kiosk-all is the «I just want to start» entry point for the Kiosk framework. Installing it pulls in the production data-plane gems: kiosk-core (value types, abstract bases, configuration) and kiosk-server — the whole host-side surface: the wire controllers (one endpoint per verb — GET /kiosk/<query-name>, POST /kiosk/<action-name> — plus /kiosk/{schema,openapi.json,pay}), the register/login auth plane, JWKS, KYC attestation, discovery, the account-binding ceremony, the Executor, the PoW gate, the headers middleware and the `kiosk:install` generator. Deliberately out of scope: - kiosk-rls — opt-in DB-level RLS defense-in-depth; add it explicitly if you use enable_rls_on in migrations. - Test harnesses (kiosk-test-support, kiosk-rls-rspec, kiosk-rls-minitest) — host picks one per stack and adds it to the dev/test group of its Gemfile. - Adapter gems (kiosk-user-idp-*, kiosk-pay-*) — providers pick per market/stack. See https://kiosk.tech.

kiosk-kyc-prove implements Kiosk::KycProviders::Base against the Prove anonymizing KYC broker: it opens a verification at the broker's intake, and accepts only attestations the broker minted for this operator. Assign an instance to Kiosk.configuration.kyc_provider and kiosk-server serves request_kyc and the broker's callback.

kiosk-pay-stripe is the open-source Stripe payment adapter for Kiosk. It implements both halves of the provider-acquired, card-on-file model: - Card acquisition. `setup_url(user_id:, return_url:)` returns a hosted Stripe Checkout session in `mode: "setup"` that saves the buyer's card on the PROVIDER's own Stripe account (an existing open setup session is reused, so the url is stable across polls); `setup_required?` tells the wire whether a principal still has to complete it, backed by `saved_method?`, which asks Stripe whether the resolved Customer has a usable card. - Charging. This adapter's own `#capture` settles an AP2 cart mandate as an `off_session` (merchant-initiated) PaymentIntent against that saved card — the assistant authorizes the cart, it never presents a card. The gem stays app-agnostic: the principal-to-Stripe-Customer mapping is injected by the host through `customer_resolver:` / `customer_saver:` callables, and no application table is read inside the gem. Today only kiosk-pay-stripe ships; there is no default PSP (Configuration#payment_provider is nil). A host that needs another PSP subclasses Kiosk::PaymentProviders::Base and assigns the instance to Kiosk.configuration.payment_provider.

kiosk-rls provides the row-level-security DSL Kiosk providers use inside their ActiveRecord migrations: `enable_rls_on`, `policy`, plus the add/change/remove/rename migration verbs. The DSL compiles to standard PostgreSQL DDL (ALTER TABLE ENABLE ROW LEVEL SECURITY, ALTER TABLE FORCE ROW LEVEL SECURITY, GRANT, CREATE POLICY, COMMENT ON TABLE) and runs inside the migration's transaction via the host's `#execute` method. FORCE is not optional: without it Postgres exempts the table owner, and the typical Rails app connects as the owner, so RLS would be a no-op. No PostgreSQL runtime dependency — pure SQL generation. The host provides the connection.

kiosk-rls-minitest wires the framework-agnostic Kiosk journey-test DSL (kiosk-test-support) into Minitest. `include Kiosk::TestHelpers` inside any `Minitest::Test` subclass mixes in the journey helpers (`as_agent_of`, `as_user`, `as_agent`, `as_anonymous`, `query`, `run_query`, `run_action`, `pay_action`, `kiosk_seed`). Ships the assertions `assert_rls_denied` and `assert_quota_exceeded` for asserting the structured error classes — both also exposed as the Minitest `must_raise_*` / `wont_raise_*` spec-DSL forms.

kiosk-rls-rspec wires the framework-agnostic Kiosk journey-test DSL (kiosk-test-support) into RSpec. Automatically mixes the journey helpers (`as_agent_of`, `as_user`, `as_agent`, `as_anonymous`, `query`, `run_query`, `run_action`, `pay_action`, `kiosk_seed`) into any example group tagged `type: :kiosk_journey` (or `type: :kiosk_agent`, the same DSL under a second tag). Ships the matchers `be_rls_denied` and `be_quota_exceeded` for asserting the structured error classes.

kiosk-server is the host-side surface for Kiosk. The full surface ships: - The controllers — the per-verb wire (GET <endpoint>/<query-name>, POST <endpoint>/<action-name>) and the reserved endpoints (/kiosk/schema, /kiosk/pay), a derived OpenAPI description of both, the register/login proof-of-possession auth plane, JWKS, the KYC attestation endpoint, agents.txt / agents.json / kiosk.json discovery, and the account-binding ceremony (RFC 8628-shaped device authorization, the possession-proof-gated token poll, the verify and «Link an assistant» pages). - Kiosk::Server::Executor — dispatches a resolved command to the queries and actions the host registered. - Agent registration and login, with a pluggable agent-IdP. - The PoW gate that enforces a kiosk-reputation policy's challenge (soft dependency; zero overhead when no policy is set). - A Rack middleware injecting the Kiosk-Server-Version / Kiosk-API-Version / Kiosk-Min-Client response headers, a pure-Ruby builder for the discovery documents, SQL generators for the canonical schema migrations, and a `kiosk:install` generator that lays down the initializer and the migrations. The Rails engine serves that whole surface from one `kiosk` block in config/routes.rb, which mounts it at Kiosk.configuration.mount_path — drawing the wire/auth/JWKS/KYC/binding routes under the mount and installing the root-relative discovery routes (agents.txt, .well-known) into the host — then one route per query and action the block names. It also auto-injects the headers middleware.

kiosk-test-support is the framework-agnostic test surface a Kiosk provider uses on their OWN application. It carries two things. The CONFORMANCE CHECKS assert the four properties the protocol makes normative of an origin: that its routes resolve, that a verb executes, that a query answers the shape it declared, and that data access is scoped to the authenticated principal. They ship with a Minitest adapter and an RSpec adapter, both loaded by explicit require, so the same fault reads identically in either framework. The JOURNEY DSL carries the identity-scoped call helpers (`as_agent_of`, `as_user`, `as_agent`, `as_anonymous`, `query`, `run_query`, `run_action`, `pay_action`, `kiosk_seed`), the pluggable executor contract, a NullExecutor for self-tests, and the structured error classes (`RLSDenied`, `QuotaExceeded`, `ExecutorNotConfigured`). It is wired into RSpec by `kiosk-rls-rspec` and into Minitest by `kiosk-rls-minitest`. The ASSISTANT drives an origin over HTTP as an assistant does: it registers, pays proof-of-work tolls, queries, runs, pays with signed mandates and listens on the event stream. `Kyc` stands in for the operator's KYC provider, and `StripeMock` fronts a local stripe-mock. No Postgres, no Rails, no test-framework dependency. `InProcessExecutor` and `Conformance::InProcessOrigin` run against the host's kiosk-server and are required explicitly; this gem does not depend on kiosk-server.

kiosk-user-idp-devise is the opt-in user-IdP adapter for Rails providers that authenticate principals through Devise. Add it to your Gemfile explicitly — the kiosk-all meta-gem pulls in only kiosk-core and kiosk-server, so IdP adapters are chosen per provider. It reads the signed-in user from the request's Warden proxy (`request.env["warden"].user`) passed by kiosk-server and returns a {Kiosk::Identity} value object. Covers both Devise paths — `database_authenticatable` and `omniauthable` — since both populate the Warden user, so the adapter is agnostic to how the user logged in. Lockable / confirmable handling comes for free: Devise's `active_for_authentication?` already gates the Warden user, so a locked or unconfirmed user yields no signed-in user and the request fails as unauthenticated with no extra code. No hard runtime dependency on Devise itself — the adapter only reads the request's Warden user, so the provider's already-installed Devise satisfies the requirement.