@emilia-protocol/gate 0.9.5 → 0.10.0

package/index.js

@@ -1,5 +1,5 @@
 /**
- * @emilia-protocol/gate — EMILIA Gate: the Trusted Action Firewall.
+ * @emilia-protocol/gate — EMILIA Gate: the Consequence Firewall.
  * @license Apache-2.0
  *
  * Deny-by-default enforcement for consequential machine actions. A guarded
@@ -25,26 +25,28 @@
  * adds the three things a firewall needs over a bare verifier: assurance-tier
  * enforcement, replay defense, and the evidence log. Fails closed.
  */
-const {
+import crypto from 'node:crypto';
+import {
   verifyEmiliaReceipt,
   receiptChallenge,
   receiptRequiredHeader,
   validateActionRiskManifest,
   findActionRequirement,
   evaluateReceiptAssurance,
-  receiptAssuranceTier: receiptAssuranceTierFromProof,
+  validatePinnedQuorumPolicy,
+  receiptAssuranceTier as receiptAssuranceTierFromProof,
+  parseReceiptCarrier,
   RECEIPT_REQUIRED_STATUS,
   RECEIPT_REQUIRED_HEADER,
-} = await import('@emilia-protocol/require-receipt').catch(() => import('../require-receipt/index.js'));
-// The real per-signer verifiers (WebAuthn device-signoff + M-of-N quorum). The
-// Gate MUST use these to CREDIT class_a / quorum — a receipt's self-asserted
-// outcome string or a fabricated quorum block is NOT proof. Same resolution
-// pattern as require-receipt: prefer the published package, fall back to the
-// in-repo source so the monorepo test/build works without a node_modules link.
-const { verifyWebAuthnSignoff, verifyQuorum } = await import('@emilia-protocol/verify')
-  .catch(() => import('../verify/index.js'));
-import { MemoryConsumptionStore } from './store.js';
-import { createAtomicEvidenceLog, createEvidenceLog, createMemoryAtomicEvidenceBackend } from './evidence.js';
+} from '@emilia-protocol/require-receipt';
+import { verifyWebAuthnSignoff, verifyQuorum } from '@emilia-protocol/verify';
+import { MemoryConsumptionStore, isSecureConsumptionStore } from './store.js';
+import {
+  canonicalEvidenceJson,
+  createAtomicEvidenceLog,
+  createEvidenceLog,
+  createMemoryAtomicEvidenceBackend,
+} from './evidence.js';
 import { DEFAULT_GATE_MANIFEST, HIGH_RISK_ACTION_PACKS, createDefaultActionRiskManifest } from './action-packs.js';
 import { hashCanonical, verifyExecutionBinding } from './execution-binding.js';
 import { buildReliancePacket, ADMISSIBILITY_VERDICTS } from './reliance-packet.js';
@@ -53,9 +55,29 @@ import { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
 import { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 import { classifyRetention, buildRetentionExport } from './retention.js';
 import { createDefaultActionControlManifest, findActionControl, validateActionControlManifest } from './action-control-manifest.js';
+import {
+  mintBreakGlassAuthorization,
+  verifyBreakGlass,
+  consumeBreakGlass,
+  buildBreakGlassEvidence,
+  runBreakGlass,
+  BREAKGLASS_VERSION,
+  BREAKGLASS_EVIDENCE_KIND,
+} from './breakglass.js';
 
-export { MemoryConsumptionStore, createEvidenceLog, createAtomicEvidenceLog, createMemoryAtomicEvidenceBackend };
-export { createDurableConsumptionStore, createMemoryBackend, DURABLE_CONSUMPTION_VERSION } from './store.js';
+export {
+  MemoryConsumptionStore,
+  canonicalEvidenceJson,
+  createEvidenceLog,
+  createAtomicEvidenceLog,
+  createMemoryAtomicEvidenceBackend,
+};
+export {
+  createDurableConsumptionStore,
+  createMemoryBackend,
+  isSecureConsumptionStore,
+  DURABLE_CONSUMPTION_VERSION,
+} from './store.js';
 export { createDurableChallengeStore, challengeStorageKey, challengeBodyDigest, DURABLE_CHALLENGE_STORE_VERSION } from './challenge-store.js';
 export { createKeyRegistry, asKeyRegistry } from './key-registry.js';
 export { classifyRetention, buildRetentionExport, RETENTION_EXPORT_VERSION } from './retention.js';
@@ -86,17 +108,28 @@ export {
   createEg1Harness, makeGateInvoke, runEg1, mintDeviceSignoff, mintQuorumEvidence,
 } from './eg1-conformance.js';
 export { CF1_VERSION, CF1_CHECKS, runCf1 } from './cf1-conformance.js';
+export {
+  mintBreakGlassAuthorization,
+  verifyBreakGlass,
+  consumeBreakGlass,
+  buildBreakGlassEvidence,
+  runBreakGlass,
+  BREAKGLASS_VERSION,
+  BREAKGLASS_EVIDENCE_KIND,
+};
 export const ASSURANCE_TIERS = ['software', 'class_a', 'quorum'];
 const TIER_RANK = { software: 0, class_a: 1, quorum: 2 };
 
+function safeCanonicalHash(value) {
+  try { return hashCanonical(value); } catch { return null; }
+}
+
 /**
- * Verify a PRE-COMPUTED reliance packet's admissibility block against a profile
- * the relying party PINNED. This is the gate's whole job re: admissibility — it
- * does NOT re-evaluate raw evidence and does NOT define the bar. The relying
- * party's own evaluator (lib/evidence/admissibility-profiles.js) computes the
- * verdict OFFLINE against its pinned profile and produces the reliance packet;
- * the gate only confirms the packet answers the SAME profile_hash and carries an
- * 'admissible' verdict. Pure, dependency-light, fail-closed.
+ * Structurally compare a PRE-COMPUTED admissibility block with a profile hash.
+ * This helper does NOT authenticate the block or establish evaluator provenance.
+ * An execution gate must first verify a signature over the packet or recompute
+ * the verdict from trusted evidence. createGate enforces that boundary through
+ * its verifyAdmissibilityPacket callback whenever a profile is pinned.
  *
  * @param {{id?:string, profile_hash:string}} pinned  the profile the relying party requires
  * @param {object|null} presented  a reliance packet, or its `.admissibility` block,
@@ -156,13 +189,13 @@ export function verifyAdmissibilityAgainstPinnedProfile(pinned, presented) {
  *      strongest model — the verifier never trusts a key that travels inside the
  *      receipt. Delegated to require-receipt's receiptAssuranceTierFromProof.
  *
- *  (b) Self-contained embedded evidence (DoD audit fix): a full EP-QUORUM-v1
+ *  (b) Embedded evidence (DoD audit fix): a full EP-QUORUM-v1
  *      document (payload.quorum) whose per-signer WebAuthn assertions verify via
  *      verifyQuorum (distinct humans + distinct keys + threshold + action-binding
  *      + window) earns `quorum`; a WebAuthn device signoff (payload.signoff =
  *      {context, webauthn}) that verifies against the approver's own key via
- *      verifyWebAuthnSignoff earns `class_a`. Used where the approver keys travel
- *      with the receipt rather than being pinned by the relying party.
+ *      verifyWebAuthnSignoff earns `class_a`. Quorum additionally requires an
+ *      out-of-band organizational policy and identity-bound approver directory.
  *
  *      TRUST-LAUNDERING GUARD: an approver key carried INSIDE the receipt proves
  *      only that whoever minted the receipt also holds that key — it is NOT proof
@@ -170,8 +203,8 @@ export function verifyAdmissibilityAgainstPinnedProfile(pinned, presented) {
  *      key would collapse VERIFIED into ACCEPTED (any party can mint a fresh
  *      keypair, self-sign a signoff, and embed both). So path (b) elevates the
  *      tier ONLY when either: (i) the caller explicitly opts in with
- *      `allowEmbeddedApproverKeys:true` (the documented self-contained mode,
- *      DEFAULT OFF); or (ii) every embedded approver key that would earn the
+ *      `allowEmbeddedApproverKeys:true` for a single Class-A integrity demo
+ *      (DEFAULT OFF); or (ii) the embedded approver key that would earn the
  *      credit is present in the relying party's PINNED approver key set
  *      (opts.approverKeys). With no pin and no opt-in, path (b) may still VERIFY
  *      the signoff/quorum, but it does NOT elevate above `software`. Fail-closed.
@@ -181,9 +214,9 @@ export function verifyAdmissibilityAgainstPinnedProfile(pinned, presented) {
  * @param {object} [opts.approverKeys] pinned approver keys for path (a) and the
  *   path-(b) fallback: a receipt-embedded approver key elevates the tier only if
  *   it is one of these pinned keys (unless allowEmbeddedApproverKeys is set)
- * @param {boolean} [opts.allowEmbeddedApproverKeys=false] explicit opt-in to the
- *   self-contained mode where an UNPINNED approver key carried inside the receipt
- *   may still elevate the path-(b) tier. DEFAULT OFF (fail-closed).
+ * @param {boolean} [opts.allowEmbeddedApproverKeys=false] explicit opt-in where
+ *   one unpinned embedded key may earn Class-A integrity. It never earns quorum.
+ * @param {object} [opts.quorumPolicy] relying-party-pinned organizational rule
  * @param {function} [opts.verifyAssurance] custom assurance verifier for path (a)
  * @param {string} [opts.rpId]  bind embedded device assertions to this WebAuthn RP id (path b)
  * @param {boolean} [opts.detail] return a {tier, quorum, signoff} object instead of the string
@@ -202,13 +235,16 @@ export function receiptAssuranceTier(doc, opts = {}) {
 
   // --- Path (b): self-contained embedded per-signer evidence (DoD audit fix). ---
   const p = doc?.payload || {};
-  const verifyOpts = opts.rpId ? { rpId: opts.rpId } : {};
+  const verifyOpts = {
+    ...(opts.rpId ? { rpId: opts.rpId } : {}),
+    ...(Array.isArray(opts.allowedOrigins) ? { allowedOrigins: opts.allowedOrigins } : {}),
+  };
   // The relying party's PINNED approver public keys (base64url SPKI-DER strings).
   // An embedded approver key elevates the tier only if it is in this set, unless
   // the caller explicitly opts into the self-contained mode.
   const allowEmbedded = opts.allowEmbeddedApproverKeys === true;
-  const pinnedKeys = pinnedApproverKeySet(opts.approverKeys);
-  const keyIsTrusted = (k) => allowEmbedded || (typeof k === 'string' && pinnedKeys.has(k));
+  const keyIsTrusted = (k, approver) => allowEmbedded
+    || Boolean(findPinnedApproverKey(opts.approverKeys, k, approver));
 
   // quorum: a real, self-contained EP-QUORUM-v1 evidence document. Accept it
   // under payload.quorum or payload.claim.quorum. It only counts if it is a full
@@ -219,12 +255,36 @@ export function receiptAssuranceTier(doc, opts = {}) {
   // when every member's embedded approver key is pinned (or the caller opted in).
   const q = p.quorum || p.claim?.quorum;
   if (detail.tier !== 'quorum' && isQuorumEvidence(q)) {
-    const qr = verifyQuorum(q, verifyOpts);
-    const membersTrusted = allowEmbedded
-      || (Array.isArray(q.members) && q.members.length > 0
-          && q.members.every((m) => keyIsTrusted(m?.approver_public_key)));
-    detail.quorum = { valid: qr.valid, checks: qr.checks, embedded_keys_trusted: membersTrusted };
-    if (qr.valid && membersTrusted) detail.tier = 'quorum';
+    const policy = validatePinnedQuorumPolicy(opts.quorumPolicy || opts.quorum_policy);
+    const trustedMembers = Array.isArray(q.members) ? q.members.map((member) => {
+      const entry = findPinnedApproverKey(
+        opts.approverKeys,
+        member?.approver_public_key,
+        member?.signoff?.context?.approver,
+      );
+      return entry ? { ...member, approver_public_key: entry.public_key } : null;
+    }) : [];
+    const membersTrusted = trustedMembers.length > 0 && trustedMembers.every(Boolean);
+    const qr = policy.ok && membersTrusted
+      ? verifyQuorum({ ...q, policy: policy.policy, members: trustedMembers }, verifyOpts)
+      : { valid: false, checks: {} };
+    detail.quorum = {
+      valid: qr.valid,
+      checks: qr.checks,
+      policy_pinned: policy.ok,
+      embedded_keys_trusted: membersTrusted,
+      approvers: qr.valid
+        ? trustedMembers.map((member) => member?.signoff?.context?.approver).filter(nonEmptyString)
+        : [],
+      roles: qr.valid
+        ? trustedMembers.map((member) => ({
+          subject: member?.signoff?.context?.approver ?? null,
+          role: member?.role ?? null,
+        }))
+        : [],
+      refusal: !policy.ok ? policy.reason : (!membersTrusted ? 'quorum_member_key_unpinned' : null),
+    };
+    if (qr.valid && policy.ok && membersTrusted) detail.tier = 'quorum';
   }
 
   // class_a: a verifiable WebAuthn device signoff. The signoff evidence is
@@ -237,8 +297,13 @@ export function receiptAssuranceTier(doc, opts = {}) {
       const key = so.approver_public_key || p.approver_public_key || p.claim?.approver_public_key;
       if (key) {
         const sr = verifyWebAuthnSignoff(so, key, verifyOpts);
-        const trusted = keyIsTrusted(key);
-        detail.signoff = { valid: sr.valid, checks: sr.checks, embedded_key_trusted: trusted };
+        const trusted = keyIsTrusted(key, so?.context?.approver);
+        detail.signoff = {
+          valid: sr.valid,
+          checks: sr.checks,
+          embedded_key_trusted: trusted,
+          approver: so?.context?.approver ?? null,
+        };
         if (sr.valid && trusted && (TIER_RANK[detail.tier] ?? 0) < TIER_RANK.class_a) detail.tier = 'class_a';
       }
     }
@@ -254,25 +319,21 @@ export function receiptAssuranceTier(doc, opts = {}) {
  * array/set of key strings. Used to decide whether a receipt-embedded approver
  * key may elevate the path-(b) tier. Never throws.
  */
-function pinnedApproverKeySet(approverKeys) {
-  const out = new Set();
-  if (!approverKeys) return out;
-  if (approverKeys instanceof Set) {
-    for (const k of approverKeys) if (typeof k === 'string' && k) out.add(k);
-    return out;
-  }
-  if (Array.isArray(approverKeys)) {
-    for (const k of approverKeys) if (typeof k === 'string' && k) out.add(k);
-    return out;
-  }
-  if (typeof approverKeys === 'object') {
-    for (const entry of Object.values(approverKeys)) {
-      if (typeof entry === 'string' && entry) { out.add(entry); continue; }
-      const pk = entry && typeof entry === 'object' ? entry.public_key : null;
-      if (typeof pk === 'string' && pk) out.add(pk);
-    }
-  }
-  return out;
+function spkiFingerprint(value) {
+  try {
+    const key = crypto.createPublicKey({ key: Buffer.from(value, 'base64url'), format: 'der', type: 'spki' });
+    return crypto.createHash('sha256').update(key.export({ type: 'spki', format: 'der' })).digest('hex');
+  } catch { return null; }
+}
+
+function findPinnedApproverKey(approverKeys, presentedKey, approver) {
+  if (!approverKeys || typeof approverKeys !== 'object' || Array.isArray(approverKeys)) return null;
+  const presentedFingerprint = spkiFingerprint(presentedKey);
+  if (!presentedFingerprint || typeof approver !== 'string' || !approver) return null;
+  const matches = Object.values(approverKeys).filter((entry) => entry && typeof entry === 'object'
+    && entry.approver_id === approver
+    && spkiFingerprint(entry.public_key) === presentedFingerprint);
+  return matches.length === 1 ? matches[0] : null;
 }
 
 /** A quorum evidence doc must carry members with per-signer signoffs to be verifiable. */
@@ -285,13 +346,207 @@ function isSignoffEvidence(s) {
   return !!s && typeof s === 'object' && s.context && s.webauthn;
 }
 
+function nonEmptyString(value) {
+  return typeof value === 'string' && value.length > 0 ? value : null;
+}
+
+function businessAuthorizationSource(requirement) {
+  if (!requirement || typeof requirement !== 'object') return null;
+  const nested = requirement.business_authorization
+    || requirement.businessAuthorization
+    || requirement.authorization_requirement
+    || requirement.authorizationRequirement
+    || requirement.authorization_policy
+    || requirement.authorizationPolicy
+    || requirement.business_policy
+    || requirement.control?.business_authorization
+    || requirement.control?.authorization_requirement
+    || requirement.control?.authorization_policy;
+  if (nested && typeof nested === 'object' && !Array.isArray(nested)) return nested;
+  const hasDirect = [
+    'policy', 'business_policy', 'policy_id', 'policy_hash', 'tenant_id', 'allowed_approvers',
+    'allowed_approver_subjects', 'allowed_approver_roles',
+  ].some((field) => Object.prototype.hasOwnProperty.call(requirement, field));
+  return hasDirect ? requirement : null;
+}
+
+/**
+ * Normalize the relying party's business-authorization pin for one action.
+ *
+ * Canonical manifest shape:
+ *   business_authorization: {
+ *     policy: { id, hash }, tenant_id,
+ *     allowed_approvers: [{ subject, role }]
+ *   }
+ *
+ * Flat policy_id/policy_hash and approver aliases are accepted so an existing
+ * manifest can add the control without changing its surrounding schema. Once
+ * any part is configured, every part is required; a partial pin is invalid.
+ */
+export function businessAuthorizationRequirement(requirement) {
+  const source = businessAuthorizationSource(requirement);
+  if (!source) {
+    return {
+      configured: false, ok: true, reason: null,
+      policy_id: null, policy_hash: null, tenant_id: null, allowed_approvers: [],
+    };
+  }
+  const policy = source.policy && typeof source.policy === 'object' && !Array.isArray(source.policy)
+    ? source.policy
+    : (source.business_policy && typeof source.business_policy === 'object' && !Array.isArray(source.business_policy)
+      ? source.business_policy : {});
+  const root = requirement && typeof requirement === 'object' ? requirement : {};
+  const policyId = nonEmptyString(source.policy_id ?? source.id ?? policy.policy_id ?? policy.id ?? root.policy_id);
+  const policyHash = nonEmptyString(source.policy_hash ?? source.hash ?? policy.policy_hash ?? policy.hash ?? root.policy_hash);
+  const tenantId = nonEmptyString(
+    source.tenant_id ?? source.tenant ?? source.organization_id
+    ?? root.tenant_id ?? root.tenant ?? root.organization_id,
+  );
+  const rawApprovers = source.allowed_approvers ?? source.approvers ?? source.approver_roster
+    ?? root.allowed_approvers ?? root.approvers ?? root.approver_roster;
+  const subjects = source.allowed_approver_subjects ?? source.approver_subjects
+    ?? root.allowed_approver_subjects ?? root.approver_subjects;
+  const roles = source.allowed_approver_roles ?? source.approver_roles
+    ?? root.allowed_approver_roles ?? root.approver_roles;
+  let allowed = [];
+  if (Array.isArray(rawApprovers)) {
+    allowed = rawApprovers.map((entry) => {
+      if (typeof entry === 'string') return { subject: entry, role: null };
+      if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return { subject: null, role: null };
+      return {
+        subject: nonEmptyString(entry.subject ?? entry.approver ?? entry.principal_id),
+        role: nonEmptyString(entry.role ?? entry.approver_role),
+      };
+    });
+  } else if (Array.isArray(subjects)) {
+    const validRoles = Array.isArray(roles) ? roles.filter((role) => nonEmptyString(role)) : [];
+    allowed = subjects.flatMap((subject) => {
+      if (!validRoles.length) return [{ subject: nonEmptyString(subject), role: null }];
+      return validRoles.map((role) => ({ subject: nonEmptyString(subject), role }));
+    });
+  }
+  const malformed = !policyId || !policyHash || !tenantId || allowed.length === 0
+    || allowed.some((entry) => !entry.subject || !entry.role);
+  const duplicate = new Set(allowed.map((entry) => `${entry.subject}\u0000${entry.role}`)).size !== allowed.length;
+  return {
+    configured: true,
+    ok: !malformed && !duplicate,
+    reason: malformed ? 'business_authorization_incomplete'
+      : (duplicate ? 'business_authorization_duplicate_approver' : null),
+    policy_id: policyId,
+    policy_hash: policyHash,
+    tenant_id: tenantId,
+    allowed_approvers: allowed,
+  };
+}
+
+function signedString(candidates) {
+  const present = candidates.filter((value) => value !== undefined && value !== null);
+  if (!present.length) return { ok: true, value: null };
+  if (present.some((value) => !nonEmptyString(value))) return { ok: false, value: null };
+  const distinct = [...new Set(present)];
+  return distinct.length === 1 ? { ok: true, value: distinct[0] } : { ok: false, value: null };
+}
+
+function receiptRoleAssertions(receipt, tierResult) {
+  const claim = receipt?.payload?.claim || {};
+  const assertions = [];
+  const arrays = [claim.approvers, claim.approver_authorizations, claim.approver_roles];
+  for (const entries of arrays) {
+    if (!Array.isArray(entries)) continue;
+    for (const entry of entries) {
+      if (!entry || typeof entry !== 'object' || Array.isArray(entry)) continue;
+      const subject = nonEmptyString(entry.subject ?? entry.approver ?? entry.principal_id);
+      const role = nonEmptyString(entry.role ?? entry.approver_role);
+      if (subject && role) assertions.push({ subject, role });
+    }
+  }
+  const singleSubject = nonEmptyString(claim.approver ?? claim.approver_subject);
+  const singleRole = nonEmptyString(claim.approver_role ?? claim.role);
+  if (singleSubject && singleRole) assertions.push({ subject: singleSubject, role: singleRole });
+
+  if (tierResult?.quorum?.valid === true) {
+    for (const member of (receipt?.payload?.quorum?.members || [])) {
+      const subject = nonEmptyString(member?.signoff?.context?.approver);
+      const role = nonEmptyString(member?.role);
+      if (subject && role) assertions.push({ subject, role });
+    }
+  }
+  return assertions;
+}
+
+function verifiedApproverSubjects(assurance, tierResult) {
+  const subjects = new Set(Array.isArray(assurance?.approvers) ? assurance.approvers.filter(nonEmptyString) : []);
+  if (tierResult?.signoff?.valid === true && nonEmptyString(tierResult.signoff.approver)) {
+    subjects.add(tierResult.signoff.approver);
+  }
+  if (tierResult?.quorum?.valid === true) {
+    for (const subject of (tierResult.quorum.approvers || [])) {
+      if (nonEmptyString(subject)) subjects.add(subject);
+    }
+  }
+  return [...subjects].sort();
+}
+
+/**
+ * Verify signed business-policy and tenant fields plus the cryptographically
+ * credited human approvers against one action's relying-party pins.
+ */
+export function verifyBusinessAuthorization({ requirement, receipt, assurance, tierResult } = {}) {
+  const expected = businessAuthorizationRequirement(requirement);
+  const claim = receipt?.payload?.claim || {};
+  const payload = receipt?.payload || {};
+  const policyId = signedString([claim.policy_id, payload.policy_id]);
+  const policyHash = signedString([claim.policy_hash, payload.policy_hash]);
+  const tenantId = signedString([
+    claim.tenant_id, claim.organization_id, payload.tenant_id, payload.organization_id,
+  ]);
+  const subjects = verifiedApproverSubjects(assurance, tierResult);
+  const roleAssertions = receiptRoleAssertions(receipt, tierResult);
+  const evaluatedApprovers = subjects.map((subject) => {
+    const asserted = [...new Set(roleAssertions.filter((entry) => entry.subject === subject).map((entry) => entry.role))];
+    return { subject, roles: asserted };
+  });
+  const evaluated = {
+    policy_id: policyId.value,
+    policy_hash: policyHash.value,
+    tenant_id: tenantId.value,
+    approvers: evaluatedApprovers,
+  };
+  const base = { required: expected.configured, ok: true, reason: null, expected, evaluated };
+  if (!expected.configured) return base;
+  if (!expected.ok) return { ...base, ok: false, reason: expected.reason };
+  if (!policyId.ok) return { ...base, ok: false, reason: 'business_policy_id_ambiguous' };
+  if (!policyHash.ok) return { ...base, ok: false, reason: 'business_policy_hash_ambiguous' };
+  if (!tenantId.ok) return { ...base, ok: false, reason: 'business_tenant_ambiguous' };
+  if (policyId.value !== expected.policy_id) return { ...base, ok: false, reason: 'business_policy_id_mismatch' };
+  if (policyHash.value !== expected.policy_hash) return { ...base, ok: false, reason: 'business_policy_hash_mismatch' };
+  if (tenantId.value !== expected.tenant_id) return { ...base, ok: false, reason: 'business_tenant_mismatch' };
+  if (!subjects.length) return { ...base, ok: false, reason: 'business_approver_required' };
+
+  for (const approver of evaluatedApprovers) {
+    const allowedForSubject = expected.allowed_approvers.filter((entry) => entry.subject === approver.subject);
+    if (!allowedForSubject.length) return { ...base, ok: false, reason: 'business_approver_not_allowed' };
+    const allowedRoles = new Set(allowedForSubject.map((entry) => entry.role));
+    if (approver.roles.length && !approver.roles.some((role) => allowedRoles.has(role))) {
+      return { ...base, ok: false, reason: 'business_approver_role_not_allowed' };
+    }
+    // The manifest is the authoritative subject-to-role assignment. When the
+    // receipt does not repeat a role, record the pinned role rather than trusting
+    // an unsigned/free-text role label from elsewhere.
+    if (!approver.roles.length) approver.roles = [...allowedRoles].sort();
+  }
+  return base;
+}
+
 /**
  * Create a gate.
  * @param {object} opts
  * @param {object} [opts.manifest]      EP-ACTION-RISK-MANIFEST-v0.1 (which actions are guarded, their tier)
  * @param {string[]} [opts.trustedKeys] base64url SPKI-DER issuer keys you trust
  * @param {number} [opts.maxAgeSec=900] reject receipts older than this
- * @param {object} [opts.store]         consumption store (default in-memory)
+ * @param {object} [opts.store]         durable, ownership-fenced, permanent consumption store
+ * @param {boolean} [opts.allowEphemeralStore=false] explicit test/demo opt-in for in-memory state
  * @param {object} [opts.log]           evidence log (default in-memory, hash-chained)
  * @param {boolean} [opts.allowInlineKey=false] accept the receipt's own key (integrity, NOT trust)
  * @param {object} [opts.keyRegistry] a key registry (createKeyRegistry) for rotation + revocation;
@@ -300,13 +555,19 @@ function isSignoffEvidence(s) {
  * @param {object} [opts.approverKeys] PINNED approver keys ({ keyId: { public_key, key_class } }).
  *   Used both for the pinned assurance-proof path and to authorize receipt-embedded
  *   approver keys under the self-contained embedded-evidence path.
- * @param {boolean} [opts.allowEmbeddedApproverKeys=false] opt into the self-contained
- *   embedded-evidence mode: when true, a class_a/quorum tier may be credited from an
- *   approver key carried INSIDE the receipt even if that key is not pinned. DEFAULT OFF
- *   — with no pinned approverKeys and no opt-in, embedded evidence verifies but does not
- *   elevate above 'software' (prevents VERIFIED collapsing into ACCEPTED / trust-laundering).
+ * @param {boolean} [opts.allowEmbeddedApproverKeys=false] allow one embedded key
+ *   to earn Class-A integrity in demos. Embedded keys never establish quorum.
+ * @param {object} [opts.quorumPolicy] global relying-party-pinned quorum rule
+ * @param {object} [opts.quorumPolicies] action_type -> pinned quorum rule
+ * @param {string} [opts.rpId] WebAuthn relying-party identifier. Required for
+ *   built-in Class-A or quorum assurance verification.
+ * @param {string[]} [opts.allowedOrigins] exact WebAuthn origins accepted by the
+ *   relying party. Required for built-in Class-A or quorum verification.
+ * @param {function} [opts.verifyAdmissibilityPacket] trusted relying-party hook.
+ *   Required whenever an admissibility profile is pinned. It must authenticate
+ *   the presented packet or recompute the verdict and return the trusted block.
  */
-export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null, rpId = null, requiredAdmissibilityProfile = null, allowEmbeddedApproverKeys = false } = {}) {
+export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900, store, log, allowInlineKey = false, allowEphemeralStore = false, strictEvidence = true, now = Date.now, keyRegistry = null, approverKeys = {}, approver_keys = null, verifyAssurance = null, rpId = null, allowedOrigins = [], quorumPolicy = null, quorumPolicies = {}, requiredAdmissibilityProfile = null, verifyAdmissibilityPacket = null, allowEmbeddedApproverKeys = false } = {}) {
   // Production key custody: a registry (rotation + revocation) supersedes a flat
   // trustedKeys list. A flat list is coerced to an always-valid registry, so
   // existing callers are unchanged.
@@ -314,23 +575,40 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
   if (manifest) {
     const m = validateActionRiskManifest(manifest);
     if (!m.ok) throw new Error('EMILIA Gate: invalid action-risk manifest: ' + m.errors.join('; '));
+    for (const [index, actionRequirement] of (manifest.actions || []).entries()) {
+      if (actionRequirement?.receipt_required !== true) continue;
+      const business = businessAuthorizationRequirement(actionRequirement);
+      if (business.configured && !business.ok) {
+        throw new Error(`EMILIA Gate: invalid action-risk manifest: actions[${index}].business_authorization ${business.reason}`);
+      }
+    }
   }
   if (allowInlineKey) {
     // eslint-disable-next-line no-console
     console.warn('EMILIA Gate: allowInlineKey=true accepts a receipt\'s OWN key. This proves INTEGRITY (the receipt was not tampered with) but NOT issuer TRUST (anyone can mint a receipt with their own key). Use for demos only; pin trustedKeys in production.');
   }
-  // Replay defense is only sound if the consumption store is shared across every
-  // instance that can serve the action. The in-memory default is per-process, so
-  // a receipt consumed on one pod/lambda could be replayed on another. Fail
-  // CLOSED in production unless the operator explicitly accepts a single instance.
+  // Replay defense is only sound if the store is shared, ownership-fenced, and
+  // permanent. This is a security property in every environment; NODE_ENV must
+  // never silently decide whether a receipt can be replayed.
   let consumption = store;
   if (!consumption) {
-    const isProd = typeof process !== 'undefined' && process.env && process.env.NODE_ENV === 'production';
-    if (isProd && !allowEphemeralStore) {
-      throw new Error('EMILIA Gate: no consumption store provided. The default in-memory store is per-process and is NOT safe for multi-instance or serverless deployments — a receipt consumed on one instance can be replayed on another, defeating one-time consumption. Provide a shared store ({ async consume(key) {...} }, e.g. Redis/DB-backed), or pass allowEphemeralStore:true to acknowledge a single-instance deployment.');
-    }
+    if (!allowEphemeralStore) throw new Error(
+      'EMILIA Gate requires a durable, ownership-fenced, permanent consumption store. '
+      + 'Pass allowEphemeralStore:true only for an explicit test/demo gate.',
+    );
     consumption = new MemoryConsumptionStore();
   }
+  for (const method of ['consume', 'reserve', 'commit']) {
+    if (typeof consumption?.[method] !== 'function') {
+      throw new Error(`EMILIA Gate consumption store must implement ${method}()`);
+    }
+  }
+  if (!allowEphemeralStore && !isSecureConsumptionStore(consumption)) {
+    throw new Error(
+      'EMILIA Gate requires a durable, ownership-fenced, permanent consumption store. '
+      + 'Pass allowEphemeralStore:true only for an explicit test/demo gate.',
+    );
+  }
   const evidence = log || createEvidenceLog({ strict: strictEvidence });
 
   async function check({ selector = {}, receipt = null, observedAction = null, consumptionMode = 'consume', admissibilityProfile = null, reliancePacket: presentedPacket = null, admissibility = null } = {}) {
@@ -346,7 +624,18 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     const requiredTier = requirement
       ? requirement.assurance_class
       : (selector.assurance_class || 'software');
+    const pinnedQuorumPolicy = requirement?.quorum_policy
+      || (quorumPolicies && typeof quorumPolicies === 'object' ? quorumPolicies[action] : null)
+      || quorumPolicy;
     const observed = observedAction || selector.observedAction || selector.actionDetails || null;
+    const businessExpected = businessAuthorizationRequirement(requirement);
+    let businessEvaluation = {
+      required: businessExpected.configured,
+      ok: !businessExpected.configured,
+      reason: null,
+      expected: businessExpected,
+      evaluated: { policy_id: null, policy_hash: null, tenant_id: null, approvers: [] },
+    };
 
     async function decide(allow, status, reason, extra = {}) {
       const entry = {
@@ -360,7 +649,12 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
         required_tier: requiredTier,
         receipt_id: receipt?.payload?.receipt_id ?? null,
         subject: receipt?.payload?.subject ?? null,
-        observed_action_hash: observed ? hashCanonical(observed) : null,
+        observed_action_hash: observed ? safeCanonicalHash(observed) : null,
+        business_authorization: businessEvaluation,
+        evaluated_policy_id: businessEvaluation.evaluated.policy_id,
+        evaluated_policy_hash: businessEvaluation.evaluated.policy_hash,
+        evaluated_tenant_id: businessEvaluation.evaluated.tenant_id,
+        evaluated_approvers: businessEvaluation.evaluated.approvers,
         ...extra,
       };
       let record;
@@ -428,12 +722,38 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     //       WebAuthn device signoff) re-verified via verifyQuorum /
     //       verifyWebAuthnSignoff (DoD audit fix).
     // A receipt that only CLAIMS a higher tier earns 'software' and is refused.
+    const needRank = TIER_RANK[requiredTier];
+    if (needRank === undefined) {
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'unknown_required_tier', { have_tier: 'software', need_tier: requiredTier, assurance_tier_source: 'cryptographic_verification' });
+    }
+    if (needRank >= TIER_RANK.class_a && typeof verifyAssurance !== 'function'
+        && (typeof rpId !== 'string' || !rpId
+          || !Array.isArray(allowedOrigins) || allowedOrigins.length === 0
+          || allowedOrigins.some((origin) => typeof origin !== 'string' || !origin))) {
+      return decide(false, RECEIPT_REQUIRED_STATUS, 'assurance_context_unpinned', {
+        have_tier: 'software', need_tier: requiredTier,
+        assurance_tier_source: 'cryptographic_verification',
+      });
+    }
+    if (requiredTier === 'quorum' && typeof verifyAssurance !== 'function') {
+      const policy = validatePinnedQuorumPolicy(pinnedQuorumPolicy);
+      if (!policy.ok) {
+        return decide(false, RECEIPT_REQUIRED_STATUS, policy.reason, {
+          have_tier: 'software', need_tier: requiredTier,
+          assurance_tier_source: 'cryptographic_verification',
+        });
+      }
+    }
     const assurance = evaluateReceiptAssurance(receipt, requiredTier, {
       approverKeys: approver_keys || approverKeys,
       verifyAssurance,
+      rpId,
+      allowedOrigins,
+      quorumPolicy: pinnedQuorumPolicy,
     });
     const tierResult = receiptAssuranceTier(receipt, {
-      rpId, detail: true, approverKeys: approver_keys || approverKeys, verifyAssurance,
+      rpId, allowedOrigins, detail: true, approverKeys: approver_keys || approverKeys,
+      verifyAssurance, quorumPolicy: pinnedQuorumPolicy,
       // Trust-laundering guard: a receipt-embedded approver key does NOT elevate
       // the tier unless it is in the pinned approverKeys set, or the operator
       // explicitly opted into the self-contained embedded-evidence mode. DEFAULT OFF.
@@ -442,13 +762,6 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     // Take the strongest tier either path proves.
     const have = (TIER_RANK[assurance.have] ?? 0) >= (TIER_RANK[tierResult.tier] ?? 0)
       ? assurance.have : tierResult.tier;
-    const needRank = TIER_RANK[requiredTier];
-    // Fail CLOSED on an unknown / mis-cased required tier: never silently treat
-    // it as 'software'. If a manifest asks for a tier this gate does not model,
-    // no receipt can satisfy it.
-    if (needRank === undefined) {
-      return decide(false, RECEIPT_REQUIRED_STATUS, 'unknown_required_tier', { have_tier: have, need_tier: requiredTier, assurance_tier_source: 'cryptographic_verification' });
-    }
     if ((TIER_RANK[have] ?? 0) < needRank) {
       // The credited tier (from either proof path) is below what the action
       // requires. The canonical machine-readable reason is 'assurance_too_low';
@@ -461,6 +774,23 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
         tier_evidence: { quorum: tierResult.quorum, signoff: tierResult.signoff },
       });
     }
+    // Business authorization is a distinct trust root from receipt issuer
+    // integrity and assurance tier. The signed claim must name the exact policy
+    // id+hash and tenant this action requirement pins, and the humans who
+    // cryptographically earned the tier must belong to its subject/role roster.
+    // This runs BEFORE execution binding, admissibility, and receipt reservation.
+    businessEvaluation = verifyBusinessAuthorization({
+      requirement,
+      receipt,
+      assurance,
+      tierResult,
+    });
+    if (!businessEvaluation.ok) {
+      return decide(false, RECEIPT_REQUIRED_STATUS, businessEvaluation.reason, {
+        have_tier: have,
+        assurance_tier_source: 'cryptographic_verification',
+      });
+    }
     // The high-risk action packs define material fields that must be observed
     // by the executor from the system of record. A signed, harmless-looking
     // claim cannot authorize a different real mutation.
@@ -479,9 +809,32 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     // When no profile is pinned, this whole block is inert — behavior is
     // byte-for-byte unchanged from the pre-admissibility gate.
     const pinnedProfile = admissibilityProfile || selector.admissibilityProfile || requiredAdmissibilityProfile;
+    let trustedAdmissibility = null;
     if (pinnedProfile) {
       const presentedAdmissibility = admissibility ?? presentedPacket ?? selector.reliancePacket ?? selector.admissibility ?? null;
-      const adm = verifyAdmissibilityAgainstPinnedProfile(pinnedProfile, presentedAdmissibility);
+      if (typeof verifyAdmissibilityPacket !== 'function') {
+        return decide(false, RECEIPT_REQUIRED_STATUS, 'admissibility_verifier_required', {
+          pinned_profile: { id: pinnedProfile.id ?? null, profile_hash: pinnedProfile.profile_hash ?? null },
+          have_tier: have,
+          assurance_tier_source: 'cryptographic_verification',
+        });
+      }
+      try {
+        trustedAdmissibility = await verifyAdmissibilityPacket({
+          pinned_profile: structuredClone(pinnedProfile),
+          presented: structuredClone(presentedAdmissibility),
+          receipt: structuredClone(receipt),
+          selector: structuredClone(selector),
+          observed_action: observed === null ? null : structuredClone(observed),
+        });
+      } catch {
+        return decide(false, RECEIPT_REQUIRED_STATUS, 'admissibility_verification_failed', {
+          pinned_profile: { id: pinnedProfile.id ?? null, profile_hash: pinnedProfile.profile_hash ?? null },
+          have_tier: have,
+          assurance_tier_source: 'cryptographic_verification',
+        });
+      }
+      const adm = verifyAdmissibilityAgainstPinnedProfile(pinnedProfile, trustedAdmissibility);
       if (!adm.ok) {
         return decide(false, RECEIPT_REQUIRED_STATUS, adm.reason, {
           admissibility_check: adm,
@@ -517,7 +870,9 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     // Carry the admissibility block (from the presented packet) onto the decision
     // so a reliance packet built from this decision embeds the verdict the relying
     // party's evaluator computed. Only when something was actually presented.
-    const presentedAdmForAllow = admissibility ?? presentedPacket ?? selector.reliancePacket ?? selector.admissibility ?? null;
+    const presentedAdmForAllow = pinnedProfile
+      ? trustedAdmissibility
+      : (admissibility ?? presentedPacket ?? selector.reliancePacket ?? selector.admissibility ?? null);
     if (presentedAdmForAllow) {
       const admBlock = presentedAdmForAllow.admissibility !== undefined ? presentedAdmForAllow.admissibility : presentedAdmForAllow;
       if (admBlock) allowExtra.admissibility = admBlock;
@@ -525,27 +880,97 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     return decide(true, 200, 'allow', allowExtra);
   }
 
-  /** Express/Connect middleware: refuse the route unless a sufficient receipt is present. */
-  function middleware(opts = {}) {
-    return async function emiliaGate(req, res, next) {
-      let selector = typeof opts.selector === 'function' ? opts.selector(req) : { ...(opts.selector || {}) };
-      if (opts.action && !selector.action_type) {
-        selector.action_type = typeof opts.action === 'function' ? opts.action(req) : opts.action;
-      }
-      let doc = null;
+  async function requestGateInput(req, opts = {}) {
+    let selector = typeof opts.selector === 'function'
+      ? await opts.selector(req)
+      : { ...(opts.selector || {}) };
+    if (!selector || typeof selector !== 'object' || Array.isArray(selector)) selector = {};
+    if (opts.action && !selector.action_type) {
+      selector.action_type = typeof opts.action === 'function' ? await opts.action(req) : opts.action;
+    }
+    let receipt = typeof opts.receipt === 'function' ? await opts.receipt(req) : (opts.receipt ?? null);
+    if (!receipt) {
       const hdr = req.headers?.['x-emilia-receipt'];
-      if (hdr) { try { doc = JSON.parse(Buffer.from(hdr, 'base64').toString('utf8')); } catch { /* fallthrough */ } }
-      if (!doc && req.body?.emilia_receipt) doc = req.body.emilia_receipt;
-      const observedAction = typeof opts.observedAction === 'function'
-        ? opts.observedAction(req)
-        : (opts.observedAction || req.emiliaObservedAction || null);
-      const out = await check({ selector, receipt: doc, observedAction });
-      if (!out.allow) {
-        res.setHeader(RECEIPT_REQUIRED_HEADER, out.header);
-        return res.status(out.status).json(out.challenge);
-      }
-      req.emiliaGate = out;
-      return next();
+      if (hdr) receipt = parseReceiptCarrier(hdr);
+      if (!receipt && req.body?.emilia_receipt) receipt = req.body.emilia_receipt;
+    }
+    const observedAction = typeof opts.observedAction === 'function'
+      ? await opts.observedAction(req)
+      : (opts.observedAction || req.emiliaObservedAction || null);
+    const admissibilityProfile = typeof opts.admissibilityProfile === 'function'
+      ? await opts.admissibilityProfile(req)
+      : (opts.admissibilityProfile ?? null);
+    const presentedPacket = typeof opts.reliancePacket === 'function'
+      ? await opts.reliancePacket(req)
+      : (opts.reliancePacket ?? opts.admissibility ?? null);
+    return { selector, receipt, observedAction, admissibilityProfile, reliancePacket: presentedPacket };
+  }
+
+  function sendRefusal(res, authorization) {
+    if (typeof res?.setHeader === 'function' && authorization.header) {
+      res.setHeader(RECEIPT_REQUIRED_HEADER, authorization.header);
+    }
+    if (typeof res?.status === 'function' && typeof res?.json === 'function') {
+      return res.status(authorization.status).json(authorization.challenge);
+    }
+    if (res) res.statusCode = authorization.status;
+    if (typeof res?.end === 'function') {
+      if (typeof res?.setHeader === 'function') res.setHeader('content-type', 'application/json');
+      return res.end(JSON.stringify(authorization.challenge));
+    }
+    return authorization;
+  }
+
+  /**
+   * Express/Connect route wrapper. The route handler itself is the effect
+   * callback owned by gate.run(), so authorization, receipt reservation,
+   * execution, consumption, and evidence form one lifecycle.
+   */
+  function route(handler, opts = {}) {
+    if (typeof handler !== 'function') throw new Error('EMILIA Gate route(): handler is required');
+    return async function emiliaGateRoute(req, res) {
+      const input = await requestGateInput(req, opts);
+      const out = await run(input, async (authorization) => {
+        req.emiliaGate = authorization;
+        return handler(req, res, authorization);
+      });
+      if (!out.ok) return sendRefusal(res, out.authorization);
+      req.emiliaGate = out.authorization;
+      req.emiliaGateExecution = out.execution;
+      req.emiliaReliancePacket = out.packet;
+      return out.result;
+    };
+  }
+
+  /**
+   * @deprecated Middleware cannot prove that code after next() actually ran.
+   * It therefore fails closed without parsing or consuming a presented receipt.
+   * Use gate.route(handler, opts), gate.guard(), or gate.run().
+   */
+  function middleware(opts = {}) {
+    return async function emiliaGateDeprecatedMiddleware(req, res) {
+      const selector = typeof opts.selector === 'function'
+        ? await opts.selector(req)
+        : { ...(opts.selector || {}) };
+      const action = (selector && (selector.action_type || selector.action))
+        || (typeof opts.action === 'function' ? await opts.action(req) : opts.action)
+        || null;
+      const reason = 'unsafe_middleware_deprecated';
+      const challenge = receiptChallenge(action, reason, {
+        status: RECEIPT_REQUIRED_STATUS,
+        assuranceClass: selector?.assurance_class || null,
+        maxAgeSec,
+        manifest: selector?.manifestUrl,
+      });
+      const authorization = {
+        allow: false,
+        status: RECEIPT_REQUIRED_STATUS,
+        reason,
+        action,
+        challenge,
+        header: receiptRequiredHeader({ action, assuranceClass: selector?.assurance_class || null, maxAgeSec }),
+      };
+      return sendRefusal(res, authorization);
     };
   }
 
@@ -564,7 +989,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
       action: authorization?.action ?? auth.action ?? null,
       receipt_id: auth.receipt_id ?? null,
       outcome, // 'executed' | 'failed'
-      observed_action_hash: observedAction ? hashCanonical(observedAction) : null,
+      observed_action_hash: observedAction ? safeCanonicalHash(observedAction) : null,
       execution_binding: executionBinding || authorization?.evidence?.execution_binding || authorization?.execution_binding || null,
       ...(detail !== undefined ? { detail } : {}),
     });
@@ -572,7 +997,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
 
   /**
    * Recommended end-to-end path. Reserves the receipt, runs the side effect,
-   * commits one-time consumption only after success, and records execution.
+   * commits one-time consumption after the effect attempt, and records execution.
    * Once the executor is invoked, an exception is an INDETERMINATE outcome: the
    * external effect may have happened before its response was lost. The receipt
    * is therefore committed (or left reserved if the store is unavailable),
@@ -598,7 +1023,8 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
       if (opts.recordExecution === false) return { ok: true, result, authorization, execution: null, packet: null };
       phase = 'recording_execution';
       const execution = await recordExecution({ authorization, outcome: 'executed', observedAction });
-      return { ok: true, result, authorization, execution, packet: reliancePacket({ authorization, execution }) };
+      const packet = await reliancePacket({ authorization, execution });
+      return { ok: true, result, authorization, execution, packet };
     } catch (e) {
       // An exception after invoking fn() cannot establish that no external
       // effect occurred. Burn the approval if possible; if storage is down, the
@@ -663,7 +1089,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
     };
   }
 
-  function reliancePacket({ authorization, execution = null, binding = null, admissibility = null } = {}) {
+  async function reliancePacket({ authorization, execution = null, binding = null, admissibility = null } = {}) {
     // The admissibility block rides on the authorization decision's evidence when
     // a reliance packet was presented at check() time; an explicit `admissibility`
     // arg overrides it. buildReliancePacket fails closed on a non-'admissible'
@@ -692,7 +1118,7 @@ export function createGate({ manifest = null, trustedKeys = [], maxAgeSec = 900,
   }
 
   return {
-    check, run, recordExecution, middleware, guard, reliancePacket, evidence,
+    check, run, recordExecution, route, wrapRoute: route, middleware, guard, reliancePacket, evidence,
     store: consumption, keyRegistry: registry, retention, retentionExport,
   };
 }
@@ -723,14 +1149,18 @@ export async function gateConformance({ gate, harness, action, selector = EG1_DE
 }
 
 /**
- * Self-certify the reference gate: build a default Trusted Action Firewall that
+ * Self-certify the reference gate: build a default Consequence Firewall that
  * trusts a fresh EG-1 harness key, then run all eight checks. This is the
  * canonical "EMILIA Gate earns EG-1" proof — runnable as a CLI (`eg1.mjs`),
  * shown on /gate, and the template an adopter copies for their integration.
  */
 export async function gateConformanceSelfTest({ now } = {}) {
   const harness = createEg1Harness({ now });
-  const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey], approverKeys: harness.approverKeys, now });
+  const gate = createTrustedActionFirewall({
+    trustedKeys: [harness.publicKey], approverKeys: harness.approverKeys,
+    rpId: harness.rpId, allowedOrigins: harness.allowedOrigins,
+    now, allowEphemeralStore: true,
+  });
   return gateConformance({ gate, harness });
 }
 
@@ -770,16 +1200,27 @@ export async function cf1Conformance({ gate, wrongGate, harness, manifest = null
 export async function cf1ConformanceSelfTest({ now } = {}) {
   const harness = createEg1Harness({ now });
   const manifest = createDefaultActionRiskManifest();
-  const gate = createTrustedActionFirewall({ trustedKeys: [harness.publicKey], approverKeys: harness.approverKeys, now });
+  const gate = createTrustedActionFirewall({
+    trustedKeys: [harness.publicKey], approverKeys: harness.approverKeys,
+    rpId: harness.rpId, allowedOrigins: harness.allowedOrigins,
+    now, allowEphemeralStore: true,
+  });
   const wrongHarness = createEg1Harness({ now });
-  const wrongGate = createTrustedActionFirewall({ trustedKeys: [wrongHarness.publicKey], approverKeys: wrongHarness.approverKeys, now });
+  const wrongGate = createTrustedActionFirewall({
+    trustedKeys: [wrongHarness.publicKey], approverKeys: wrongHarness.approverKeys,
+    rpId: wrongHarness.rpId, allowedOrigins: wrongHarness.allowedOrigins,
+    now, allowEphemeralStore: true,
+  });
   return cf1Conformance({ gate, wrongGate, harness, manifest, selector: EG1_DEFAULT_SELECTOR, action: harness.action });
 }
 
 export default {
   createGate,
   createTrustedActionFirewall,
+  runBreakGlass,
   receiptAssuranceTier,
+  businessAuthorizationRequirement,
+  verifyBusinessAuthorization,
   verifyAdmissibilityAgainstPinnedProfile,
   ADMISSIBILITY_VERDICTS,
   MemoryConsumptionStore,