@emilia-protocol/gate 0.8.0 → 0.9.1

package/enterprise.js

@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — enterprise entitlement layer (EP-GATE-ENTITLEMENT-v1).
+ *
+ * The license key IS an EP-style artifact: a signed entitlement — Ed25519 over
+ * canonical JSON (sorted keys, same idiom as receipts/evidence) of
+ * { org, tier, features[], limits, not_before, expires_at, kid }. Verifiers pin
+ * issuer keys by kid; nothing in the artifact is trusted until the signature
+ * verifies against a pinned key.
+ *
+ * OPEN-CORE SEMANTICS — two different fail directions, by design:
+ *   - The CORE gate is never bricked. No entitlement, an expired one, a
+ *     tampered one, an unknown kid — all resolve to { valid:false,
+ *     tier:'community' } with a machine-readable reason. Community tier always
+ *     works; a licensing failure can never block the firewall itself.
+ *   - Enterprise FEATURES fail closed. `requireFeature` returns true ONLY for
+ *     a cryptographically valid, in-window entitlement that explicitly lists
+ *     the feature. Everything else — including community fallback — is false.
+ *
+ * Pure functions: inputs in, verdict out. Time is injected (`now`), never read
+ * from the wall clock implicitly, so verification is deterministic.
+ */
+import crypto from 'node:crypto';
+
+export const ENTITLEMENT_VERSION = 'EP-GATE-ENTITLEMENT-v1';
+export const ENTITLEMENT_TIERS = ['community', 'team', 'business', 'enterprise', 'regulated'];
+
+/** The tier every failure path resolves to — the gate keeps working on it. */
+const COMMUNITY = 'community';
+
+/** Canonical JSON (recursive sorted keys) — matches @emilia-protocol/verify. */
+function canonical(v) {
+  if (v === null || v === undefined) return JSON.stringify(v);
+  if (Array.isArray(v)) return `[${v.map(canonical).join(',')}]`;
+  if (typeof v === 'object') {
+    return `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonical(v[k])).join(',')}}`;
+  }
+  return JSON.stringify(v);
+}
+
+function toMs(t) {
+  if (t == null) return null;
+  const ms = typeof t === 'number' ? t : Date.parse(t);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+/** Community fallback — every refusal shape is identical and machine-readable. */
+function community(reason, extra = {}) {
+  return { valid: false, tier: COMMUNITY, features: [], limits: null, reason, ...extra };
+}
+
+/**
+ * Mint a signed entitlement (test/ops helper — the licensing service, not the
+ * verifier, holds the private key). Throws on invalid fields: a malformed
+ * license must never be issued, only refused.
+ * @param {crypto.KeyObject} privateKey Ed25519 private key
+ * @param {object} fields { org, tier, features?, limits?, not_before, expires_at, kid }
+ * @returns {{ '@version': string, payload: object, signature: { algorithm: 'Ed25519', value: string } }}
+ */
+export function mintEntitlement(privateKey, {
+  org, tier, features = [], limits = {}, not_before, expires_at, kid,
+} = {}) {
+  if (!org || typeof org !== 'string') throw new Error('entitlement: org is required');
+  if (!ENTITLEMENT_TIERS.includes(tier)) {
+    throw new Error(`entitlement: unknown tier "${tier}" (expected one of ${ENTITLEMENT_TIERS.join('|')})`);
+  }
+  if (!Array.isArray(features) || features.some((f) => typeof f !== 'string')) {
+    throw new Error('entitlement: features must be an array of strings');
+  }
+  if (!limits || typeof limits !== 'object' || Array.isArray(limits)) {
+    throw new Error('entitlement: limits must be an object');
+  }
+  if (toMs(not_before) == null) throw new Error('entitlement: not_before is required (ISO or ms)');
+  if (toMs(expires_at) == null) throw new Error('entitlement: expires_at is required (ISO or ms)');
+  if (!kid || typeof kid !== 'string') throw new Error('entitlement: kid is required');
+  const payload = { org, tier, features, limits, not_before, expires_at, kid };
+  const value = crypto.sign(null, Buffer.from(canonical(payload), 'utf8'), privateKey).toString('base64url');
+  return { '@version': ENTITLEMENT_VERSION, payload, signature: { algorithm: 'Ed25519', value } };
+}
+
+/** Resolve a base64url SPKI-DER key for `kid` from a map or an entry list. */
+function issuerKeyFor(issuerKeys, kid) {
+  if (!issuerKeys) return null;
+  if (Array.isArray(issuerKeys)) {
+    const e = issuerKeys.find((x) => x && x.kid === kid && typeof x.key === 'string');
+    return e ? e.key : null;
+  }
+  const k = issuerKeys[kid];
+  return typeof k === 'string' ? k : null;
+}
+
+/**
+ * Verify an entitlement. NEVER throws for a bad artifact — every failure
+ * resolves to the community tier with a machine-readable reason, so a licensing
+ * problem degrades gracefully instead of bricking the gate. Enterprise features
+ * remain gated by `requireFeature`, which fails closed on any non-valid result.
+ *
+ * @param {object|string|null} entitlementJson the artifact (object or JSON string); absence -> community
+ * @param {object} o
+ * @param {object|Array<{kid:string,key:string}>} o.issuerKeys pinned kid -> base64url SPKI-DER public key
+ * @param {number|string|function} [o.now=Date.now] injected clock (ms, ISO, or () => ms)
+ * @returns {{ valid: boolean, tier: string, features: string[], limits: object|null, reason: string, org?: string, kid?: string }}
+ */
+export function verifyEntitlement(entitlementJson, { issuerKeys, now = Date.now } = {}) {
+  // Absence is NOT an error: the open-core floor. Community keeps working.
+  if (entitlementJson == null || entitlementJson === '') return community('no_entitlement');
+
+  let doc = entitlementJson;
+  if (typeof doc === 'string') {
+    try { doc = JSON.parse(doc); } catch { return community('entitlement_unparseable'); }
+  }
+  if (!doc || typeof doc !== 'object') return community('entitlement_malformed');
+  if (doc['@version'] !== ENTITLEMENT_VERSION) return community('unsupported_version');
+
+  const p = doc.payload;
+  const sig = doc.signature;
+  if (!p || typeof p !== 'object' || !sig || typeof sig !== 'object') return community('entitlement_malformed');
+  if (sig.algorithm !== 'Ed25519' || typeof sig.value !== 'string') return community('unsupported_algorithm');
+  if (!ENTITLEMENT_TIERS.includes(p.tier)) return community('unknown_tier');
+  if (!Array.isArray(p.features) || p.features.some((f) => typeof f !== 'string')) return community('entitlement_malformed');
+
+  // Issuer pinning: the kid must resolve to a PINNED key. An entitlement can
+  // never nominate its own key — unknown kid (or no pins at all) fails closed.
+  const keyB64 = issuerKeyFor(issuerKeys, p.kid);
+  if (!keyB64) return community('unknown_kid', { kid: p.kid ?? null });
+
+  let ok = false;
+  try {
+    const pub = crypto.createPublicKey({ key: Buffer.from(keyB64, 'base64url'), format: 'der', type: 'spki' });
+    ok = crypto.verify(null, Buffer.from(canonical(p), 'utf8'), pub, Buffer.from(sig.value, 'base64url'));
+  } catch { ok = false; }
+  // One reason covers both tampering and a wrong key: the signature does not
+  // verify against the pinned key for this kid.
+  if (!ok) return community('bad_signature', { kid: p.kid });
+
+  // Validity window — checked only AFTER the signature, so the timestamps
+  // themselves are authenticated. Both bounds are required; an unparseable
+  // window fails closed.
+  const nowMs = typeof now === 'function' ? now() : toMs(now);
+  const nbf = toMs(p.not_before);
+  const exp = toMs(p.expires_at);
+  if (nbf == null || exp == null || nowMs == null) return community('invalid_validity_window', { kid: p.kid });
+  if (nowMs < nbf) return community('not_yet_valid', { kid: p.kid, not_before: p.not_before });
+  if (nowMs > exp) return community('expired', { kid: p.kid, expires_at: p.expires_at });
+
+  return {
+    valid: true,
+    tier: p.tier,
+    features: p.features.slice(),
+    limits: (p.limits && typeof p.limits === 'object') ? { ...p.limits } : {},
+    reason: 'entitlement_verified',
+    org: p.org,
+    kid: p.kid,
+    not_before: p.not_before,
+    expires_at: p.expires_at,
+  };
+}
+
+/**
+ * Is `feature` licensed? FAIL CLOSED: true only for a valid entitlement that
+ * explicitly lists the feature. Community fallback, invalid/expired/tampered
+ * artifacts, and unlisted features are all false — no enterprise code path
+ * runs without a live license naming it.
+ * @param {object} verified the result of verifyEntitlement
+ * @param {string} feature
+ * @returns {boolean}
+ */
+export function requireFeature(verified, feature) {
+  if (!verified || verified.valid !== true) return false;
+  if (typeof feature !== 'string' || feature.length === 0) return false;
+  return Array.isArray(verified.features) && verified.features.includes(feature);
+}
+
+export default { mintEntitlement, verifyEntitlement, requireFeature, ENTITLEMENT_VERSION, ENTITLEMENT_TIERS };

package/index.js

@@ -6,8 +6,12 @@
  * action runs ONLY if it arrives with a receipt that is:
  *   1. valid          — Ed25519 over canonical JSON, signed by a pinned issuer;
  *   2. in-scope       — bound to the exact action the manifest guards;
- *   3. sufficiently   — meets the action's required assurance tier
- *      assured           (software / class_a device signoff / quorum);
+ *   3. sufficiently   — meets the action's required assurance tier, and the
+ *      assured           credited tier is CRYPTOGRAPHICALLY VERIFIED, not read
+ *                        from self-asserted payload fields: class_a requires a
+ *                        valid WebAuthn device signoff, quorum requires a valid
+ *                        EP-QUORUM-v1 (distinct humans + distinct keys +
+ *                        threshold + per-signer assertions);
  *   4. fresh          — within max age; and
  *   5. unused         — not a replay (one-time consumption).
  * Otherwise it is refused with a machine-readable Receipt-Required challenge
@@ -32,12 +36,19 @@ const {
   RECEIPT_REQUIRED_STATUS,
   RECEIPT_REQUIRED_HEADER,
 } = await import('@emilia-protocol/require-receipt').catch(() => import('../require-receipt/index.js'));
+// The real per-signer verifiers (WebAuthn device-signoff + M-of-N quorum). The
+// Gate MUST use these to CREDIT class_a / quorum — a receipt's self-asserted
+// outcome string or a fabricated quorum block is NOT proof. Same resolution
+// pattern as require-receipt: prefer the published package, fall back to the
+// in-repo source so the monorepo test/build works without a node_modules link.
+const { verifyWebAuthnSignoff, verifyQuorum } = await import('@emilia-protocol/verify')
+  .catch(() => import('../verify/index.js'));
 import { MemoryConsumptionStore } from './store.js';
 import { createEvidenceLog } from './evidence.js';
 import { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest } from './action-packs.js';
 import { hashCanonical, verifyExecutionBinding } from './execution-binding.js';
-import { buildReliancePacket } from './reliance-packet.js';
-import { createEg1Harness, makeGateInvoke, runEg1, EG1_DEFAULT_SELECTOR } from './eg1-conformance.js';
+import { buildReliancePacket, ADMISSIBILITY_VERDICTS } from './reliance-packet.js';
+import { createEg1Harness, makeGateInvoke, runEg1, EG1_DEFAULT_SELECTOR, mintDeviceSignoff, mintQuorumEvidence } from './eg1-conformance.js';
 import { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
 import { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 import { classifyRetention, buildRetentionExport } from './retention.js';
@@ -61,21 +72,151 @@ export {
   validateActionControlManifest,
 } from './action-control-manifest.js';
 export { EXECUTION_BINDING_VERSION, canonicalize, hashCanonical, materialFieldsFor, verifyExecutionBinding } from './execution-binding.js';
-export { RELIANCE_PACKET_VERSION, buildReliancePacket } from './reliance-packet.js';
+export { RELIANCE_PACKET_VERSION, ADMISSIBILITY_VERDICTS, buildReliancePacket } from './reliance-packet.js';
 export {
   EG1_VERSION, EG1_CHECKS, EG1_DEFAULT_ACTION, EG1_DEFAULT_SELECTOR,
-  createEg1Harness, makeGateInvoke, runEg1,
+  createEg1Harness, makeGateInvoke, runEg1, mintDeviceSignoff, mintQuorumEvidence,
 } from './eg1-conformance.js';
 export { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
 export const ASSURANCE_TIERS = ['software', 'class_a', 'quorum'];
 const TIER_RANK = { software: 0, class_a: 1, quorum: 2 };
 
 /**
- * Return the proof-backed assurance tier. Without pinned approver keys or a
- * caller-supplied verifier, higher tiers are not inferred from receipt fields.
+ * Verify a PRE-COMPUTED reliance packet's admissibility block against a profile
+ * the relying party PINNED. This is the gate's whole job re: admissibility — it
+ * does NOT re-evaluate raw evidence and does NOT define the bar. The relying
+ * party's own evaluator (lib/evidence/admissibility-profiles.js) computes the
+ * verdict OFFLINE against its pinned profile and produces the reliance packet;
+ * the gate only confirms the packet answers the SAME profile_hash and carries an
+ * 'admissible' verdict. Pure, dependency-light, fail-closed.
+ *
+ * @param {{id?:string, profile_hash:string}} pinned  the profile the relying party requires
+ * @param {object|null} presented  a reliance packet, or its `.admissibility` block,
+ *   as produced by buildReliancePacket / the relying party's evaluator
+ * @returns {{ok:boolean, reason:string|null, pinned_hash:string, presented_hash:string|null, verdict:string|null}}
+ *   ok:true ONLY when the presented profile_hash equals the pinned hash AND the
+ *   verdict is exactly 'admissible'. Every other case fails closed with a distinct reason.
+ */
+export function verifyAdmissibilityAgainstPinnedProfile(pinned, presented) {
+  const pinnedHash = pinned && typeof pinned.profile_hash === 'string' ? pinned.profile_hash : null;
+  // A pin with no hash is a misconfiguration: refuse, do not silently pass.
+  if (!pinnedHash) {
+    return { ok: false, reason: 'pinned_profile_missing_hash', pinned_hash: null, presented_hash: null, verdict: null };
+  }
+  // Accept either a full reliance packet (has .admissibility) or the block itself.
+  const adm = presented && typeof presented === 'object'
+    ? (presented.admissibility !== undefined ? presented.admissibility : presented)
+    : null;
+  if (!adm || typeof adm !== 'object') {
+    return { ok: false, reason: 'admissibility_profile_pinned_but_absent', pinned_hash: pinnedHash, presented_hash: null, verdict: null };
+  }
+  const presentedHash = typeof adm.profile_hash === 'string' ? adm.profile_hash : null;
+  const verdict = typeof adm.verdict === 'string' ? adm.verdict : null;
+  // Constant-work equality is unnecessary (hashes are public), but the mismatch
+  // MUST be a distinct, named refusal: a presented verdict for a DIFFERENT bar is
+  // not evidence about the pinned bar.
+  if (presentedHash === null || presentedHash !== pinnedHash) {
+    return { ok: false, reason: 'profile_hash_mismatch', pinned_hash: pinnedHash, presented_hash: presentedHash, verdict };
+  }
+  // Verdict must be recognized AND exactly 'admissible'. Any other closed-set
+  // member (missing_evidence/stale/conflicted/unverifiable), an unrecognized
+  // string, or a missing verdict fails closed and names the verdict it saw.
+  if (verdict === null || !ADMISSIBILITY_VERDICTS.includes(verdict)) {
+    return { ok: false, reason: 'admissibility_verdict_unrecognized', pinned_hash: pinnedHash, presented_hash: presentedHash, verdict };
+  }
+  if (verdict !== 'admissible') {
+    return { ok: false, reason: `admissibility_not_admissible:${verdict}`, pinned_hash: pinnedHash, presented_hash: presentedHash, verdict };
+  }
+  return { ok: true, reason: null, pinned_hash: pinnedHash, presented_hash: presentedHash, verdict };
+}
+
+/**
+ * The assurance tier a receipt has CRYPTOGRAPHICALLY EARNED.
+ *
+ * SECURITY: the credited tier is NEVER inferred from self-asserted payload
+ * fields. A bare `quorum:{signers,threshold}` block or an `outcome:
+ * 'allow_with_signoff'` string with no verifiable signature earns only
+ * `software` — it will be refused `assurance_too_low` by any guard that needs
+ * more. Fail-closed by construction.
+ *
+ * Two independent cryptographic proof shapes are accepted; a receipt earns the
+ * HIGHEST tier any of them proves:
+ *
+ *  (a) Pinned assurance proof (`payload.assurance_proof`, EP-ASSURANCE-PROOF-v1):
+ *      per-signer signatures verified against PINNED approver keys (opts.approverKeys)
+ *      or a caller-supplied verifier (opts.verifyAssurance). This is the primary,
+ *      strongest model — the verifier never trusts a key that travels inside the
+ *      receipt. Delegated to require-receipt's receiptAssuranceTierFromProof.
+ *
+ *  (b) Self-contained embedded evidence (DoD audit fix): a full EP-QUORUM-v1
+ *      document (payload.quorum) whose per-signer WebAuthn assertions verify via
+ *      verifyQuorum (distinct humans + distinct keys + threshold + action-binding
+ *      + window) earns `quorum`; a WebAuthn device signoff (payload.signoff =
+ *      {context, webauthn}) that verifies against the approver's own key via
+ *      verifyWebAuthnSignoff earns `class_a`. Used where the approver keys travel
+ *      with the receipt rather than being pinned by the relying party.
+ *
+ * @param {object} doc  the EP-RECEIPT-v1 document
+ * @param {object} [opts]
+ * @param {object} [opts.approverKeys] pinned approver keys for path (a)
+ * @param {function} [opts.verifyAssurance] custom assurance verifier for path (a)
+ * @param {string} [opts.rpId]  bind embedded device assertions to this WebAuthn RP id (path b)
+ * @param {boolean} [opts.detail] return a {tier, quorum, signoff} object instead of the string
+ * @returns {'software'|'class_a'|'quorum'|object} the highest tier proven
  */
 export function receiptAssuranceTier(doc, opts = {}) {
-  return receiptAssuranceTierFromProof(doc, opts);
+  const detail = { tier: 'software', quorum: null, signoff: null };
+
+  // --- Path (a): pinned assurance proof / caller-supplied verifier. ---
+  // Never inferred from receipt fields without a pinned key or explicit verifier.
+  let proofTier = 'software';
+  try {
+    proofTier = receiptAssuranceTierFromProof(doc, opts) || 'software';
+  } catch { proofTier = 'software'; }
+  if ((TIER_RANK[proofTier] ?? 0) > (TIER_RANK[detail.tier] ?? 0)) detail.tier = proofTier;
+
+  // --- Path (b): self-contained embedded per-signer evidence (DoD audit fix). ---
+  const p = doc?.payload || {};
+  const verifyOpts = opts.rpId ? { rpId: opts.rpId } : {};
+
+  // quorum: a real, self-contained EP-QUORUM-v1 evidence document. Accept it
+  // under payload.quorum or payload.claim.quorum. It only counts if it is a full
+  // quorum document (policy + members with WebAuthn signoffs) AND verifyQuorum
+  // returns valid. A bare {signers,threshold} block has no members to verify and
+  // therefore CANNOT be credited quorum.
+  const q = p.quorum || p.claim?.quorum;
+  if (detail.tier !== 'quorum' && isQuorumEvidence(q)) {
+    const qr = verifyQuorum(q, verifyOpts);
+    detail.quorum = { valid: qr.valid, checks: qr.checks };
+    if (qr.valid) detail.tier = 'quorum';
+  }
+
+  // class_a: a verifiable WebAuthn device signoff. The signoff evidence is
+  // {context, webauthn}; the approver key travels with it (signoff.approver_public_key)
+  // or alongside it (payload.approver_public_key).
+  if ((TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) {
+    const so = p.signoff || p.claim?.signoff;
+    if (isSignoffEvidence(so)) {
+      const key = so.approver_public_key || p.approver_public_key || p.claim?.approver_public_key;
+      if (key) {
+        const sr = verifyWebAuthnSignoff(so, key, verifyOpts);
+        detail.signoff = { valid: sr.valid, checks: sr.checks };
+        if (sr.valid && (TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) detail.tier = 'class_a';
+      }
+    }
+  }
+
+  return opts.detail ? detail : detail.tier;
+}
+
+/** A quorum evidence doc must carry members with per-signer signoffs to be verifiable. */
+function isQuorumEvidence(q) {
+  return !!q && typeof q === 'object' && q.policy && Array.isArray(q.members) && q.members.length > 0
+    && typeof q.action_hash === 'string' && q.action_hash.length > 0;
+}
+/** A device signoff must carry the WebAuthn assertion material to be verifiable. */
+function isSignoffEvidence(s) {
+  return !!s && typeof s === 'object' && s.context && s.webauthn;
 }
 
 /**
@@ -91,7 +232,7 @@ export function receiptAssuranceTier(doc, opts = {}) {
  *   if given it supersedes trustedKeys — a receipt is verified only against keys valid (and not
  *   revoked) at its issuance time.
  */
-export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null } = {}) {
+export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null, rpId = null, requiredAdmissibilityProfile = null } = {}) {
   // Production key custody: a registry (rotation + revocation) supersedes a flat
   // trustedKeys list. A flat list is coerced to an always-valid registry, so
   // existing callers are unchanged.
@@ -118,10 +259,19 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
   }
   const evidence = log || createEvidenceLog({ strict: strictEvidence });
 
-  async function check({ selector = {}, receipt = null, observedAction = null, consumptionMode = 'consume' } = {}) {
+  async function check({ selector = {}, receipt = null, observedAction = null, consumptionMode = 'consume', admissibilityProfile = null, reliancePacket: presentedPacket = null, admissibility = null } = {}) {
     const requirement = manifest ? findActionRequirement(manifest, selector) : null;
     const action = requirement?.action_type || selector.action_type || selector.action || null;
-    const requiredTier = requirement?.assurance_class || selector.assurance_class || 'software';
+    // Assurance tier the action requires (cryptographically checked below). For a
+    // manifest-guarded action the tier MUST be declared explicitly: never fall
+    // back to the weakest 'software' tier because assurance_class was omitted —
+    // that would let a guarded, possibly critical, action accept a bare
+    // machine-signed receipt (a fail-open). A guarded requirement with no tier
+    // is a misconfiguration and fails closed just below. Only selector-only
+    // checks (no manifest requirement) use the documented 'software' default.
+    const requiredTier = requirement
+      ? requirement.assurance_class
+      : (selector.assurance_class || 'software');
     const observed = observedAction || selector.observedAction || selector.actionDetails || null;
 
     async function decide(allow, status, reason, extra = {}) {
@@ -176,6 +326,14 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!receipt) {
       return decide(false, RECEIPT_REQUIRED_STATUS, 'receipt_required');
     }
+    // A manifest-guarded action that declares no assurance_class is a
+    // misconfiguration. Fail CLOSED rather than defaulting to the weakest tier
+    // (which would accept a bare machine-signed receipt for a guarded action).
+    // validateActionRiskManifest also rejects such a manifest at author time;
+    // this is defense in depth for a manifest loaded without re-validation.
+    if (requirement && requirement.receipt_required !== false && !requiredTier) {
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'manifest_missing_assurance_class');
+    }
     // Signature / freshness / action-binding / outcome. Production key custody:
     // resolve the issuer keys valid (and not revoked) at THIS receipt's issuance
     // time. A revoked or out-of-window key is excluded, so its signature does not
@@ -187,20 +345,42 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!v.ok) {
       return decide(false, RECEIPT_REQUIRED_STATUS, `receipt_rejected:${v.reason}`, { rejected: v });
     }
-    // Assurance tier: proof-backed only. A receipt's issuer may describe a human
-    // signoff, but high-tier enforcement requires pinned approver proof or an
-    // explicit verifier hook. Self-asserted `allow_with_signoff` / `quorum`
-    // fields are software-tier until proven.
+    // Assurance tier. CRYPTOGRAPHICALLY VERIFIED — never inferred from
+    // self-asserted payload fields. The credited tier is the HIGHER of two
+    // independent proof paths:
+    //   (a) pinned assurance proof (payload.assurance_proof verified against
+    //       pinned approverKeys) or a caller-supplied verifyAssurance hook;
+    //   (b) self-contained embedded per-signer evidence (EP-QUORUM-v1 /
+    //       WebAuthn device signoff) re-verified via verifyQuorum /
+    //       verifyWebAuthnSignoff (DoD audit fix).
+    // A receipt that only CLAIMS a higher tier earns 'software' and is refused.
     const assurance = evaluateReceiptAssurance(receipt, requiredTier, {
       approverKeys: approver_keys || approverKeys,
       verifyAssurance,
     });
-    const have = assurance.have;
-    if (!assurance.ok || (TIER_RANK[have] ?? 0) < (TIER_RANK[requiredTier] ?? 0)) {
-      return decide(false, RECEIPT_REQUIRED_STATUS, assurance.reason || 'assurance_too_low', {
-        have_tier: have,
-        need_tier: requiredTier,
-        assurance_tier_source: 'proof',
+    const tierResult = receiptAssuranceTier(receipt, {
+      rpId, detail: true, approverKeys: approver_keys || approverKeys, verifyAssurance,
+    });
+    // Take the strongest tier either path proves.
+    const have = (TIER_RANK[assurance.have] ?? 0) >= (TIER_RANK[tierResult.tier] ?? 0)
+      ? assurance.have : tierResult.tier;
+    const needRank = TIER_RANK[requiredTier];
+    // Fail CLOSED on an unknown / mis-cased required tier: never silently treat
+    // it as 'software'. If a manifest asks for a tier this gate does not model,
+    // no receipt can satisfy it.
+    if (needRank === undefined) {
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'unknown_required_tier', { have_tier: have, need_tier: requiredTier, assurance_tier_source: 'cryptographic_verification' });
+    }
+    if ((TIER_RANK[have] ?? 0) < needRank) {
+      // The credited tier (from either proof path) is below what the action
+      // requires. The canonical machine-readable reason is 'assurance_too_low';
+      // main's proof-path detail (e.g. 'assurance_proof_required') is surfaced
+      // separately so callers keep the diagnostic without changing the contract.
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'assurance_too_low', {
+        have_tier: have, need_tier: requiredTier,
+        assurance_tier_source: 'cryptographic_verification',
+        assurance_detail: assurance.reason || null,
+        tier_evidence: { quorum: tierResult.quorum, signoff: tierResult.signoff },
       });
     }
     // The high-risk action packs define material fields that must be observed
@@ -208,7 +388,30 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     // claim cannot authorize a different real mutation.
     const executionBinding = verifyExecutionBinding({ requirement, receipt, observedAction: observed });
     if (!executionBinding.ok) {
-      return decide(false, RECEIPT_REQUIRED_STATUS, 'execution_binding_failed', { execution_binding: executionBinding, have_tier: have, assurance_tier_source: 'proof' });
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'execution_binding_failed', { execution_binding: executionBinding, have_tier: have, assurance_tier_source: 'cryptographic_verification' });
+    }
+    // OPT-IN admissibility pinning. When the caller pins a required admissibility
+    // profile {id, profile_hash} (gate-level requiredAdmissibilityProfile, a
+    // per-call admissibilityProfile, or selector.admissibilityProfile), the gate
+    // REFUSES unless a presented reliance packet's admissibility block was computed
+    // against the SAME pinned profile_hash AND carries an 'admissible' verdict. The
+    // gate does NOT re-evaluate raw evidence and does NOT define the bar — the
+    // relying party's own evaluator produced the verdict OFFLINE against its pinned
+    // profile. Checked BEFORE consumption so a mismatch never burns the receipt.
+    // When no profile is pinned, this whole block is inert — behavior is
+    // byte-for-byte unchanged from the pre-admissibility gate.
+    const pinnedProfile = admissibilityProfile || selector.admissibilityProfile || requiredAdmissibilityProfile;
+    if (pinnedProfile) {
+      const presentedAdmissibility = admissibility ?? presentedPacket ?? selector.reliancePacket ?? selector.admissibility ?? null;
+      const adm = verifyAdmissibilityAgainstPinnedProfile(pinnedProfile, presentedAdmissibility);
+      if (!adm.ok) {
+        return decide(false, RECEIPT_REQUIRED_STATUS, adm.reason, {
+          admissibility_check: adm,
+          pinned_profile: { id: pinnedProfile.id ?? null, profile_hash: pinnedProfile.profile_hash ?? null },
+          have_tier: have,
+          assurance_tier_source: 'cryptographic_verification',
+        });
+      }
     }
     // One-time consumption (replay defense). Require a stable, issuer-generated
     // receipt_id — never fall back to a content hash, whose canonicalization can
@@ -232,7 +435,16 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     if (!fresh) {
       return decide(false, RECEIPT_REQUIRED_STATUS, 'replay_refused', { consumption_key: receiptId });
     }
-    return decide(true, 200, 'allow', { signer: v.signer, outcome: v.outcome, have_tier: have, assurance_tier_source: 'proof', execution_binding: executionBinding, consumption_mode: consumptionMode });
+    const allowExtra = { signer: v.signer, outcome: v.outcome, have_tier: have, assurance_tier_source: 'cryptographic_verification', execution_binding: executionBinding, consumption_mode: consumptionMode };
+    // Carry the admissibility block (from the presented packet) onto the decision
+    // so a reliance packet built from this decision embeds the verdict the relying
+    // party's evaluator computed. Only when something was actually presented.
+    const presentedAdmForAllow = admissibility ?? presentedPacket ?? selector.reliancePacket ?? selector.admissibility ?? null;
+    if (presentedAdmForAllow) {
+      const admBlock = presentedAdmForAllow.admissibility !== undefined ? presentedAdmForAllow.admissibility : presentedAdmForAllow;
+      if (admBlock) allowExtra.admissibility = admBlock;
+    }
+    return decide(true, 200, 'allow', allowExtra);
   }
 
   /** Express/Connect middleware: refuse the route unless a sufficient receipt is present. */
@@ -286,9 +498,9 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
    * If the side effect throws, the reservation is released so the approval can
    * be retried safely.
    */
-  async function run({ selector = {}, receipt = null, observedAction = null } = {}, fn, opts = {}) {
+  async function run({ selector = {}, receipt = null, observedAction = null, admissibilityProfile = null, reliancePacket: presentedPacket = null, admissibility = null } = {}, fn, opts = {}) {
     if (typeof fn !== 'function') throw new Error('EMILIA Gate run(): fn is required');
-    const authorization = await check({ selector, receipt, observedAction, consumptionMode: 'reserve' });
+    const authorization = await check({ selector, receipt, observedAction, consumptionMode: 'reserve', admissibilityProfile, reliancePacket: presentedPacket, admissibility });
     if (!authorization.allow) {
       return { ok: false, status: authorization.status, body: authorization.challenge, authorization };
     }
@@ -327,7 +539,13 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
       const observedAction = typeof opts.observedAction === 'function'
         ? opts.observedAction(...args)
         : (opts.observedAction || selector.observedAction || null);
-      const out = await run({ selector, receipt, observedAction }, () => fn(...args), { recordExecution: opts.recordExecution });
+      const admissibilityProfile = typeof opts.admissibilityProfile === 'function'
+        ? opts.admissibilityProfile(...args)
+        : (opts.admissibilityProfile ?? null);
+      const presentedPacket = typeof opts.reliancePacket === 'function'
+        ? opts.reliancePacket(...args)
+        : (opts.reliancePacket ?? opts.admissibility ?? null);
+      const out = await run({ selector, receipt, observedAction, admissibilityProfile, reliancePacket: presentedPacket }, () => fn(...args), { recordExecution: opts.recordExecution });
       if (!out.ok) {
         const e = new Error(`EMILIA Gate refused (${out.authorization.reason})`);
         e.code = 'EMILIA_RECEIPT_REQUIRED';
@@ -338,13 +556,22 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     };
   }
 
-  function reliancePacket({ authorization, execution = null, binding = null } = {}) {
+  function reliancePacket({ authorization, execution = null, binding = null, admissibility = null } = {}) {
+    // The admissibility block rides on the authorization decision's evidence when
+    // a reliance packet was presented at check() time; an explicit `admissibility`
+    // arg overrides it. buildReliancePacket fails closed on a non-'admissible'
+    // block, so a do_not_rely verdict can never be laundered into rely here.
+    const adm = admissibility
+      ?? authorization?.evidence?.admissibility
+      ?? authorization?.admissibility
+      ?? null;
     return buildReliancePacket({
       decision: authorization,
       execution,
       evidence,
       manifest,
       binding,
+      admissibility: adm,
     });
   }
 
@@ -446,6 +673,8 @@ export default {
   createGate,
   createTrustedActionFirewall,
   receiptAssuranceTier,
+  verifyAdmissibilityAgainstPinnedProfile,
+  ADMISSIBILITY_VERDICTS,
   MemoryConsumptionStore,
   createEvidenceLog,
   ASSURANCE_TIERS,