@emilia-protocol/gate 0.8.0 → 0.9.1

package/deploy/terraform/main.tf

@@ -0,0 +1,256 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# EMILIA Gate — reference Terraform module (EP-GATE-TF-v1).
+#
+# The Terraform sibling of the Helm chart (deploy/helm, EP-GATE-HELM-v1) for
+# BYOC installs: the deployer's cluster, the deployer's keys. Same container
+# contract as the chart — EP_GATE_* env, the action-risk manifest mounted at
+# /etc/emilia-gate/action-risk-manifest.json, pinned issuer keys arriving as
+# EP_GATE_ISSUER_KEYS from a Secret the DEPLOYER created. Three resources,
+# nothing hidden:
+#
+#   kubernetes_config_map_v1.manifest — the action-risk manifest (policy);
+#   kubernetes_deployment_v1.gate     — the gate pods, hardened defaults
+#     (non-root, read-only rootfs, no privilege escalation, all capabilities
+#     dropped, no service-account token);
+#   kubernetes_service_v1.gate        — cluster-internal Service in front of
+#     the pods (ClusterIP by default).
+#
+# Fail-closed wiring:
+#   - the issuer-keys secretKeyRef is NOT optional: if the deployer has not
+#     provisioned pinned issuer keys, the pods do not start — a gate without
+#     pinned issuers must never come up permissive;
+#   - EP_GATE_EVIDENCE_STRICT defaults to true: the gate refuses to authorize
+#     an action it cannot durably account for;
+#   - the manifest is validated as JSON at plan time (see variables.tf) and a
+#     sha256 of it is annotated onto the pod template, so every manifest change
+#     rolls the pods — a stale policy can't keep serving silently.
+
+locals {
+  module_version = "EP-GATE-TF-v1"
+
+  labels = merge({
+    "app.kubernetes.io/name"            = var.name
+    "app.kubernetes.io/component"       = "trusted-action-firewall"
+    "app.kubernetes.io/part-of"         = "emilia-protocol"
+    "emiliaprotocol.ai/module-contract" = local.module_version
+    "emiliaprotocol.ai/maturity"        = "experimental"
+  }, var.extra_labels)
+
+  selector_labels = {
+    "app.kubernetes.io/name"      = var.name
+    "app.kubernetes.io/component" = "trusted-action-firewall"
+  }
+
+  # Same paths as the Helm chart's container contract.
+  manifest_mount_dir = "/etc/emilia-gate"
+  manifest_file      = "action-risk-manifest.json"
+}
+
+# The policy the gate enforces. Plain ConfigMap: the manifest is deny-by-default
+# POLICY, not a secret — auditors should be able to read it in-cluster.
+resource "kubernetes_config_map_v1" "manifest" {
+  metadata {
+    name      = "${var.name}-manifest"
+    namespace = var.namespace
+    labels    = local.labels
+  }
+
+  data = {
+    (local.manifest_file) = var.manifest_json
+  }
+}
+
+resource "kubernetes_deployment_v1" "gate" {
+  metadata {
+    name      = var.name
+    namespace = var.namespace
+    labels    = local.labels
+  }
+
+  spec {
+    replicas = var.replicas
+
+    selector {
+      match_labels = local.selector_labels
+    }
+
+    template {
+      metadata {
+        labels = local.labels
+        annotations = {
+          # Roll the pods whenever the policy changes.
+          "emiliaprotocol.ai/manifest-sha256" = sha256(var.manifest_json)
+        }
+      }
+
+      spec {
+        # The gate does not call the Kubernetes API; no token, no ambient authority.
+        automount_service_account_token = false
+
+        security_context {
+          run_as_non_root = true
+          run_as_user     = var.run_as_user
+          run_as_group    = var.run_as_user
+          fs_group        = var.run_as_user
+
+          seccomp_profile {
+            type = "RuntimeDefault"
+          }
+        }
+
+        container {
+          name              = "gate"
+          image             = var.image
+          image_pull_policy = var.image_pull_policy
+
+          port {
+            name           = "http"
+            container_port = var.port
+            protocol       = "TCP"
+          }
+
+          env {
+            name  = "NODE_ENV"
+            value = "production"
+          }
+
+          env {
+            name  = "EP_GATE_PORT"
+            value = tostring(var.port)
+          }
+
+          env {
+            name  = "EP_GATE_LOG_LEVEL"
+            value = var.log_level
+          }
+
+          # Strict evidence log: never authorize an action the gate cannot
+          # durably account for.
+          env {
+            name  = "EP_GATE_EVIDENCE_STRICT"
+            value = tostring(var.evidence_strict)
+          }
+
+          env {
+            name  = "EP_GATE_MANIFEST_PATH"
+            value = "${local.manifest_mount_dir}/${local.manifest_file}"
+          }
+
+          env {
+            name  = "EP_GATE_METRICS_ENABLED"
+            value = tostring(var.metrics_enabled)
+          }
+
+          # Pinned issuer keys — REFERENCED from an existing Secret, never
+          # passed through Terraform. optional=false is the fail-closed
+          # switch: no pinned issuers, no pods.
+          env {
+            name = "EP_GATE_ISSUER_KEYS"
+            value_from {
+              secret_key_ref {
+                name     = var.issuer_keys_secret_name
+                key      = var.issuer_keys_secret_key
+                optional = false
+              }
+            }
+          }
+
+          dynamic "env" {
+            for_each = var.extra_env
+            content {
+              name  = env.key
+              value = env.value
+            }
+          }
+
+          volume_mount {
+            name       = "action-risk-manifest"
+            mount_path = local.manifest_mount_dir
+            read_only  = true
+          }
+
+          # Writable scratch for the runtime; rootfs stays read-only.
+          volume_mount {
+            name       = "tmp"
+            mount_path = "/tmp"
+          }
+
+          resources {
+            requests = var.resources.requests
+            limits   = var.resources.limits
+          }
+
+          dynamic "liveness_probe" {
+            for_each = var.liveness_path == null ? [] : [var.liveness_path]
+            content {
+              http_get {
+                path = liveness_probe.value
+                port = "http"
+              }
+              initial_delay_seconds = 5
+              period_seconds        = 10
+              timeout_seconds       = 2
+              failure_threshold     = 3
+            }
+          }
+
+          dynamic "readiness_probe" {
+            for_each = var.readiness_path == null ? [] : [var.readiness_path]
+            content {
+              http_get {
+                path = readiness_probe.value
+                port = "http"
+              }
+              initial_delay_seconds = 5
+              period_seconds        = 10
+              timeout_seconds       = 2
+              failure_threshold     = 3
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+            read_only_root_filesystem  = var.read_only_root_filesystem
+
+            capabilities {
+              drop = ["ALL"]
+            }
+          }
+        }
+
+        volume {
+          name = "action-risk-manifest"
+          config_map {
+            name = kubernetes_config_map_v1.manifest.metadata[0].name
+          }
+        }
+
+        volume {
+          name = "tmp"
+          empty_dir {}
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service_v1" "gate" {
+  metadata {
+    name      = var.name
+    namespace = var.namespace
+    labels    = local.labels
+  }
+
+  spec {
+    type     = var.service_type
+    selector = local.selector_labels
+
+    port {
+      name        = "http"
+      port        = var.service_port
+      target_port = "http"
+      protocol    = "TCP"
+    }
+  }
+}

package/deploy/terraform/outputs.tf

@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# EMILIA Gate — reference Terraform module (EP-GATE-TF-v1) — outputs.
+
+output "module_version" {
+  description = "Versioned identifier of this reference module."
+  value       = "EP-GATE-TF-v1"
+}
+
+output "service_name" {
+  description = "Name of the Kubernetes Service fronting the gate."
+  value       = kubernetes_service_v1.gate.metadata[0].name
+}
+
+output "namespace" {
+  description = "Namespace the gate is deployed into."
+  value       = kubernetes_service_v1.gate.metadata[0].namespace
+}
+
+output "service_endpoint" {
+  description = "In-cluster HTTP endpoint of the gate (cluster-DNS form). Point guarded callers at this."
+  value       = "http://${kubernetes_service_v1.gate.metadata[0].name}.${kubernetes_service_v1.gate.metadata[0].namespace}.svc.cluster.local:${var.service_port}"
+}
+
+output "deployment_name" {
+  description = "Name of the gate Deployment."
+  value       = kubernetes_deployment_v1.gate.metadata[0].name
+}
+
+output "manifest_config_map_name" {
+  description = "Name of the ConfigMap carrying the action-risk manifest."
+  value       = kubernetes_config_map_v1.manifest.metadata[0].name
+}

package/deploy/terraform/variables.tf

@@ -0,0 +1,205 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# EMILIA Gate — reference Terraform module (EP-GATE-TF-v1) — inputs.
+#
+# KEY CUSTODY RULE (non-negotiable): issuer public keys are consumed from an
+# EXISTING Kubernetes Secret that the deployer creates and controls. This
+# module takes the secret's NAME only. It never accepts key material inline,
+# never creates a Secret, and never reads secret data — so no key bytes ever
+# enter Terraform state, plan output, or version control via this module.
+
+variable "name" {
+  description = "Base name for all resources (Deployment, Service, ConfigMap prefix)."
+  type        = string
+  default     = "emilia-gate"
+
+  validation {
+    condition     = can(regex("^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", var.name)) && length(var.name) <= 53
+    error_message = "name must be a DNS-1123 label (lowercase alphanumerics and '-', max 53 chars to leave room for suffixes)."
+  }
+}
+
+variable "namespace" {
+  description = "Kubernetes namespace to deploy into. Must already exist — this module does not create namespaces."
+  type        = string
+  default     = "default"
+
+  validation {
+    condition     = can(regex("^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", var.namespace))
+    error_message = "namespace must be a DNS-1123 label."
+  }
+}
+
+variable "image" {
+  description = "Container image for the gate (registry/repo:tag or @digest). BYOC: build and push your own image; pin a digest or exact tag for production — never a floating tag."
+  type        = string
+
+  validation {
+    condition     = length(trimspace(var.image)) > 0
+    error_message = "image is required."
+  }
+}
+
+variable "image_pull_policy" {
+  description = "Kubernetes imagePullPolicy for the gate container."
+  type        = string
+  default     = "IfNotPresent"
+
+  validation {
+    condition     = contains(["Always", "IfNotPresent", "Never"], var.image_pull_policy)
+    error_message = "image_pull_policy must be one of Always, IfNotPresent, Never."
+  }
+}
+
+variable "replicas" {
+  description = "Number of gate replicas. Replay defense across >1 replica requires a shared consumption store (see README) — the module deploys the pods either way, but fleet-safety is the deployer's configuration responsibility."
+  type        = number
+  default     = 2
+
+  validation {
+    condition     = var.replicas >= 1 && floor(var.replicas) == var.replicas
+    error_message = "replicas must be a whole number >= 1."
+  }
+}
+
+variable "manifest_json" {
+  description = "The action-risk manifest (EP-ACTION-RISK-MANIFEST) as a JSON string — the deny-by-default policy the gate enforces. Rendered into a ConfigMap and mounted read-only. Must parse as JSON and contain an \"actions\" array; an unparseable manifest fails at plan time, not in the cluster."
+  type        = string
+
+  validation {
+    condition     = can(jsondecode(var.manifest_json)) && can(jsondecode(var.manifest_json).actions)
+    error_message = "manifest_json must be valid JSON with an \"actions\" field (EP-ACTION-RISK-MANIFEST shape)."
+  }
+}
+
+variable "issuer_keys_secret_name" {
+  description = "Name of an EXISTING Kubernetes Secret (in the same namespace) holding the pinned issuer public keys the gate trusts. Referenced by name only — key material must NEVER be passed to Terraform. Exposed to the container as EP_GATE_ISSUER_KEYS via a non-optional secretKeyRef: pods do not start without it (fail closed — a gate with no pinned issuers must never come up permissive)."
+  type        = string
+
+  validation {
+    # DNS-1123 subdomain. This also structurally rejects pasted key material
+    # (PEM headers, JSON, base64url with '_') landing in this variable.
+    condition     = can(regex("^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$", var.issuer_keys_secret_name)) && length(var.issuer_keys_secret_name) <= 253
+    error_message = "issuer_keys_secret_name must be the NAME of an existing Secret (DNS-1123 subdomain). Never inline key material here."
+  }
+}
+
+variable "issuer_keys_secret_key" {
+  description = "Key inside the issuer-keys Secret that holds the pinned keys (a JSON array of base64url SPKI-DER Ed25519 public keys, or a {kid: key} map). Matches the Helm chart's issuerKeys.secretKey."
+  type        = string
+  default     = "issuer-keys.json"
+
+  validation {
+    condition     = length(trimspace(var.issuer_keys_secret_key)) > 0
+    error_message = "issuer_keys_secret_key must be non-empty."
+  }
+}
+
+variable "port" {
+  description = "Port the gate HTTP service listens on inside the container (EP_GATE_PORT). Matches the Helm chart's gate.port."
+  type        = number
+  default     = 8080
+
+  validation {
+    condition     = var.port >= 1 && var.port <= 65535
+    error_message = "port must be 1-65535."
+  }
+}
+
+variable "service_port" {
+  description = "Port the Service exposes inside the cluster."
+  type        = number
+  default     = 8080
+
+  validation {
+    condition     = var.service_port >= 1 && var.service_port <= 65535
+    error_message = "service_port must be 1-65535."
+  }
+}
+
+variable "service_type" {
+  description = "Kubernetes Service type. ClusterIP (default) keeps the gate cluster-internal; anything more exposed is the deployer's explicit choice."
+  type        = string
+  default     = "ClusterIP"
+
+  validation {
+    condition     = contains(["ClusterIP", "NodePort", "LoadBalancer"], var.service_type)
+    error_message = "service_type must be one of ClusterIP, NodePort, LoadBalancer."
+  }
+}
+
+variable "log_level" {
+  description = "Gate log verbosity (EP_GATE_LOG_LEVEL)."
+  type        = string
+  default     = "info"
+
+  validation {
+    condition     = contains(["error", "warn", "info", "debug"], var.log_level)
+    error_message = "log_level must be one of error, warn, info, debug."
+  }
+}
+
+variable "evidence_strict" {
+  description = "Strict evidence log (EP_GATE_EVIDENCE_STRICT): when true the gate fails CLOSED if a decision record cannot be durably written — it never authorizes an action it cannot account for. Keep true."
+  type        = bool
+  default     = true
+}
+
+variable "metrics_enabled" {
+  description = "Sets EP_GATE_METRICS_ENABLED. Scrape wiring (ServiceMonitor etc.) is out of scope for this module — see the Helm chart."
+  type        = bool
+  default     = false
+}
+
+variable "liveness_path" {
+  description = "HTTP path for the liveness probe. Set to null to disable."
+  type        = string
+  default     = "/healthz"
+}
+
+variable "readiness_path" {
+  description = "HTTP path for the readiness probe. Set to null to disable."
+  type        = string
+  default     = "/readyz"
+}
+
+variable "resources" {
+  description = "Container resource requests/limits (Kubernetes quantity strings)."
+  type = object({
+    requests = map(string)
+    limits   = map(string)
+  })
+  default = {
+    requests = { cpu = "100m", memory = "128Mi" }
+    limits   = { cpu = "500m", memory = "256Mi" }
+  }
+}
+
+variable "run_as_user" {
+  description = "UID/GID the gate container runs as (must be non-root; the pod security context enforces runAsNonRoot). Matches the Helm chart's default of 10001."
+  type        = number
+  default     = 10001
+
+  validation {
+    condition     = var.run_as_user > 0
+    error_message = "run_as_user must be non-zero: the gate never runs as root."
+  }
+}
+
+variable "read_only_root_filesystem" {
+  description = "Mount the container's root filesystem read-only (hardened default). A writable emptyDir is mounted at /tmp for runtime scratch either way."
+  type        = bool
+  default     = true
+}
+
+variable "extra_env" {
+  description = "Additional plain-text environment variables for the gate container (e.g. a durable consumption-store URL host/port). Do NOT put secrets here — values in this map land in Terraform state. Reference deployer-managed Secrets instead."
+  type        = map(string)
+  default     = {}
+}
+
+variable "extra_labels" {
+  description = "Additional labels merged onto every resource."
+  type        = map(string)
+  default     = {}
+}

package/deploy/terraform/versions.tf

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# EMILIA Gate — reference Terraform module (EP-GATE-TF-v1).
+# Provider and core version constraints. The kubernetes provider is the ONLY
+# provider this module uses: everything lands in the deployer's own cluster,
+# authenticated with the deployer's own credentials. No EMILIA-hosted backend,
+# no remote state requirement, no callbacks.
+
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 2.23.0, < 3.0.0"
+    }
+  }
+}

package/eg1-conformance.js

@@ -43,6 +43,80 @@ const canon = (v) => (v == null ? JSON.stringify(v)
 const sha256Hex = (v) => crypto.createHash('sha256').update(v, 'utf8').digest('hex');
 const sha256Bytes = (v) => crypto.createHash('sha256').update(v).digest();
 
+const RP_ID = 'emiliaprotocol.ai';
+
+/**
+ * Mint a GENUINE WebAuthn ECDSA-P256 device signoff over an authorization
+ * context — the same structure @emilia-protocol/verify verifyWebAuthnSignoff
+ * checks. This is what earns a receipt its class_a tier: a real per-signer
+ * assertion, not a self-asserted `outcome` string. Used to build the Class-A and
+ * quorum evidence the EG-1 harness embeds so the Gate can CRYPTOGRAPHICALLY
+ * credit the tier.
+ */
+export function mintDeviceSignoff({ actionHash, approver, issuedAtMs = Date.now(), nonce, prevContextHash = undefined } = {}) {
+  const signer = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+  const context = {
+    ep_version: '1.0', context_type: 'ep.signoff.v1',
+    action_hash: actionHash,
+    policy: 'policy_eg1',
+    nonce: nonce || ('sig_' + crypto.randomBytes(16).toString('hex')),
+    approver,
+    initiator: 'ent_agent_eg1',
+    issued_at: new Date(issuedAtMs).toISOString(),
+    expires_at: new Date(issuedAtMs + 5 * 60_000).toISOString(),
+    ...(prevContextHash !== undefined ? { prev_context_hash: prevContextHash } : {}),
+  };
+  const challenge = crypto.createHash('sha256').update(canon(context), 'utf8').digest().toString('base64url');
+  const clientData = Buffer.from(JSON.stringify({ type: 'webauthn.get', challenge, origin: `https://www.${RP_ID}` }), 'utf8');
+  const authData = Buffer.concat([
+    crypto.createHash('sha256').update(RP_ID, 'utf8').digest(),
+    Buffer.from([0x05]), // UP | UV
+    Buffer.from([0, 0, 0, 1]),
+  ]);
+  const signed = Buffer.concat([authData, crypto.createHash('sha256').update(clientData).digest()]);
+  const signature = crypto.sign('sha256', signed, signer.privateKey).toString('base64url');
+  return {
+    signoff: {
+      '@type': 'ep.signoff',
+      context,
+      webauthn: {
+        authenticator_data: authData.toString('base64url'),
+        client_data_json: clientData.toString('base64url'),
+        signature,
+      },
+      approver_public_key: signer.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+    },
+    approver_public_key: signer.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+    context,
+  };
+}
+
+/**
+ * Mint a GENUINE EP-QUORUM-v1 evidence document: N distinct humans, each on a
+ * distinct device key, each with a real WebAuthn assertion bound to the SAME
+ * action_hash, within a window. verifyQuorum returns valid for it. This is what
+ * earns a receipt its `quorum` tier — never a bare {signers,threshold} block.
+ */
+export function mintQuorumEvidence({ actionHash, threshold = 2, approvers, issuedAtMs = Date.now() } = {}) {
+  const people = approvers || Array.from({ length: threshold }, (_, i) => ({ role: `approver_${i + 1}`, approver: `ep:approver:eg1_${i + 1}` }));
+  const members = people.map((p, i) => {
+    const s = mintDeviceSignoff({ actionHash, approver: p.approver, issuedAtMs: issuedAtMs + i * 1000 });
+    return { role: p.role, approver_public_key: s.approver_public_key, signoff: { '@type': s.signoff['@type'], context: s.signoff.context, webauthn: s.signoff.webauthn } };
+  });
+  return {
+    '@type': 'ep.quorum',
+    action_hash: actionHash,
+    policy: {
+      mode: 'threshold',
+      required: threshold,
+      approvers: people,
+      distinct_humans: true,
+      window_sec: 900,
+    },
+    members,
+  };
+}
+
 // The default high-risk action EG-1 exercises: a Class-A money movement, which
 // the default gate manifest guards (selector { protocol:'mcp', tool:'release_payment' }).
 export const EG1_DEFAULT_SELECTOR = Object.freeze({ protocol: 'mcp', tool: 'release_payment' });
@@ -87,6 +161,10 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
   let counter = 0;
   const nowMs = () => (typeof now === 'function' ? now() : now);
 
+  // The action_hash the self-contained human device assertions are bound to.
+  // Derived from the action so the signoff/quorum evidence is about THIS action.
+  const actionHash = crypto.createHash('sha256').update(canon(action), 'utf8').digest('hex');
+
   function assuranceContext(payload) {
     return {
       '@version': 'EP-ASSURANCE-CONTEXT-v1',
@@ -140,26 +218,46 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
   /**
    * Mint a scenario receipt.
    * @param {object} o
-   * @param {'allow'|'allow_with_signoff'} [o.outcome] 'allow'=software, 'allow_with_signoff'=Class-A
-   * @param {object} [o.quorum] a quorum block (signers/threshold) -> quorum tier
+   * @param {'allow'|'allow_with_signoff'} [o.outcome] 'allow'=software; 'allow_with_signoff'
+   *   embeds a REAL WebAuthn device signoff so the receipt cryptographically earns class_a.
+   * @param {object|boolean} [o.quorum] request quorum-tier evidence. Truthy -> a REAL
+   *   EP-QUORUM-v1 doc (distinct humans + distinct keys + per-signer assertions). If an
+   *   object with `threshold`/`signers`, its size sets the quorum size.
+   * @param {boolean} [o.fakeQuorum] embed an UNVERIFIABLE self-asserted quorum block
+   *   ({signers,threshold}) with no per-signer signatures — used to prove the Gate
+   *   REFUSES it (must NOT be credited quorum). For adversarial tests only.
    * @param {object} [o.tamper] fields assigned to the claim AFTER signing (breaks the signature)
    */
-  function mint({ outcome = 'allow_with_signoff', quorum = null, tamper = null, extra = {} } = {}) {
+  function mint({ outcome = 'allow_with_signoff', quorum = null, fakeQuorum = false, tamper = null, extra = {} } = {}) {
+    const claim = { ...action, outcome, approver: 'ep:approver:eg1', ...extra };
     const payload = {
       receipt_id: `${idPrefix}_${++counter}`,
       subject: 'agent:eg1-conformance',
       issuer: 'ep:org:eg1',
       created_at: new Date(nowMs()).toISOString(),
-      claim: {
-        ...action,
-        outcome,
-        approver: 'ep:approver:eg1',
-        ...(quorum ? { quorum } : {}),
-        ...extra,
-      },
+      claim,
     };
-    if (outcome === 'allow_with_signoff' || quorum) {
+    if (fakeQuorum) {
+      // Self-asserted ONLY — NO members / NO signatures / NO pinned proof. The
+      // Gate must refuse to credit this as quorum (assurance_too_low). For
+      // adversarial tests that prove payload claims are never trusted.
+      payload.quorum = { signers: ['ep:a', 'ep:b'], threshold: 2 };
+    } else if (outcome === 'allow_with_signoff' || quorum) {
+      // Genuine, per-signer-verifiable evidence. The PRIMARY proof is the pinned
+      // EP-ASSURANCE-PROOF-v1 (verified against the harness's pinned approverKeys),
+      // which is what the EG-1 gate/custody path checks. We ALSO embed self-contained
+      // evidence (EP-QUORUM-v1 / WebAuthn device signoff) so a relying party that
+      // does NOT pin keys can still cryptographically credit the tier (DoD audit fix).
       payload.assurance_proof = assuranceProof(payload, quorum);
+      if (quorum) {
+        const threshold = Number.isInteger(quorum.threshold) ? quorum.threshold
+          : (Array.isArray(quorum.signers) ? quorum.signers.length : 2);
+        payload.quorum = mintQuorumEvidence({ actionHash, threshold, issuedAtMs: nowMs() });
+      } else {
+        const s = mintDeviceSignoff({ actionHash, approver: 'ep:approver:eg1', issuedAtMs: nowMs() });
+        payload.signoff = s.signoff;
+        payload.approver_public_key = s.approver_public_key;
+      }
     }
     const value = crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url');
     const receipt = { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value } };
@@ -167,7 +265,7 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
     return receipt;
   }
 
-  return { publicKey: pub, approverKeys, mint, action, now: nowMs };
+  return { publicKey: pub, approverKeys, mint, action, actionHash, now: nowMs };
 }
 
 /**
@@ -270,4 +368,4 @@ export async function runEg1({ invoke, harness, action } = {}) {
   };
 }
 
-export default { EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR, createEg1Harness, makeGateInvoke, runEg1 };
+export default { EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR, createEg1Harness, makeGateInvoke, runEg1, mintDeviceSignoff, mintQuorumEvidence };