Metadata-Version: 2.4
Name: emilia-crewai
Version: 0.3.3
Summary: Guard CrewAI tools with EMILIA Protocol — require an offline-verifiable authorization receipt (EP-RECEIPT-v1) before an irreversible tool runs: missing -> refused, valid -> runs, replay -> refused, forged -> refused (RR-1).
Project-URL: Homepage, https://www.emiliaprotocol.ai/agent-guard
Project-URL: Repository, https://github.com/emiliaprotocol/emilia-protocol
Author-email: Iman Schrock <team@emiliaprotocol.ai>
License: Apache-2.0
License-File: LICENSE
Keywords: agent-safety,ai-agent,authorization,crewai,emilia-protocol,guardrails,human-in-the-loop,multi-agent
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.9
Requires-Dist: emilia-verify>=2.7.0
Provides-Extra: test
Requires-Dist: cryptography>=41; extra == 'test'
Requires-Dist: pytest>=7; extra == 'test'
Description-Content-Type: text/markdown

# emilia-crewai

Guard [CrewAI](https://crewai.com) tools with the **EMILIA Protocol** — require an
**offline-verifiable authorization receipt** (EP-RECEIPT-v1) before an irreversible
tool runs.

```
missing receipt  -> refused
valid receipt    -> runs
replayed receipt -> refused   (one-time consumption)
forged receipt   -> refused
```

Verification is offline Ed25519 over canonical JSON via
[`emilia-verify`](https://pypi.org/project/emilia-verify/) — **zero network, no
vendor in the loop.** The approval becomes portable evidence an auditor can check
without trusting the operator. It is *necessary, not sufficient*: it composes with —
never replaces — your tool's own checks.

> The base gate proves a pinned issuer signed an action-bound authorization claim.
> For a human-presence claim, require `assurance_class="class_a"` and supply an
> independent assurance verifier pinned to the relying party's keys, RP, and origins.

## Install

```bash
pip install emilia-crewai          # brings in emilia-verify
```

CrewAI remains a duck-typed optional peer and is not installed transitively.
Install the CrewAI version selected by your application after auditing its own
dependency graph. This avoids making EMILIA an installation path for CrewAI's
currently unpatched optional ChromaDB dependency chain.

## Quick start

Gate a CrewAI `BaseTool` instance — its `_run` now requires a receipt:

```python
from emilia_crewai import guard_crewai_tool, using_receipt

guard_crewai_tool(
    my_wire_tool,
    action="payment.release",
    trusted_keys=[ISSUER_SPKI_B64URL],     # pin the issuer keys you trust
    target_for=lambda to, amount: to,  # optional semantic selector
    assurance_class="class_a",
    verify_assurance=verify_pinned_class_a_evidence,
)

# Bind the human-approved receipt for the agent step, then run as normal:
with using_receipt(receipt):
    crew.kickoff()        # my_wire_tool runs only with a valid, action-bound receipt
```

The high-level wrappers always bind the tool name and complete bound arguments;
`target_for` can add context but cannot weaken that binding. Use
`bind_call_action()` when minting the exact receipt action.

Or decorate a plain tool function:

```python
from emilia_crewai import require_receipt, using_receipt

@require_receipt("payment.release", trusted_keys=[ISSUER_SPKI_B64URL])
def send_payment(to: str, amount: int) -> str:
    return do_transfer(to, amount)
```

Lower-level gate (verify -> reserve -> execute -> commit yourself):

```python
from emilia_crewai import ReceiptGate
gate = ReceiptGate("payment.release", trusted_keys=[ISSUER_SPKI_B64URL])
result = gate.run(receipt, lambda: do_transfer(to, amount), target=to)
```

`run()` consumes the receipt after any execution attempt, including an exception:
the external effect may have happened before its response was lost. Production
fleets must pass an atomic, ownership-fenced `{reserve, commit, release}` store;
the default is process-local. Call `release()` only when you can prove execution
never began.

## Multi-agent / quorum

For collective decisions (M-of-N agents or humans approving one action), EMILIA's
quorum produces a single composite, offline-verifiable receipt. See the
`emilia_verify.verify_quorum` primitive and `draft-schrock-ep-quorum`.

## What it is / isn't

- **Is:** an offline gate for an action-bound issuer receipt, with an explicit
  Class-A/quorum verifier hook for independently established human ceremony.
- **Isn't:** authentication ("who is the agent"), access control, or a hosted runtime.
  It composes on top of whatever runtime you use.

Apache-2.0. Reference implementation, experimental. Part of the
[EMILIA Protocol](https://github.com/emiliaprotocol/emilia-protocol) — an open
IETF-track authorization-receipt standard (`draft-schrock-ep-authorization-receipts`).
