@emilia-protocol/gate 0.9.2 → 0.9.4

package/evidence.js

@@ -1,5 +1,5 @@
 /**
- * @emilia-protocol/gate — evidence log (tamper-evident audit of decisions).
+ * @emilia-protocol/gate — evidence log (tamper-detecting audit of decisions).
  * @license Apache-2.0
  *
  * Every gate decision — allow or deny — appends a hash-chained record. Each
@@ -7,7 +7,10 @@
  * breaks the chain and `verify()` catches it. This is the compliance and
  * insurance artifact: a provable account of exactly which consequential actions
  * were authorized, refused, and why. Default sink is in-memory; pass `sink` to
- * stream records to durable/append-only storage.
+ * stream records to storage. This local chain detects alteration only when the
+ * verifier receives its complete history from genesis; a sink alone cannot
+ * prevent truncation, restart-from-genesis, or cross-replica forks. Use
+ * createAtomicEvidenceLog for a shared production head.
  *
  * Hashing is over CANONICAL JSON (sorted keys) so the same logical record hashes
  * identically across systems and languages — a plain JSON.stringify is
@@ -39,8 +42,20 @@ export function createEvidenceLog({ sink, strict = false } = {}) {
   let prev = 'genesis';
 
   return {
+    // A sink can persist this process-local chain, but it cannot make the head
+    // atomic across replicas or continue it after restart. Never advertise the
+    // local logger as a fleet-safe production ledger.
+    durable: false,
+    persisted: typeof sink === 'function' && strict === true,
+    strict: strict === true,
+    forkAware: false,
+    atomicAppend: false,
     async record(entry) {
-      const body = { seq: records.length, prev_hash: prev, ...entry };
+      // Deep-copy the caller's entry: a shallow spread embeds live references to
+      // nested objects, so a caller mutating them after record() would silently
+      // corrupt the hash-chained evidence record (and anything a sink persisted).
+      const snapshot = entry && typeof entry === 'object' ? structuredClone(entry) : entry;
+      const body = { seq: records.length, prev_hash: prev, ...snapshot };
       const hash = sha256hex(canonical(body));
       const rec = { ...body, hash };
       if (sink) {
@@ -81,4 +96,258 @@ export function createEvidenceLog({ sink, strict = false } = {}) {
   };
 }
 
-export default { createEvidenceLog };
+const LOG_HEX_256 = /^[0-9a-f]{64}$/;
+const LOG_RESERVED_FIELDS = new Set(['seq', 'prev_hash', 'record_id', 'hash']);
+
+/** Verify one logger acknowledgement independently of the logger that emitted it. */
+export function verifyEvidenceRecord(record, { atomicRequired = false, expectedEntry } = {}) {
+  try {
+    if (!record || typeof record !== 'object' || Array.isArray(record)
+        || !Number.isSafeInteger(record.seq) || record.seq < 0
+        || (record.prev_hash !== 'genesis' && !LOG_HEX_256.test(record.prev_hash))
+        || !LOG_HEX_256.test(record.hash)) return false;
+    const hasRecordId = Object.prototype.hasOwnProperty.call(record, 'record_id');
+    if ((atomicRequired && !hasRecordId)
+        || (hasRecordId && (typeof record.record_id !== 'string'
+          || record.record_id.length < 16 || record.record_id.length > 256))) return false;
+    const { hash, ...body } = record;
+    if (sha256hex(canonical(body)) !== hash) return false;
+    if (expectedEntry !== undefined) {
+      if (!expectedEntry || typeof expectedEntry !== 'object' || Array.isArray(expectedEntry)) return false;
+      const entry = Object.fromEntries(
+        Object.entries(record).filter(([key]) => !LOG_RESERVED_FIELDS.has(key)),
+      );
+      if (canonical(entry) !== canonical(expectedEntry)) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function assertLogEntry(entry) {
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+    throw new Error('atomic evidence entry must be an object');
+  }
+  for (const field of LOG_RESERVED_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(entry, field)) {
+      throw new Error(`atomic evidence entry must not supply reserved field ${field}`);
+    }
+  }
+  const stack = [{ value: entry, depth: 0 }];
+  const seen = new WeakSet();
+  let nodes = 0;
+  let stringBytes = 0;
+  while (stack.length) {
+    const { value, depth } = stack.pop();
+    if (++nodes > 50000 || depth > 64) throw new Error('atomic evidence entry exceeds resource limits');
+    if (value === null || typeof value === 'boolean') continue;
+    if (typeof value === 'number') {
+      if (!Number.isSafeInteger(value)) throw new Error('atomic evidence entry contains a non-safe integer');
+      continue;
+    }
+    if (typeof value === 'string') {
+      stringBytes += Buffer.byteLength(value, 'utf8');
+      if (stringBytes > 1024 * 1024) throw new Error('atomic evidence entry exceeds string limit');
+      continue;
+    }
+    if (typeof value !== 'object') throw new Error('atomic evidence entry is not canonical JSON');
+    if (seen.has(value)) throw new Error('atomic evidence entry contains a cycle or alias');
+    seen.add(value);
+    if (Array.isArray(value)) {
+      for (const child of value) stack.push({ value: child, depth: depth + 1 });
+    } else {
+      for (const [key, child] of Object.entries(value)) {
+        stringBytes += Buffer.byteLength(key, 'utf8');
+        if (stringBytes > 1024 * 1024) throw new Error('atomic evidence entry exceeds string limit');
+        stack.push({ value: child, depth: depth + 1 });
+      }
+    }
+  }
+}
+
+function validateAtomicRecord(record, expectedId, expectedEntry, expectedRecord = null) {
+  return record?.record_id === expectedId
+    && verifyEvidenceRecord(record, { atomicRequired: true, expectedEntry })
+    && (expectedRecord === null || canonical(record) === canonical(expectedRecord));
+}
+
+function validHead(head) {
+  return head === null || Boolean(head && Number.isSafeInteger(head.seq) && head.seq >= 0 && LOG_HEX_256.test(head.hash));
+}
+
+/**
+ * Fleet-safe, fail-closed evidence log over an atomic shared-head backend.
+ *
+ * Backend contract (all operations are scoped by streamId):
+ *   readHead(streamId) -> null | { seq, hash }
+ *   getById(streamId, recordId) -> null | record
+ *   appendIfHead(streamId, expectedHeadHash|null, record) -> boolean
+ *   readAll(streamId) -> record[]                    // optional, for verify/all
+ *
+ * appendIfHead MUST atomically compare the current head, append the immutable
+ * record, reject duplicate record_id, and advance the head in one durable
+ * transaction. A true return MUST provide immediate read-after-write visibility
+ * through getById. `backend.durable === true` is a deployment capability
+ * assertion; this module tests the protocol but cannot prove storage hardware
+ * semantics.
+ */
+export function createAtomicEvidenceLog(backend, {
+  streamId = 'emilia-gate',
+  maxRetries = 32,
+  recordIdFactory = () => crypto.randomUUID(),
+} = {}) {
+  for (const method of ['readHead', 'getById', 'appendIfHead']) {
+    if (typeof backend?.[method] !== 'function') {
+      throw new Error(`createAtomicEvidenceLog: backend must implement async ${method}()`);
+    }
+  }
+  if (typeof streamId !== 'string' || !streamId || streamId.length > 256) {
+    throw new Error('createAtomicEvidenceLog: streamId must be a non-empty string of at most 256 characters');
+  }
+  if (!Number.isSafeInteger(maxRetries) || maxRetries < 1 || maxRetries > 1024) {
+    throw new Error('createAtomicEvidenceLog: maxRetries must be an integer from 1 to 1024');
+  }
+  if (typeof recordIdFactory !== 'function') {
+    throw new Error('createAtomicEvidenceLog: recordIdFactory must be a function');
+  }
+
+  async function recover(recordId, snapshot, expectedRecord = null) {
+    const existing = await backend.getById(streamId, recordId);
+    if (existing === null || existing === undefined) return null;
+    if (!validateAtomicRecord(existing, recordId, snapshot, expectedRecord)) {
+      throw new Error('atomic evidence backend returned a conflicting record_id');
+    }
+    return structuredClone(existing);
+  }
+
+  return {
+    durable: backend.durable === true,
+    persisted: backend.durable === true,
+    strict: true,
+    forkAware: true,
+    atomicAppend: true,
+    streamId,
+
+    async record(entry) {
+      const snapshot = structuredClone(entry);
+      assertLogEntry(snapshot);
+      const recordId = recordIdFactory();
+      if (typeof recordId !== 'string' || recordId.length < 16 || recordId.length > 256) {
+        throw new Error('atomic evidence record id must be a string of 16 to 256 characters');
+      }
+
+      for (let attempt = 0; attempt < maxRetries; attempt++) {
+        const recovered = await recover(recordId, snapshot);
+        if (recovered) return recovered;
+
+        const head = await backend.readHead(streamId);
+        if (!validHead(head)) throw new Error('atomic evidence backend returned a malformed head');
+        const seq = head === null ? 0 : head.seq + 1;
+        const prevHash = head === null ? 'genesis' : head.hash;
+        const body = { seq, prev_hash: prevHash, record_id: recordId, ...snapshot };
+        const record = { ...body, hash: sha256hex(canonical(body)) };
+        try {
+          if ((await backend.appendIfHead(streamId, head?.hash ?? null, record)) === true) {
+            const persisted = await recover(recordId, snapshot, record);
+            if (persisted) return persisted;
+            throw new Error('atomic_evidence_append_not_observable');
+          }
+        } catch (error) {
+          // The append may have linearized before its response was lost. Recover
+          // by stable id; if no record is visible, fail closed and let the caller
+          // retain/freeze its execution reservation.
+          const afterError = await recover(recordId, snapshot, record);
+          if (afterError) return afterError;
+          const wrapped = new Error('atomic_evidence_append_indeterminate');
+          wrapped.cause = error;
+          throw wrapped;
+        }
+      }
+      throw new Error('atomic_evidence_contention_limit');
+    },
+
+    async all() {
+      if (typeof backend.readAll !== 'function') throw new Error('atomic evidence backend does not expose readAll()');
+      const records = await backend.readAll(streamId);
+      if (!Array.isArray(records)) throw new Error('atomic evidence backend returned malformed history');
+      return structuredClone(records);
+    },
+
+    async verify() {
+      try {
+        if (typeof backend.readAll !== 'function') return { ok: false, reason: 'read_all_unavailable' };
+        const records = await backend.readAll(streamId);
+        if (!Array.isArray(records)) return { ok: false, reason: 'malformed_history' };
+        let prev = 'genesis';
+        const ids = new Set();
+        for (let index = 0; index < records.length; index++) {
+          const record = records[index];
+          if (!record || typeof record !== 'object' || Array.isArray(record)
+              || record.seq !== index || record.prev_hash !== prev
+              || typeof record.record_id !== 'string' || ids.has(record.record_id)) {
+            return { ok: false, at: index, reason: 'sequence_or_predecessor_mismatch' };
+          }
+          const { hash, ...body } = record;
+          if (!LOG_HEX_256.test(hash) || sha256hex(canonical(body)) !== hash) {
+            return { ok: false, at: index, reason: 'hash_mismatch' };
+          }
+          ids.add(record.record_id);
+          prev = hash;
+        }
+        const head = await backend.readHead(streamId);
+        const expectedHead = records.length === 0 ? null : { seq: records.length - 1, hash: prev };
+        if (canonical(head) !== canonical(expectedHead)) return { ok: false, reason: 'head_mismatch' };
+        return { ok: true, length: records.length, head: expectedHead?.hash ?? null };
+      } catch {
+        return { ok: false, reason: 'backend_read_failed_or_malformed' };
+      }
+    },
+  };
+}
+
+/** In-memory contract model for tests. It is intentionally not durable. */
+export function createMemoryAtomicEvidenceBackend() {
+  const streams = new Map();
+  const state = (streamId) => {
+    if (!streams.has(streamId)) streams.set(streamId, { records: [], byId: new Map() });
+    return streams.get(streamId);
+  };
+  return {
+    durable: false,
+    async readHead(streamId) {
+      const records = state(streamId).records;
+      const record = records[records.length - 1];
+      return record ? { seq: record.seq, hash: record.hash } : null;
+    },
+    async getById(streamId, recordId) {
+      return structuredClone(state(streamId).byId.get(recordId) ?? null);
+    },
+    async appendIfHead(streamId, expectedHeadHash, record) {
+      const s = state(streamId);
+      const head = s.records[s.records.length - 1] ?? null;
+      const actual = head?.hash ?? null;
+      if (actual !== expectedHeadHash || s.byId.has(record.record_id)
+          || record.seq !== s.records.length || record.prev_hash !== (head?.hash ?? 'genesis')) return false;
+      const snapshot = structuredClone(record);
+      s.records.push(snapshot);
+      s.byId.set(snapshot.record_id, snapshot);
+      return true;
+    },
+    async readAll(streamId) { return structuredClone(state(streamId).records); },
+  };
+}
+
+export const __atomicEvidenceSecurityInternals = Object.freeze({
+  canonical,
+  assertLogEntry,
+  validateAtomicRecord,
+  validHead,
+});
+
+export default {
+  createEvidenceLog,
+  verifyEvidenceRecord,
+  createAtomicEvidenceLog,
+  createMemoryAtomicEvidenceBackend,
+};

package/index.js

@@ -44,7 +44,7 @@ const {
 const { verifyWebAuthnSignoff, verifyQuorum } = await import('@emilia-protocol/verify')
   .catch(() => import('../verify/index.js'));
 import { MemoryConsumptionStore } from './store.js';
-import { createEvidenceLog } from './evidence.js';
+import { createAtomicEvidenceLog, createEvidenceLog, createMemoryAtomicEvidenceBackend } from './evidence.js';
 import { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest } from './action-packs.js';
 import { hashCanonical, verifyExecutionBinding } from './execution-binding.js';
 import { buildReliancePacket, ADMISSIBILITY_VERDICTS } from './reliance-packet.js';
@@ -54,8 +54,9 @@ import { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 import { classifyRetention, buildRetentionExport } from './retention.js';
 import { createDefaultActionControlManifest, findActionControl, validateActionControlManifest } from './action-control-manifest.js';
 
-export { MemoryConsumptionStore, createEvidenceLog };
-export { createDurableConsumptionStore, createMemoryBackend } from './store.js';
+export { MemoryConsumptionStore, createEvidenceLog, createAtomicEvidenceLog, createMemoryAtomicEvidenceBackend };
+export { createDurableConsumptionStore, createMemoryBackend, DURABLE_CONSUMPTION_VERSION } from './store.js';
+export { createDurableChallengeStore, challengeStorageKey, challengeBodyDigest, DURABLE_CHALLENGE_STORE_VERSION } from './challenge-store.js';
 export { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 export { classifyRetention, buildRetentionExport, RETENTION_EXPORT_VERSION } from './retention.js';
 export { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest };
@@ -163,9 +164,26 @@ export function verifyAdmissibilityAgainstPinnedProfile(pinned, presented) {
  *      verifyWebAuthnSignoff earns `class_a`. Used where the approver keys travel
  *      with the receipt rather than being pinned by the relying party.
  *
+ *      TRUST-LAUNDERING GUARD: an approver key carried INSIDE the receipt proves
+ *      only that whoever minted the receipt also holds that key — it is NOT proof
+ *      the relying party trusts that human. Crediting an elevated tier off such a
+ *      key would collapse VERIFIED into ACCEPTED (any party can mint a fresh
+ *      keypair, self-sign a signoff, and embed both). So path (b) elevates the
+ *      tier ONLY when either: (i) the caller explicitly opts in with
+ *      `allowEmbeddedApproverKeys:true` (the documented self-contained mode,
+ *      DEFAULT OFF); or (ii) every embedded approver key that would earn the
+ *      credit is present in the relying party's PINNED approver key set
+ *      (opts.approverKeys). With no pin and no opt-in, path (b) may still VERIFY
+ *      the signoff/quorum, but it does NOT elevate above `software`. Fail-closed.
+ *
  * @param {object} doc  the EP-RECEIPT-v1 document
  * @param {object} [opts]
- * @param {object} [opts.approverKeys] pinned approver keys for path (a)
+ * @param {object} [opts.approverKeys] pinned approver keys for path (a) and the
+ *   path-(b) fallback: a receipt-embedded approver key elevates the tier only if
+ *   it is one of these pinned keys (unless allowEmbeddedApproverKeys is set)
+ * @param {boolean} [opts.allowEmbeddedApproverKeys=false] explicit opt-in to the
+ *   self-contained mode where an UNPINNED approver key carried inside the receipt
+ *   may still elevate the path-(b) tier. DEFAULT OFF (fail-closed).
  * @param {function} [opts.verifyAssurance] custom assurance verifier for path (a)
  * @param {string} [opts.rpId]  bind embedded device assertions to this WebAuthn RP id (path b)
  * @param {boolean} [opts.detail] return a {tier, quorum, signoff} object instead of the string
@@ -185,30 +203,43 @@ export function receiptAssuranceTier(doc, opts = {}) {
   // --- Path (b): self-contained embedded per-signer evidence (DoD audit fix). ---
   const p = doc?.payload || {};
   const verifyOpts = opts.rpId ? { rpId: opts.rpId } : {};
+  // The relying party's PINNED approver public keys (base64url SPKI-DER strings).
+  // An embedded approver key elevates the tier only if it is in this set, unless
+  // the caller explicitly opts into the self-contained mode.
+  const allowEmbedded = opts.allowEmbeddedApproverKeys === true;
+  const pinnedKeys = pinnedApproverKeySet(opts.approverKeys);
+  const keyIsTrusted = (k) => allowEmbedded || (typeof k === 'string' && pinnedKeys.has(k));
 
   // quorum: a real, self-contained EP-QUORUM-v1 evidence document. Accept it
   // under payload.quorum or payload.claim.quorum. It only counts if it is a full
   // quorum document (policy + members with WebAuthn signoffs) AND verifyQuorum
   // returns valid. A bare {signers,threshold} block has no members to verify and
-  // therefore CANNOT be credited quorum.
+  // therefore CANNOT be credited quorum. The cryptographic verification runs
+  // regardless (so `detail.quorum` reports validity), but the tier elevates only
+  // when every member's embedded approver key is pinned (or the caller opted in).
   const q = p.quorum || p.claim?.quorum;
   if (detail.tier !== 'quorum' && isQuorumEvidence(q)) {
     const qr = verifyQuorum(q, verifyOpts);
-    detail.quorum = { valid: qr.valid, checks: qr.checks };
-    if (qr.valid) detail.tier = 'quorum';
+    const membersTrusted = allowEmbedded
+      || (Array.isArray(q.members) && q.members.length > 0
+          && q.members.every((m) => keyIsTrusted(m?.approver_public_key)));
+    detail.quorum = { valid: qr.valid, checks: qr.checks, embedded_keys_trusted: membersTrusted };
+    if (qr.valid && membersTrusted) detail.tier = 'quorum';
   }
 
   // class_a: a verifiable WebAuthn device signoff. The signoff evidence is
   // {context, webauthn}; the approver key travels with it (signoff.approver_public_key)
-  // or alongside it (payload.approver_public_key).
+  // or alongside it (payload.approver_public_key). That key elevates the tier only
+  // when it is pinned by the relying party (or the caller opted into embedded keys).
   if ((TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) {
     const so = p.signoff || p.claim?.signoff;
     if (isSignoffEvidence(so)) {
       const key = so.approver_public_key || p.approver_public_key || p.claim?.approver_public_key;
       if (key) {
         const sr = verifyWebAuthnSignoff(so, key, verifyOpts);
-        detail.signoff = { valid: sr.valid, checks: sr.checks };
-        if (sr.valid && (TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) detail.tier = 'class_a';
+        const trusted = keyIsTrusted(key);
+        detail.signoff = { valid: sr.valid, checks: sr.checks, embedded_key_trusted: trusted };
+        if (sr.valid && trusted && (TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) detail.tier = 'class_a';
       }
     }
   }
@@ -216,6 +247,34 @@ export function receiptAssuranceTier(doc, opts = {}) {
   return opts.detail ? detail : detail.tier;
 }
 
+/**
+ * The set of PINNED approver public keys (base64url SPKI-DER strings) a relying
+ * party trusts, from the same `approverKeys` map path (a) uses. Accepts either a
+ * map of { keyId: { public_key } } (the EP-ASSURANCE-PROOF-v1 shape) or a plain
+ * array/set of key strings. Used to decide whether a receipt-embedded approver
+ * key may elevate the path-(b) tier. Never throws.
+ */
+function pinnedApproverKeySet(approverKeys) {
+  const out = new Set();
+  if (!approverKeys) return out;
+  if (approverKeys instanceof Set) {
+    for (const k of approverKeys) if (typeof k === 'string' && k) out.add(k);
+    return out;
+  }
+  if (Array.isArray(approverKeys)) {
+    for (const k of approverKeys) if (typeof k === 'string' && k) out.add(k);
+    return out;
+  }
+  if (typeof approverKeys === 'object') {
+    for (const entry of Object.values(approverKeys)) {
+      if (typeof entry === 'string' && entry) { out.add(entry); continue; }
+      const pk = entry && typeof entry === 'object' ? entry.public_key : null;
+      if (typeof pk === 'string' && pk) out.add(pk);
+    }
+  }
+  return out;
+}
+
 /** A quorum evidence doc must carry members with per-signer signoffs to be verifiable. */
 function isQuorumEvidence(q) {
   return !!q && typeof q === 'object' && q.policy && Array.isArray(q.members) && q.members.length > 0
@@ -238,8 +297,16 @@ function isSignoffEvidence(s) {
  * @param {object} [opts.keyRegistry] a key registry (createKeyRegistry) for rotation + revocation;
  *   if given it supersedes trustedKeys — a receipt is verified only against keys valid (and not
  *   revoked) at its issuance time.
+ * @param {object} [opts.approverKeys] PINNED approver keys ({ keyId: { public_key, key_class } }).
+ *   Used both for the pinned assurance-proof path and to authorize receipt-embedded
+ *   approver keys under the self-contained embedded-evidence path.
+ * @param {boolean} [opts.allowEmbeddedApproverKeys=false] opt into the self-contained
+ *   embedded-evidence mode: when true, a class_a/quorum tier may be credited from an
+ *   approver key carried INSIDE the receipt even if that key is not pinned. DEFAULT OFF
+ *   — with no pinned approverKeys and no opt-in, embedded evidence verifies but does not
+ *   elevate above 'software' (prevents VERIFIED collapsing into ACCEPTED / trust-laundering).
  */
-export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null, rpId = null, requiredAdmissibilityProfile = null } = {}) {
+export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null, rpId = null, requiredAdmissibilityProfile = null, allowEmbeddedApproverKeys = false } = {}) {
   // Production key custody: a registry (rotation + revocation) supersedes a flat
   // trustedKeys list. A flat list is coerced to an always-valid registry, so
   // existing callers are unchanged.
@@ -367,6 +434,10 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     });
     const tierResult = receiptAssuranceTier(receipt, {
       rpId, detail: true, approverKeys: approver_keys || approverKeys, verifyAssurance,
+      // Trust-laundering guard: a receipt-embedded approver key does NOT elevate
+      // the tier unless it is in the pinned approverKeys set, or the operator
+      // explicitly opted into the self-contained embedded-evidence mode. DEFAULT OFF.
+      allowEmbeddedApproverKeys,
     });
     // Take the strongest tier either path proves.
     const have = (TIER_RANK[assurance.have] ?? 0) >= (TIER_RANK[tierResult.tier] ?? 0)
@@ -502,8 +573,11 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
   /**
    * Recommended end-to-end path. Reserves the receipt, runs the side effect,
    * commits one-time consumption only after success, and records execution.
-   * If the side effect throws, the reservation is released so the approval can
-   * be retried safely.
+   * Once the executor is invoked, an exception is an INDETERMINATE outcome: the
+   * external effect may have happened before its response was lost. The receipt
+   * is therefore committed (or left reserved if the store is unavailable),
+   * never released automatically. Callers that need retries must make the
+   * downstream effect idempotent under the receipt id and reconcile its result.
    */
   async function run({ selector = {}, receipt = null, observedAction = null, admissibilityProfile = null, reliancePacket: presentedPacket = null, admissibility = null } = {}, fn, opts = {}) {
     if (typeof fn !== 'function') throw new Error('EMILIA Gate run(): fn is required');
@@ -512,23 +586,49 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
       return { ok: false, status: authorization.status, body: authorization.challenge, authorization };
     }
     const receiptId = authorization.evidence?.receipt_id;
-    let actionRan = false;
+    let phase = 'reserved';
+    let consumptionCommitted = false;
     try {
+      phase = 'effect_attempted';
       const result = await fn(authorization);
-      actionRan = true;
+      phase = 'effect_returned';
       if (typeof consumption.commit === 'function') await consumption.commit(receiptId);
+      consumptionCommitted = true;
+      phase = 'consumed';
       if (opts.recordExecution === false) return { ok: true, result, authorization, execution: null, packet: null };
+      phase = 'recording_execution';
       const execution = await recordExecution({ authorization, outcome: 'executed', observedAction });
       return { ok: true, result, authorization, execution, packet: reliancePacket({ authorization, execution }) };
     } catch (e) {
-      if (!actionRan && typeof consumption.release === 'function') await consumption.release(receiptId);
-      if (opts.recordExecution !== false) {
-        await recordExecution({
-          authorization,
-          outcome: 'failed',
-          detail: actionRan ? `post_execution_failure:${String(e?.message ?? e)}` : String(e?.message ?? e),
-          observedAction,
-        });
+      // An exception after invoking fn() cannot establish that no external
+      // effect occurred. Burn the approval if possible; if storage is down, the
+      // ownership-fenced reservation remains and still blocks replay.
+      let consumptionError = null;
+      if (!consumptionCommitted && phase !== 'reserved' && typeof consumption.commit === 'function') {
+        try {
+          await consumption.commit(receiptId);
+          consumptionCommitted = true;
+        } catch (commitError) {
+          consumptionError = commitError;
+        }
+      }
+      if (opts.recordExecution !== false && phase !== 'recording_execution') {
+        try {
+          await recordExecution({
+            authorization,
+            outcome: 'indeterminate',
+            // Exception text frequently contains provider payloads, record IDs,
+            // or secrets. The caller still receives the original exception;
+            // the portable evidence record carries only the closed outcome.
+            detail: { code: 'effect_attempted_outcome_unknown' },
+            observedAction,
+          });
+        } catch (recordError) {
+          if (!consumptionError) consumptionError = recordError;
+        }
+      }
+      if (consumptionError && e && typeof e === 'object') {
+        e.consumption_error = String(consumptionError?.message ?? consumptionError);
       }
       throw e;
     }
@@ -684,6 +784,8 @@ export default {
   ADMISSIBILITY_VERDICTS,
   MemoryConsumptionStore,
   createEvidenceLog,
+  createAtomicEvidenceLog,
+  createMemoryAtomicEvidenceBackend,
   ASSURANCE_TIERS,
   DEFAULT_GATE_MANIFEST,
   HIGH_RISK_ACTION_PACKS,

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@emilia-protocol/gate",
-  "version": "0.9.2",
+  "version": "0.9.4",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/emiliaprotocol/emilia-protocol.git",
+    "directory": "packages/gate"
+  },
   "description": "EMILIA Gate \u2014 the Trusted Action Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), a tamper-evident evidence log, default high-risk action packs, execution-field binding, reliance packets, an MCP drop-in, a GitHub system-of-record adapter, and EG-1 conformance. Framework-agnostic, fails closed. Reference implementation, experimental.",
   "license": "Apache-2.0",
   "type": "module",
@@ -32,19 +37,32 @@
     "./reports/underwriter": "./reports/underwriter.js",
     "./metrics": "./metrics.js",
     "./breakglass": "./breakglass.js",
+    "./challenge-store": "./challenge-store.js",
     "./store-postgres": "./store-postgres.js",
+    "./evidence": "./evidence.js",
     "./reports/auditor-workpaper": "./reports/auditor-workpaper.js",
     "./reports/reperform": "./reports/reperform.js",
-    "./reports/external-verification": "./reports/external-verification.js"
+    "./reports/external-verification": "./reports/external-verification.js",
+    "./reports/assurance-package": "./reports/assurance-package.js",
+    "./reliance-kernel": "./reliance-kernel.js",
+    "./aec-execution": "./aec-execution.js"
+  },
+  "bin": {
+    "ep-assure": "./ep-assure.mjs"
   },
   "files": [
     "index.js",
     "store.js",
+    "challenge-store.js",
     "evidence.js",
     "action-packs.js",
     "action-control-manifest.js",
     "execution-binding.js",
     "reliance-packet.js",
+    "reliance-kernel.js",
+    "aec-execution.js",
+    "reports/assurance-package.js",
+    "ep-assure.mjs",
     "key-registry.js",
     "retention.js",
     "eg1-conformance.js",