@emilia-protocol/gate 0.9.3 → 0.9.4

package/evidence.js

@@ -1,5 +1,5 @@
 /**
- * @emilia-protocol/gate — evidence log (tamper-evident audit of decisions).
+ * @emilia-protocol/gate — evidence log (tamper-detecting audit of decisions).
  * @license Apache-2.0
  *
  * Every gate decision — allow or deny — appends a hash-chained record. Each
@@ -7,7 +7,10 @@
  * breaks the chain and `verify()` catches it. This is the compliance and
  * insurance artifact: a provable account of exactly which consequential actions
  * were authorized, refused, and why. Default sink is in-memory; pass `sink` to
- * stream records to durable/append-only storage.
+ * stream records to storage. This local chain detects alteration only when the
+ * verifier receives its complete history from genesis; a sink alone cannot
+ * prevent truncation, restart-from-genesis, or cross-replica forks. Use
+ * createAtomicEvidenceLog for a shared production head.
  *
  * Hashing is over CANONICAL JSON (sorted keys) so the same logical record hashes
  * identically across systems and languages — a plain JSON.stringify is
@@ -39,8 +42,20 @@ export function createEvidenceLog({ sink, strict = false } = {}) {
   let prev = 'genesis';
 
   return {
+    // A sink can persist this process-local chain, but it cannot make the head
+    // atomic across replicas or continue it after restart. Never advertise the
+    // local logger as a fleet-safe production ledger.
+    durable: false,
+    persisted: typeof sink === 'function' && strict === true,
+    strict: strict === true,
+    forkAware: false,
+    atomicAppend: false,
     async record(entry) {
-      const body = { seq: records.length, prev_hash: prev, ...entry };
+      // Deep-copy the caller's entry: a shallow spread embeds live references to
+      // nested objects, so a caller mutating them after record() would silently
+      // corrupt the hash-chained evidence record (and anything a sink persisted).
+      const snapshot = entry && typeof entry === 'object' ? structuredClone(entry) : entry;
+      const body = { seq: records.length, prev_hash: prev, ...snapshot };
       const hash = sha256hex(canonical(body));
       const rec = { ...body, hash };
       if (sink) {
@@ -81,4 +96,258 @@ export function createEvidenceLog({ sink, strict = false } = {}) {
   };
 }
 
-export default { createEvidenceLog };
+const LOG_HEX_256 = /^[0-9a-f]{64}$/;
+const LOG_RESERVED_FIELDS = new Set(['seq', 'prev_hash', 'record_id', 'hash']);
+
+/** Verify one logger acknowledgement independently of the logger that emitted it. */
+export function verifyEvidenceRecord(record, { atomicRequired = false, expectedEntry } = {}) {
+  try {
+    if (!record || typeof record !== 'object' || Array.isArray(record)
+        || !Number.isSafeInteger(record.seq) || record.seq < 0
+        || (record.prev_hash !== 'genesis' && !LOG_HEX_256.test(record.prev_hash))
+        || !LOG_HEX_256.test(record.hash)) return false;
+    const hasRecordId = Object.prototype.hasOwnProperty.call(record, 'record_id');
+    if ((atomicRequired && !hasRecordId)
+        || (hasRecordId && (typeof record.record_id !== 'string'
+          || record.record_id.length < 16 || record.record_id.length > 256))) return false;
+    const { hash, ...body } = record;
+    if (sha256hex(canonical(body)) !== hash) return false;
+    if (expectedEntry !== undefined) {
+      if (!expectedEntry || typeof expectedEntry !== 'object' || Array.isArray(expectedEntry)) return false;
+      const entry = Object.fromEntries(
+        Object.entries(record).filter(([key]) => !LOG_RESERVED_FIELDS.has(key)),
+      );
+      if (canonical(entry) !== canonical(expectedEntry)) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function assertLogEntry(entry) {
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+    throw new Error('atomic evidence entry must be an object');
+  }
+  for (const field of LOG_RESERVED_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(entry, field)) {
+      throw new Error(`atomic evidence entry must not supply reserved field ${field}`);
+    }
+  }
+  const stack = [{ value: entry, depth: 0 }];
+  const seen = new WeakSet();
+  let nodes = 0;
+  let stringBytes = 0;
+  while (stack.length) {
+    const { value, depth } = stack.pop();
+    if (++nodes > 50000 || depth > 64) throw new Error('atomic evidence entry exceeds resource limits');
+    if (value === null || typeof value === 'boolean') continue;
+    if (typeof value === 'number') {
+      if (!Number.isSafeInteger(value)) throw new Error('atomic evidence entry contains a non-safe integer');
+      continue;
+    }
+    if (typeof value === 'string') {
+      stringBytes += Buffer.byteLength(value, 'utf8');
+      if (stringBytes > 1024 * 1024) throw new Error('atomic evidence entry exceeds string limit');
+      continue;
+    }
+    if (typeof value !== 'object') throw new Error('atomic evidence entry is not canonical JSON');
+    if (seen.has(value)) throw new Error('atomic evidence entry contains a cycle or alias');
+    seen.add(value);
+    if (Array.isArray(value)) {
+      for (const child of value) stack.push({ value: child, depth: depth + 1 });
+    } else {
+      for (const [key, child] of Object.entries(value)) {
+        stringBytes += Buffer.byteLength(key, 'utf8');
+        if (stringBytes > 1024 * 1024) throw new Error('atomic evidence entry exceeds string limit');
+        stack.push({ value: child, depth: depth + 1 });
+      }
+    }
+  }
+}
+
+function validateAtomicRecord(record, expectedId, expectedEntry, expectedRecord = null) {
+  return record?.record_id === expectedId
+    && verifyEvidenceRecord(record, { atomicRequired: true, expectedEntry })
+    && (expectedRecord === null || canonical(record) === canonical(expectedRecord));
+}
+
+function validHead(head) {
+  return head === null || Boolean(head && Number.isSafeInteger(head.seq) && head.seq >= 0 && LOG_HEX_256.test(head.hash));
+}
+
+/**
+ * Fleet-safe, fail-closed evidence log over an atomic shared-head backend.
+ *
+ * Backend contract (all operations are scoped by streamId):
+ *   readHead(streamId) -> null | { seq, hash }
+ *   getById(streamId, recordId) -> null | record
+ *   appendIfHead(streamId, expectedHeadHash|null, record) -> boolean
+ *   readAll(streamId) -> record[]                    // optional, for verify/all
+ *
+ * appendIfHead MUST atomically compare the current head, append the immutable
+ * record, reject duplicate record_id, and advance the head in one durable
+ * transaction. A true return MUST provide immediate read-after-write visibility
+ * through getById. `backend.durable === true` is a deployment capability
+ * assertion; this module tests the protocol but cannot prove storage hardware
+ * semantics.
+ */
+export function createAtomicEvidenceLog(backend, {
+  streamId = 'emilia-gate',
+  maxRetries = 32,
+  recordIdFactory = () => crypto.randomUUID(),
+} = {}) {
+  for (const method of ['readHead', 'getById', 'appendIfHead']) {
+    if (typeof backend?.[method] !== 'function') {
+      throw new Error(`createAtomicEvidenceLog: backend must implement async ${method}()`);
+    }
+  }
+  if (typeof streamId !== 'string' || !streamId || streamId.length > 256) {
+    throw new Error('createAtomicEvidenceLog: streamId must be a non-empty string of at most 256 characters');
+  }
+  if (!Number.isSafeInteger(maxRetries) || maxRetries < 1 || maxRetries > 1024) {
+    throw new Error('createAtomicEvidenceLog: maxRetries must be an integer from 1 to 1024');
+  }
+  if (typeof recordIdFactory !== 'function') {
+    throw new Error('createAtomicEvidenceLog: recordIdFactory must be a function');
+  }
+
+  async function recover(recordId, snapshot, expectedRecord = null) {
+    const existing = await backend.getById(streamId, recordId);
+    if (existing === null || existing === undefined) return null;
+    if (!validateAtomicRecord(existing, recordId, snapshot, expectedRecord)) {
+      throw new Error('atomic evidence backend returned a conflicting record_id');
+    }
+    return structuredClone(existing);
+  }
+
+  return {
+    durable: backend.durable === true,
+    persisted: backend.durable === true,
+    strict: true,
+    forkAware: true,
+    atomicAppend: true,
+    streamId,
+
+    async record(entry) {
+      const snapshot = structuredClone(entry);
+      assertLogEntry(snapshot);
+      const recordId = recordIdFactory();
+      if (typeof recordId !== 'string' || recordId.length < 16 || recordId.length > 256) {
+        throw new Error('atomic evidence record id must be a string of 16 to 256 characters');
+      }
+
+      for (let attempt = 0; attempt < maxRetries; attempt++) {
+        const recovered = await recover(recordId, snapshot);
+        if (recovered) return recovered;
+
+        const head = await backend.readHead(streamId);
+        if (!validHead(head)) throw new Error('atomic evidence backend returned a malformed head');
+        const seq = head === null ? 0 : head.seq + 1;
+        const prevHash = head === null ? 'genesis' : head.hash;
+        const body = { seq, prev_hash: prevHash, record_id: recordId, ...snapshot };
+        const record = { ...body, hash: sha256hex(canonical(body)) };
+        try {
+          if ((await backend.appendIfHead(streamId, head?.hash ?? null, record)) === true) {
+            const persisted = await recover(recordId, snapshot, record);
+            if (persisted) return persisted;
+            throw new Error('atomic_evidence_append_not_observable');
+          }
+        } catch (error) {
+          // The append may have linearized before its response was lost. Recover
+          // by stable id; if no record is visible, fail closed and let the caller
+          // retain/freeze its execution reservation.
+          const afterError = await recover(recordId, snapshot, record);
+          if (afterError) return afterError;
+          const wrapped = new Error('atomic_evidence_append_indeterminate');
+          wrapped.cause = error;
+          throw wrapped;
+        }
+      }
+      throw new Error('atomic_evidence_contention_limit');
+    },
+
+    async all() {
+      if (typeof backend.readAll !== 'function') throw new Error('atomic evidence backend does not expose readAll()');
+      const records = await backend.readAll(streamId);
+      if (!Array.isArray(records)) throw new Error('atomic evidence backend returned malformed history');
+      return structuredClone(records);
+    },
+
+    async verify() {
+      try {
+        if (typeof backend.readAll !== 'function') return { ok: false, reason: 'read_all_unavailable' };
+        const records = await backend.readAll(streamId);
+        if (!Array.isArray(records)) return { ok: false, reason: 'malformed_history' };
+        let prev = 'genesis';
+        const ids = new Set();
+        for (let index = 0; index < records.length; index++) {
+          const record = records[index];
+          if (!record || typeof record !== 'object' || Array.isArray(record)
+              || record.seq !== index || record.prev_hash !== prev
+              || typeof record.record_id !== 'string' || ids.has(record.record_id)) {
+            return { ok: false, at: index, reason: 'sequence_or_predecessor_mismatch' };
+          }
+          const { hash, ...body } = record;
+          if (!LOG_HEX_256.test(hash) || sha256hex(canonical(body)) !== hash) {
+            return { ok: false, at: index, reason: 'hash_mismatch' };
+          }
+          ids.add(record.record_id);
+          prev = hash;
+        }
+        const head = await backend.readHead(streamId);
+        const expectedHead = records.length === 0 ? null : { seq: records.length - 1, hash: prev };
+        if (canonical(head) !== canonical(expectedHead)) return { ok: false, reason: 'head_mismatch' };
+        return { ok: true, length: records.length, head: expectedHead?.hash ?? null };
+      } catch {
+        return { ok: false, reason: 'backend_read_failed_or_malformed' };
+      }
+    },
+  };
+}
+
+/** In-memory contract model for tests. It is intentionally not durable. */
+export function createMemoryAtomicEvidenceBackend() {
+  const streams = new Map();
+  const state = (streamId) => {
+    if (!streams.has(streamId)) streams.set(streamId, { records: [], byId: new Map() });
+    return streams.get(streamId);
+  };
+  return {
+    durable: false,
+    async readHead(streamId) {
+      const records = state(streamId).records;
+      const record = records[records.length - 1];
+      return record ? { seq: record.seq, hash: record.hash } : null;
+    },
+    async getById(streamId, recordId) {
+      return structuredClone(state(streamId).byId.get(recordId) ?? null);
+    },
+    async appendIfHead(streamId, expectedHeadHash, record) {
+      const s = state(streamId);
+      const head = s.records[s.records.length - 1] ?? null;
+      const actual = head?.hash ?? null;
+      if (actual !== expectedHeadHash || s.byId.has(record.record_id)
+          || record.seq !== s.records.length || record.prev_hash !== (head?.hash ?? 'genesis')) return false;
+      const snapshot = structuredClone(record);
+      s.records.push(snapshot);
+      s.byId.set(snapshot.record_id, snapshot);
+      return true;
+    },
+    async readAll(streamId) { return structuredClone(state(streamId).records); },
+  };
+}
+
+export const __atomicEvidenceSecurityInternals = Object.freeze({
+  canonical,
+  assertLogEntry,
+  validateAtomicRecord,
+  validHead,
+});
+
+export default {
+  createEvidenceLog,
+  verifyEvidenceRecord,
+  createAtomicEvidenceLog,
+  createMemoryAtomicEvidenceBackend,
+};

package/index.js

@@ -44,7 +44,7 @@ const {
 const { verifyWebAuthnSignoff, verifyQuorum } = await import('@emilia-protocol/verify')
   .catch(() => import('../verify/index.js'));
 import { MemoryConsumptionStore } from './store.js';
-import { createEvidenceLog } from './evidence.js';
+import { createAtomicEvidenceLog, createEvidenceLog, createMemoryAtomicEvidenceBackend } from './evidence.js';
 import { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest } from './action-packs.js';
 import { hashCanonical, verifyExecutionBinding } from './execution-binding.js';
 import { buildReliancePacket, ADMISSIBILITY_VERDICTS } from './reliance-packet.js';
@@ -54,8 +54,9 @@ import { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 import { classifyRetention, buildRetentionExport } from './retention.js';
 import { createDefaultActionControlManifest, findActionControl, validateActionControlManifest } from './action-control-manifest.js';
 
-export { MemoryConsumptionStore, createEvidenceLog };
-export { createDurableConsumptionStore, createMemoryBackend } from './store.js';
+export { MemoryConsumptionStore, createEvidenceLog, createAtomicEvidenceLog, createMemoryAtomicEvidenceBackend };
+export { createDurableConsumptionStore, createMemoryBackend, DURABLE_CONSUMPTION_VERSION } from './store.js';
+export { createDurableChallengeStore, challengeStorageKey, challengeBodyDigest, DURABLE_CHALLENGE_STORE_VERSION } from './challenge-store.js';
 export { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 export { classifyRetention, buildRetentionExport, RETENTION_EXPORT_VERSION } from './retention.js';
 export { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest };
@@ -572,8 +573,11 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
   /**
    * Recommended end-to-end path. Reserves the receipt, runs the side effect,
    * commits one-time consumption only after success, and records execution.
-   * If the side effect throws, the reservation is released so the approval can
-   * be retried safely.
+   * Once the executor is invoked, an exception is an INDETERMINATE outcome: the
+   * external effect may have happened before its response was lost. The receipt
+   * is therefore committed (or left reserved if the store is unavailable),
+   * never released automatically. Callers that need retries must make the
+   * downstream effect idempotent under the receipt id and reconcile its result.
    */
   async function run({ selector = {}, receipt = null, observedAction = null, admissibilityProfile = null, reliancePacket: presentedPacket = null, admissibility = null } = {}, fn, opts = {}) {
     if (typeof fn !== 'function') throw new Error('EMILIA Gate run(): fn is required');
@@ -582,23 +586,49 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
       return { ok: false, status: authorization.status, body: authorization.challenge, authorization };
     }
     const receiptId = authorization.evidence?.receipt_id;
-    let actionRan = false;
+    let phase = 'reserved';
+    let consumptionCommitted = false;
     try {
+      phase = 'effect_attempted';
       const result = await fn(authorization);
-      actionRan = true;
+      phase = 'effect_returned';
       if (typeof consumption.commit === 'function') await consumption.commit(receiptId);
+      consumptionCommitted = true;
+      phase = 'consumed';
       if (opts.recordExecution === false) return { ok: true, result, authorization, execution: null, packet: null };
+      phase = 'recording_execution';
       const execution = await recordExecution({ authorization, outcome: 'executed', observedAction });
       return { ok: true, result, authorization, execution, packet: reliancePacket({ authorization, execution }) };
     } catch (e) {
-      if (!actionRan && typeof consumption.release === 'function') await consumption.release(receiptId);
-      if (opts.recordExecution !== false) {
-        await recordExecution({
-          authorization,
-          outcome: 'failed',
-          detail: actionRan ? `post_execution_failure:${String(e?.message ?? e)}` : String(e?.message ?? e),
-          observedAction,
-        });
+      // An exception after invoking fn() cannot establish that no external
+      // effect occurred. Burn the approval if possible; if storage is down, the
+      // ownership-fenced reservation remains and still blocks replay.
+      let consumptionError = null;
+      if (!consumptionCommitted && phase !== 'reserved' && typeof consumption.commit === 'function') {
+        try {
+          await consumption.commit(receiptId);
+          consumptionCommitted = true;
+        } catch (commitError) {
+          consumptionError = commitError;
+        }
+      }
+      if (opts.recordExecution !== false && phase !== 'recording_execution') {
+        try {
+          await recordExecution({
+            authorization,
+            outcome: 'indeterminate',
+            // Exception text frequently contains provider payloads, record IDs,
+            // or secrets. The caller still receives the original exception;
+            // the portable evidence record carries only the closed outcome.
+            detail: { code: 'effect_attempted_outcome_unknown' },
+            observedAction,
+          });
+        } catch (recordError) {
+          if (!consumptionError) consumptionError = recordError;
+        }
+      }
+      if (consumptionError && e && typeof e === 'object') {
+        e.consumption_error = String(consumptionError?.message ?? consumptionError);
       }
       throw e;
     }
@@ -754,6 +784,8 @@ export default {
   ADMISSIBILITY_VERDICTS,
   MemoryConsumptionStore,
   createEvidenceLog,
+  createAtomicEvidenceLog,
+  createMemoryAtomicEvidenceBackend,
   ASSURANCE_TIERS,
   DEFAULT_GATE_MANIFEST,
   HIGH_RISK_ACTION_PACKS,

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "@emilia-protocol/gate",
-  "version": "0.9.3",
-  "description": "EMILIA Gate — the Trusted Action Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), a tamper-evident evidence log, default high-risk action packs, execution-field binding, reliance packets, an MCP drop-in, a GitHub system-of-record adapter, and EG-1 conformance. Framework-agnostic, fails closed. Reference implementation, experimental.",
+  "version": "0.9.4",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/emiliaprotocol/emilia-protocol.git",
+    "directory": "packages/gate"
+  },
+  "description": "EMILIA Gate \u2014 the Trusted Action Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), a tamper-evident evidence log, default high-risk action packs, execution-field binding, reliance packets, an MCP drop-in, a GitHub system-of-record adapter, and EG-1 conformance. Framework-agnostic, fails closed. Reference implementation, experimental.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "index.js",
@@ -32,19 +37,32 @@
     "./reports/underwriter": "./reports/underwriter.js",
     "./metrics": "./metrics.js",
     "./breakglass": "./breakglass.js",
+    "./challenge-store": "./challenge-store.js",
     "./store-postgres": "./store-postgres.js",
+    "./evidence": "./evidence.js",
     "./reports/auditor-workpaper": "./reports/auditor-workpaper.js",
     "./reports/reperform": "./reports/reperform.js",
-    "./reports/external-verification": "./reports/external-verification.js"
+    "./reports/external-verification": "./reports/external-verification.js",
+    "./reports/assurance-package": "./reports/assurance-package.js",
+    "./reliance-kernel": "./reliance-kernel.js",
+    "./aec-execution": "./aec-execution.js"
+  },
+  "bin": {
+    "ep-assure": "./ep-assure.mjs"
   },
   "files": [
     "index.js",
     "store.js",
+    "challenge-store.js",
     "evidence.js",
     "action-packs.js",
     "action-control-manifest.js",
     "execution-binding.js",
     "reliance-packet.js",
+    "reliance-kernel.js",
+    "aec-execution.js",
+    "reports/assurance-package.js",
+    "ep-assure.mjs",
     "key-registry.js",
     "retention.js",
     "eg1-conformance.js",

package/reliance-kernel.js

@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EP-RELIANCE-KERNEL-v1 — runtime enforcement wrapper.
+ *
+ * The pure verdict lives in @emilia-protocol/verify/reliance (evaluateReliance).
+ * This is the deny-by-default RUNTIME point a relying party puts in front of a
+ * consequential action: it evaluates the evidence packet against the relying
+ * party's pinned EP-RELIANCE-PROFILE-v1, appends the decision to a tamper-evident
+ * evidence log, and — on anything other than `rely` — returns a machine-readable
+ * refusal (HTTP 428, the same Receipt-Required status the Gate uses) naming the
+ * closed verdict and what evidence was required.
+ *
+ * ALLOW iff verdict === 'rely'. Every other closed verdict, a thrown verifier,
+ * or a strict evidence-log failure denies. The kernel never re-derives a verdict
+ * of its own — it enforces the one the pure offline verifier computed.
+ */
+import { createEvidenceLog } from './evidence.js';
+
+const RECEIPT_REQUIRED_STATUS = 428;
+
+// Same cross-package resolution the Gate uses: prefer the published verifier,
+// fall back to the in-repo source so the monorepo builds without a node_modules
+// link. evaluateReliance is pure/offline; no DB, no network.
+const { evaluateReliance, RELIANCE_VERDICTS, RELIANCE_PROFILE_VERSION } = await import('@emilia-protocol/verify/reliance')
+  .catch(() => import('../verify/reliance.js'));
+
+export { RELIANCE_VERDICTS, RELIANCE_PROFILE_VERSION };
+
+/** Build the 428 refusal for a non-`rely` verdict. */
+function relianceChallenge(verdict, reasons, profile) {
+  return {
+    status: RECEIPT_REQUIRED_STATUS,
+    error: 'do_not_rely',
+    verdict,
+    reasons: Array.isArray(reasons) ? reasons : [],
+    required_assurance: profile?.required_assurance ?? null,
+    required_authority: profile?.required_authority === true,
+    required_evidence: Array.isArray(profile?.required_evidence) ? profile.required_evidence : [],
+    header: { name: 'Reliance-Refused', value: verdict },
+  };
+}
+
+/**
+ * Create a reliance kernel bound to one relying-party profile.
+ *
+ * @param {object} cfg
+ * @param {object} cfg.profile        the pinned EP-RELIANCE-PROFILE-v1
+ * @param {object} [cfg.log]          an evidence log (createEvidenceLog); one is created if absent
+ * @param {boolean} [cfg.strictEvidence=true]  fail closed if the evidence log sink fails
+ * @returns {{ check: Function, evidence: object }}
+ */
+export function createRelianceKernel({ profile, log, strictEvidence = true } = {}) {
+  const evidence = log || createEvidenceLog({ strict: strictEvidence });
+
+  /**
+   * Evaluate + enforce one evidence packet.
+   * @param {object} input  the evaluateReliance input MINUS relying_party_profile (bound here)
+   * @param {object} [opts] verifier options { approverKeys, logPublicKey, rpId, revokerKeys }
+   * @returns {Promise<{ allow:boolean, status:number, verdict:string, reasons:string[], checks:object, challenge:(object|null), decision:object }>}
+   */
+  async function check(input = {}, opts = {}) {
+    let result;
+    try {
+      result = evaluateReliance({ ...input, relying_party_profile: profile }, opts);
+    } catch (err) {
+      // A thrown verifier is not a maybe — it is a refusal.
+      result = { verdict: 'do_not_rely_unsigned', rely: false, reasons: [`verifier_error:${err?.message || 'threw'}`], checks: {} };
+    }
+
+    const allow = result.verdict === 'rely';
+    const actionHash = input?.action?.action_hash ?? input?.receipt?.action_hash ?? null;
+
+    // Deny-by-default: record the decision to the tamper-evident log first. In
+    // strict mode a log-sink failure THROWS, which we convert to a refusal — an
+    // action whose decision cannot be durably recorded must not proceed.
+    let decision;
+    try {
+      decision = await evidence.record({
+        type: 'reliance.decision',
+        verdict: result.verdict,
+        allow,
+        action_hash: actionHash,
+        reasons: result.reasons,
+        checks: result.checks,
+        profile: result.profile ?? null,
+      });
+    } catch (err) {
+      return {
+        allow: false,
+        status: RECEIPT_REQUIRED_STATUS,
+        verdict: 'do_not_rely_unsigned',
+        reasons: [`evidence_log_failed:${err?.message || 'sink'}`],
+        checks: result.checks || {},
+        challenge: relianceChallenge('do_not_rely_unsigned', ['evidence_log_failed'], profile),
+        decision: null,
+      };
+    }
+
+    return {
+      allow,
+      status: allow ? 200 : RECEIPT_REQUIRED_STATUS,
+      verdict: result.verdict,
+      reasons: result.reasons,
+      checks: result.checks,
+      challenge: allow ? null : relianceChallenge(result.verdict, result.reasons, profile),
+      decision,
+    };
+  }
+
+  return { check, evidence };
+}
+
+const relianceKernelApi = { createRelianceKernel };
+export default relianceKernelApi;