum;
-  const signers = q && (q.signers || q.approvers);
-  const threshold = q && (q.m ?? q.threshold ?? (Array.isArray(signers) ? signers.length : 0));
-  if (q && Array.isArray(signers) && signers.length >= 2 && threshold >= 2) return 'quorum';
-  if (p.signoff || p.claim?.outcome === 'allow_with_signoff') return 'class_a';
-  return 'software';
+  if (detail.tier !== 'quorum' && isQuorumEvidence(q)) {
+    const qr = verifyQuorum(q, verifyOpts);
+    detail.quorum = { valid: qr.valid, checks: qr.checks };
+    if (qr.valid) detail.tier = 'quorum';
+  }
+
+  // class_a: a verifiable WebAuthn device signoff. The signoff evidence is
+  // {context, webauthn}; the approver key travels with it (signoff.approver_public_key)
+  // or alongside it (payload.approver_public_key).
+  if ((TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) {
+    const so = p.signoff || p.claim?.signoff;
+    if (isSignoffEvidence(so)) {
+      const key = so.approver_public_key || p.approver_public_key || p.claim?.approver_public_key;
+      if (key) {
+        const sr = verifyWebAuthnSignoff(so, key, verifyOpts);
+        detail.signoff = { valid: sr.valid, checks: sr.checks };
+        if (sr.valid && (TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) detail.tier = 'class_a';
+      }
+    }
+  }
+
+  return opts.detail ? detail : detail.tier;
+}
+
+/** A quorum evidence doc must carry members with per-signer signoffs to be verifiable. */
+function isQuorumEvidence(q) {
+  return !!q && typeof q === 'object' && q.policy && Array.isArray(q.members) && q.members.length > 0
+    && typeof q.action_hash === 'string' && q.action_hash.length > 0;
+}
+/** A device signoff must carry the WebAuthn assertion material to be verifiable. */
+function isSignoffEvidence(s) {
+  return !!s && typeof s === 'object' && s.context && s.webauthn;
 }
 
 /**
@@ -84,7 +183,7 @@ export function receiptAssuranceTier(doc) {
  *   if given it supersedes trustedKeys — a receipt is verified only against keys valid (and not
  *   revoked) at its issuance time.
  */
-export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null } = {}) {
+export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null, rpId = null } = {}) {
   // Production key custody: a registry (rotation + revocation) supersedes a flat
   // trustedKeys list. A flat list is coerced to an always-valid registry, so
   // existing callers are unchanged.
@@ -180,17 +279,50 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!v.ok) {
       return decide(false, RECEIPT_REQUIRED_STATUS, `receipt_rejected:${v.reason}`, { rejected: v });
     }
-    // Assurance tier.
-    const have = receiptAssuranceTier(receipt);
-    if ((TIER_RANK[have] ?? 0) < (TIER_RANK[requiredTier] ?? 0)) {
-      return decide(false, RECEIPT_REQUIRED_STATUS, 'assurance_too_low', { have_tier: have, need_tier: requiredTier });
+    // Assurance tier. CRYPTOGRAPHICALLY VERIFIED — never inferred from
+    // self-asserted payload fields. The credited tier is the HIGHER of two
+    // independent proof paths:
+    //   (a) pinned assurance proof (payload.assurance_proof verified against
+    //       pinned approverKeys) or a caller-supplied verifyAssurance hook;
+    //   (b) self-contained embedded per-signer evidence (EP-QUORUM-v1 /
+    //       WebAuthn device signoff) re-verified via verifyQuorum /
+    //       verifyWebAuthnSignoff (DoD audit fix).
+    // A receipt that only CLAIMS a higher tier earns 'software' and is refused.
+    const assurance = evaluateReceiptAssurance(receipt, requiredTier, {
+      approverKeys: approver_keys || approverKeys,
+      verifyAssurance,
+    });
+    const tierResult = receiptAssuranceTier(receipt, {
+      rpId, detail: true, approverKeys: approver_keys || approverKeys, verifyAssurance,
+    });
+    // Take the strongest tier either path proves.
+    const have = (TIER_RANK[assurance.have] ?? 0) >= (TIER_RANK[tierResult.tier] ?? 0)
+      ? assurance.have : tierResult.tier;
+    const needRank = TIER_RANK[requiredTier];
+    // Fail CLOSED on an unknown / mis-cased required tier: never silently treat
+    // it as 'software'. If a manifest asks for a tier this gate does not model,
+    // no receipt can satisfy it.
+    if (needRank === undefined) {
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'unknown_required_tier', { have_tier: have, need_tier: requiredTier, assurance_tier_source: 'cryptographic_verification' });
+    }
+    if ((TIER_RANK[have] ?? 0) < needRank) {
+      // The credited tier (from either proof path) is below what the action
+      // requires. The canonical machine-readable reason is 'assurance_too_low';
+      // main's proof-path detail (e.g. 'assurance_proof_required') is surfaced
+      // separately so callers keep the diagnostic without changing the contract.
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'assurance_too_low', {
+        have_tier: have, need_tier: requiredTier,
+        assurance_tier_source: 'cryptographic_verification',
+        assurance_detail: assurance.reason || null,
+        tier_evidence: { quorum: tierResult.quorum, signoff: tierResult.signoff },
+      });
     }
     // The high-risk action packs define material fields that must be observed
     // by the executor from the system of record. A signed, harmless-looking
     // claim cannot authorize a different real mutation.
     const executionBinding = verifyExecutionBinding({ requirement, receipt, observedAction: observed });
     if (!executionBinding.ok) {
-      return decide(false, RECEIPT_REQUIRED_STATUS, 'execution_binding_failed', { execution_binding: executionBinding, have_tier: have });
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'execution_binding_failed', { execution_binding: executionBinding, have_tier: have, assurance_tier_source: 'cryptographic_verification' });
     }
     // One-time consumption (replay defense). Require a stable, issuer-generated
     // receipt_id — never fall back to a content hash, whose canonicalization can
@@ -214,7 +346,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!fresh) {
       return decide(false, RECEIPT_REQUIRED_STATUS, 'replay_refused', { consumption_key: receiptId });
     }
-    return decide(true, 200, 'allow', { signer: v.signer, outcome: v.outcome, have_tier: have, execution_binding: executionBinding, consumption_mode: consumptionMode });
+    return decide(true, 200, 'allow', { signer: v.signer, outcome: v.outcome, have_tier: have, assurance_tier_source: 'cryptographic_verification', execution_binding: executionBinding, consumption_mode: consumptionMode });
   }
 
   /** Express/Connect middleware: refuse the route unless a sufficient receipt is present. */
@@ -378,10 +510,52 @@ export async function gateConformance({ gate, harness, action, selector = EG1_DE
  */
 export async function gateConformanceSelfTest({ now } = {}) {
   const harness = createEg1Harness({ now });
-  const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey], now });
+  const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey], approverKeys: harness.approverKeys, now });
   return gateConformance({ gate, harness });
 }
 
+/**
+ * CF-1 (Consequence Firewall) conformance for an existing gate. Runs the eight
+ * EG-1 runtime checks plus the three CF-1 category checks: the action is
+ * declared consequential by the manifest, a gate pinned to the WRONG issuer key
+ * refuses a valid receipt, and the allowed run emits offline-verifiable reliance
+ * evidence. The `gate` MUST trust `harness.publicKey`; `wrongGate` MUST trust a
+ * DIFFERENT key (otherwise wrong_authority_refused cannot be demonstrated).
+ * @param {object} o
+ * @param {object} o.gate       an EMILIA Gate trusting harness.publicKey
+ * @param {object} [o.wrongGate] a sibling gate trusting a different (wrong) key
+ * @param {object} o.harness    from createEg1Harness()
+ * @param {object} [o.manifest] the action-risk manifest (to resolve the requirement)
+ * @param {object} [o.selector] the manifest selector for the action
+ * @param {object} [o.action]   the high-risk action to exercise
+ */
+export async function cf1Conformance({ gate, wrongGate, harness, manifest = null, selector = EG1_DEFAULT_SELECTOR, action } = {}) {
+  if (!gate || typeof gate.run !== 'function') throw new Error('cf1Conformance requires a gate built trusting harness.publicKey');
+  if (!harness) throw new Error('cf1Conformance requires the harness whose key the gate trusts');
+  const act = action || harness.action;
+  const invoke = makeGateInvoke(gate, { selector, action: act });
+  const wrongInvoke = (wrongGate && typeof wrongGate.run === 'function')
+    ? makeGateInvoke(wrongGate, { selector, action: act }) : undefined;
+  const requirement = manifest ? findActionRequirement(manifest, selector) : null;
+  return runCf1({ invoke, wrongInvoke, harness, action: act, requirement });
+}
+
+/**
+ * Self-certify the reference gate against CF-1: a default Trusted Action
+ * Firewall trusting a fresh harness key, a sibling firewall trusting a DIFFERENT
+ * key (for wrong_authority_refused), and the default action-risk manifest (for
+ * consequential_action_declared). The canonical "reference gate earns CF-1"
+ * proof — runnable as a CLI (`cf1.mjs`).
+ */
+export async function cf1ConformanceSelfTest({ now } = {}) {
+  const harness = createEg1Harness({ now });
+  const manifest = createDefaultActionRiskManifest();
+  const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey], approverKeys: harness.approverKeys, now });
+  const wrongHarness = createEg1Harness({ now });
+  const wrongGate = createTrustedActionFirewall({ trustedKeys: [wrongHarness.publicKey], approverKeys: wrongHarness.approverKeys, now });
+  return cf1Conformance({ gate, wrongGate, harness, manifest, selector: EG1_DEFAULT_SELECTOR, action: harness.action });
+}
+
 export default {
   createGate,
   createTrustedActionFirewall,
@@ -393,10 +567,18 @@ export default {
   HIGH_RISK_ACTION_PACKS,
   gateConformance,
   gateConformanceSelfTest,
+  cf1Conformance,
+  cf1ConformanceSelfTest,
+  CF1_VERSION,
+  CF1_CHECKS,
+  runCf1,
   createEg1Harness,
   runEg1,
   createKeyRegistry,
   asKeyRegistry,
   classifyRetention,
   buildRetentionExport,
+  createDefaultActionControlManifest,
+  findActionControl,
+  validateActionControlManifest,
 };

package/mcp.js

@@ -52,29 +52,37 @@ export function gateMcpTool(gate, o = {}, handler) {
   const { tool, protocol = 'mcp', action } = o;
   if (!tool) throw new Error('gateMcpTool requires { tool }');
 
+  const refused = (reason, body = null) => ({
+    isError: true,
+    content: [{
+      type: 'text',
+      text: `EMILIA Gate refused "${tool}": ${reason}. `
+        + 'This is a high-risk action; present a valid, sufficiently-assured, unused human/quorum receipt.',
+    }],
+    _emilia: {
+      gate: 'refused',
+      status: 428,
+      reason,
+      challenge: body,
+    },
+  });
+
   return async function gatedTool(args = {}, extra) {
     const selector = { protocol, tool, ...(action ? { action_type: action } : {}) };
-    const receipt = resolveReceipt(args, o);
-    const observedAction = typeof o.observedAction === 'function'
-      ? o.observedAction(args, extra)
-      : (o.observedAction ?? args);
+    let receipt;
+    let observedAction;
+    try {
+      receipt = resolveReceipt(args, o);
+      observedAction = typeof o.observedAction === 'function'
+        ? o.observedAction(args, extra)
+        : (o.observedAction ?? args);
+    } catch {
+      return refused('receipt_boundary_failed');
+    }
 
     const out = await gate.run({ selector, receipt, observedAction }, () => handler(args, extra));
     if (!out.ok) {
-      return {
-        isError: true,
-        content: [{
-          type: 'text',
-          text: `EMILIA Gate refused "${tool}": ${out.authorization.reason}. `
-            + 'This is a high-risk action; present a valid, sufficiently-assured, unused human/quorum receipt.',
-        }],
-        _emilia: {
-          gate: 'refused',
-          status: out.status,
-          reason: out.authorization.reason,
-          challenge: out.body,
-        },
-      };
+      return refused(out.authorization.reason, out.body);
     }
     const result = out.result;
     // Attach the proof without clobbering a structured tool result.

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@emilia-protocol/gate",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "EMILIA Gate — the Trusted Action Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), a tamper-evident evidence log, default high-risk action packs, execution-field binding, reliance packets, an MCP drop-in, a GitHub system-of-record adapter, and EG-1 conformance. Framework-agnostic, fails closed. Reference implementation, experimental.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "index.js",
   "exports": {
     ".": "./index.js",
+    "./action-control-manifest": "./action-control-manifest.js",
     "./mcp": "./mcp.js",
     "./adapters/github": "./adapters/github.js",
     "./adapters/stripe": "./adapters/stripe.js",
@@ -24,14 +25,59 @@
     "./retention": "./retention.js",
     "./package.json": "./package.json"
   },
-  "files": ["index.js", "store.js", "evidence.js", "action-packs.js", "execution-binding.js", "reliance-packet.js", "key-registry.js", "retention.js", "eg1-conformance.js", "eg1.mjs", "mcp.js", "adapters/_kit.js", "adapters/github.js", "adapters/github-demo.mjs", "adapters/stripe.js", "adapters/supabase.js", "adapters/aws.js", "adapters/k8s.js", "adapters/terraform.js", "adapters/gcp.js", "adapters/vercel.js", "adapters/cloudflare.js", "adapters/linear.js", "adapters/jira.js", "adapters/salesforce.js", "demo.mjs", "custody-demo.mjs", "README.md"],
+  "files": [
+    "index.js",
+    "store.js",
+    "evidence.js",
+    "action-packs.js",
+    "action-control-manifest.js",
+    "execution-binding.js",
+    "reliance-packet.js",
+    "key-registry.js",
+    "retention.js",
+    "eg1-conformance.js",
+    "eg1.mjs",
+    "cf1-conformance.js",
+    "cf1.mjs",
+    "mcp.js",
+    "adapters/_kit.js",
+    "adapters/github.js",
+    "adapters/github-demo.mjs",
+    "adapters/stripe.js",
+    "adapters/supabase.js",
+    "adapters/aws.js",
+    "adapters/k8s.js",
+    "adapters/terraform.js",
+    "adapters/gcp.js",
+    "adapters/vercel.js",
+    "adapters/cloudflare.js",
+    "adapters/linear.js",
+    "adapters/jira.js",
+    "adapters/salesforce.js",
+    "demo.mjs",
+    "custody-demo.mjs",
+    "README.md"
+  ],
   "scripts": {
     "test": "node --test",
     "demo": "node demo.mjs",
-    "eg1": "node eg1.mjs"
+    "eg1": "node eg1.mjs",
+    "cf1": "node cf1.mjs"
   },
   "dependencies": {
-    "@emilia-protocol/require-receipt": "^0.4.1"
+    "@emilia-protocol/require-receipt": "^0.5.0",
+    "@emilia-protocol/verify": "^3.3.0"
   },
-  "keywords": ["emilia", "authorization", "receipt", "firewall", "trusted-action-firewall", "agent", "mcp", "gate", "policy-enforcement-point", "ai-safety"]
+  "keywords": [
+    "emilia",
+    "authorization",
+    "receipt",
+    "firewall",
+    "trusted-action-firewall",
+    "agent",
+    "mcp",
+    "gate",
+    "policy-enforcement-point",
+    "ai-safety"
+  ]
 }