@emilia-protocol/gate 0.9.5 → 0.10.0

package/custody-demo.mjs

@@ -1,10 +1,13 @@
 /**
- * EMILIA Gate — production custody demo. Run: node custody-demo.mjs
+ * EMILIA Gate — issuer custody reference demo. Run: node custody-demo.mjs
  *
  * Shows the three custody controls a serious buyer asks for:
  *   1. ROTATION  — a new issuer key takes over without breaking the old one.
  *   2. REVOCATION — a compromised issuer key is rejected immediately, live.
  *   3. RETENTION  — the evidence log classifies hot/cold/expired + exports.
+ * Issuer keys use the live registry path. Approver keys are embedded only to
+ * keep this reference demo self-contained; production Gate deployments pin
+ * approver keys or provide their own assurance verifier.
  * @license Apache-2.0
  */
 import { createGate, createKeyRegistry, createEg1Harness } from './index.js';
@@ -14,7 +17,14 @@ const SEL = { protocol: 'mcp', tool: 'release_payment' };
 const k1 = createEg1Harness({ idPrefix: 'k1' });
 const k2 = createEg1Harness({ idPrefix: 'k2' });
 const registry = createKeyRegistry([{ kid: 'issuer-1', key: k1.publicKey }]);
-const gate = createGate({ manifest: DEFAULT_GATE_MANIFEST, keyRegistry: registry });
+const gate = createGate({
+  manifest: DEFAULT_GATE_MANIFEST,
+  keyRegistry: registry,
+  rpId: k1.rpId,
+  allowedOrigins: k1.allowedOrigins,
+  allowEmbeddedApproverKeys: true,
+  allowEphemeralStore: true,
+});
 
 const G = (s) => `\x1b[32m${s}\x1b[0m`; const R = (s) => `\x1b[31m${s}\x1b[0m`;
 const line = (s) => console.log(s);
@@ -24,7 +34,7 @@ async function pay(label, harness) {
 }
 
 line('='.repeat(64));
-line('  EMILIA Gate — production custody: rotate, revoke, retain');
+line('  EMILIA Gate — custody reference: rotate, revoke, retain');
 line('='.repeat(64));
 await pay('1. payout, issuer-1 (current)            ', k1);
 registry.revoke('issuer-1');

package/demo.mjs

@@ -1,6 +1,6 @@
 /**
  * EMILIA Gate — end-to-end demo. Run: node demo.mjs
- * Shows the Trusted Action Firewall refusing and allowing a consequential
+ * Shows the Consequence Firewall refusing and allowing a consequential
  * action, defeating replay and tampering, and emitting a verifiable audit log.
  * @license Apache-2.0
  */
@@ -35,13 +35,19 @@ const receipt = (outcome, extra = {}) => {
   return { '@version': 'EP-RECEIPT-v1', payload, signature: { algorithm: 'Ed25519', value: crypto.sign(null, Buffer.from(canon(payload), 'utf8'), privateKey).toString('base64url') } };
 };
 
-const gate = createTrustedActionFirewall({ trustedKeys: [pub] });
+const gate = createTrustedActionFirewall({
+  trustedKeys: [pub],
+  rpId: 'emiliaprotocol.ai',
+  allowedOrigins: ['https://www.emiliaprotocol.ai'],
+  allowEmbeddedApproverKeys: true,
+  allowEphemeralStore: true,
+});
 const PAY = { protocol: 'mcp', tool: 'release_payment' };
 const line = (s) => console.log(s);
 const r = (o) => o.allow ? `\x1b[32mALLOW\x1b[0m` : `\x1b[31mREFUSE ${o.status}\x1b[0m (${o.reason})`;
 
 line('='.repeat(64));
-line('  EMILIA Gate — Trusted Action Firewall  (release_payment, critical)');
+line('  EMILIA Gate — Consequence Firewall  (release_payment, critical)');
 line('='.repeat(64));
 line(`\n  1. read_status (not guarded)             -> ${r(await gate.check({ selector: { protocol: 'mcp', tool: 'read_status' } }))}`);
 line(`  2. release_payment, no receipt          -> ${r(await gate.check({ selector: PAY }))}`);

package/deploy/helm/README.md

@@ -1,7 +1,11 @@
 <!-- SPDX-License-Identifier: Apache-2.0 -->
 # EMILIA Gate — reference Helm chart (`emilia-gate`)
 
-**Contract:** `EP-GATE-HELM-v1` · **Status: reference chart, experimental, BYOC.**
+**Contract:** `EP-GATE-HELM-v1` · **Status: deprecated, experimental, BYOC.**
+
+This legacy chart is retained only for compatibility. It can use per-process
+in-memory consumption and evidence state. New deployments should use
+`emilia-gate-service`, whose runtime refuses missing durable adapters.
 
 A reference Kubernetes deployment of the [EMILIA Gate](../../README.md) — the
 Trusted Action Firewall. Deny-by-default enforcement for consequential machine
@@ -36,6 +40,9 @@ public image yet — build and push your own image of the gate service.
    `capabilities: drop [ALL]`, `seccompProfile: RuntimeDefault`,
    `automountServiceAccountToken: false`. Loosen deliberately via values, not
    accidentally.
+4. **Single replica by default**: `replicaCount` defaults to `1`. Rendering more
+   than one replica fails unless both shared consumption and evidence backends
+   are wired through complete Secret-backed `sharedState` references.
 
 ## Quick start
 
@@ -50,7 +57,7 @@ kubectl -n emilia create secret generic emilia-gate-issuer-keys \
 helm install gate ./emilia-gate \
   --namespace emilia --create-namespace \
   --set image.repository=YOUR_REGISTRY/emilia-gate \
-  --set image.tag=0.9.5 \
+  --set image.tag=0.10.0 \
   --set issuerKeys.existingSecret=emilia-gate-issuer-keys
 
 # 3. (Optional) expose /metrics + ServiceMonitor stub (needs Prometheus Operator).
@@ -82,8 +89,9 @@ Secrets/ConfigMaps there rather than inlining values.
 
 | Value | Default | Meaning |
 | ----- | ------- | ------- |
-| `replicaCount` | `2` | Gate replicas. NOTE: replay defense across replicas needs a shared consumption store (see `createDurableConsumptionStore` in `packages/gate/store.js`); configure the backend via `gate.extraEnv`. |
-| `image.repository` / `image.tag` | `ghcr.io/emilia-protocol/gate` / chart `appVersion` | BYOC image. |
+| `replicaCount` | `1` | Legacy Gate replicas. Values above one are refused without both Secret-backed shared-state references. |
+| `sharedState.consumption` / `sharedState.evidence` | empty | Each requires `envName`, `existingSecret`, and `secretKey`; both are mandatory above one replica. |
+| `image.repository` / `image.tag` | — **required** / chart `appVersion` | Operator-built BYOC image; no official public image is implied. |
 | `issuerKeys.existingSecret` | — **required** | Name of your pre-created Secret with pinned issuer keys. |
 | `issuerKeys.secretKey` | `issuer-keys.json` | Key inside that Secret. |
 | `manifest.inline` | subset of default packs | Action-risk manifest rendered to the ConfigMap. Replace with your org's manifest. |
@@ -96,10 +104,10 @@ Secrets/ConfigMaps there rather than inlining values.
 
 - **Experimental.** Not battle-tested; `helm lint`-clean is not a security
   review. Read the rendered output (`helm template`) before applying.
-- The default in-memory consumption store and evidence sink are per-pod. For
-  fleets (`replicaCount > 1`) wire a shared/durable backend or replayed
-  receipts on another pod are only caught by receipt freshness, not
-  consumption.
+- The default in-memory consumption store and evidence sink are per-pod. The
+  chart now refuses fleets unless both shared backend Secret references are
+  complete. That render-time check proves wiring exists, not that a custom
+  legacy image correctly implements the adapters; prefer `emilia-gate-service`.
 - The ServiceMonitor is a **stub**: no TLS/auth on the scrape endpoint —
   adapt it to your monitoring stack.
 - No Ingress/NetworkPolicy/HPA templates on purpose: the gate is an internal

package/deploy/helm/emilia-gate/Chart.yaml

@@ -15,11 +15,12 @@ description: >-
   Reference chart, experimental, BYOC. Issuer keys are referenced from an
   existing Secret and are never rendered by this chart.
 type: application
+deprecated: true
 # Chart version (the packaging), independent of the gate's app version.
 version: 0.1.0
 # Version of @emilia-protocol/gate this chart tracks; used as the default
 # image tag when .Values.image.tag is empty.
-appVersion: "0.9.5"
+appVersion: "0.10.0"
 kubeVersion: ">=1.23.0-0"
 home: https://emiliaprotocol.ai
 sources:
@@ -35,5 +36,6 @@ annotations:
   emiliaprotocol.ai/chart-contract: EP-GATE-HELM-v1
   emiliaprotocol.ai/maturity: experimental
   emiliaprotocol.ai/deployment-model: byoc
+  emiliaprotocol.ai/replacement: emilia-gate-service
   artifacthub.io/prerelease: "true"
   artifacthub.io/license: Apache-2.0

package/deploy/helm/emilia-gate/templates/NOTES.txt

@@ -6,8 +6,9 @@ EMILIA Gate — Trusted Action Firewall (chart {{ .Chart.Name }}-{{ .Chart.Versi
   Image:     {{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
   Replicas:  {{ .Values.replicaCount }}
 
-STATUS: reference chart — EXPERIMENTAL, BYOC. Review the rendered manifests
-before trusting production traffic to them.
+STATUS: DEPRECATED reference chart — EXPERIMENTAL, BYOC. Prefer the
+emilia-gate-service chart. Review the rendered manifests before trusting
+production traffic to them.
 
 1. Issuer keys (already enforced at render time — this release referenced the
    existing Secret "{{ .Values.issuerKeys.existingSecret }}", key

package/deploy/helm/emilia-gate/templates/deployment.yaml

@@ -7,6 +7,42 @@
 {{- $name := default .Chart.Name .Values.nameOverride }}
 {{- $fullname := default (printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-") .Values.fullnameOverride }}
 {{- $manifestConfigMap := default $fullname .Values.manifest.existingConfigMap }}
+{{- $consumption := .Values.sharedState.consumption }}
+{{- $evidence := .Values.sharedState.evidence }}
+{{- $consumptionAny := or (ne $consumption.envName "") (ne $consumption.existingSecret "") (ne $consumption.secretKey "") }}
+{{- $evidenceAny := or (ne $evidence.envName "") (ne $evidence.existingSecret "") (ne $evidence.secretKey "") }}
+{{- $consumptionConfigured := and (ne $consumption.envName "") (ne $consumption.existingSecret "") (ne $consumption.secretKey "") }}
+{{- $evidenceConfigured := and (ne $evidence.envName "") (ne $evidence.existingSecret "") (ne $evidence.secretKey "") }}
+{{- $reservedEnv := list "NODE_ENV" "EP_GATE_PORT" "EP_GATE_LOG_LEVEL" "EP_GATE_EVIDENCE_STRICT" "EP_GATE_MANIFEST_PATH" "EP_GATE_METRICS_ENABLED" "EP_GATE_ISSUER_KEYS" }}
+{{- if and $consumptionAny (not $consumptionConfigured) }}
+{{- fail "sharedState.consumption requires envName, existingSecret, and secretKey together" }}
+{{- end }}
+{{- if and $evidenceAny (not $evidenceConfigured) }}
+{{- fail "sharedState.evidence requires envName, existingSecret, and secretKey together" }}
+{{- end }}
+{{- if and $consumptionConfigured (not (regexMatch "^[A-Za-z_][A-Za-z0-9_]*$" $consumption.envName)) }}
+{{- fail "sharedState.consumption.envName must be a valid environment variable name" }}
+{{- end }}
+{{- if and $evidenceConfigured (not (regexMatch "^[A-Za-z_][A-Za-z0-9_]*$" $evidence.envName)) }}
+{{- fail "sharedState.evidence.envName must be a valid environment variable name" }}
+{{- end }}
+{{- if and $consumptionConfigured (has $consumption.envName $reservedEnv) }}
+{{- fail "sharedState.consumption.envName must not override a chart-managed environment variable" }}
+{{- end }}
+{{- if and $evidenceConfigured (has $evidence.envName $reservedEnv) }}
+{{- fail "sharedState.evidence.envName must not override a chart-managed environment variable" }}
+{{- end }}
+{{- if and $consumptionConfigured $evidenceConfigured (eq $consumption.envName $evidence.envName) }}
+{{- fail "sharedState.consumption.envName and sharedState.evidence.envName must be distinct" }}
+{{- end }}
+{{- range $extra := .Values.gate.extraEnv }}
+{{- if or (has $extra.name $reservedEnv) (and $consumptionConfigured (eq $extra.name $consumption.envName)) (and $evidenceConfigured (eq $extra.name $evidence.envName)) }}
+{{- fail (printf "gate.extraEnv name %s duplicates a chart-managed or shared-state environment variable" $extra.name) }}
+{{- end }}
+{{- end }}
+{{- if and (gt (int .Values.replicaCount) 1) (not (and $consumptionConfigured $evidenceConfigured)) }}
+{{- fail "deprecated emilia-gate refuses replicaCount > 1 without complete Secret-backed sharedState.consumption and sharedState.evidence references; prefer emilia-gate-service" }}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -21,6 +57,8 @@ metadata:
     helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version }}
     emiliaprotocol.ai/chart-contract: EP-GATE-HELM-v1
     emiliaprotocol.ai/maturity: experimental
+    emiliaprotocol.ai/deprecated: "true"
+    emiliaprotocol.ai/replacement: emilia-gate-service
 spec:
   replicas: {{ .Values.replicaCount }}
   selector:
@@ -55,7 +93,7 @@ spec:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
         - name: gate
-          image: "{{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}"
+          image: "{{ required "image.repository is required; build and push a BYOC image before rendering this deprecated chart" .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           securityContext:
             {{- toYaml .Values.containerSecurityContext | nindent 12 }}
@@ -86,6 +124,22 @@ spec:
                 secretKeyRef:
                   name: {{ required "issuerKeys.existingSecret is required. This chart NEVER renders key material — create the Secret out-of-band (see README.md) and set issuerKeys.existingSecret to its name." .Values.issuerKeys.existingSecret }}
                   key: {{ .Values.issuerKeys.secretKey }}
+            {{- if $consumptionConfigured }}
+            - name: {{ $consumption.envName }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $consumption.existingSecret }}
+                  key: {{ $consumption.secretKey }}
+                  optional: false
+            {{- end }}
+            {{- if $evidenceConfigured }}
+            - name: {{ $evidence.envName }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $evidence.existingSecret }}
+                  key: {{ $evidence.secretKey }}
+                  optional: false
+            {{- end }}
             {{- with .Values.gate.extraEnv }}
             {{- toYaml . | nindent 12 }}
             {{- end }}

package/deploy/helm/emilia-gate/values.yaml

@@ -13,12 +13,15 @@
 #      capabilities, no service-account token). Loosen deliberately, not
 #      accidentally.
 
-replicaCount: 2
+# This deprecated chart uses in-memory state unless a BYOC image consumes both
+# Secret-backed shared-state references below. One replica is the only safe
+# default. Prefer the emilia-gate-service chart for production deployments.
+replicaCount: 1
 
 image:
   # BYOC: build and push your own image of the gate service; there is no
   # official public image while the chart is experimental.
-  repository: ghcr.io/emilia-protocol/gate
+  repository: ""
   # Defaults to the chart's appVersion when empty.
   tag: ""
   pullPolicy: IfNotPresent
@@ -43,6 +46,19 @@ gate:
   # EnvVar objects — supports valueFrom for your own Secret/ConfigMap refs).
   extraEnv: []
 
+# Legacy multi-replica guard. These references are rendered as environment
+# variables for a BYOC image that implements the corresponding durable adapters.
+# Setting replicaCount > 1 is refused unless BOTH references are complete.
+sharedState:
+  consumption:
+    envName: ""
+    existingSecret: ""
+    secretKey: ""
+  evidence:
+    envName: ""
+    existingSecret: ""
+    secretKey: ""
+
 # ---------------------------------------------------------------------------
 # Issuer keys — REQUIRED, referenced, never rendered.
 # Create the Secret yourself, e.g.:

package/deploy/helm/emilia-gate-service/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: emilia-gate-service
+description: BYOC deployment chart for the EMILIA Gate service
+type: application
+version: 0.2.0
+appVersion: "0.2.0"
+kubeVersion: ">=1.27.0-0"
+annotations:
+  emiliaprotocol.ai/deployment-model: byoc
+  emiliaprotocol.ai/maturity: reference
+  artifacthub.io/license: Apache-2.0

package/deploy/helm/emilia-gate-service/README.md

@@ -0,0 +1,81 @@
+# EMILIA Gate service Helm chart
+
+This chart is a BYOC reference deployment for `apps/gate-service`. It does not
+name or imply an official published image. Build `Dockerfile.gate`, push the
+result to a registry you control, and pass an immutable digest where possible.
+
+The chart intentionally refuses to render with its default values. Supply:
+
+- `image.repository` and exactly one of `image.digest` or `image.tag`;
+- `configuration.existingSecret` containing `gate.config.mjs` and
+  `migrate.mjs`;
+- `secrets.postgres.existingSecret` with the database URL key;
+- `migrations.postgres.existingSecret` with a distinct DDL-capable login URL;
+- `secrets.apiToken.existingSecret` with the Gate action-API bearer token;
+- optionally, `secrets.kms.existingSecret` when the operator config uses a KMS-backed extension;
+- `secrets.issuerRoots.existingSecret` with the pinned issuer-root set.
+
+The chart never renders a Kubernetes `Secret`. Secret names and keys are wired
+with non-optional references. The migration hook receives the operator config
+and a mandatory Postgres reference distinct from the runtime Secret. The
+service receives the config and runtime
+references. The config module must satisfy the durable store contracts in
+`apps/gate-service/README.md`. The chart does not substitute an in-memory
+adapter or invent a persistence schema on the operator's behalf.
+
+## Install
+
+```bash
+helm upgrade --install emilia-gate \
+  packages/gate/deploy/helm/emilia-gate-service \
+  --namespace emilia-gate --create-namespace \
+  --set-string image.repository=registry.example.com/security/emilia-gate-service \
+  --set-string image.digest=sha256:REPLACE_WITH_IMAGE_DIGEST \
+  --set-string configuration.existingSecret=emilia-gate-configuration \
+  --set-string secrets.postgres.existingSecret=emilia-gate-postgres \
+  --set-string migrations.postgres.existingSecret=emilia-gate-postgres-migrate \
+  --set-string migrations.postgres.key=database-url \
+  --set-string secrets.apiToken.existingSecret=emilia-gate-api-token \
+  --set-string secrets.issuerRoots.existingSecret=emilia-gate-issuer-roots \
+  --atomic --wait
+```
+
+The pre-install/pre-upgrade migration Job must complete before Helm rolls the
+Deployment. It is bounded by an active deadline and runs non-root with a
+read-only root filesystem. The Deployment defaults to two replicas,
+`maxUnavailable: 0`, a one-pod PDB, resource requests/limits, startup/liveness/
+readiness probes, and a writable memory/scratch volume only at `/tmp`.
+Rendering fails if migrations are enabled without a migration Secret, or if
+that Secret name equals the runtime Postgres Secret. Helm cannot compare Secret
+contents; provision different database login credentials in the two Secrets
+and verify the runtime login has no DDL privileges.
+
+## Network policy
+
+The default NetworkPolicy permits DNS, same-namespace ingress, and Postgres on
+port 5432 only to a same-namespace pod labeled
+`app.kubernetes.io/name=postgresql`. Managed Postgres requires an operator to
+set `networkPolicy.egress.postgres.podSelector=null` plus stable
+`networkPolicy.egress.postgres.cidrs` (or provide an additional CNI policy).
+
+Standard Kubernetes NetworkPolicy does not support DNS names. GitHub API,
+cloud KMS, and SIEM endpoints commonly use changing address ranges. Do not copy
+today's public IP list into a long-lived manifest and assume it remains valid.
+Prefer a controlled egress proxy with stable CIDRs or a CNI FQDN policy, then
+set `kmsCidrs`, `githubCidrs`, and `siemCidrs` to the stable enforcement points.
+Until configured, those outbound paths remain denied.
+
+On a first Helm install, the migration is a pre-install hook and therefore runs
+before this release's regular NetworkPolicy exists. Enforce a namespace-level
+baseline egress policy before installation; subsequent upgrades are covered by
+the existing release policy.
+
+## Clusterless check
+
+```bash
+packages/gate/deploy/helm/emilia-gate-service/tests/render-check.sh
+```
+
+The script runs strict Helm linting, renders with documentation-only registry
+and Secret names, asserts the hardening resources and settings, and rejects any
+rendered `Secret`. It does not connect to a cluster.

package/deploy/helm/emilia-gate-service/templates/NOTES.txt

@@ -0,0 +1,12 @@
+EMILIA Gate service was rendered as a BYOC deployment.
+
+Image: {{ include "emilia-gate-service.image" . }}
+Service: {{ include "emilia-gate-service.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.service.port }}
+
+The chart did not create any Secret. Operator configuration, Postgres, KMS, and
+issuer-root values are referenced from existing Secret names supplied at
+install time.
+
+Readiness:
+  kubectl -n {{ .Release.Namespace }} port-forward service/{{ include "emilia-gate-service.fullname" . }} 8080:{{ .Values.service.port }}
+  curl --fail http://127.0.0.1:8080{{ .Values.probes.readiness.path }}

package/deploy/helm/emilia-gate-service/templates/_helpers.tpl

@@ -0,0 +1,83 @@
+{{- define "emilia-gate-service.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "emilia-gate-service.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name (include "emilia-gate-service.name" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "emilia-gate-service.labels" -}}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | quote }}
+app.kubernetes.io/name: {{ include "emilia-gate-service.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/part-of: emilia-gate
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+emiliaprotocol.ai/deployment-model: byoc
+{{- end -}}
+
+{{- define "emilia-gate-service.baseSelectorLabels" -}}
+app.kubernetes.io/name: {{ include "emilia-gate-service.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "emilia-gate-service.serviceSelectorLabels" -}}
+{{ include "emilia-gate-service.baseSelectorLabels" . }}
+app.kubernetes.io/component: service
+{{- end -}}
+
+{{- define "emilia-gate-service.image" -}}
+{{- $repository := required "image.repository is required; build and push Dockerfile.gate to a registry you control" .Values.image.repository -}}
+{{- if and .Values.image.tag .Values.image.digest -}}
+{{- fail "set exactly one of image.tag or image.digest" -}}
+{{- else if .Values.image.digest -}}
+{{- if not (regexMatch "^sha256:[a-f0-9]{64}$" .Values.image.digest) -}}
+{{- fail "image.digest must be sha256:<64 lowercase hex characters>" -}}
+{{- end -}}
+{{- printf "%s@%s" $repository .Values.image.digest -}}
+{{- else if .Values.image.tag -}}
+{{- if eq (lower .Values.image.tag) "latest" -}}
+{{- fail "image.tag=latest is mutable and refused; use an immutable version tag or digest" -}}
+{{- end -}}
+{{- printf "%s:%s" $repository .Values.image.tag -}}
+{{- else -}}
+{{- fail "set exactly one of image.tag or image.digest; mutable implicit latest is refused" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "emilia-gate-service.postgresSecret" -}}
+{{- required "secrets.postgres.existingSecret is required; the chart only references existing Secrets" .Values.secrets.postgres.existingSecret -}}
+{{- end -}}
+
+{{- define "emilia-gate-service.migrationPostgresSecret" -}}
+{{- $runtimeSecret := include "emilia-gate-service.postgresSecret" . -}}
+{{- $migrationSecret := required "migrations.postgres.existingSecret is required when migrations.enabled=true; migration credentials never fall back to the runtime Secret" .Values.migrations.postgres.existingSecret -}}
+{{- if eq $migrationSecret $runtimeSecret -}}
+{{- fail "migrations.postgres.existingSecret must name a Secret distinct from secrets.postgres.existingSecret" -}}
+{{- end -}}
+{{- $migrationSecret -}}
+{{- end -}}
+
+{{- define "emilia-gate-service.migrationPostgresKey" -}}
+{{- required "migrations.postgres.key is required when migrations.enabled=true" .Values.migrations.postgres.key -}}
+{{- end -}}
+
+{{- define "emilia-gate-service.configurationSecret" -}}
+{{- required "configuration.existingSecret is required; apps/gate-service requires an operator-owned gate.config.mjs" .Values.configuration.existingSecret -}}
+{{- end -}}
+
+{{- define "emilia-gate-service.apiTokenSecret" -}}
+{{- required "secrets.apiToken.existingSecret is required; action routes require operator authentication" .Values.secrets.apiToken.existingSecret -}}
+{{- end -}}
+
+{{- define "emilia-gate-service.kmsSecret" -}}
+{{- .Values.secrets.kms.existingSecret -}}
+{{- end -}}
+
+{{- define "emilia-gate-service.issuerRootsSecret" -}}
+{{- required "secrets.issuerRoots.existingSecret is required; the chart only references existing Secrets" .Values.secrets.issuerRoots.existingSecret -}}
+{{- end -}}

package/deploy/helm/emilia-gate-service/templates/deployment.yaml

@@ -0,0 +1,153 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "emilia-gate-service.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "emilia-gate-service.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: 3
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      {{- include "emilia-gate-service.serviceSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "emilia-gate-service.serviceSelectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ include "emilia-gate-service.fullname" . }}
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: {{ .Values.runtime.terminationGracePeriodSeconds }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: gate-service
+          image: {{ include "emilia-gate-service.image" . | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.runtime.port }}
+              protocol: TCP
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: HOST
+              value: 0.0.0.0
+            - name: PORT
+              value: {{ .Values.runtime.port | quote }}
+            - name: EMILIA_GATE_CONFIG
+              value: {{ printf "%s/%s" .Values.configuration.mountPath .Values.configuration.configKey | quote }}
+            - name: EP_GATE_PORT
+              value: {{ .Values.runtime.port | quote }}
+            - name: EP_GATE_LOG_LEVEL
+              value: {{ .Values.runtime.logLevel | quote }}
+            - name: {{ .Values.secrets.postgres.envName }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "emilia-gate-service.postgresSecret" . }}
+                  key: {{ .Values.secrets.postgres.key }}
+                  optional: false
+            - name: {{ .Values.secrets.apiToken.envName }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "emilia-gate-service.apiTokenSecret" . }}
+                  key: {{ .Values.secrets.apiToken.key }}
+                  optional: false
+            {{- if .Values.secrets.kms.existingSecret }}
+            - name: {{ .Values.secrets.kms.envName }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "emilia-gate-service.kmsSecret" . }}
+                  key: {{ .Values.secrets.kms.key }}
+                  optional: false
+            {{- end }}
+            - name: {{ .Values.secrets.issuerRoots.envName }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "emilia-gate-service.issuerRootsSecret" . }}
+                  key: {{ .Values.secrets.issuerRoots.key }}
+                  optional: false
+            {{- with .Values.runtime.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          startupProbe:
+            httpGet:
+              path: {{ .Values.probes.startup.path }}
+              port: http
+            periodSeconds: {{ .Values.probes.startup.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.startup.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.startup.failureThreshold }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: configuration
+              mountPath: {{ .Values.configuration.mountPath }}
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 64Mi
+        - name: configuration
+          secret:
+            secretName: {{ include "emilia-gate-service.configurationSecret" . }}
+            optional: false
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.configuration.configKey }}
+                path: {{ .Values.configuration.configKey }}
+      topologySpreadConstraints:
+        {{- range .Values.topologySpreadConstraints }}
+        - maxSkew: {{ .maxSkew }}
+          topologyKey: {{ .topologyKey }}
+          whenUnsatisfiable: {{ .whenUnsatisfiable }}
+          labelSelector:
+            matchLabels:
+              {{- include "emilia-gate-service.serviceSelectorLabels" $ | nindent 14 }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}