@emilia-protocol/gate 0.9.3 → 0.9.5

package/README.md

@@ -83,9 +83,12 @@ passes. A bare `@emilia-protocol/require-receipt` gate binds the action type/tar
 this package when parameter drift (amount, beneficiary, commit, role, …) must be caught.
 
 Prefer `gate.run(...)` for mutations: it reserves the receipt, runs the side effect, commits
-one-time consumption only after success, releases the reservation if the action fails before
-mutation, and emits the execution receipt + reliance packet. Use lower-level `gate.check(...)` only
-when your framework has to separate authorization from execution.
+one-time consumption after success, and emits the execution receipt + reliance packet. Once the
+executor is invoked, a thrown error is an **indeterminate effect**, not proof that nothing happened:
+the approval is burned (or its no-TTL reservation remains frozen if the store is unavailable) so a
+blind retry cannot duplicate the side effect. Retryable integrations should make the downstream
+operation idempotent under `receipt_id` and reconcile the result. Use lower-level `gate.check(...)`
+only when your framework has to separate authorization from execution.
 
 Use your own manifest when you need custom policy:
 
@@ -223,8 +226,10 @@ challenge. The Gate composes that and adds the three things a firewall needs:
   verifier in `@emilia-protocol/verify`.
 - **One-time consumption** — a receipt authorizes one action, once. Replays are refused
   (`replay_refused`). Default store is in-memory; swap in Redis/DB for a fleet.
-- **Evidence log** — every decision is hash-chained (`evidence.verify()` detects any alteration).
-  This is the compliance / insurance artifact.
+- **Evidence log** — the local logger hash-chains decisions and detects alteration when given its
+  complete process history. It is not a fleet ledger: a sink cannot prevent restart-from-genesis or
+  cross-replica forks. Safety-critical deployments use `createAtomicEvidenceLog()` over a durable
+  backend whose compare-and-append transaction advances one shared head across replicas.
 - **Execution-field binding** — for high-risk packs, the signed claim must match the executor's
   observed mutation fields (`amount_usd`, `commit_sha`, `principal_id`, `record_id`, etc.). This
   closes "approved harmless X, executed dangerous Y."
@@ -235,6 +240,20 @@ challenge. The Gate composes that and adds the three things a firewall needs:
 
 The three things a serious buyer (CISO, auditor, insurer) asks after the demo:
 
+**AEC execution custody.** `createAECExecutionGate()` requires a relying-party requirement,
+executor-owned action, explicit human floor, and constructor-pinned custom verifier and key
+registries. Transaction input may carry evidence, but never verifier code, trust keys, or human
+acceptance profiles; attempts to do so are refused before verification. Production mode additionally refuses an expiring
+consumption store or a process-local evidence logger. It consumes
+`aec:action:<canonical-action-digest>` before the effect, passes the effect a frozen pre-await action
+snapshot, and conservatively burns or freezes the action after an indeterminate result. Every
+otherwise identical intended effect therefore needs a unique action-instance nonce inside the
+signed action. Use `createAtomicEvidenceLog()` from `@emilia-protocol/gate/evidence`; its backend
+must atomically compare and append against one durable shared head. The gate independently
+recomputes every logger acknowledgment and requires its entry bytes to equal the requested
+decision; the atomic logger also requires readback to equal the exact submitted sequence and
+predecessor.
+
 **Issuer key rotation + revocation.** A flat `trustedKeys` list can't revoke a leaked key
 or rotate without downtime. A key registry can — a receipt is verified only against keys
 valid (and not revoked) at its issuance time. Revocation is fail-closed and immediate.
@@ -251,15 +270,24 @@ registry.revoke('issuer-1'); // compromised — refused immediately, live, no re
 ```
 
 **Fleet-safe replay defense.** The in-memory store is per-process. In production, back the
-consumption store with a shared key-value store whose insert-if-absent is atomic:
+consumption store with a shared key-value store whose insert-if-absent, compare-and-set, and
+conditional delete operations are atomic:
 
 ```js
 import { createDurableConsumptionStore } from '@emilia-protocol/gate';
-const store = createDurableConsumptionStore(redisBackend); // backend.addIfAbsent MUST be atomic (Redis SET NX)
+const store = createDurableConsumptionStore(redisBackend); // addIfAbsent + compareAndSet + deleteIfValue + has
 const gate = createGate({ manifest, keyRegistry, store });
 // A receipt consumed on one pod cannot be replayed on another.
 ```
 
+Reservations carry an opaque owner token and have no TTL. Only that owner may commit or release;
+an abandoned reservation requires reconciliation because automatically reopening it after a crash
+could repeat an effect whose response was lost. A TTL may apply only to committed rows.
+The Postgres adapter rejects malformed or regressing clocks before expiry-bearing state changes.
+The model-based fault gate runs 5,000 generated schedules across crash, lag, rollback, failover,
+duplicate delivery, and before/after-linearization response loss; see
+`security/CONSUMPTION_FAULT_STATUS.md`.
+
 **Evidence retention.** Classify the evidence log into hot/cold/expired with legal hold, and
 export the auditor/SIEM manifest (tied to the evidence head). `EP_AUDIT_HOT_DAYS` /
 `EP_AUDIT_COLD_DAYS` set the horizons.

package/aec-execution.js

@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Stateful execution boundary for EP-AEC.
+ *
+ * verifyAuthorizationChain is a pure evidence-composition decision. This
+ * wrapper adds the stateful properties an executor needs: independently bound
+ * action bytes, a mandatory human-assurance floor, atomic one-time reservation,
+ * tamper-evident decision records, and conservative crash semantics.
+ */
+import { createEvidenceLog, verifyEvidenceRecord } from './evidence.js';
+import { MemoryConsumptionStore } from './store.js';
+
+const { verifyAuthorizationChain } = await import('@emilia-protocol/verify/evidence-chain')
+  .catch(() => import('../verify/evidence-chain.js'));
+
+const HUMAN_FLOORS = new Set(['class_a', 'quorum', 'class_a_or_quorum']);
+const HEX_256 = /^[0-9a-f]{64}$/;
+const COMPONENT_TYPE = /^[A-Za-z0-9_.:-]+$/;
+const RESERVED_COMPONENT_TYPES = new Set(['ep-receipt', 'ep-quorum']);
+const own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+
+function deepFreeze(value) {
+  if (!value || typeof value !== 'object') return value;
+  const stack = [value];
+  const seen = new WeakSet();
+  while (stack.length) {
+    const current = stack.pop();
+    if (!current || typeof current !== 'object' || seen.has(current)) continue;
+    seen.add(current);
+    for (const child of Object.values(current)) stack.push(child);
+    Object.freeze(current);
+  }
+  return value;
+}
+
+function validLogRecord(record, atomicRequired, expectedEntry) {
+  return verifyEvidenceRecord(record, { atomicRequired, expectedEntry });
+}
+
+function validComponent(result, type) {
+  return Array.isArray(result?.components)
+    && result.components.some((component) => component.type === type && component.valid === true && component.bound === true);
+}
+
+function humanFloorSatisfied(result, floor) {
+  const classA = validComponent(result, 'ep-receipt');
+  const quorum = validComponent(result, 'ep-quorum');
+  if (floor === 'class_a') return classA;
+  if (floor === 'quorum') return quorum;
+  return classA || quorum;
+}
+
+function evidenceSatisfied(result) {
+  try {
+    if (!result || typeof result !== 'object') return false;
+    // New verifiers expose the evidence-layer term. Older supported 3.x
+    // verifiers expose the equivalent `allow` result only. If `satisfied` is
+    // present, it is authoritative so a conflicting compatibility alias can
+    // never upgrade a refusal.
+    return own(result, 'satisfied') ? result.satisfied === true : result.allow === true;
+  } catch {
+    return false;
+  }
+}
+
+function consumptionKey(result) {
+  // Consume the executor-owned action instance, not a presenter-selected
+  // component identifier. Otherwise an invalid decoy component or an alternate
+  // valid human proof can create a fresh key for the same physical effect.
+  // Repeated intended effects therefore need a unique nonce/id inside the
+  // canonical action before authorization is collected.
+  return HEX_256.test(result?.action_digest)
+    ? `aec:action:${result.action_digest}`
+    : null;
+}
+
+function instant(now) {
+  try {
+    const value = typeof now === 'function' ? now() : now;
+    const date = value instanceof Date ? value : new Date(value);
+    return Number.isFinite(date.getTime()) ? date.toISOString() : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {object} config
+ * @param {string} config.requirement relying-party AEC requirement
+ * @param {object} config.policiesByType relying-party human acceptance profiles
+ * @param {object} [config.verifiers] relying-party-pinned custom component verifiers
+ * @param {object} [config.keysByType] relying-party-pinned custom verifier keys
+ * @param {'class_a'|'quorum'|'class_a_or_quorum'} config.humanFloor
+ * @param {object} [config.store] ownership-fenced consumption store
+ * @param {object} [config.log] tamper-evident evidence log
+ * @param {boolean} [config.allowEphemeralState=false] test/demo opt-in only
+ * @param {Function|number|Date} [config.now=Date.now]
+ */
+export function createAECExecutionGate({
+  requirement,
+  policiesByType,
+  verifiers = {},
+  keysByType = {},
+  humanFloor,
+  store,
+  log,
+  allowEphemeralState = false,
+  now = Date.now,
+} = {}) {
+  if (typeof requirement !== 'string' || !requirement.trim()) {
+    throw new Error('AEC execution gate requires a relying-party requirement');
+  }
+  if (!policiesByType || typeof policiesByType !== 'object' || Array.isArray(policiesByType)) {
+    throw new Error('AEC execution gate requires relying-party policiesByType');
+  }
+  let pinnedPolicies;
+  try { pinnedPolicies = deepFreeze(structuredClone(policiesByType)); }
+  catch { throw new Error('AEC execution gate policiesByType must be cloneable canonical data'); }
+  if (!verifiers || typeof verifiers !== 'object' || Array.isArray(verifiers)) {
+    throw new Error('AEC execution gate verifiers must be a relying-party-owned object');
+  }
+  const pinnedVerifiers = Object.create(null);
+  try {
+    for (const [type, verifier] of Object.entries(verifiers)) {
+      if (!COMPONENT_TYPE.test(type) || type.length > 128 || RESERVED_COMPONENT_TYPES.has(type)
+          || typeof verifier !== 'function') {
+        throw new Error('invalid verifier registry member');
+      }
+      pinnedVerifiers[type] = verifier;
+    }
+    Object.freeze(pinnedVerifiers);
+  } catch {
+    throw new Error('AEC execution gate verifiers must contain only named custom verifier functions');
+  }
+  if (!keysByType || typeof keysByType !== 'object' || Array.isArray(keysByType)) {
+    throw new Error('AEC execution gate keysByType must be a relying-party-owned object');
+  }
+  let pinnedKeysByType;
+  try { pinnedKeysByType = deepFreeze(structuredClone(keysByType)); }
+  catch { throw new Error('AEC execution gate keysByType must be cloneable canonical data'); }
+  if (!HUMAN_FLOORS.has(humanFloor)) {
+    throw new Error('AEC execution gate requires humanFloor class_a, quorum, or class_a_or_quorum');
+  }
+  if (!store && !allowEphemeralState) {
+    throw new Error('AEC execution gate requires a durable consumption store');
+  }
+  if (!log && !allowEphemeralState) {
+    throw new Error('AEC execution gate requires a durable strict evidence log');
+  }
+
+  const consumption = store || new MemoryConsumptionStore();
+  const evidence = log || createEvidenceLog({ strict: true });
+  if (!allowEphemeralState && (consumption.durable !== true || consumption.ownershipFenced !== true
+      || consumption.permanentConsumption !== true)) {
+    throw new Error('AEC execution gate requires a capability-marked, ownership-fenced durable store with non-expiring committed keys');
+  }
+  if (!allowEphemeralState && (evidence.durable !== true || evidence.strict !== true
+      || evidence.forkAware !== true || evidence.atomicAppend !== true)) {
+    throw new Error('AEC execution gate requires a durable strict evidence log with atomic shared-head append and fork detection');
+  }
+  for (const method of ['reserve', 'commit']) {
+    if (typeof consumption?.[method] !== 'function') {
+      throw new Error(`AEC execution gate consumption store requires ${method}()`);
+    }
+  }
+  if (typeof evidence?.record !== 'function') {
+    throw new Error('AEC execution gate evidence log requires record()');
+  }
+  // Capture the methods that passed construction checks. Callers may retain the
+  // objects for observability, but replacing a method later must not rewrite the
+  // gate's replay or evidence semantics.
+  const reserveConsumption = consumption.reserve.bind(consumption);
+  const commitConsumption = consumption.commit.bind(consumption);
+  const releaseConsumption = typeof consumption.release === 'function'
+    ? consumption.release.bind(consumption) : null;
+  const recordEvidence = evidence.record.bind(evidence);
+
+  async function deny(reason, result = null, extra = {}) {
+    let decision = null;
+    try {
+      const entry = {
+        type: 'aec.execution.decision',
+        at: instant(now),
+        allow: false,
+        reason,
+        action_digest: result?.action_digest ?? null,
+        requirement,
+        human_floor: humanFloor,
+        ...extra,
+      };
+      decision = await recordEvidence(entry);
+      if (!validLogRecord(decision, !allowEphemeralState, entry)) throw new Error('malformed evidence record');
+    } catch {
+      return { ok: false, allow: false, reason: 'evidence_log_failed', result, decision: null };
+    }
+    return { ok: false, allow: false, reason, result, decision };
+  }
+
+  async function run(request = {}, effect) {
+    if (typeof effect !== 'function') throw new Error('AEC execution gate run() requires an effect function');
+    let chain;
+    let expectedAction;
+    try {
+      if (!request || typeof request !== 'object' || Array.isArray(request)) {
+        return deny('invalid_execution_request');
+      }
+      // Trust configuration belongs to the relying party at gate construction.
+      // Accepting verifier code or trust keys beside presenter evidence lets the
+      // presenter define the proof that its own evidence must pass.
+      if (own(request, 'verifiers') || own(request, 'keysByType') || own(request, 'policiesByType')) {
+        return deny('runtime_trust_configuration_refused');
+      }
+      chain = request.chain;
+      expectedAction = request.expectedAction;
+    } catch {
+      return deny('invalid_execution_request');
+    }
+    const verificationTime = instant(now);
+    if (!verificationTime) return deny('invalid_verification_time');
+    let actionSnapshot;
+    try { actionSnapshot = deepFreeze(structuredClone(expectedAction)); }
+    catch { return deny('invalid_expected_action'); }
+
+    const result = verifyAuthorizationChain(chain, {
+      verifiers: pinnedVerifiers,
+      keysByType: pinnedKeysByType,
+      policiesByType: pinnedPolicies,
+      requirement,
+      expectedAction: actionSnapshot,
+      verificationTime,
+    });
+    if (!evidenceSatisfied(result)) return deny('aec_refused', result, { reasons: result.reasons });
+    if (!humanFloorSatisfied(result, humanFloor)) return deny('human_floor_unsatisfied', result);
+
+    const key = consumptionKey(result);
+    if (!key) return deny('missing_stable_consumption_key', result);
+
+    let reserved;
+    try { reserved = (await reserveConsumption(key)) === true; }
+    catch { return deny('consumption_store_unavailable', result, { consumption_key: key }); }
+    if (!reserved) return deny('replay_refused', result, { consumption_key: key });
+
+    let authorization;
+    try {
+      const entry = {
+        type: 'aec.execution.decision',
+        at: verificationTime,
+        allow: true,
+        reason: 'allow',
+        action_digest: result.action_digest,
+        requirement,
+        human_floor: humanFloor,
+        consumption_key: key,
+      };
+      authorization = await recordEvidence(entry);
+      if (!validLogRecord(authorization, !allowEphemeralState, entry)) throw new Error('malformed evidence record');
+    } catch {
+      try { if (releaseConsumption) await releaseConsumption(key); } catch { /* frozen is safe */ }
+      return { ok: false, allow: false, reason: 'evidence_log_failed', result, decision: null };
+    }
+
+    let effectStarted = false;
+    let committed = false;
+    try {
+      effectStarted = true;
+      const value = await effect({ action: actionSnapshot, result, authorization });
+      if ((await commitConsumption(key)) !== true) throw new Error('consumption_store_commit_refused');
+      committed = true;
+      const executionEntry = {
+        type: 'aec.execution.outcome',
+        at: instant(now),
+        outcome: 'executed',
+        authorizes_decision: authorization.hash,
+        action_digest: result.action_digest,
+        consumption_key: key,
+      };
+      const execution = await recordEvidence(executionEntry);
+      if (!validLogRecord(execution, !allowEphemeralState, executionEntry)) throw new Error('malformed evidence record');
+      return { ok: true, allow: true, value, result, authorization, execution };
+    } catch (error) {
+      if (effectStarted && !committed) {
+        try { committed = (await commitConsumption(key)) === true; } catch { /* reservation remains fail-closed */ }
+      }
+      try {
+        const indeterminateEntry = {
+          type: 'aec.execution.outcome',
+          at: instant(now),
+          outcome: 'indeterminate',
+          authorizes_decision: authorization.hash,
+          action_digest: result.action_digest,
+          consumption_key: key,
+        };
+        const indeterminate = await recordEvidence(indeterminateEntry);
+        if (!validLogRecord(indeterminate, !allowEphemeralState, indeterminateEntry)) {
+          throw new Error('malformed evidence record');
+        }
+      } catch { /* the original failure remains primary; replay is still blocked */ }
+      throw error;
+    }
+  }
+
+  return { run, evidence, store: consumption };
+}
+
+export const __aecExecutionSecurityInternals = Object.freeze({
+  deepFreeze,
+  validLogRecord,
+  validComponent,
+  humanFloorSatisfied,
+  evidenceSatisfied,
+  consumptionKey,
+  instant,
+});
+
+export default { createAECExecutionGate };

package/challenge-store.js

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Durable, body-bound lifecycle store for AE-CHALLENGE-v1.
+ *
+ * Registration is atomic insert-if-absent. Consumption is an atomic transition
+ * from the digest of the exact registered body to a consumed state carrying
+ * that same digest. A presenter that changes action, profile, expiry, or any
+ * other challenge member cannot consume the original registration even when it
+ * reuses the challenge id and nonce.
+ */
+import { hashCanonical } from './execution-binding.js';
+
+export const DURABLE_CHALLENGE_STORE_VERSION = 'EP-DURABLE-CHALLENGE-STORE-v1';
+const OPEN_PREFIX = 'challenge-open:v1:';
+const CONSUMED_PREFIX = 'challenge-consumed:v1:';
+
+function assertChallenge(challenge) {
+  if (!challenge || typeof challenge !== 'object' || Array.isArray(challenge)) {
+    throw new Error('challenge must be an object');
+  }
+  if (challenge['@version'] !== 'AE-CHALLENGE-v1') throw new Error('unsupported challenge version');
+  if (typeof challenge.challenge_id !== 'string' || !challenge.challenge_id.trim()) throw new Error('challenge_id is required');
+  if (typeof challenge.nonce !== 'string' || !challenge.nonce.trim()) throw new Error('challenge nonce is required');
+}
+
+export function challengeStorageKey(challenge) {
+  assertChallenge(challenge);
+  return `ae-challenge:${hashCanonical({ challenge_id: challenge.challenge_id, nonce: challenge.nonce })}`;
+}
+
+export function challengeBodyDigest(challenge) {
+  assertChallenge(challenge);
+  return hashCanonical(challenge);
+}
+
+export function createDurableChallengeStore(backend) {
+  for (const method of ['addIfAbsent', 'compareAndSet', 'has']) {
+    if (typeof backend?.[method] !== 'function') {
+      throw new Error(`createDurableChallengeStore: backend must implement atomic async ${method}()`);
+    }
+  }
+
+  return {
+    durable: backend.durable === true,
+    atomicRegistration: true,
+    bodyBound: true,
+    permanentConsumption: true,
+    async register(challenge) {
+      const key = challengeStorageKey(challenge);
+      const digest = challengeBodyDigest(challenge);
+      return (await backend.addIfAbsent(key, `${OPEN_PREFIX}${digest}`)) === true;
+    },
+
+    async consume(challenge) {
+      const key = challengeStorageKey(challenge);
+      const digest = challengeBodyDigest(challenge);
+      return (await backend.compareAndSet(
+        key,
+        `${OPEN_PREFIX}${digest}`,
+        `${CONSUMED_PREFIX}${digest}`,
+      )) === true;
+    },
+
+    async has(challenge) {
+      return (await backend.has(challengeStorageKey(challenge))) === true;
+    },
+  };
+}
+
+export default { createDurableChallengeStore, challengeStorageKey, challengeBodyDigest, DURABLE_CHALLENGE_STORE_VERSION };

package/deploy/helm/README.md

@@ -50,7 +50,7 @@ kubectl -n emilia create secret generic emilia-gate-issuer-keys \
 helm install gate ./emilia-gate \
   --namespace emilia --create-namespace \
   --set image.repository=YOUR_REGISTRY/emilia-gate \
-  --set image.tag=0.9.0 \
+  --set image.tag=0.9.5 \
   --set issuerKeys.existingSecret=emilia-gate-issuer-keys
 
 # 3. (Optional) expose /metrics + ServiceMonitor stub (needs Prometheus Operator).

package/deploy/helm/emilia-gate/Chart.yaml

@@ -19,7 +19,7 @@ type: application
 version: 0.1.0
 # Version of @emilia-protocol/gate this chart tracks; used as the default
 # image tag when .Values.image.tag is empty.
-appVersion: "0.9.0"
+appVersion: "0.9.5"
 kubeVersion: ">=1.23.0-0"
 home: https://emiliaprotocol.ai
 sources:

package/enterprise.js

@@ -73,7 +73,10 @@ export function mintEntitlement(privateKey, {
   if (toMs(not_before) == null) throw new Error('entitlement: not_before is required (ISO or ms)');
   if (toMs(expires_at) == null) throw new Error('entitlement: expires_at is required (ISO or ms)');
   if (!kid || typeof kid !== 'string') throw new Error('entitlement: kid is required');
-  const payload = { org, tier, features, limits, not_before, expires_at, kid };
+  // Snapshot features/limits into the signed payload: embedding the caller's live
+  // array/object would let a licensing service mutate them after minting and
+  // diverge the entitlement from its signature.
+  const payload = { org, tier, features: structuredClone(features), limits: structuredClone(limits), not_before, expires_at, kid };
   const value = crypto.sign(null, Buffer.from(canonical(payload), 'utf8'), privateKey).toString('base64url');
   return { '@version': ENTITLEMENT_VERSION, payload, signature: { algorithm: 'Ed25519', value } };
 }

package/ep-assure.mjs

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * ep-assure — re-perform an EMILIA reliance assurance package and emit an auditor
+ * workpaper. The independent-assurer CLI: point it at a package (or raw decisions
+ * + a pinned profile) and auditor-supplied keys, and it recomputes every reliance
+ * verdict offline, detects drift against the runtime's stated verdicts, maps each
+ * to a control objective, and prints the workpaper. Exit code is non-zero when it
+ * finds a decision that RELIED ON INADMISSIBLE evidence (claimed rely, recomputes
+ * to a refusal), so it drops into CI/audit pipelines.
+ *
+ *   node packages/gate/ep-assure.mjs <input.json> [--json] [--strict]
+ *
+ * input.json is one of:
+ *   { "package": <EP-ASSURANCE-PACKAGE-v1>, "keys": {...}, "now": <iso|ms> }
+ *   { "decisions": [...], "profile": <EP-RELIANCE-PROFILE-v1>, "keys": {...}, "now": <iso|ms> }
+ *
+ * keys (auditor-pinned, out of band): { approverKeys, logPublicKey, rpId, revokerKeys }
+ * --json   print the full EP-ASSURANCE-REPERFORMANCE-v1 document instead of text
+ * --strict exit non-zero if ANY drift is found (default: only inadmissible-reliance drift)
+ */
+import { readFileSync } from 'node:fs';
+import { buildAssurancePackage, reperformAssurancePackage, renderAssuranceWorkpaper } from './reports/assurance-package.js';
+
+function fail(msg) { process.stderr.write(`ep-assure: ${msg}\n`); process.exit(2); }
+
+const args = process.argv.slice(2);
+const flags = new Set(args.filter((a) => a.startsWith('--')));
+const path = args.find((a) => !a.startsWith('--'));
+if (!path) fail('usage: ep-assure <input.json> [--json] [--strict]');
+
+let input;
+try { input = JSON.parse(readFileSync(path, 'utf8')); } catch (e) { fail(`cannot read ${path}: ${e.message}`); }
+
+const keys = input.keys || {};
+const now = input.now != null ? (typeof input.now === 'string' ? Date.parse(input.now) : input.now) : 0;
+
+let pkg = input.package;
+if (!pkg) {
+  if (!Array.isArray(input.decisions)) fail('input needs a `package` or a `decisions` array');
+  pkg = buildAssurancePackage(input.decisions, { profile: input.profile, organization: input.organization || null, now });
+}
+
+let doc;
+try {
+  doc = reperformAssurancePackage(pkg, {
+    approverKeys: keys.approverKeys || {}, logPublicKey: keys.logPublicKey || null,
+    rpId: keys.rpId || null, revokerKeys: keys.revokerKeys || {}, now,
+  });
+} catch (e) { fail(e.message); }
+
+if (flags.has('--json')) {
+  process.stdout.write(JSON.stringify(doc, null, 2) + '\n');
+} else {
+  process.stdout.write(renderAssuranceWorkpaper(doc) + '\n');
+}
+
+const inadmissibleReliance = doc.population.relied_on_inadmissible_evidence;
+const anyDrift = doc.population.drift;
+const bad = flags.has('--strict') ? anyDrift : inadmissibleReliance;
+if (bad > 0) {
+  process.stderr.write(`ep-assure: ${bad} finding(s) — ${flags.has('--strict') ? 'drift' : 'reliance on inadmissible evidence'} detected\n`);
+  process.exit(1);
+}
+process.exit(0);