@emilia-protocol/gate 0.9.5 → 0.10.0

package/deploy/terraform/variables.tf

@@ -52,9 +52,9 @@ variable "image_pull_policy" {
 }
 
 variable "replicas" {
-  description = "Number of gate replicas. Replay defense across >1 replica requires a shared consumption store (see README) — the module deploys the pods either way, but fleet-safety is the deployer's configuration responsibility."
+  description = "Number of legacy gate replicas. Values above one require explicit Secret-backed shared consumption and evidence backend references."
   type        = number
-  default     = 2
+  default     = 1
 
   validation {
     condition     = var.replicas >= 1 && floor(var.replicas) == var.replicas
@@ -95,6 +95,99 @@ variable "issuer_keys_secret_key" {
   }
 }
 
+variable "shared_consumption_backend" {
+  description = "Secret-backed environment reference for a shared durable consumption backend used by a custom legacy image. Required with replicas > 1."
+  type = object({
+    env_name    = string
+    secret_name = string
+    secret_key  = string
+  })
+  default  = null
+  nullable = true
+
+  validation {
+    condition = var.shared_consumption_backend == null ? true : (
+      can(regex("^[A-Za-z_][A-Za-z0-9_]*$", var.shared_consumption_backend.env_name))
+      && trimspace(var.shared_consumption_backend.secret_name) != ""
+      && trimspace(var.shared_consumption_backend.secret_key) != ""
+    )
+    error_message = "shared_consumption_backend must provide a valid env_name and non-empty existing Secret name/key."
+  }
+}
+
+variable "shared_evidence_backend" {
+  description = "Secret-backed environment reference for a shared durable evidence backend used by a custom legacy image. Required with replicas > 1."
+  type = object({
+    env_name    = string
+    secret_name = string
+    secret_key  = string
+  })
+  default  = null
+  nullable = true
+
+  validation {
+    condition = var.shared_evidence_backend == null ? true : (
+      can(regex("^[A-Za-z_][A-Za-z0-9_]*$", var.shared_evidence_backend.env_name))
+      && trimspace(var.shared_evidence_backend.secret_name) != ""
+      && trimspace(var.shared_evidence_backend.secret_key) != ""
+    )
+    error_message = "shared_evidence_backend must provide a valid env_name and non-empty existing Secret name/key."
+  }
+}
+
+variable "github_token_secret_name" {
+  description = "Optional existing Secret containing a GitHub token. Only the Secret reference enters Terraform state."
+  type        = string
+  default     = null
+  nullable    = true
+
+  validation {
+    condition     = var.github_token_secret_name == null ? true : can(regex("^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$", var.github_token_secret_name))
+    error_message = "github_token_secret_name must be null or a Kubernetes Secret name."
+  }
+}
+
+variable "github_token_secret_key" {
+  description = "Key in github_token_secret_name containing the GitHub token."
+  type        = string
+  default     = "token"
+
+  validation {
+    condition     = trimspace(var.github_token_secret_key) != ""
+    error_message = "github_token_secret_key must be non-empty."
+  }
+}
+
+variable "github_token_env_name" {
+  description = "Environment variable populated from github_token_secret_name."
+  type        = string
+  default     = "GITHUB_TOKEN"
+
+  validation {
+    condition     = can(regex("^[A-Za-z_][A-Za-z0-9_]*$", var.github_token_env_name))
+    error_message = "github_token_env_name must be a valid environment variable name."
+  }
+}
+
+variable "secret_env" {
+  description = "Additional environment variables populated from existing Kubernetes Secrets. Secret values are never module inputs."
+  type = map(object({
+    secret_name = string
+    secret_key  = string
+  }))
+  default = {}
+
+  validation {
+    condition = alltrue([
+      for env_name, reference in var.secret_env :
+      can(regex("^[A-Za-z_][A-Za-z0-9_]*$", env_name))
+      && trimspace(reference.secret_name) != ""
+      && trimspace(reference.secret_key) != ""
+    ])
+    error_message = "secret_env keys must be environment variable names and each Secret name/key must be non-empty."
+  }
+}
+
 variable "port" {
   description = "Port the gate HTTP service listens on inside the container (EP_GATE_PORT). Matches the Helm chart's gate.port."
   type        = number

package/deployment-attestation.js

@@ -0,0 +1,248 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Relying-party evaluation of evidence that an expected Gate workload is
+ * running. This module introduces no attestation format and no trust root: the
+ * profile pins a verifier selected by the relying party, and that verifier may
+ * consume EAT/RATS, App Attest, Play Integrity, TPM, confidential-compute, or
+ * workload-identity evidence.
+ */
+import { canonicalize, hashCanonical } from './execution-binding.js';
+
+export const DEPLOYMENT_PROFILE_VERSION = 'EP-GATE-DEPLOYMENT-PROFILE-v1';
+export const DEPLOYMENT_ATTESTATION_VERDICTS = Object.freeze([
+  'attested',
+  'refuse_profile_invalid',
+  'refuse_verifier_unpinned',
+  'refuse_evidence_invalid',
+  'refuse_verifier_error',
+  'refuse_context_mismatch',
+  'refuse_measurement_mismatch',
+  'refuse_stale',
+]);
+
+const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+const RFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?Z$/;
+
+function isPlainObject(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function strictInstantMs(value) {
+  if (typeof value !== 'string') return NaN;
+  const match = value.match(RFC3339);
+  if (!match) return NaN;
+  const [, y, m, d, h, min, s] = match;
+  const calendar = new Date(0);
+  calendar.setUTCFullYear(Number(y), Number(m) - 1, Number(d));
+  calendar.setUTCHours(Number(h), Number(min), Number(s), 0);
+  if (calendar.toISOString().slice(0, 19) !== `${y}-${m}-${d}T${h}:${min}:${s}`) return NaN;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : NaN;
+}
+
+function string(value, max = 512) {
+  return typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+}
+
+function digest(value) {
+  return typeof value === 'string' && DIGEST_RE.test(value);
+}
+
+function exactKeys(value, allowed) {
+  return isPlainObject(value) && Object.keys(value).every((key) => allowed.has(key));
+}
+
+function validateProfile(profile) {
+  if (!exactKeys(profile, new Set([
+    '@version', 'profile_id', 'verifier_id', 'evidence_type', 'gate_id', 'environment_id',
+    'audience', 'nonce', 'max_age_sec', 'max_future_skew_sec', 'required_measurements',
+  ]))) return 'profile_shape_invalid';
+  if (profile['@version'] !== DEPLOYMENT_PROFILE_VERSION) return 'profile_version_invalid';
+  for (const field of ['profile_id', 'verifier_id', 'evidence_type', 'gate_id', 'environment_id', 'audience']) {
+    if (!string(profile[field])) return `profile_${field}_invalid`;
+  }
+  if (!string(profile.nonce, 1024)) return 'profile_nonce_invalid';
+  if (!Number.isSafeInteger(profile.max_age_sec) || profile.max_age_sec < 1 || profile.max_age_sec > 86_400) {
+    return 'profile_max_age_invalid';
+  }
+  if (!Number.isSafeInteger(profile.max_future_skew_sec)
+      || profile.max_future_skew_sec < 0 || profile.max_future_skew_sec > 300) {
+    return 'profile_future_skew_invalid';
+  }
+  if (!isPlainObject(profile.required_measurements)
+      || Object.keys(profile.required_measurements).length === 0
+      || Object.keys(profile.required_measurements).length > 32) return 'profile_measurements_invalid';
+  for (const [name, value] of Object.entries(profile.required_measurements)) {
+    if (!string(name, 128) || !digest(value)) return 'profile_measurements_invalid';
+  }
+  try { canonicalize(profile); } catch { return 'profile_canonicalization_invalid'; }
+  return null;
+}
+
+export function deploymentProfileDigest(profile) {
+  const invalid = validateProfile(profile);
+  if (invalid) throw new TypeError(invalid);
+  return `sha256:${hashCanonical(profile)}`;
+}
+
+function fail(verdict, profileHash = null, extra = {}) {
+  return {
+    accepted: false,
+    verified: false,
+    verdict,
+    profile_hash: profileHash,
+    checks: {
+      profile: verdict !== 'refuse_profile_invalid',
+      verifier: false,
+      evidence: false,
+      context: false,
+      freshness: false,
+      measurements: false,
+      ...extra,
+    },
+  };
+}
+
+function verifierFor(verifiers, verifierId) {
+  let verifier;
+  if (verifiers instanceof Map) verifier = verifiers.get(verifierId);
+  else if (isPlainObject(verifiers)) {
+    verifier = Object.getOwnPropertyDescriptor(verifiers, verifierId)?.value;
+  }
+  return typeof verifier === 'function' ? verifier : null;
+}
+
+/**
+ * Verify deployment evidence under a relying-party-pinned profile.
+ *
+ * The selected verifier is taken from `profile.verifier_id`, which is a trusted
+ * input. A presenter cannot select its own verifier by labeling the evidence.
+ * The verifier returns normalized claims; this kernel independently compares
+ * every context and measurement claim with the profile.
+ */
+export async function verifyDeploymentAttestation(evidence, options = {}) {
+  let profile;
+  let invalid;
+  try {
+    invalid = validateProfile(options.profile);
+    profile = invalid ? options.profile : JSON.parse(canonicalize(options.profile));
+  } catch {
+    invalid = 'profile_hostile_input';
+    profile = null;
+  }
+  if (invalid) return { ...fail('refuse_profile_invalid'), reason: invalid };
+  const profileHash = deploymentProfileDigest(profile);
+  const verifier = verifierFor(options.verifiers, profile.verifier_id);
+  if (typeof verifier !== 'function') {
+    return { ...fail('refuse_verifier_unpinned', profileHash, { profile: true }), reason: 'pinned_verifier_missing' };
+  }
+
+  let claims;
+  try {
+    claims = await verifier(evidence, Object.freeze({
+      evidence_type: profile.evidence_type,
+      audience: profile.audience,
+      nonce: profile.nonce,
+      gate_id: profile.gate_id,
+      environment_id: profile.environment_id,
+    }));
+  } catch {
+    return {
+      ...fail('refuse_verifier_error', profileHash, { profile: true, verifier: true }),
+      reason: 'pinned_verifier_threw',
+    };
+  }
+  if (!isPlainObject(claims) || claims.verified !== true || !isPlainObject(claims.measurements)) {
+    return {
+      ...fail('refuse_evidence_invalid', profileHash, { profile: true, verifier: true }),
+      reason: 'attestation_not_verified',
+    };
+  }
+  try { claims = JSON.parse(canonicalize(claims)); } catch {
+    return {
+      ...fail('refuse_evidence_invalid', profileHash, { profile: true, verifier: true }),
+      reason: 'attestation_claims_not_canonical_json',
+    };
+  }
+
+  const contextMatches = claims.verifier_id === profile.verifier_id
+    && claims.evidence_type === profile.evidence_type
+    && claims.gate_id === profile.gate_id
+    && claims.environment_id === profile.environment_id
+    && claims.audience === profile.audience
+    && claims.nonce === profile.nonce;
+  if (!contextMatches) {
+    return {
+      ...fail('refuse_context_mismatch', profileHash, {
+        profile: true, verifier: true, evidence: true,
+      }),
+      reason: 'attestation_context_mismatch',
+    };
+  }
+
+  const now = options.now === undefined ? Date.now() : Number(options.now);
+  const issuedAt = strictInstantMs(claims.issued_at);
+  const expiresAt = strictInstantMs(claims.expires_at);
+  if (!Number.isFinite(now) || !Number.isFinite(issuedAt) || !Number.isFinite(expiresAt)
+      || expiresAt < issuedAt
+      || issuedAt > now + (profile.max_future_skew_sec * 1000)
+      || now - issuedAt > profile.max_age_sec * 1000
+      || now >= expiresAt) {
+    return {
+      ...fail('refuse_stale', profileHash, {
+        profile: true, verifier: true, evidence: true, context: true,
+      }),
+      reason: 'attestation_outside_freshness_window',
+    };
+  }
+
+  const mismatched = [];
+  const missing = [];
+  for (const [name, expected] of Object.entries(profile.required_measurements)) {
+    if (!Object.hasOwn(claims.measurements, name)) missing.push(name);
+    else if (claims.measurements[name] !== expected) mismatched.push(name);
+  }
+  if (missing.length || mismatched.length) {
+    return {
+      ...fail('refuse_measurement_mismatch', profileHash, {
+        profile: true, verifier: true, evidence: true, context: true, freshness: true,
+      }),
+      reason: 'attestation_measurement_mismatch',
+      missing_measurements: missing,
+      mismatched_measurements: mismatched,
+    };
+  }
+
+  return {
+    accepted: true,
+    verified: true,
+    verdict: 'attested',
+    reason: null,
+    profile_hash: profileHash,
+    verifier_id: profile.verifier_id,
+    evidence_type: profile.evidence_type,
+    gate_id: profile.gate_id,
+    environment_id: profile.environment_id,
+    issued_at: claims.issued_at,
+    expires_at: claims.expires_at,
+    measurements: Object.freeze({ ...profile.required_measurements }),
+    checks: {
+      profile: true,
+      verifier: true,
+      evidence: true,
+      context: true,
+      freshness: true,
+      measurements: true,
+    },
+    limitation: 'Attestation proves the expected workload measurements, not that every consequential route is forced through that workload.',
+  };
+}
+
+export default {
+  DEPLOYMENT_PROFILE_VERSION,
+  DEPLOYMENT_ATTESTATION_VERDICTS,
+  deploymentProfileDigest,
+  verifyDeploymentAttestation,
+};

package/eg1-conformance.js

@@ -44,6 +44,7 @@ const sha256Hex = (v) => crypto.createHash('sha256').update(v, 'utf8').digest('h
 const sha256Bytes = (v) => crypto.createHash('sha256').update(v).digest();
 
 const RP_ID = 'emiliaprotocol.ai';
+const RP_ORIGIN = `https://www.${RP_ID}`;
 
 /**
  * Mint a GENUINE WebAuthn ECDSA-P256 device signoff over an authorization
@@ -147,17 +148,32 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
   const pub = publicKey.export({ type: 'spki', format: 'der' }).toString('base64url');
   const approverA = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+  const approverA2 = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
   const approverB = crypto.generateKeyPairSync('ed25519');
   const approverKeys = {
     'ep:key:eg1:class-a': {
+      approver_id: 'ep:approver:eg1:cfo',
       public_key: approverA.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
       key_class: 'A',
     },
+    'ep:key:eg1:class-a-2': {
+      approver_id: 'ep:approver:eg1:security-officer',
+      public_key: approverA2.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
+      key_class: 'A',
+    },
     'ep:key:eg1:controller': {
+      approver_id: 'ep:approver:eg1:controller',
       public_key: approverB.publicKey.export({ type: 'spki', format: 'der' }).toString('base64url'),
       key_class: 'B',
     },
   };
+  const quorumPolicy = {
+    mode: 'threshold', required: 2, distinct_humans: true, window_sec: 900,
+    approvers: [
+      { role: 'cfo', approver: approverKeys['ep:key:eg1:class-a'].approver_id },
+      { role: 'security_officer', approver: approverKeys['ep:key:eg1:class-a-2'].approver_id },
+    ],
+  };
   let counter = 0;
   const nowMs = () => (typeof now === 'function' ? now() : now);
 
@@ -173,20 +189,24 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
     };
   }
 
-  function classASignoff(digest) {
+  function classASignoff(digest, {
+    keyId = 'ep:key:eg1:class-a',
+    keyPair = approverA,
+    approver = 'ep:approver:eg1:cfo',
+  } = {}) {
     const challenge = Buffer.from(digest).toString('base64url');
-    const clientDataJSON = Buffer.from(JSON.stringify({ type: 'webauthn.get', challenge, origin: 'https://www.emiliaprotocol.ai' }), 'utf8');
-    const rpIdHash = crypto.createHash('sha256').update('www.emiliaprotocol.ai').digest();
+    const clientDataJSON = Buffer.from(JSON.stringify({ type: 'webauthn.get', challenge, origin: RP_ORIGIN }), 'utf8');
+    const rpIdHash = crypto.createHash('sha256').update(RP_ID).digest();
     const authData = Buffer.concat([rpIdHash, Buffer.from([0x05]), Buffer.from([0, 0, 0, 0])]); // UP + UV
     const signedData = Buffer.concat([authData, sha256Bytes(clientDataJSON)]);
     return {
-      approver: 'ep:approver:eg1:cfo',
-      approver_key_id: 'ep:key:eg1:class-a',
+      approver,
+      approver_key_id: keyId,
       key_class: 'A',
       webauthn: {
         authenticator_data: authData.toString('base64url'),
         client_data_json: clientDataJSON.toString('base64url'),
-        signature: crypto.sign('sha256', signedData, approverA.privateKey).toString('base64url'),
+        signature: crypto.sign('sha256', signedData, keyPair.privateKey).toString('base64url'),
       },
     };
   }
@@ -206,7 +226,13 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
     const digest = Buffer.from(contextHash.replace(/^sha256:/, ''), 'hex');
     const threshold = Number(quorum?.threshold ?? quorum?.m ?? 1);
     const signoffs = [classASignoff(digest)];
-    if (threshold >= 2) signoffs.push(softwareSignoff(digest));
+    if (threshold >= 2) {
+      signoffs.push(classASignoff(digest, {
+        keyId: 'ep:key:eg1:class-a-2',
+        keyPair: approverA2,
+        approver: 'ep:approver:eg1:security-officer',
+      }));
+    }
     return {
       '@version': 'EP-ASSURANCE-PROOF-v1',
       context_hash: contextHash,
@@ -227,9 +253,12 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
    *   ({signers,threshold}) with no per-signer signatures — used to prove the Gate
    *   REFUSES it (must NOT be credited quorum). For adversarial tests only.
    * @param {object} [o.tamper] fields assigned to the claim AFTER signing (breaks the signature)
-   */
+  */
   function mint({ outcome = 'allow_with_signoff', quorum = null, fakeQuorum = false, tamper = null, extra = {} } = {}) {
-    const claim = { ...action, outcome, approver: 'ep:approver:eg1', ...extra };
+    const approver = outcome === 'allow'
+      ? 'ep:approver:eg1:controller'
+      : 'ep:approver:eg1:cfo';
+    const claim = { ...action, outcome, approver, ...extra };
     const payload = {
       receipt_id: `${idPrefix}_${++counter}`,
       subject: 'agent:eg1-conformance',
@@ -252,9 +281,14 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
       if (quorum) {
         const threshold = Number.isInteger(quorum.threshold) ? quorum.threshold
           : (Array.isArray(quorum.signers) ? quorum.signers.length : 2);
-        payload.quorum = mintQuorumEvidence({ actionHash, threshold, issuedAtMs: nowMs() });
+        payload.quorum = mintQuorumEvidence({
+          actionHash,
+          threshold,
+          approvers: quorumPolicy.approvers.slice(0, threshold),
+          issuedAtMs: nowMs(),
+        });
       } else {
-        const s = mintDeviceSignoff({ actionHash, approver: 'ep:approver:eg1', issuedAtMs: nowMs() });
+        const s = mintDeviceSignoff({ actionHash, approver, issuedAtMs: nowMs() });
         payload.signoff = s.signoff;
         payload.approver_public_key = s.approver_public_key;
       }
@@ -265,7 +299,7 @@ export function createEg1Harness({ now = Date.now, action = EG1_DEFAULT_ACTION,
     return receipt;
   }
 
-  return { publicKey: pub, approverKeys, mint, action, actionHash, now: nowMs };
+  return { publicKey: pub, approverKeys, quorumPolicy, mint, action, actionHash, now: nowMs, rpId: RP_ID, allowedOrigins: [RP_ORIGIN] };
 }
 
 /**

package/enterprise.js

@@ -21,6 +21,7 @@
  * from the wall clock implicitly, so verification is deterministic.
  */
 import crypto from 'node:crypto';
+import { strictJsonGate } from './strict-json.js';
 
 export const ENTITLEMENT_VERSION = 'EP-GATE-ENTITLEMENT-v1';
 export const ENTITLEMENT_TIERS = ['community', 'team', 'business', 'enterprise', 'regulated'];
@@ -110,9 +111,12 @@ export function verifyEntitlement(entitlementJson, { issuerKeys, now = Date.now
 
   let doc = entitlementJson;
   if (typeof doc === 'string') {
-    try { doc = JSON.parse(doc); } catch { return community('entitlement_unparseable'); }
+    try {
+      if (Buffer.byteLength(doc, 'utf8') > 1024 * 1024 || !strictJsonGate(doc).ok) return community('entitlement_unparseable');
+      doc = JSON.parse(doc);
+    } catch { return community('entitlement_unparseable'); }
   }
-  if (!doc || typeof doc !== 'object') return community('entitlement_malformed');
+  if (!doc || typeof doc !== 'object' || Array.isArray(doc)) return community('entitlement_malformed');
   if (doc['@version'] !== ENTITLEMENT_VERSION) return community('unsupported_version');
 
   const p = doc.payload;

package/ep-assure.mjs

@@ -15,7 +15,7 @@
  *   { "package": <EP-ASSURANCE-PACKAGE-v1>, "keys": {...}, "now": <iso|ms> }
  *   { "decisions": [...], "profile": <EP-RELIANCE-PROFILE-v1>, "keys": {...}, "now": <iso|ms> }
  *
- * keys (auditor-pinned, out of band): { approverKeys, logPublicKey, rpId, revokerKeys }
+ * keys (auditor-pinned, out of band): { approverKeys, logPublicKey, rpId, allowedOrigins, revokerKeys }
  * --json   print the full EP-ASSURANCE-REPERFORMANCE-v1 document instead of text
  * --strict exit non-zero if ANY drift is found (default: only inadmissible-reliance drift)
  */
@@ -45,7 +45,8 @@ let doc;
 try {
   doc = reperformAssurancePackage(pkg, {
     approverKeys: keys.approverKeys || {}, logPublicKey: keys.logPublicKey || null,
-    rpId: keys.rpId || null, revokerKeys: keys.revokerKeys || {}, now,
+    rpId: keys.rpId || null, allowedOrigins: keys.allowedOrigins || [],
+    revokerKeys: keys.revokerKeys || {}, now,
   });
 } catch (e) { fail(e.message); }