@emilia-protocol/gate 0.8.0 → 0.9.0

package/README.md

@@ -75,6 +75,13 @@ Each pack also defines `execution_binding.required_fields`. The executor must pa
 fields from the real system of record. If the signed claim and observed mutation differ, the gate
 refuses with `execution_binding_failed` before consuming the receipt.
 
+Execution-parameter binding is therefore a **Gate** guarantee that holds **only when you supply a
+system-of-record `observedAction`**: it is the Gate — not receipt verification on its own — that
+proves the executed parameters matched what was authorized. If a required field is declared but no
+`observedAction` is provided, the check fails closed (`execution_binding_failed`), never silently
+passes. A bare `@emilia-protocol/require-receipt` gate binds the action type/target only; reach for
+this package when parameter drift (amount, beneficiary, commit, role, …) must be caught.
+
 Prefer `gate.run(...)` for mutations: it reserves the receipt, runs the side effect, commits
 one-time consumption only after success, releases the reservation if the action fails before
 mutation, and emits the execution receipt + reliance packet. Use lower-level `gate.check(...)` only

package/demo.mjs

@@ -5,7 +5,7 @@
  * @license Apache-2.0
  */
 import crypto from 'node:crypto';
-import { createTrustedActionFirewall } from './index.js';
+import { createTrustedActionFirewall, mintDeviceSignoff } from './index.js';
 
 const canon = (v) => v == null ? JSON.stringify(v)
   : Array.isArray(v) ? `[${v.map(canon).join(',')}]`
@@ -21,8 +21,17 @@ const action = {
   payment_instruction_id: 'pi_demo_40000',
   beneficiary_account_hash: 'sha256:demo-beneficiary',
 };
+// action_hash the CFO's device assertion is bound to.
+const actionHash = crypto.createHash('sha256').update(canon(action), 'utf8').digest('hex');
 const receipt = (outcome, extra = {}) => {
   const payload = { receipt_id: `rcpt_${++n}`, subject: 'agent:finance-bot', issuer: 'ep:org:demo', created_at: new Date().toISOString(), claim: { ...action, outcome, approver: 'ep:approver:cfo', ...extra } };
+  // class_a is EARNED by a genuine WebAuthn device signoff, not by the outcome
+  // string. A software receipt (outcome 'allow') carries no signoff.
+  if (outcome === 'allow_with_signoff') {
+    const s = mintDeviceSignoff({ actionHash, approver: 'ep:approver:cfo' });
+    payload.signoff = s.signoff;
+    payload.approver_public_key = s.approver_public_key;
+  }
   return { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value: crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url') } };
 };
 

package/eg1-conformance.js

@@ -43,6 +43,80 @@ const canon = (v) => (v == null ? JSON.stringify(v)
 const sha256Hex = (v) => crypto.createHash('sha256').update(v, 'utf8').digest('hex');
 const sha256Bytes = (v) => crypto.createHash('sha256').update(v).digest();
 
+const RP_ID = 'emiliaprotocol.ai';
+
+/**
+ * Mint a GENUINE WebAuthn ECDSA-P256 device signoff over an authorization
+ * context — the same structure @emilia-protocol/verify verifyWebAuthnSignoff
+ * checks. This is what earns a receipt its class_a tier: a real per-signer
+ * assertion, not a self-asserted `outcome` string. Used to build the Class-A and
+ * quorum evidence the EG-1 harness embeds so the Gate can CRYPTOGRAPHICALLY
+ * credit the tier.
+ */
+export function mintDeviceSignoff({ actionHash, approver, issuedAtMs = Date.now(), nonce, prevContextHash = undefined } = {}) {
+  const signer = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+  const context = {
+    ep_version: '1.0', context_type: 'ep.signoff.v1',
+    action_hash: actionHash,
+    policy: 'policy_eg1',
+    nonce: nonce || ('sig_' + crypto.randomBytes(16).toString('hex')),
+    approver,
+    initiator: 'ent_agent_eg1',
+    issued_at: new Date(issuedAtMs).toISOString(),
+    expires_at: new Date(issuedAtMs + 5 * 60_000).toISOString(),
+    ...(prevContextHash !== undefined ? { prev_context_hash: prevContextHash } : {}),
+  };
+  const challenge = crypto.createHash('sha256').update(canon(context), 'utf8').digest().toString('base64url');
+  const clientData = Buffer.from(JSON.stringify({ type: 'webauthn.get', challenge, origin: `https://www.${RP_ID}` }), 'utf8');
+  const authData = Buffer.concat([
+    crypto.createHash('sha256').update(RP_ID, 'utf8').digest(),
+    Buffer.from([0x05]), // UP | UV
+    Buffer.from([0, 0, 0, 1]),
+  ]);
+  const signed = Buffer.concat([authData, crypto.createHash('sha256').update(clientData).digest()]);
+  const signature = crypto.sign('sha256', signed, signer.privateKey).toString('base64url');
+  return {
+    signoff: {
+      '@type': 'ep.signoff',
+      context,
+      webauthn: {
+        authenticator_data: authData.toString('base64url'),
+        client_data_json: clientData.toString('base64url'),
+        signature,
+      },
+      approver_public_key: signer.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+    },
+    approver_public_key: signer.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+    context,
+  };
+}
+
+/**
+ * Mint a GENUINE EP-QUORUM-v1 evidence document: N distinct humans, each on a
+ * distinct device key, each with a real WebAuthn assertion bound to the SAME
+ * action_hash, within a window. verifyQuorum returns valid for it. This is what
+ * earns a receipt its `quorum` tier — never a bare {signers,threshold} block.
+ */
+export function mintQuorumEvidence({ actionHash, threshold = 2, approvers, issuedAtMs = Date.now() } = {}) {
+  const people = approvers || Array.from({ length: threshold }, (_, i) => ({ role: `approver_${i + 1}`, approver: `ep:approver:eg1_${i + 1}` }));
+  const members = people.map((p, i) => {
+    const s = mintDeviceSignoff({ actionHash, approver: p.approver, issuedAtMs: issuedAtMs + i * 1000 });
+    return { role: p.role, approver_public_key: s.approver_public_key, signoff: { '@type': s.signoff['@type'], context: s.signoff.context, webauthn: s.signoff.webauthn } };
+  });
+  return {
+    '@type': 'ep.quorum',
+    action_hash: actionHash,
+    policy: {
+      mode: 'threshold',
+      required: threshold,
+      approvers: people,
+      distinct_humans: true,
+      window_sec: 900,
+    },
+    members,
+  };
+}
+
 // The default high-risk action EG-1 exercises: a Class-A money movement, which
 // the default gate manifest guards (selector { protocol:'mcp', tool:'release_payment' }).
 export const EG1_DEFAULT_SELECTOR = Object.freeze({ protocol: 'mcp', tool: 'release_payment' });
@@ -87,6 +161,10 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
   let counter = 0;
   const nowMs = () => (typeof now === 'function' ? now() : now);
 
+  // The action_hash the self-contained human device assertions are bound to.
+  // Derived from the action so the signoff/quorum evidence is about THIS action.
+  const actionHash = crypto.createHash('sha256').update(canon(action), 'utf8').digest('hex');
+
   function assuranceContext(payload) {
     return {
       '@version': 'EP-ASSURANCE-CONTEXT-v1',
@@ -140,26 +218,46 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
   /**
    * Mint a scenario receipt.
    * @param {object} o
-   * @param {'allow'|'allow_with_signoff'} [o.outcome] 'allow'=software, 'allow_with_signoff'=Class-A
-   * @param {object} [o.quorum] a quorum block (signers/threshold) -> quorum tier
+   * @param {'allow'|'allow_with_signoff'} [o.outcome] 'allow'=software; 'allow_with_signoff'
+   *   embeds a REAL WebAuthn device signoff so the receipt cryptographically earns class_a.
+   * @param {object|boolean} [o.quorum] request quorum-tier evidence. Truthy -> a REAL
+   *   EP-QUORUM-v1 doc (distinct humans + distinct keys + per-signer assertions). If an
+   *   object with `threshold`/`signers`, its size sets the quorum size.
+   * @param {boolean} [o.fakeQuorum] embed an UNVERIFIABLE self-asserted quorum block
+   *   ({signers,threshold}) with no per-signer signatures — used to prove the Gate
+   *   REFUSES it (must NOT be credited quorum). For adversarial tests only.
    * @param {object} [o.tamper] fields assigned to the claim AFTER signing (breaks the signature)
    */
-  function mint({ outcome = 'allow_with_signoff', quorum = null, tamper = null, extra = {} } = {}) {
+  function mint({ outcome = 'allow_with_signoff', quorum = null, fakeQuorum = false, tamper = null, extra = {} } = {}) {
+    const claim = { ...action, outcome, approver: 'ep:approver:eg1', ...extra };
     const payload = {
       receipt_id: `${idPrefix}_${++counter}`,
       subject: 'agent:eg1-conformance',
       issuer: 'ep:org:eg1',
       created_at: new Date(nowMs()).toISOString(),
-      claim: {
-        ...action,
-        outcome,
-        approver: 'ep:approver:eg1',
-        ...(quorum ? { quorum } : {}),
-        ...extra,
-      },
+      claim,
     };
-    if (outcome === 'allow_with_signoff' || quorum) {
+    if (fakeQuorum) {
+      // Self-asserted ONLY — NO members / NO signatures / NO pinned proof. The
+      // Gate must refuse to credit this as quorum (assurance_too_low). For
+      // adversarial tests that prove payload claims are never trusted.
+      payload.quorum = { signers: ['ep:a', 'ep:b'], threshold: 2 };
+    } else if (outcome === 'allow_with_signoff' || quorum) {
+      // Genuine, per-signer-verifiable evidence. The PRIMARY proof is the pinned
+      // EP-ASSURANCE-PROOF-v1 (verified against the harness's pinned approverKeys),
+      // which is what the EG-1 gate/custody path checks. We ALSO embed self-contained
+      // evidence (EP-QUORUM-v1 / WebAuthn device signoff) so a relying party that
+      // does NOT pin keys can still cryptographically credit the tier (DoD audit fix).
       payload.assurance_proof = assuranceProof(payload, quorum);
+      if (quorum) {
+        const threshold = Number.isInteger(quorum.threshold) ? quorum.threshold
+          : (Array.isArray(quorum.signers) ? quorum.signers.length : 2);
+        payload.quorum = mintQuorumEvidence({ actionHash, threshold, issuedAtMs: nowMs() });
+      } else {
+        const s = mintDeviceSignoff({ actionHash, approver: 'ep:approver:eg1', issuedAtMs: nowMs() });
+        payload.signoff = s.signoff;
+        payload.approver_public_key = s.approver_public_key;
+      }
     }
     const value = crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url');
     const receipt = { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value } };
@@ -167,7 +265,7 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
     return receipt;
   }
 
-  return { publicKey: pub, approverKeys, mint, action, now: nowMs };
+  return { publicKey: pub, approverKeys, mint, action, actionHash, now: nowMs };
 }
 
 /**
@@ -270,4 +368,4 @@ export async function runEg1({ invoke, harness, action } = {}) {
   };
 }
 
-export default { EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR, createEg1Harness, makeGateInvoke, runEg1 };
+export default { EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR, createEg1Harness, makeGateInvoke, runEg1, mintDeviceSignoff, mintQuorumEvidence };

package/index.js

@@ -6,8 +6,12 @@
  * action runs ONLY if it arrives with a receipt that is:
  *   1. valid          — Ed25519 over canonical JSON, signed by a pinned issuer;
  *   2. in-scope       — bound to the exact action the manifest guards;
- *   3. sufficiently   — meets the action's required assurance tier
- *      assured           (software / class_a device signoff / quorum);
+ *   3. sufficiently   — meets the action's required assurance tier, and the
+ *      assured           credited tier is CRYPTOGRAPHICALLY VERIFIED, not read
+ *                        from self-asserted payload fields: class_a requires a
+ *                        valid WebAuthn device signoff, quorum requires a valid
+ *                        EP-QUORUM-v1 (distinct humans + distinct keys +
+ *                        threshold + per-signer assertions);
  *   4. fresh          — within max age; and
  *   5. unused         — not a replay (one-time consumption).
  * Otherwise it is refused with a machine-readable Receipt-Required challenge
@@ -32,12 +36,19 @@ const {
   RECEIPT_REQUIRED_STATUS,
   RECEIPT_REQUIRED_HEADER,
 } = await import('@emilia-protocol/require-receipt').catch(() => import('../require-receipt/index.js'));
+// The real per-signer verifiers (WebAuthn device-signoff + M-of-N quorum). The
+// Gate MUST use these to CREDIT class_a / quorum — a receipt's self-asserted
+// outcome string or a fabricated quorum block is NOT proof. Same resolution
+// pattern as require-receipt: prefer the published package, fall back to the
+// in-repo source so the monorepo test/build works without a node_modules link.
+const { verifyWebAuthnSignoff, verifyQuorum } = await import('@emilia-protocol/verify')
+  .catch(() => import('../verify/index.js'));
 import { MemoryConsumptionStore } from './store.js';
 import { createEvidenceLog } from './evidence.js';
 import { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest } from './action-packs.js';
 import { hashCanonical, verifyExecutionBinding } from './execution-binding.js';
 import { buildReliancePacket } from './reliance-packet.js';
-import { createEg1Harness, makeGateInvoke, runEg1, EG1_DEFAULT_SELECTOR } from './eg1-conformance.js';
+import { createEg1Harness, makeGateInvoke, runEg1, EG1_DEFAULT_SELECTOR, mintDeviceSignoff, mintQuorumEvidence } from './eg1-conformance.js';
 import { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
 import { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 import { classifyRetention, buildRetentionExport } from './retention.js';
@@ -64,18 +75,99 @@ export { EXECUTION_BINDING_VERSION, canonicalize, hashCanonical, materialFieldsF
 export { RELIANCE_PACKET_VERSION, buildReliancePacket } from './reliance-packet.js';
 export {
   EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR,
-  createEg1Harness, makeGateInvoke, runEg1,
+  createEg1Harness, makeGateInvoke, runEg1, mintDeviceSignoff, mintQuorumEvidence,
 } from './eg1-conformance.js';
 export { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
 export const ASSURANCE_TIERS = ['software', 'class_a', 'quorum'];
 const TIER_RANK = { software: 0, class_a: 1, quorum: 2 };
 
 /**
- * Return the proof-backed assurance tier. Without pinned approver keys or a
- * caller-supplied verifier, higher tiers are not inferred from receipt fields.
+ * The assurance tier a receipt has CRYPTOGRAPHICALLY EARNED.
+ *
+ * SECURITY: the credited tier is NEVER inferred from self-asserted payload
+ * fields. A bare `quorum:{signers,threshold}` block or an `outcome:
+ * 'allow_with_signoff'` string with no verifiable signature earns only
+ * `software` — it will be refused `assurance_too_low` by any guard that needs
+ * more. Fail-closed by construction.
+ *
+ * Two independent cryptographic proof shapes are accepted; a receipt earns the
+ * HIGHEST tier any of them proves:
+ *
+ *  (a) Pinned assurance proof (`payload.assurance_proof`, EP-ASSURANCE-PROOF-v1):
+ *      per-signer signatures verified against PINNED approver keys (opts.approverKeys)
+ *      or a caller-supplied verifier (opts.verifyAssurance). This is the primary,
+ *      strongest model — the verifier never trusts a key that travels inside the
+ *      receipt. Delegated to require-receipt's receiptAssuranceTierFromProof.
+ *
+ *  (b) Self-contained embedded evidence (DoD audit fix): a full EP-QUORUM-v1
+ *      document (payload.quorum) whose per-signer WebAuthn assertions verify via
+ *      verifyQuorum (distinct humans + distinct keys + threshold + action-binding
+ *      + window) earns `quorum`; a WebAuthn device signoff (payload.signoff =
+ *      {context, webauthn}) that verifies against the approver's own key via
+ *      verifyWebAuthnSignoff earns `class_a`. Used where the approver keys travel
+ *      with the receipt rather than being pinned by the relying party.
+ *
+ * @param {object} doc  the EP-RECEIPT-v1 document
+ * @param {object} [opts]
+ * @param {object} [opts.approverKeys] pinned approver keys for path (a)
+ * @param {function} [opts.verifyAssurance] custom assurance verifier for path (a)
+ * @param {string} [opts.rpId]  bind embedded device assertions to this WebAuthn RP id (path b)
+ * @param {boolean} [opts.detail] return a {tier, quorum, signoff} object instead of the string
+ * @returns {'software'|'class_a'|'quorum'|object} the highest tier proven
  */
 export function receiptAssuranceTier(doc, opts = {}) {
-  return receiptAssuranceTierFromProof(doc, opts);
+  const detail = { tier: 'software', quorum: null, signoff: null };
+
+  // --- Path (a): pinned assurance proof / caller-supplied verifier. ---
+  // Never inferred from receipt fields without a pinned key or explicit verifier.
+  let proofTier = 'software';
+  try {
+    proofTier = receiptAssuranceTierFromProof(doc, opts) || 'software';
+  } catch { proofTier = 'software'; }
+  if ((TIER_RANK[proofTier] ?? 0) > (TIER_RANK[detail.tier] ?? 0)) detail.tier = proofTier;
+
+  // --- Path (b): self-contained embedded per-signer evidence (DoD audit fix). ---
+  const p = doc?.payload || {};
+  const verifyOpts = opts.rpId ? { rpId: opts.rpId } : {};
+
+  // quorum: a real, self-contained EP-QUORUM-v1 evidence document. Accept it
+  // under payload.quorum or payload.claim.quorum. It only counts if it is a full
+  // quorum document (policy + members with WebAuthn signoffs) AND verifyQuorum
+  // returns valid. A bare {signers,threshold} block has no members to verify and
+  // therefore CANNOT be credited quorum.
+  const q = p.quorum || p.claim?.quorum;
+  if (detail.tier !== 'quorum' && isQuorumEvidence(q)) {
+    const qr = verifyQuorum(q, verifyOpts);
+    detail.quorum = { valid: qr.valid, checks: qr.checks };
+    if (qr.valid) detail.tier = 'quorum';
+  }
+
+  // class_a: a verifiable WebAuthn device signoff. The signoff evidence is
+  // {context, webauthn}; the approver key travels with it (signoff.approver_public_key)
+  // or alongside it (payload.approver_public_key).
+  if ((TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) {
+    const so = p.signoff || p.claim?.signoff;
+    if (isSignoffEvidence(so)) {
+      const key = so.approver_public_key || p.approver_public_key || p.claim?.approver_public_key;
+      if (key) {
+        const sr = verifyWebAuthnSignoff(so, key, verifyOpts);
+        detail.signoff = { valid: sr.valid, checks: sr.checks };
+        if (sr.valid && (TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) detail.tier = 'class_a';
+      }
+    }
+  }
+
+  return opts.detail ? detail : detail.tier;
+}
+
+/** A quorum evidence doc must carry members with per-signer signoffs to be verifiable. */
+function isQuorumEvidence(q) {
+  return !!q && typeof q === 'object' && q.policy && Array.isArray(q.members) && q.members.length > 0
+    && typeof q.action_hash === 'string' && q.action_hash.length > 0;
+}
+/** A device signoff must carry the WebAuthn assertion material to be verifiable. */
+function isSignoffEvidence(s) {
+  return !!s && typeof s === 'object' && s.context && s.webauthn;
 }
 
 /**
@@ -91,7 +183,7 @@ export function receiptAssuranceTier(doc, opts = {}) {
  *   if given it supersedes trustedKeys — a receipt is verified only against keys valid (and not
  *   revoked) at its issuance time.
  */
-export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null } = {}) {
+export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null, rpId = null } = {}) {
   // Production key custody: a registry (rotation + revocation) supersedes a flat
   // trustedKeys list. A flat list is coerced to an always-valid registry, so
   // existing callers are unchanged.
@@ -187,20 +279,42 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!v.ok) {
       return decide(false, RECEIPT_REQUIRED_STATUS, `receipt_rejected:${v.reason}`, { rejected: v });
     }
-    // Assurance tier: proof-backed only. A receipt's issuer may describe a human
-    // signoff, but high-tier enforcement requires pinned approver proof or an
-    // explicit verifier hook. Self-asserted `allow_with_signoff` / `quorum`
-    // fields are software-tier until proven.
+    // Assurance tier. CRYPTOGRAPHICALLY VERIFIED — never inferred from
+    // self-asserted payload fields. The credited tier is the HIGHER of two
+    // independent proof paths:
+    //   (a) pinned assurance proof (payload.assurance_proof verified against
+    //       pinned approverKeys) or a caller-supplied verifyAssurance hook;
+    //   (b) self-contained embedded per-signer evidence (EP-QUORUM-v1 /
+    //       WebAuthn device signoff) re-verified via verifyQuorum /
+    //       verifyWebAuthnSignoff (DoD audit fix).
+    // A receipt that only CLAIMS a higher tier earns 'software' and is refused.
     const assurance = evaluateReceiptAssurance(receipt, requiredTier, {
       approverKeys: approver_keys || approverKeys,
       verifyAssurance,
     });
-    const have = assurance.have;
-    if (!assurance.ok || (TIER_RANK[have] ?? 0) < (TIER_RANK[requiredTier] ?? 0)) {
-      return decide(false, RECEIPT_REQUIRED_STATUS, assurance.reason || 'assurance_too_low', {
-        have_tier: have,
-        need_tier: requiredTier,
-        assurance_tier_source: 'proof',
+    const tierResult = receiptAssuranceTier(receipt, {
+      rpId, detail: true, approverKeys: approver_keys || approverKeys, verifyAssurance,
+    });
+    // Take the strongest tier either path proves.
+    const have = (TIER_RANK[assurance.have] ?? 0) >= (TIER_RANK[tierResult.tier] ?? 0)
+      ? assurance.have : tierResult.tier;
+    const needRank = TIER_RANK[requiredTier];
+    // Fail CLOSED on an unknown / mis-cased required tier: never silently treat
+    // it as 'software'. If a manifest asks for a tier this gate does not model,
+    // no receipt can satisfy it.
+    if (needRank === undefined) {
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'unknown_required_tier', { have_tier: have, need_tier: requiredTier, assurance_tier_source: 'cryptographic_verification' });
+    }
+    if ((TIER_RANK[have] ?? 0) < needRank) {
+      // The credited tier (from either proof path) is below what the action
+      // requires. The canonical machine-readable reason is 'assurance_too_low';
+      // main's proof-path detail (e.g. 'assurance_proof_required') is surfaced
+      // separately so callers keep the diagnostic without changing the contract.
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'assurance_too_low', {
+        have_tier: have, need_tier: requiredTier,
+        assurance_tier_source: 'cryptographic_verification',
+        assurance_detail: assurance.reason || null,
+        tier_evidence: { quorum: tierResult.quorum, signoff: tierResult.signoff },
       });
     }
     // The high-risk action packs define material fields that must be observed
@@ -208,7 +322,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     // claim cannot authorize a different real mutation.
     const executionBinding = verifyExecutionBinding({ requirement, receipt, observedAction: observed });
     if (!executionBinding.ok) {
-      return decide(false, RECEIPT_REQUIRED_STATUS, 'execution_binding_failed', { execution_binding: executionBinding, have_tier: have, assurance_tier_source: 'proof' });
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'execution_binding_failed', { execution_binding: executionBinding, have_tier: have, assurance_tier_source: 'cryptographic_verification' });
     }
     // One-time consumption (replay defense). Require a stable, issuer-generated
     // receipt_id — never fall back to a content hash, whose canonicalization can
@@ -232,7 +346,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!fresh) {
       return decide(false, RECEIPT_REQUIRED_STATUS, 'replay_refused', { consumption_key: receiptId });
     }
-    return decide(true, 200, 'allow', { signer: v.signer, outcome: v.outcome, have_tier: have, assurance_tier_source: 'proof', execution_binding: executionBinding, consumption_mode: consumptionMode });
+    return decide(true, 200, 'allow', { signer: v.signer, outcome: v.outcome, have_tier: have, assurance_tier_source: 'cryptographic_verification', execution_binding: executionBinding, consumption_mode: consumptionMode });
   }
 
   /** Express/Connect middleware: refuse the route unless a sufficient receipt is present. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emilia-protocol/gate",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "EMILIA Gate — the Trusted Action Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), a tamper-evident evidence log, default high-risk action packs, execution-field binding, reliance packets, an MCP drop-in, a GitHub system-of-record adapter, and EG-1 conformance. Framework-agnostic, fails closed. Reference implementation, experimental.",
   "license": "Apache-2.0",
   "type": "module",
@@ -65,7 +65,8 @@
     "cf1": "node cf1.mjs"
   },
   "dependencies": {
-    "@emilia-protocol/require-receipt": "^0.5.0"
+    "@emilia-protocol/require-receipt": "^0.5.0",
+    "@emilia-protocol/verify": "^3.3.0"
   },
   "keywords": [
     "emilia",