feat(composition): add bounded AIC-to-AEB exact-action mappings

.gitattributes

@@ -350,6 +350,9 @@ conformance/composition/aeb-crossing-lifecycle-v1/run.mjs linguist-generated=tru
 conformance/composition/aeb-crossing-lifecycle-v1/run.node-test.mjs linguist-generated=true
 conformance/composition/aeb-crossing-record-v1/run.mjs linguist-generated=true
 conformance/composition/aeb-crossing-record-v1/run.node-test.mjs linguist-generated=true
+conformance/composition/aic-aeb-crossing-v0.2/run.mjs linguist-generated=true
+conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mjs linguist-generated=true
+conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mjs linguist-generated=true
 conformance/composition/ccs-l1-aeb-v1/run.mjs linguist-generated=true
 conformance/composition/ccs-l1-aeb-v1/run.test.mjs linguist-generated=true
 conformance/composition/ccs-oasnt-aeb-v1/run.mjs linguist-generated=true
@@ -671,6 +674,7 @@ packages/verify/a2a-receipt-binding.test.js linguist-generated=true
 packages/verify/aadp-authorization-artifact.test.js linguist-generated=true
 packages/verify/aeb-acceptance-profile.test.js linguist-generated=true
 packages/verify/aeb-adapter-contract.test.js linguist-generated=true
+packages/verify/aeb-aic-crossing-adapter.test.js linguist-generated=true
 packages/verify/aeb-aps-adapter.test.js linguist-generated=true
 packages/verify/aeb-ccs-adapter.test.js linguist-generated=true
 packages/verify/aeb-consequence-conformance.test.js linguist-generated=true

AI_CONTEXT.md

@@ -2,7 +2,7 @@
 
 > EMILIA is the authority control plane for autonomous work. The plain-language operating picture is a customer-owned authority toll booth at a configured protected boundary, where a human or institution defines a finite operating mandate and agents work unattended inside it. EMILIA Gate verifies the authority and evidence the owner requires for the exact action, reserves accepted authority before provider entry, admits or refuses the crossing, preserves executed or indeterminate outcomes, refuses blind replay, and returns an action-bound receipt packet. EMILIA Host is the private local deployment form of Gate for activated covered HTTP and MCP paths at a credential-owning provider boundary; the current surface is an HTTP local service alpha, HTTP and MCP SDK protection, and governed pilots. Native mandates and credentials from A2A, AP2, OAuth, and hardware-backed approval systems remain attributable to their issuers. EMILIA Protocol is the open Action Receipt Contract underneath Gate; EMILIA Approver captures device-bound exact-action human decisions when the mandate or local policy requires fresh human authority; EMILIA Assurance Plane defines scoped verification, re-performance, conformance-report, and deployment-evidence procedures without acting as an auditor or accredited certifier. The toll-booth metaphor describes the intended cross-stack contract, not current coverage or operation of a central global network.
 
-Generated from repository evidence. Evidence snapshot: 2026-09-01T09:44:11.545Z. Input digest: sha256:58ef6ac4a77b5d5dbc19181b45e6f796b0a54a61aace98f77114fa91bcd7a2a8.
+Generated from repository evidence. Evidence snapshot: 2026-09-01T14:52:23.203Z. Input digest: sha256:b532abe6876389a10aac43bd2c66faef2d58c5cc50a644aa7578772e68052845.
 Do not edit this file directly. Source: [docs/ai/context-source.v1.json](docs/ai/context-source.v1.json). Freshness check: `npm run check:llm-context`.
 
 ## Read This First
@@ -15,10 +15,10 @@ When this file conflicts with a quantitative claim elsewhere, use the machine-re
 
 ## Current Evidence Snapshot
 
-- Automated tests: 10,609 cases across 658 files; all platform-applicable cases must pass; platform-specific cases may skip.
+- Automated tests: 10,611 cases across 659 files; all platform-applicable cases must pass; platform-specific cases may skip.
 - Cross-language conformance: 21 suites, 332 current vectors, 3 same-team ports (JavaScript, Python, Go). This is consistency evidence, not implementation independence.
 - External Rust interoperability: pass on the time-pinned 164-vector set evaluated 2026-07-11; the current bundle has 332. The same pinned implementation passes 359 hostility cases. Strict clean-room construction acceptance: false.
-- Security case: 35 executable claims, 259 evidence files, execution passed; bundle sha256:947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880.
+- Security case: 35 executable claims, 259 evidence files, execution passed; bundle sha256:03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7.
 - Core formal inventory: 26 TLA+ invariants, 35 Alloy facts, 32 Alloy assertions. The selected-scenario models are reported separately below; formal scope and exclusions remain claim-specific.
 - Selected model/runtime scenario conformance: 78 content-addressed scenarios across 14 bounded models and 21 public claims; 51 negative controls pair a formal counterexample with a safe-runtime refusal. They do not mutate the runtime implementation. Boundary: selected model/runtime scenarios under explicit projection relations; not a mechanized implementation refinement proof.
 - Formal evidence taxonomy: 2 claims with verified formal obligations; 21 with bounded runtime-traced evidence; 1 with bounded formal evidence but no governed runtime bridge; 0 with partial symbolic coverage; 11 with executable or operational evidence only.

conformance/clean-room/v2/bundle.v2.json

@@ -3,8 +3,8 @@
   "claim_scope": "source-free current-bundle conformance input; independent construction acceptance requires a separate trusted-attestor signature",
   "source_manifest": {
     "path": "conformance/conformance-manifest.json",
-    "sha256": "1f0f5a06b90faabab4c4eada8a87380d94a8f0d872af0a56b9391287a83bc3f2",
-    "manifest_sha256": "de00937588feff870bb7b72e5f6b09549a3008142f76136dd6a1bd7cce91e71a"
+    "sha256": "cb64bb6cf65672d0ee785e92765d7e4028db7e31ce5c94a2c71fb89865c4e8c4",
+    "manifest_sha256": "9fb14a40af62b7a94b629021dc316ea6087ba6c2873da23a43e07e71bf7a9200"
   },
   "runner_protocol": {
     "version": "EP-CONFORMANCE-FILE-RUNNER-v2",

conformance/composition/aic-aeb-crossing-v0.2/README.md

@@ -0,0 +1,160 @@
+# AIC exact-action crossing composition profile
+
+This kit maps two pinned AIC credential forms into one
+`EP-AEB-CROSSING-RECORD-v1` decision without claiming the credential forms are
+interchangeable:
+
+- pure-JSON AIC-JWT with protected-header `typ=aic+jwt` and an RFC 7638 JWK
+  thumbprint (`hash_alg=jkt`); and
+- AIC identity certificates with a SHA-2 hash of the X.509 Subject Public Key
+  Info (SPKI).
+
+The v0.2 profile adds four relying-party-owned checks before a native AIC
+decision can be recorded:
+
+1. the pinned capability-to-action projection must equal the executor's exact
+   `caid` and `action_digest`;
+2. the projection must bind the same relying-party identifier, audience,
+   executor, and state domain used by the boundary;
+3. source status must be explicitly `CURRENT` and carry both an observation
+   time (`status.checked_at`) and a source-head digest; and
+4. that observation must not be future, older than the fixed 60-second v0.2
+   freshness limit, or outside the native credential's validity window.
+
+Only the bound v2 authority mappings are public. They carry evaluation time and
+the fixed freshness limit in the relying-party context. The package exposes no
+unbound AIC authority result that can be handed to the generic crossing-record
+issuer.
+
+The bound authority commits the full admission domain, including
+`relying_party_id`, into its authority-instance, replay, and constraints
+digests. `EP-AEB-CROSSING-RECORD-v1` then commits those opaque digests, but its
+generic issuer cannot recompute the AIC context or prove that a separately
+supplied boundary matches it. AIC issuance therefore uses
+`issueAicBoundCrossingRecord`, which receives the native input, relying-party
+context, and record draft together and refuses any action or admission-domain
+mismatch before signing. The generic crossing issuer is not the AIC issuance
+API. A future crossing-record v2 can make that admission-domain binding
+recomputable without changing the frozen v1 digest.
+
+The adapter keeps the native-verifier result and relying-party policy as
+separate arguments. The native result carries the claimed issuer anchor,
+verifier descriptor, verification-evidence digest, and evaluated artifact.
+Only the relying-party policy carries the trusted-anchor set, expected native
+verifier, mapping profile, and action-projection profile. A presented result
+cannot establish acceptance by changing both a claimed anchor and a colocated
+"trusted" list. The relying-party context also pins the exact requested-
+capability digest, action, and admission domain, so a presented projection
+cannot mint a second replay identity by changing one of those values.
+
+The relying party supplies and authenticates the mapping-profile provenance
+and digest. The reusable v0.2 adapter enforces the profile identifier and
+exactly 60 seconds of source-status freshness, but it does not load or
+recompute this directory's `mapping-profile.json` as a trust decision.
+
+The adapter checks a supplied capability-to-action projection for exact
+equality. It does not create that projection. Unknown schemes, ambiguous
+mappings, and unmapped material parameters must refuse upstream.
+
+The adapter consumes a successful native-verifier result. It does not
+reimplement AIC-JWT signatures, delegation, capability or constraint
+validation, token-status retrieval, or X.509 path validation. The native
+verifier and the closed action-projection profile remain separately pinned
+prerequisites. Unknown capability schemes, ambiguous mappings, or unmapped
+material parameters must refuse before this adapter is called. The pinned
+gateway bearer helper does not pass `ExpectedAudience`, `RequestCapability`,
+`PrincipalMaterial`, or `PresenterKey` into the upstream validator. This
+adapter derives and checks the compact token audience and the RFC 7638
+thumbprint of explicit public JWK material, but it does not prove possession of
+that key or prove that the upstream helper evaluated the requested capability.
+Production wiring therefore needs an authenticated native-result wrapper that
+attests the same capability evaluation.
+
+The pinned `gateway-core` revision can verify an AIC-JWT bearer token and
+return a synthesized `x509.Certificate` for its certificate-oriented pipeline.
+That returned object is bare: the inspected implementation does not attach an
+authenticated original-carrier tag, raw certificate DER, raw SPKI, or a public
+key. This adapter therefore derives provenance from the exact raw source. The
+JWT/JKT path requires the original compact token and derives its `typ`, artifact
+digest, audience, issuer/JTI replay identity, signed `iat`/`nbf`/`exp` envelope,
+claimed JKT, and the RFC 7638 thumbprint of explicit public JWK material. The
+signed temporal envelope must exactly match the native wrapper's validity
+window, so a stale or faulty wrapper cannot extend the token. The native
+X.509/SPKI path requires
+real, distinct agent and principal certificate DER and derives the bundle
+digest, agent serial, and principal SHA-256 SPKI hash. The local distinct-DER
+rule is stricter than the pinned upstream `VerifyBundle`, which requires both
+chain slots but does not itself compare the leaf bytes for inequality. A
+JWT-origin synthesized object has no native certificate bundle bytes and is
+refused by the X.509 path while remaining eligible only for the JWT/JKT path.
+
+Raw DER does not establish every native-result field. X.509 issuer, subject,
+status, validity, constraints, trust-anchor selection, and verifier-evidence
+digest remain outputs of the trusted native wrapper. The DER-derived bundle
+identity prevents free wrapper labels from fragmenting replay, but those labels
+must still be authenticated before they cross a process boundary.
+
+The adapter derives raw-carrier fingerprints from the bytes it receives. Those
+fingerprints do not prove the native verifier saw the same bytes unless an
+authenticated wrapper binds them to the verifier result.
+
+The JWT-SVID helper has a separate, private source-verification path. It never
+returns a crossing authority. Its projection digest commits the accepted
+source evaluation, including the pinned verifier and source-verification
+profile, verification-evidence digest, selected issuer anchor, status head and
+observation time, native validity, and the fixed 60-second freshness context.
+
+That is a local fail-closed boundary, not an upstream integration claim. A
+deployment crossing a Go or JSON process boundary still needs a tagged or
+authenticated verifier-result wrapper that preserves the original carrier.
+The inspected repository had no non-test `VerifyBearer` call site, and the
+helper is not evidence of a wired or deployed bearer path.
+
+The deterministic positive fixtures are adapter-boundary stubs, not upstream
+interoperability vectors. Native `VERIFIED` is stipulated: the compact JWT uses
+a placeholder signature, and the parseable X.509 certificates do not carry the
+AIC and principal-authorization extensions required by the pinned native
+bundle verifier. The report records this explicitly and does not claim those
+verifiers accepted the fixtures.
+
+## Reproduce
+
+From the repository root:
+
+```sh
+npm --prefix packages/verify run build
+node conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mjs
+node --test \
+  packages/verify/aeb-aic-crossing-adapter.test.js \
+  conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mjs
+node conformance/composition/aic-aeb-crossing-v0.2/run.mjs --check
+```
+
+The deterministic report covers twenty cases: two stipulated native-result mappings
+and hybrid-signed crossing records; separation of jkt and SPKI profiles;
+DER-stable X.509 replay identity; principal-binding mismatch; relying-party
+self-pin refusal; native type
+confusion; rejection of a JWT-origin synthesized X.509 carrier in the native
+X.509 mapping while retaining its JWT/JKT route; failed or indeterminate native
+verification; exact-action and requested-capability substitution; relying-party
+domain and compact-token audience substitution; stale and future status
+observations; refusal to widen the fixed 60-second freshness profile; signed
+JWT temporal relabeling; revoked and unavailable status;
+native-validity failure; issuer-time action and admission-domain mismatch
+refusal before signing; and signed-body relying-party substitution refusal by
+signature verification.
+
+`source-lock.json` pins the exact IETF draft bytes and the exact Varwof source
+revisions inspected. `report.reference.json` embeds that source lock and the
+claim limits so the deterministic output cannot silently outgrow its evidence.
+
+## Claim boundary
+
+A passing report means the EMILIA reference implementation produced the
+committed results for the pinned inputs. It is not an independent
+implementation of AIC, does not establish production deployment or
+IETF adoption, and does not prove every relying party made the correct native
+trust decision. It also does not authenticate a native-verifier result crossing
+an untrusted process boundary. A verified crossing record remains evidence of
+one past local boundary decision. It is never fresh authority for another
+action.

conformance/composition/aic-aeb-crossing-v0.2/mapping-profile.json

@@ -0,0 +1,101 @@
+{
+  "@version": "EP-AIC-AEB-CROSSING-MAPPING-v0.2",
+  "crossing_record": "EP-AEB-CROSSING-RECORD-v1",
+  "native_mappings": [
+    {
+      "id": "EP-AEB-CROSSING-AIC-JWT-JKT-BOUND-v2",
+      "native_profile": "AIC-JWT-RFC7638-JKT",
+      "source_carrier": "AIC-JWT-COMPACT",
+      "required_provenance": [
+        "compact_token",
+        "derived_typ",
+        "derived_artifact_digest",
+        "derived_audience",
+        "derived_iat_nbf_exp_envelope",
+        "presented_principal_jwk",
+        "derived_claimed_principal_key_hash",
+        "derived_presented_rfc7638_thumbprint"
+      ],
+      "permitted_downstream_representations": [
+        "DIRECT",
+        "SYNTHESIZED-X509"
+      ],
+      "principal_binding": "RFC7638_JKT",
+      "hash_alg": "jkt"
+    },
+    {
+      "id": "EP-AEB-CROSSING-AIC-X509-SPKI-BOUND-v2",
+      "native_profile": "AIC-X509-SPKI",
+      "source_carrier": "AIC-X509-CREDENTIAL-BUNDLE",
+      "required_provenance": [
+        "agent_certificate_der",
+        "principal_certificate_der",
+        "derived_bundle_digest",
+        "derived_agent_serial",
+        "derived_principal_spki_hash"
+      ],
+      "principal_binding": "X509_SPKI",
+      "hash_algs": ["sha-256"]
+    }
+  ],
+  "action_projection": {
+    "id": "AIC-EXACT-ACTION-PROJECTION-v1",
+    "unknown_scheme": "REFUSE",
+    "unmapped_material_parameter": "REFUSE",
+    "required_relation": "EXACT_MATCH",
+    "committed_members": [
+      "requested_capability_digest",
+      "caid",
+      "action_digest"
+    ]
+  },
+  "admission_domain": {
+    "id": "EP-AIC-ADMISSION-DOMAIN-v1",
+    "committed_members": [
+      "relying_party_id",
+      "audience",
+      "executor_id",
+      "state_domain_id"
+    ],
+    "required_relation": "EXACT_MATCH"
+  },
+  "workload_identity_projection": {
+    "id": "EP-AIC-JWT-SVID-PROJECTION-v1",
+    "source_verification_profile_id": "EP-AIC-JWT-SVID-SOURCE-VERIFICATION-v1",
+    "purpose": "WORKLOAD_IDENTITY_ONLY",
+    "authority_result_emitted": false,
+    "accepted_source_evaluation_digest_required": true
+  },
+  "source_status": {
+    "required_value": "CURRENT",
+    "observation_member": "status.checked_at",
+    "source_head_member": "status.source_head_digest",
+    "maximum_age_seconds": 60,
+    "future_observation": "REFUSE",
+    "missing_or_non_current": "REFUSE",
+    "outside_native_validity": "REFUSE"
+  },
+  "rules": {
+    "native_verification_required": "VERIFIED",
+    "relying_party_trust_anchor_pin_required": true,
+    "native_result_and_relying_party_policy_separate": true,
+    "native_verifier_descriptor_relying_party_pinned": true,
+    "mapping_and_action_projection_profiles_relying_party_pinned": true,
+    "requested_capability_digest_relying_party_pinned": true,
+    "raw_source_carrier_provenance_required": true,
+    "jwt_audience_must_include_relying_party_audience": true,
+    "jwt_signed_temporal_envelope_exact_match_required": true,
+    "jwt_presented_public_jwk_thumbprint_required": true,
+    "jwt_presented_public_jwk_proves_possession": false,
+    "jwt_synthesized_x509_requires_original_compact_token": true,
+    "native_x509_requires_real_agent_and_principal_der": true,
+    "native_x509_spki_hash_alg": "sha-256",
+    "principal_binding_exact_match_required": true,
+    "carrier_types_are_not_interchangeable": true,
+    "bound_authority_commits_relying_party_id": true,
+    "crossing_record_v1_contract_directly_commits_relying_party_id": false,
+    "aic_bound_issue_helper_requires_action_and_admission_domain_match": true,
+    "generic_crossing_issuer_revalidates_aic_opaque_context": false,
+    "crossing_record_is_execution_authority": false
+  }
+}