langchain-emilia

Before your LangChain agent does anything irreversible, a named human approves that exact action on their own device. Face ID / Touch ID / passkey. Fail-closed. Every approval mints a Trust Receipt that verifies offline — years later, with no account and no EMILIA server.

pip install langchain-emilia
export EP_API_KEY=ep_live_...  EP_ORG_ID=your-org

from langchain_emilia import EmiliaGuard, guard_tools

guard = EmiliaGuard()                                   # enforce mode
tools = guard_tools([transfer_funds, send_email, calculator], guard)
# hand `tools` to your agent exactly as before — nothing else changes

When the agent calls transfer_funds(amount=82000, beneficiary="Northwind"):

1. Gate — the call is held pre-execution; EP policy returns allow, require_signoff, or deny.
2. Signoff — on require_signoff, a named human approves on their own device. The approval is cryptographically bound to the exact action parameters — change one digit and it is invalid.
3. Consume — the exact receipt is atomically consumed before the tool body; an already-consumed receipt cannot authorize another executor.
4. Attest — after the tool returns, the adapter reports executor-observed invocation fields re-derived from the detached arguments actually handed to the tool; it does not reuse the approved plan as its own observation. This is attributable execution evidence, not proof of real-world effects. If the evidence write cannot be confirmed, the result is INDETERMINATE and the adapter says DO NOT RETRY.

Denials and pending holds are returned to the model as the tool's output ("EMILIA — BLOCKED … transfer_funds was NOT executed."), so the agent loop explains itself instead of crashing. The tool body never runs unless the gate allows it.

Why this is an executor-side precondition, not an "approval tool"

Approval tools the model calls have three failure modes: the model forgets to call them, approves action A then executes action B, or barrels past an error. langchain-emilia instead wraps the tool itself: the action digest is computed from the actual arguments at execution time and the gate runs before the tool body, unconditionally. The model-facing schema is unchanged; only the executor gains the gate.

Zero-setup dry run (observe mode)

No account, no network, nothing blocked — see what enforcement would cover:

guard = EmiliaGuard(mode="observe")
tools = guard_tools(my_tools, guard)
# ... run your agent, then:
for r in guard.records:
    print(r["tool"], r["digest"][:16], r["note"])

Configuration

EmiliaGateClient(api_key, org_id, base_url, signoff_timeout_s=280, poll_interval_s=3) reads EP_API_KEY / EP_ORG_ID / EP_BASE_URL from the environment by default.

Fail-closed semantics

Verify the evidence

Every allowed action carries a receipt_id. Anyone can verify it with zero trust in us or in you:

• In a browser (nothing uploads): https://www.emiliaprotocol.ai/verify
• Offline CLI: npx @emilia-protocol/verify receipt.json
• Spec: draft-schrock-ep-authorization-receipts (IETF)

Try the human side yourself (no signup): https://www.emiliaprotocol.ai/try

Development

cd integrations/langchain-emilia
python3 -m venv .venv && .venv/bin/pip install -e '.[dev]'
.venv/bin/pytest -q

Apache-2.0. The digest layer is pinned byte-for-byte to the JS verifier by cross-language vectors in tests/test_digest.py.

Building with LangChain.js instead? The JS sibling is @emilia-protocol/langchain — a thin gate Proxy for .invoke()-style tools on npm.