@emilia-protocol/gate 0.9.5 → 0.10.0

package/CHANGELOG.md

@@ -0,0 +1,70 @@
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+# Changelog
+
+All notable changes to `@emilia-protocol/gate` are documented here.
+This package follows [Semantic Versioning](https://semver.org/).
+
+## 0.10.0 (2026-07-16)
+
+### Added
+
+- The EMILIA Gate consequence-control plane, including action coverage,
+  settlement, metering, deployment-attestation, network-witness, SIEM, and
+  control-plane modules.
+- A BYOC GitHub repository-deletion service with complete mediation, strict
+  receipt ingress, durable Postgres action/consumption/evidence state,
+  authenticated evidence reads, bounded readiness, graceful shutdown, and
+  fail-closed recovery of interrupted effects.
+- Helm, Terraform, Docker Compose, and SQL deployment assets for the BYOC
+  service. Production assets require explicit non-latest images, separate
+  runtime and migration credentials, and operator-owned trust configuration.
+
+### Security
+
+- Pinned issuer, approver, policy, actuator, meter, attestation, and
+  network-witness trust roots are kept outside presenter-controlled evidence.
+- Signed negative human decisions remain durable evidence but cannot satisfy
+  authorization, signer, assurance, authority, quorum, or action-material
+  predicates.
+- Mobile approval and denial evidence is bound to the exact action, profile,
+  presentation, app, device enrollment, RP, origin, and single-use challenge.
+- A same-sequence network-witness conflict permanently poisons that exact
+  witness/capture-point stream. Higher sequence numbers cannot restore trust;
+  recovery requires an explicitly provisioned replacement stream identity.
+- Ambiguous external effects burn their receipt and become `indeterminate`;
+  Gate never retries a consequential effect whose outcome is unknown.
+
+### Distribution
+
+- Gate now declares the exact `@emilia-protocol/require-receipt` and
+  `@emilia-protocol/verify` release bytes it imports. The verifier floor is
+  `3.10.1`, which includes the signed-denial authorization fix.
+- The npm package now carries this changelog and the Apache-2.0 license text.
+
+## 0.9.2 (2026-07-06)
+
+### Added
+`EP-EXTERNAL-VERIFICATION-STATEMENT-v1` (`./reports/external-verification`): the
+artifact a non-EMILIA verifier signs after checking EP evidence. It records a
+procedure, inputs, result, and limitations under the verifier's own Ed25519 key,
+and is accepted only by a relying party pinning that key together with the
+verifier identity out of band. It does not authorize an action or certify
+correctness. A turnkey harness for issuing one over a conformance run lives in
+`examples/external-verification/`.
+
+### Fixed
+`./reports/external-verification` imported `canonicalize` from outside the
+package root, which made the published tarball unloadable
+(`ERR_MODULE_NOT_FOUND`) for every consumer, including the package main entry.
+It now imports the byte-identical in-package `canonicalize`. A new
+`package-boundary` test fails closed if any shipped module ever again resolves a
+relative import outside the package root.
+
+### Security
+Verification hardening (fail-closed): a pin must name the `verifier_id` it
+vouches for, so a pinned key can never validate a different claimed identity
+(`pin_missing_or_mismatched_verifier_id`); `key_id` is derived from the carried
+public key and a mismatched envelope `key_id` is refused (`key_id_mismatch`),
+since the envelope is outside the signed bytes. Default statement limitations now
+disclose that a statement carries no expiry and no consumer binding, is
+replayable verbatim, and that `generated_at` is signer-asserted, not verified.

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2024–2026 EMILIA Protocol, Inc. and contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,6 +1,6 @@
 # @emilia-protocol/gate — EMILIA Gate
 
-**The Trusted Action Firewall.** Deny-by-default enforcement for consequential machine actions.
+**The Consequence Firewall.** Deny-by-default enforcement for consequential machine actions.
 
 > If an agent cannot produce a valid receipt, it cannot change money, code, permissions, data,
 > infrastructure, energy, or physical state.
@@ -32,6 +32,7 @@ import { createTrustedActionFirewall } from '@emilia-protocol/gate';
 
 const gate = createTrustedActionFirewall({
   trustedKeys: [ISSUER_PUBKEY_B64U], // pin the issuers you trust
+  store: sharedConsumptionStore,      // durable + ownership-fenced + permanent
   maxAgeSec: 900,
 });
 
@@ -58,6 +59,48 @@ if (!out.ok) throw out.body; // 428 Receipt Required
 console.log(out.packet.verdict); // "rely"
 ```
 
+## Three-plane deployment
+
+High-consequence infrastructure separates three jobs instead of asking one
+vendor or appliance to prove its own work:
+
+1. **Enforcement plane** — an executor-side Gate returns 428 and does not call
+   the actuator until the pinned authorization profile is satisfied.
+2. **Witness plane** — an independently pinned TAP, packet broker, or sensor
+   signs privacy-minimized observations. Observation never establishes that an
+   action was authorized, blocked, executed, or physically completed.
+3. **Control plane** — a relying party pins the coverage inventory and
+   settlement profile, joins signed evidence by exact action digest, reports
+   `gated`, `witness_only`, `ungated`, `stale`, or `unknown`, and meters only
+   protected actions.
+
+```js
+import { evaluateGateControlPlane } from '@emilia-protocol/gate/control-plane';
+
+const report = await evaluateGateControlPlane({
+  coverage: { deployments, probes, witnesses }, // presenter evidence only
+  settlements: [{ bundle }],
+}, {
+  coverageInventory,       // relying-party pinned
+  settlementProfile,       // relying-party pinned
+  expectedProbeNonces,     // current RP challenges, keyed by surface
+  attestationVerifiers,
+  pinnedProbes,
+  pinnedWitnesses,
+  witnessSequenceStore,     // durable atomic stream checkpoint store
+  verifyAuthorization,
+  verifyExecution,
+  verifyOutcome,
+});
+```
+
+The reference demonstration is `node examples/gate-control-plane/demo.mjs`.
+It shows a complete view becoming `witness_only` and settlement-ineligible when
+the Gate is removed while the network witness remains healthy.
+Witness-dependent production decisions fail closed unless `witnessSequenceStore`
+is durable or the relying party supplies a previously accepted durable witness
+result through the explicit trusted-acceptance option.
+
 ## Default action packs
 
 `createTrustedActionFirewall()` ships with high-risk defaults. These are category-based, not just
@@ -95,21 +138,21 @@ Use your own manifest when you need custom policy:
 ```js
 import { createGate } from '@emilia-protocol/gate';
 
-const gate = createGate({ manifest, trustedKeys: [ISSUER_PUBKEY_B64U] });
+const gate = createGate({ manifest, trustedKeys: [ISSUER_PUBKEY_B64U], store: sharedConsumptionStore });
 ```
 
 ## Framework adapters
 
 ```js
-// 1) Express / Connect middleware
-app.post(
-  '/payments',
-  gate.middleware({
+// 1) Express / Connect route wrapper. The handler is the effect callback;
+// Gate owns reservation, execution, consumption, and evidence as one lifecycle.
+app.post('/payments', gate.route(
+  async (req, res) => res.json(await releasePayment(req.paymentFromSystemOfRecord)),
+  {
     selector: { protocol: 'http', method: 'POST', path: '/payments' },
     observedAction: (req) => req.paymentFromSystemOfRecord,
-  }),
-  handler,
-);
+  },
+));
 
 // 2) Wrap any function
 const release = gate.guard(reallyRelease, {
@@ -125,6 +168,11 @@ const release = gate.guard(reallyRelease, {
 });
 ```
 
+`gate.middleware()` is intentionally deprecated and always refuses: middleware
+cannot prove that code after `next()` executed, so consuming a one-time receipt
+there would create an authorization-without-effect ambiguity. Use
+`gate.route()`, `gate.guard()`, or `gate.run()` for mutations.
+
 ## MCP drop-in
 
 Agents live at the MCP tool-call boundary. One wrapper turns a dangerous tool into a
@@ -134,7 +182,7 @@ receipt-required one:
 import { createTrustedActionFirewall } from '@emilia-protocol/gate';
 import { gateMcpTool } from '@emilia-protocol/gate/mcp';
 
-const gate = createTrustedActionFirewall({ trustedKeys: [ISSUER_PUBKEY_B64U] });
+const gate = createTrustedActionFirewall({ trustedKeys: [ISSUER_PUBKEY_B64U], store: sharedConsumptionStore });
 
 server.tool('release_payment', gateMcpTool(
   gate,
@@ -156,7 +204,7 @@ mutating B). All share one fail-closed contract (`adapters/_kit.js`).
 import { createGate } from '@emilia-protocol/gate';
 import { createGithubManifest, guardGithubMutation } from '@emilia-protocol/gate/adapters/github';
 
-const gate = createGate({ manifest: createGithubManifest(), trustedKeys: [ISSUER_PUBKEY_B64U] });
+const gate = createGate({ manifest: createGithubManifest(), trustedKeys: [ISSUER_PUBKEY_B64U], store: sharedConsumptionStore });
 await guardGithubMutation(gate, octokit, {
   op: 'repo.delete',                 // | 'permission.change' | 'branch_protection.remove'
   params: { owner: 'acme', repo: 'prod' },
@@ -173,7 +221,7 @@ await guardGithubMutation(gate, octokit, {
 
 ```js
 import { createStripeManifest, guardStripeMutation } from '@emilia-protocol/gate/adapters/stripe';
-const gate = createGate({ manifest: createStripeManifest(), trustedKeys: [ISSUER_PUBKEY_B64U] });
+const gate = createGate({ manifest: createStripeManifest(), trustedKeys: [ISSUER_PUBKEY_B64U], store: sharedConsumptionStore });
 await guardStripeMutation(gate, stripe, { op: 'payout.create', params: { amount: 40000, currency: 'usd', destination: 'acct_x' }, receipt });
 // Supabase: guardSupabaseMutation(gate, db, { op: 'sql.destructive', params: { sql }, receipt })  // binds the exact statement
 // AWS:      guardAwsMutation(gate, client, { op: 'iam.attach_policy', params: { user, policy_arn }, receipt })
@@ -203,7 +251,13 @@ if it demonstrably passes all eight checks:
 import { createTrustedActionFirewall, createEg1Harness, gateConformance } from '@emilia-protocol/gate';
 
 const harness = createEg1Harness();
-const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey] });
+const gate = createTrustedActionFirewall({
+  trustedKeys: [harness.publicKey],
+  approverKeys: harness.approverKeys,
+  rpId: harness.rpId,
+  allowedOrigins: harness.allowedOrigins,
+  allowEphemeralStore: true, // conformance fixture only
+});
 const report = await gateConformance({ gate, harness });
 // report.passed === true; report.badge === 'EG-1 Enforced'
 ```
@@ -216,7 +270,7 @@ into a crisp claim: *"this PR makes `delete_row` earn EG-1."*
 ## What it adds over a bare verifier
 
 `@emilia-protocol/require-receipt` already does manifest matching, offline verification, and the 428
-challenge. The Gate composes that and adds the three things a firewall needs:
+challenge. The Gate composes that and adds the lifecycle controls a firewall needs:
 
 - **Assurance tiers** — `software` < `class_a` (device signoff) < `quorum` (m-of-n). A `critical`
   action can demand `class_a` or `quorum`; a lower-assurance receipt is refused (`assurance_too_low`).
@@ -225,7 +279,9 @@ challenge. The Gate composes that and adds the three things a firewall needs:
   of every embedded device/quorum signature, use the EP §6.2 trust-receipt
   verifier in `@emilia-protocol/verify`.
 - **One-time consumption** — a receipt authorizes one action, once. Replays are refused
-  (`replay_refused`). Default store is in-memory; swap in Redis/DB for a fleet.
+  (`replay_refused`). Gate construction requires a durable, ownership-fenced, permanent store.
+  The process-local store is available only through explicit `allowEphemeralStore:true` for tests
+  and reference demos.
 - **Evidence log** — the local logger hash-chains decisions and detects alteration when given its
   complete process history. It is not a fleet ledger: a sink cannot prevent restart-from-genesis or
   cross-replica forks. Safety-critical deployments use `createAtomicEvidenceLog()` over a durable
@@ -235,6 +291,9 @@ challenge. The Gate composes that and adds the three things a firewall needs:
   closes "approved harmless X, executed dangerous Y."
 - **Reliance packet** — `gate.reliancePacket()` turns the decision, execution receipt, field binding,
   and evidence head into the compact artifact an auditor, insurer, or investigator can review.
+- **Independent coverage evidence** — deployment attestation plus a separately pinned active probe
+  can establish a declared surface as `gated`; a passive network witness alone is always
+  `witness_only`. Inventory completeness remains an explicit relying-party assumption.
 
 ## Production custody
 
@@ -265,7 +324,7 @@ const registry = createKeyRegistry([
   { kid: 'issuer-1', key: KEY1 },
   { kid: 'issuer-2', key: KEY2, not_before: '2026-07-01T00:00:00Z' }, // rotation window
 ]);
-const gate = createGate({ manifest, keyRegistry: registry });
+const gate = createGate({ manifest, keyRegistry: registry, store: sharedConsumptionStore });
 registry.revoke('issuer-1'); // compromised — refused immediately, live, no redeploy
 ```
 

package/action-control-manifest.js

@@ -119,6 +119,9 @@ export function toActionControl(action) {
     },
   };
   if (action.quorum) out.quorum = cloneJson(action.quorum);
+  if (action.business_authorization || action.businessAuthorization) {
+    out.business_authorization = cloneJson(action.business_authorization || action.businessAuthorization);
+  }
   return out;
 }
 
@@ -224,6 +227,29 @@ export function validateActionControlManifest(manifest) {
       if (control.evidence_output?.execution_attestation !== true) errors.push(`${prefix}.control.evidence_output.execution_attestation must be true`);
       if (control.evidence_output?.reliance_packet !== true) errors.push(`${prefix}.control.evidence_output.reliance_packet must be true`);
       if (action.conformance?.level !== ACTION_CONTROL_CONFORMANCE_LEVEL) errors.push(`${prefix}.conformance.level must be ${ACTION_CONTROL_CONFORMANCE_LEVEL}`);
+      if (action.business_authorization !== undefined) {
+        const business = action.business_authorization;
+        const policy = business?.policy;
+        const approvers = business?.allowed_approvers;
+        if (!business || typeof business !== 'object' || Array.isArray(business)) {
+          errors.push(`${prefix}.business_authorization must be an object`);
+        } else {
+          if (!policy || typeof policy !== 'object' || Array.isArray(policy)
+              || typeof policy.id !== 'string' || !policy.id
+              || typeof policy.hash !== 'string' || !policy.hash) {
+            errors.push(`${prefix}.business_authorization.policy must pin non-empty id and hash`);
+          }
+          if (typeof business.tenant_id !== 'string' || !business.tenant_id) {
+            errors.push(`${prefix}.business_authorization.tenant_id must be a non-empty string`);
+          }
+          if (!Array.isArray(approvers) || approvers.length === 0
+              || approvers.some((entry) => !entry || typeof entry !== 'object'
+                || typeof entry.subject !== 'string' || !entry.subject
+                || typeof entry.role !== 'string' || !entry.role)) {
+            errors.push(`${prefix}.business_authorization.allowed_approvers must name subject and role`);
+          }
+        }
+      }
     }
   }
   return { ok: errors.length === 0, errors };

package/adapters/_kit.js

@@ -6,15 +6,29 @@
  * gate.run(), and FAIL CLOSED — if the gate refuses, the real client call is
  * never made and we throw EMILIA_RECEIPT_REQUIRED.
  *
- * An op spec is: { selector, observed(params) -> {fields...}, perform(client, params) -> result }.
+ * An op spec is: { selector, observed(params) -> {fields...},
+ * actuator?(params, observed) -> {fields...}, perform(client, actuator) -> result }.
  * `observed` must return the same material fields the action pack binds, drawn
  * from the call params (the system-of-record facts), so a receipt for resource A
  * cannot authorize a mutation of resource B.
  */
-import { hashCanonical } from '../execution-binding.js';
+import { canonicalize, hashCanonical } from '../execution-binding.js';
 
 export { hashCanonical };
 
+function deepFreeze(value) {
+  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    for (const child of Object.values(value)) deepFreeze(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+
+/** Canonical plain-data snapshot used at the actuator boundary. */
+export function canonicalActuatorObject(value) {
+  return deepFreeze(JSON.parse(canonicalize(value)));
+}
+
 /** Build an EP-ACTION-RISK-MANIFEST-v0.1 from a frozen action pack (deep-copied). */
 export function manifestFromPack(pack, extraActions = []) {
   return {
@@ -26,6 +40,9 @@ export function manifestFromPack(pack, extraActions = []) {
         execution_binding: a.execution_binding
           ? { ...a.execution_binding, required_fields: [...a.execution_binding.required_fields] }
           : undefined,
+        ...(a.business_authorization
+          ? { business_authorization: canonicalActuatorObject(a.business_authorization) }
+          : {}),
       })),
       ...extraActions,
     ],
@@ -44,8 +61,33 @@ export function createAdapter({ system, ops }) {
     if (!gate || typeof gate.run !== 'function') throw new Error(`${system} adapter requires an EMILIA Gate (with .run)`);
     const spec = ops[op];
     if (!spec) throw new Error(`${system} adapter: unknown op "${op}" (expected one of: ${OPS.join(', ')})`);
-    const observedAction = spec.observed(params);
-    const out = await gate.run({ selector: spec.selector, receipt, observedAction }, () => spec.perform(client, params));
+    if (!receipt) {
+      const refused = await gate.run(
+        { selector: spec.selector, receipt: null, observedAction: null },
+        () => { throw new Error('unreachable_adapter_effect'); },
+      );
+      const e = new Error(`EMILIA Gate refused ${system}:${op} — ${refused.authorization.reason}`);
+      e.code = 'EMILIA_RECEIPT_REQUIRED';
+      e.status = refused.status;
+      e.gate = refused.authorization;
+      e.challenge = refused.body;
+      throw e;
+    }
+    // Snapshot before any asynchronous verification. Caller-owned params may be
+    // mutated while gate.run() awaits evidence/storage; neither the observation
+    // nor the eventual provider call may follow that mutable reference.
+    const input = canonicalActuatorObject(params);
+    const observedAction = canonicalActuatorObject(spec.observed(input));
+    // Default to the verified fields only. Operations that need a preimage for a
+    // bound digest (SQL, RLS, secret values, queries) must opt in with an explicit
+    // actuator() constructor. The unrestricted caller object is never passed.
+    const actuator = canonicalActuatorObject(
+      typeof spec.actuator === 'function' ? spec.actuator(input, observedAction) : observedAction,
+    );
+    const out = await gate.run(
+      { selector: spec.selector, receipt, observedAction },
+      () => spec.perform(client, actuator),
+    );
     if (!out.ok) {
       const e = new Error(`EMILIA Gate refused ${system}:${op} — ${out.authorization.reason}`);
       e.code = 'EMILIA_RECEIPT_REQUIRED';
@@ -60,4 +102,4 @@ export function createAdapter({ system, ops }) {
   return { ops, OPS, guard };
 }
 
-export default { createAdapter, manifestFromPack, hashCanonical };
+export default { createAdapter, manifestFromPack, hashCanonical, canonicalActuatorObject };

package/adapters/aws.js

@@ -13,7 +13,7 @@
  *   import { createGate } from '@emilia-protocol/gate';
  *   import { createAwsManifest, guardAwsMutation } from '@emilia-protocol/gate/adapters/aws';
  *
- *   const gate = createGate({ manifest: createAwsManifest(), trustedKeys: [ISSUER] });
+ *   const gate = createGate({ manifest: createAwsManifest(), trustedKeys: [ISSUER], store: sharedConsumptionStore });
  *   // client: { iam: { attachUserPolicy, createAccessKey, deleteUser }, ec2: { authorizeSecurityGroupIngress } }
  *   await guardAwsMutation(gate, client, {
  *     op: 'iam.attach_policy', params: { user: 'svc-bot', policy_arn: 'arn:aws:iam::aws:policy/AdministratorAccess' }, receipt,
@@ -48,7 +48,7 @@ export const AWS_ACTION_PACK = Object.freeze([
     risk: 'critical', receipt_required: true, assurance_class: 'quorum',
     match: { protocol: 'aws', tool: 'authorize_security_group_ingress' },
     why: 'Opens the network. Bind group/CIDR/port so 0.0.0.0/0:22 cannot slip through.',
-    execution_binding: { required_fields: ['action_type', 'group_id', 'cidr', 'from_port'] },
+    execution_binding: { required_fields: ['action_type', 'group_id', 'cidr', 'protocol', 'from_port', 'to_port'] },
   }),
 ]);
 
@@ -70,9 +70,20 @@ const OPS = {
   },
   'ec2.authorize_ingress': {
     selector: { protocol: 'aws', tool: 'authorize_security_group_ingress' },
-    observed: (p) => ({ action_type: 'aws.ec2.authorize_ingress', group_id: p.group_id, cidr: p.cidr, from_port: p.from_port }),
+    observed: (p) => ({
+      action_type: 'aws.ec2.authorize_ingress',
+      group_id: p.group_id,
+      cidr: p.cidr,
+      protocol: p.protocol ?? 'tcp',
+      from_port: p.from_port,
+      to_port: p.to_port ?? p.from_port,
+    }),
     perform: (client, p) => client.ec2.authorizeSecurityGroupIngress({
-      GroupId: p.group_id, CidrIp: p.cidr, FromPort: p.from_port, ToPort: p.to_port ?? p.from_port, IpProtocol: p.protocol ?? 'tcp',
+      GroupId: p.group_id,
+      CidrIp: p.cidr,
+      FromPort: p.from_port,
+      ToPort: p.to_port,
+      IpProtocol: p.protocol,
     }),
   },
 };