@emilia-protocol/gate 0.9.5 → 0.11.0

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@emilia-protocol/gate",
-  "version": "0.9.5",
+  "version": "0.11.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/emiliaprotocol/emilia-protocol.git",
     "directory": "packages/gate"
   },
-  "description": "EMILIA Gate \u2014 the Trusted Action Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), a tamper-evident evidence log, default high-risk action packs, execution-field binding, reliance packets, an MCP drop-in, a GitHub system-of-record adapter, and EG-1 conformance. Framework-agnostic, fails closed. Reference implementation, experimental.",
+  "description": "EMILIA Gate \u2014 the Consequence Firewall. Deny-by-default enforcement for consequential machine actions: an action runs only with a valid, in-scope, sufficiently-assured, non-replayed EMILIA authorization receipt (proof a named human authorized this exact action). Composes require-receipt + verify; adds assurance-tier enforcement, one-time consumption (replay defense), a tamper-evident evidence log, default high-risk action packs, execution-field binding, reliance packets, an MCP drop-in, a GitHub system-of-record adapter, and EG-1 conformance. Framework-agnostic, fails closed. Reference implementation, experimental.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "index.js",
@@ -31,6 +31,11 @@
     "./package.json": "./package.json",
     "./enterprise": "./enterprise.js",
     "./metering": "./metering.js",
+    "./network-witness": "./network-witness.js",
+    "./deployment-attestation": "./deployment-attestation.js",
+    "./coverage": "./coverage.js",
+    "./settlement": "./settlement.js",
+    "./control-plane": "./control-plane.js",
     "./siem": "./siem.js",
     "./roster": "./roster.js",
     "./reports/art14": "./reports/art14.js",
@@ -39,7 +44,16 @@
     "./breakglass": "./breakglass.js",
     "./challenge-store": "./challenge-store.js",
     "./store-postgres": "./store-postgres.js",
+    "./evidence-postgres": "./evidence-postgres.js",
+    "./witness-postgres": "./witness-postgres.js",
     "./evidence": "./evidence.js",
+    "./action-escrow": "./action-escrow.js",
+    "./action-escrow-evidence": "./action-escrow-evidence.js",
+    "./action-escrow-state": "./action-escrow-state.js",
+    "./action-escrow-postgres": "./action-escrow-postgres.js",
+    "./action-escrow-verifiers": "./action-escrow-verifiers.js",
+    "./action-escrow-custodian": "./action-escrow-custodian.js",
+    "./action-escrow-package": "./action-escrow-package.js",
     "./reports/auditor-workpaper": "./reports/auditor-workpaper.js",
     "./reports/reperform": "./reports/reperform.js",
     "./reports/external-verification": "./reports/external-verification.js",
@@ -52,9 +66,20 @@
   },
   "files": [
     "index.js",
+    "strict-json.js",
     "store.js",
     "challenge-store.js",
+    "store-postgres.js",
+    "evidence-postgres.js",
+    "witness-postgres.js",
     "evidence.js",
+    "action-escrow.js",
+    "action-escrow-evidence.js",
+    "action-escrow-state.js",
+    "action-escrow-postgres.js",
+    "action-escrow-verifiers.js",
+    "action-escrow-custodian.js",
+    "action-escrow-package.js",
     "action-packs.js",
     "action-control-manifest.js",
     "execution-binding.js",
@@ -86,16 +111,22 @@
     "adapters/salesforce.js",
     "demo.mjs",
     "custody-demo.mjs",
+    "LICENSE",
+    "CHANGELOG.md",
     "README.md",
     "enterprise.js",
     "metering.js",
+    "network-witness.js",
+    "deployment-attestation.js",
+    "coverage.js",
+    "settlement.js",
+    "control-plane.js",
     "siem.js",
     "roster.js",
     "reports/art14.js",
     "reports/underwriter.js",
     "metrics.js",
     "breakglass.js",
-    "store-postgres.js",
     "deploy/helm/emilia-gate/Chart.yaml",
     "deploy/helm/emilia-gate/values.yaml",
     "deploy/helm/emilia-gate/templates/deployment.yaml",
@@ -104,11 +135,14 @@
     "deploy/helm/emilia-gate/templates/servicemonitor.yaml",
     "deploy/helm/emilia-gate/templates/NOTES.txt",
     "deploy/helm/README.md",
+    "deploy/helm/emilia-gate-service",
     "deploy/terraform/main.tf",
     "deploy/terraform/variables.tf",
     "deploy/terraform/outputs.tf",
     "deploy/terraform/versions.tf",
     "deploy/terraform/README.md",
+    "deploy/terraform/service",
+    "deploy/sql/001-runtime.sql",
     "reports/auditor-workpaper.js",
     "reports/reperform.js",
     "reports/external-verification.js"
@@ -120,8 +154,8 @@
     "cf1": "node cf1.mjs"
   },
   "dependencies": {
-    "@emilia-protocol/require-receipt": "^0.5.0",
-    "@emilia-protocol/verify": "^3.3.0"
+    "@emilia-protocol/require-receipt": "0.6.1",
+    "@emilia-protocol/verify": "3.11.0"
   },
   "keywords": [
     "emilia",

package/reliance-kernel.js

@@ -15,15 +15,14 @@
  * of its own — it enforces the one the pure offline verifier computed.
  */
 import { createEvidenceLog } from './evidence.js';
+import {
+  evaluateReliance,
+  RELIANCE_PROFILE_VERSION,
+  RELIANCE_VERDICTS,
+} from '@emilia-protocol/verify/reliance';
 
 const RECEIPT_REQUIRED_STATUS = 428;
 
-// Same cross-package resolution the Gate uses: prefer the published verifier,
-// fall back to the in-repo source so the monorepo builds without a node_modules
-// link. evaluateReliance is pure/offline; no DB, no network.
-const { evaluateReliance, RELIANCE_VERDICTS, RELIANCE_PROFILE_VERSION } = await import('@emilia-protocol/verify/reliance')
-  .catch(() => import('../verify/reliance.js'));
-
 export { RELIANCE_VERDICTS, RELIANCE_PROFILE_VERSION };
 
 /** Build the 428 refusal for a non-`rely` verdict. */

package/reliance-packet.js

@@ -51,17 +51,41 @@ function normalizeAdmissibility(adm) {
   };
 }
 
-function evidenceStatus(evidence) {
-  if (!evidence) return { ok: null, length: null, head: null };
-  if (typeof evidence.verify === 'function') return evidence.verify();
-  return evidence;
+async function evidenceStatus(evidence) {
+  if (!evidence) {
+    return { ok: false, length: null, head: null, reason: 'evidence_verification_unavailable' };
+  }
+  try {
+    const status = typeof evidence.verify === 'function'
+      ? await evidence.verify()
+      : await evidence;
+    if (!status || typeof status !== 'object' || Array.isArray(status)) {
+      return { ok: false, length: null, head: null, reason: 'evidence_verification_malformed' };
+    }
+    if (status.ok !== true) {
+      return {
+        ok: false,
+        length: Number.isSafeInteger(status.length) ? status.length : null,
+        head: typeof status.head === 'string' ? status.head : null,
+        reason: status.reason || 'evidence_verification_rejected',
+      };
+    }
+    return {
+      ...status,
+      ok: true,
+      length: Number.isSafeInteger(status.length) ? status.length : null,
+      head: typeof status.head === 'string' ? status.head : null,
+    };
+  } catch {
+    return { ok: false, length: null, head: null, reason: 'evidence_verification_failed' };
+  }
 }
 
 function check(id, ok, detail = null) {
   return { id, ok, ...(detail ? { detail } : {}) };
 }
 
-export function buildReliancePacket({
+export async function buildReliancePacket({
   decision,
   execution = null,
   evidence = null,
@@ -70,12 +94,17 @@ export function buildReliancePacket({
   admissibility = null,
   verifier = '@emilia-protocol/gate',
 } = {}) {
-  const evidenceCheck = evidenceStatus(evidence);
+  const evidenceCheck = await evidenceStatus(evidence);
   const decisionHash = decision?.evidence?.hash || decision?.hash || null;
-  const executionBound = !execution || (execution.kind === 'execution' && execution.authorizes_decision === decisionHash);
+  const executionBound = Boolean(
+    execution
+    && execution.kind === 'execution'
+    && decisionHash
+    && execution.authorizes_decision === decisionHash,
+  );
   const bindingCheck = binding || decision?.evidence?.execution_binding || decision?.execution_binding || null;
   const allowed = decision?.allow === true;
-  const evidenceOk = evidenceCheck.ok !== false;
+  const evidenceOk = evidenceCheck.ok === true;
   const bindingOk = bindingCheck ? bindingCheck.ok === true : true;
 
   // Admissibility block (relying-party evaluator output, computed OFFLINE against
@@ -96,6 +125,10 @@ export function buildReliancePacket({
       action: decision?.action || null,
       receipt_id: decision?.evidence?.receipt_id || decision?.receipt_id || null,
       subject: decision?.evidence?.subject || null,
+      policy_id: decision?.evidence?.evaluated_policy_id || null,
+      policy_hash: decision?.evidence?.evaluated_policy_hash || null,
+      tenant_id: decision?.evidence?.evaluated_tenant_id || null,
+      approvers: decision?.evidence?.evaluated_approvers || [],
       required_tier: decision?.evidence?.required_tier || decision?.required_tier || null,
       observed_tier: decision?.evidence?.have_tier || decision?.have_tier || null,
       decision_hash: decisionHash,
@@ -117,8 +150,8 @@ export function buildReliancePacket({
       check('assurance_sufficient', allowed || decision?.reason !== 'assurance_too_low', decision?.reason === 'assurance_too_low' ? 'receipt tier below action requirement' : null),
       check('receipt_one_time_consumed', allowed || decision?.reason === 'replay_refused' ? decision?.reason !== 'replay_refused' : null),
       check('execution_fields_bound', bindingCheck ? bindingCheck.ok === true : null, bindingCheck ? { missing_observed_fields: bindingCheck.missing_observed_fields || [], mismatched_fields: bindingCheck.mismatched_fields || [] } : 'no material execution-field binding required by this action'),
-      check('execution_attests_decision', execution ? executionBound : null, execution ? null : 'no execution record supplied'),
-      check('evidence_log_intact', evidenceCheck.ok === undefined ? null : evidenceCheck.ok, evidenceCheck.reason || null),
+      check('execution_attests_decision', executionBound, execution ? null : 'no execution record supplied'),
+      check('evidence_log_intact', evidenceCheck.ok === true, evidenceCheck.reason || null),
       // Admissibility verdict against the relying party's PINNED profile. null when
       // no profile/verdict was supplied (this reliance did not gate on admissibility);
       // true only for a recognized 'admissible' verdict; false otherwise (fail closed).

package/reports/assurance-package.js

@@ -26,15 +26,11 @@
  * SUPPORTS a re-performance procedure; it never issues an opinion.
  */
 import { hashCanonical } from '../execution-binding.js';
+import { evaluateReliance, RELIANCE_VERDICTS } from '@emilia-protocol/verify/reliance';
 
 export const ASSURANCE_PACKAGE_VERSION = 'EP-ASSURANCE-PACKAGE-v1';
 export const ASSURANCE_REPERFORMANCE_VERSION = 'EP-ASSURANCE-REPERFORMANCE-v1';
 
-// Cross-package resolution, same pattern the Gate uses: the pure offline reliance
-// verifier. No DB, no network.
-const { evaluateReliance, RELIANCE_VERDICTS } = await import('@emilia-protocol/verify/reliance')
-  .catch(() => import('../../verify/reliance.js'));
-
 export { RELIANCE_VERDICTS };
 
 /**
@@ -70,6 +66,33 @@ function toIso(now) {
   return new Date(ms == null ? 0 : ms).toISOString();
 }
 
+function portableJsonCopy(value, active = new Set()) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value) || Object.is(value, -0)) {
+      throw new TypeError('assurance-package: value is not canonical JSON');
+    }
+    return value;
+  }
+  if (typeof value !== 'object') {
+    throw new TypeError('assurance-package: value is not JSON');
+  }
+  if (active.has(value)) throw new TypeError('assurance-package: cyclic value');
+  active.add(value);
+  try {
+    if (Array.isArray(value)) return value.map((entry) => portableJsonCopy(entry, active));
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError('assurance-package: value must use plain JSON objects');
+    }
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [key, portableJsonCopy(entry, active)]),
+    );
+  } finally {
+    active.delete(value);
+  }
+}
+
 /**
  * Bundle N automated reliance decisions + the evidence each relied on into one
  * portable, content-addressed assurance package. Does NOT re-perform (that is the
@@ -87,18 +110,19 @@ function toIso(now) {
 export function buildAssurancePackage(decisions = [], { profile, organization = null, now = 0 } = {}) {
   if (!Array.isArray(decisions)) throw new Error('assurance-package: decisions must be an array');
   const items = decisions.map((d, i) => {
-    const decision_id = d?.decision_id ?? `decision-${i}`;
+    const source = portableJsonCopy(d ?? {});
+    const decision_id = source.decision_id ?? `decision-${i}`;
     return {
       decision_id,
-      action: d?.action ?? null,
-      policy_hash: d?.action?.policy_hash ?? null,
-      stated_verdict: typeof d?.stated_verdict === 'string' ? d.stated_verdict : null,
+      action: source.action ?? null,
+      policy_hash: source.action?.policy_hash ?? null,
+      stated_verdict: typeof source.stated_verdict === 'string' ? source.stated_verdict : null,
       evidence: {
-        receipt: d?.receipt ?? null,
-        quorum: d?.quorum ?? null,
-        authority_proof: d?.authority_proof ?? null,
-        revocation_state: d?.revocation_state ?? null,
-        consumption: d?.consumption ?? null,
+        receipt: source.receipt ?? null,
+        quorum: source.quorum ?? null,
+        authority_proof: source.authority_proof ?? null,
+        revocation_state: source.revocation_state ?? null,
+        consumption: source.consumption ?? null,
       },
     };
   });
@@ -106,11 +130,12 @@ export function buildAssurancePackage(decisions = [], { profile, organization =
   const exceptions = items.filter((it) => it.stated_verdict && it.stated_verdict !== 'rely')
     .map((it) => ({ decision_id: it.decision_id, stated_verdict: it.stated_verdict, control_id: controlForVerdict(it.stated_verdict) }));
 
+  const profileCopy = profile == null ? null : portableJsonCopy(profile);
   const body = {
     '@version': ASSURANCE_PACKAGE_VERSION,
-    organization,
-    reliance_profile: profile ?? null,
-    profile_hash: profile ? hashCanonical(profile) : null,
+    organization: organization == null ? null : portableJsonCopy(organization),
+    reliance_profile: profileCopy,
+    profile_hash: profileCopy ? hashCanonical(profileCopy) : null,
     control_catalog: RELIANCE_CONTROL_CATALOG,
     decisions: items,
     exception_history: exceptions,
@@ -140,15 +165,16 @@ export function buildAssurancePackage(decisions = [], { profile, organization =
  * @param {object} [opts.approverKeys]  auditor-pinned approver keys (out of band)
  * @param {string} [opts.logPublicKey]  auditor-pinned transparency-log key
  * @param {string} [opts.rpId]
+ * @param {string[]} [opts.allowedOrigins]
  * @param {object} [opts.revokerKeys]
  * @param {(key:object)=>boolean} [opts.isConsumed] auditor-owned consumption lookup
  * @param {number|string|Date} [opts.now]  reliance-evaluation clock (pin for determinism)
  * @returns {object} EP-ASSURANCE-REPERFORMANCE-v1
  */
-export function reperformAssurancePackage(pkg, { approverKeys = {}, logPublicKey = null, rpId = null, revokerKeys = {}, isConsumed, now = 0 } = {}) {
+export function reperformAssurancePackage(pkg, { approverKeys = {}, logPublicKey = null, rpId = null, allowedOrigins = [], revokerKeys = {}, isConsumed, now = 0 } = {}) {
   if (!pkg || pkg['@version'] !== ASSURANCE_PACKAGE_VERSION) throw new Error('assurance-reperform: not an EP-ASSURANCE-PACKAGE-v1');
   const profile = pkg.reliance_profile;
-  const evalOpts = { approverKeys, logPublicKey, rpId, revokerKeys, ...(typeof isConsumed === 'function' ? { isConsumed } : {}) };
+  const evalOpts = { approverKeys, logPublicKey, rpId, allowedOrigins, revokerKeys, ...(typeof isConsumed === 'function' ? { isConsumed } : {}) };
   const relianceNow = typeof now === 'function' ? now() : now;
 
   const results = (Array.isArray(pkg.decisions) ? pkg.decisions : []).map((it) => {

package/reports/reperform.js

@@ -37,15 +37,10 @@
  * Deterministic: pure over (entries, issuerKeys); time enters only through the
  * injectable `now` (generated_at). No sampling, no randomness.
  */
+import crypto from 'node:crypto';
 import { createEvidenceLog } from '../evidence.js';
-
-// The protocol verifiers being re-driven. Same resolution pattern as
-// packages/gate/index.js: prefer the published package, fall back to the
-// in-repo source so the monorepo works without a node_modules link.
-const { verifyEmiliaReceipt } = await import('@emilia-protocol/require-receipt')
-  .catch(() => import('../../require-receipt/index.js'));
-const { verifyWebAuthnSignoff, verifyQuorum } = await import('@emilia-protocol/verify')
-  .catch(() => import('../../verify/index.js'));
+import { validatePinnedQuorumPolicy, verifyEmiliaReceipt } from '@emilia-protocol/require-receipt';
+import { verifyQuorum, verifyWebAuthnSignoff } from '@emilia-protocol/verify';
 
 export const REPERFORMANCE_VERSION = 'EP-GATE-REPERFORMANCE-v1';
 
@@ -107,7 +102,28 @@ function collectMaterial(e) {
  * what IS re-performed is the cryptography (signature, issuer trust, action
  * binding, ceremony checks).
  */
-function reverifyMaterial(m, { issuerKeys, action, rpId }) {
+function spkiFingerprint(value) {
+  try {
+    const key = crypto.createPublicKey({ key: Buffer.from(value, 'base64url'), format: 'der', type: 'spki' });
+    return crypto.createHash('sha256').update(key.export({ type: 'spki', format: 'der' })).digest('hex');
+  } catch { return null; }
+}
+
+function pinnedApproverEntry(approverKeys, approver, carriedKey = null) {
+  if (!approverKeys || typeof approverKeys !== 'object' || Array.isArray(approverKeys)) return null;
+  const candidates = Object.values(approverKeys).filter((entry) => entry && typeof entry === 'object'
+    && entry.approver_id === approver && typeof entry.public_key === 'string');
+  if (carriedKey) {
+    const fingerprint = spkiFingerprint(carriedKey);
+    const matches = candidates.filter((entry) => fingerprint && spkiFingerprint(entry.public_key) === fingerprint);
+    return matches.length === 1 ? matches[0] : null;
+  }
+  return candidates.length === 1 ? candidates[0] : null;
+}
+
+function reverifyMaterial(m, {
+  issuerKeys, action, rpId, allowedOrigins, approverKeys, quorumPolicy, quorumPolicies,
+}) {
   if (m.type === 'receipt') {
     const r = verifyEmiliaReceipt(m.doc, {
       trustedKeys: issuerKeys, allowInlineKey: false, action, maxAgeSec: 0,
@@ -115,14 +131,33 @@ function reverifyMaterial(m, { issuerKeys, action, rpId }) {
     return r.ok ? null : `receipt:${r.reason}`;
   }
   if (m.type === 'signoff') {
-    // No pinned/carried approver key -> nothing to verify AGAINST. Named
-    // failure, never a silent pass.
-    if (!m.key || typeof m.key !== 'string') return 'signoff:no_approver_key_carried';
-    const r = verifyWebAuthnSignoff(m.doc, m.key, rpId ? { rpId } : {});
+    if (typeof rpId !== 'string' || !rpId || !Array.isArray(allowedOrigins) || allowedOrigins.length === 0) {
+      return 'signoff:relying_party_scope_unpinned';
+    }
+    const approver = m.doc?.context?.approver;
+    const entry = pinnedApproverEntry(approverKeys, approver, m.key);
+    if (!entry) return 'signoff:approver_key_unpinned_or_ambiguous';
+    const r = verifyWebAuthnSignoff(m.doc, entry.public_key, { rpId, allowedOrigins });
     return r.valid ? null : `signoff:${r.error ? `error:${r.error}` : `checks_failed:${failingChecks(r.checks)}`}`;
   }
   if (m.type === 'quorum') {
-    const r = verifyQuorum(m.doc, rpId ? { rpId } : {});
+    if (typeof rpId !== 'string' || !rpId || !Array.isArray(allowedOrigins) || allowedOrigins.length === 0) {
+      return 'quorum:relying_party_scope_unpinned';
+    }
+    const pinnedPolicy = (quorumPolicies && typeof quorumPolicies === 'object' ? quorumPolicies[action] : null)
+      || quorumPolicy;
+    const policy = validatePinnedQuorumPolicy(pinnedPolicy);
+    if (!policy.ok) return `quorum:${policy.reason}`;
+    const members = Array.isArray(m.doc?.members) ? m.doc.members.map((member) => {
+      const entry = pinnedApproverEntry(
+        approverKeys,
+        member?.signoff?.context?.approver,
+        member?.approver_public_key,
+      );
+      return entry ? { ...member, approver_public_key: entry.public_key } : null;
+    }) : [];
+    if (members.length === 0 || members.some((member) => !member)) return 'quorum:approver_key_unpinned_or_ambiguous';
+    const r = verifyQuorum({ ...m.doc, policy: policy.policy, members }, { rpId, allowedOrigins });
     return r.valid ? null : `quorum:checks_failed:${failingChecks(r.checks)}`;
   }
   /* c8 ignore next */
@@ -154,12 +189,24 @@ function reverifyMaterial(m, { issuerKeys, action, rpId }) {
  * @param {string[]} [o.issuerKeys=[]]  pinned base64url SPKI issuer keys, sourced
  *   by the AUDITOR out of band — never from the entries themselves
  * @param {number|function} [o.now=Date.now]  clock for generated_at (pin for determinism)
- * @param {string} [o.rpId]  bind carried WebAuthn assertions to this relying-party id
+ * @param {object} [o.approverKeys={}] auditor-pinned identity-bound approver keys
+ * @param {string} [o.rpId] bind carried WebAuthn assertions to this relying-party id
+ * @param {string[]} [o.allowedOrigins=[]] exact accepted WebAuthn origins
+ * @param {object} [o.quorumPolicy] auditor-pinned global organizational quorum rule
+ * @param {object} [o.quorumPolicies] action_type -> auditor-pinned quorum rule
  * @returns {Promise<object>} EP-GATE-REPERFORMANCE-v1 document:
  *   { chain: {ok, entries, head}, receipts: {reverified, failed, not_reverifiable},
  *     counts: {allows, denies, replays_blocked, by_action_type}, ... }
  */
-export async function reperformEvidence(entries = [], { issuerKeys = [], now = Date.now, rpId = null } = {}) {
+export async function reperformEvidence(entries = [], {
+  issuerKeys = [],
+  approverKeys = {},
+  now = Date.now,
+  rpId = null,
+  allowedOrigins = [],
+  quorumPolicy = null,
+  quorumPolicies = {},
+} = {}) {
   if (!Array.isArray(entries)) {
     throw new Error('reperform: entries must be an array (evidence.all() or a full export)');
   }
@@ -227,7 +274,13 @@ export async function reperformEvidence(entries = [], { issuerKeys = [], now = D
       let allOk = true;
       for (const m of material) {
         const reason = reverifyMaterial(m, {
-          issuerKeys, action: typeof e.action === 'string' && e.action ? e.action : null, rpId,
+          issuerKeys,
+          approverKeys,
+          action: typeof e.action === 'string' && e.action ? e.action : null,
+          rpId,
+          allowedOrigins,
+          quorumPolicy,
+          quorumPolicies,
         });
         if (reason) { allOk = false; receipts.failed.push({ hash, reason }); }
       }
@@ -255,7 +308,8 @@ export async function reperformEvidence(entries = [], { issuerKeys = [], now = D
       reperforms:
         'Independent recomputation from the supplied evidence entries: the hash chain is rebuilt '
         + 'and checked with the evidence log\'s own verifier, carried receipt/signoff/quorum material '
-        + 'is cryptographically re-verified against auditor-pinned issuer keys, and decision counts '
+        + 'is cryptographically re-verified against auditor-pinned issuer and identity-bound approver keys, '
+        + 'WebAuthn scope, and organizational quorum policy; decision counts '
         + 'are recomputed from scratch without reference to any report builder.',
       does_not_establish: [
         'Completeness of the log: a chain rewritten in full, or entries withheld before they were supplied, is not detectable from the entries alone. Anchor the head hash externally to close this.',
@@ -268,6 +322,12 @@ export async function reperformEvidence(entries = [], { issuerKeys = [], now = D
     input: {
       entries_supplied: entries.length,
       issuer_keys_pinned: issuerKeys.length,
+      approver_keys_pinned: approverKeys && typeof approverKeys === 'object'
+        ? Object.keys(approverKeys).length : 0,
+      relying_party_scope_pinned: typeof rpId === 'string' && rpId.length > 0
+        && Array.isArray(allowedOrigins) && allowedOrigins.length > 0,
+      quorum_policies_pinned: (quorumPolicy ? 1 : 0)
+        + (quorumPolicies && typeof quorumPolicies === 'object' ? Object.keys(quorumPolicies).length : 0),
       expects: 'the complete evidence log from genesis (evidence.all() or a full export)',
     },
     chain,

package/reports/underwriter.js

@@ -168,7 +168,7 @@ export function buildUnderwriterAttestation(entries = [], {
       status: 'Not an insurance document. This attestation carries no coverage effect until adopted by the carrier.',
     },
     control_in_force: {
-      control: 'EMILIA Gate — Trusted Action Firewall',
+      control: 'EMILIA Gate — Consequence Firewall',
       mode: 'deny_by_default',
       statement: 'Guarded actions execute only with a valid, in-scope, sufficiently-assured, fresh, one-time authorization receipt; absent or insufficient proof is refused, and every decision is appended to a hash-chained evidence log.',
       guarded_decisions: guarded.length,