Packages

Every package in packages/*, its real purpose, and its evidence-backed status.

Per-package test counts below were independently re-verified this pass (vitest run packages/<name>, one package at a time — see the warning below for why not from the repo root), 2026-07-29, against commit 0e69ed4. The whole-repo total: npm test reports 558 passed, 35 skipped (597 total), across 131 test files (117 passed, 14 skipped). Running vitest run once from the repo root instead of per-package will produce spurious failures in packages/runtime, several tests resolve fixture paths relative to process.cwd() assuming a per-package invocation, this is a pre-existing test fragility, not a functional bug (see Troubleshooting).

Package	Purpose	Status	Tests	Evidence
shared	Domain types, config, canonical JSON types	[AVAILABLE]	22	packages/shared/src/domain/*.ts
crypto	Signing, hashing, key providers, canonical serialization	[AVAILABLE]	34	AuthorizationSigner, Ed25519SignatureProvider, Dilithium3SignatureProvider
policy	Deterministic, first-match-semantics rule evaluation, plus SignalIntentBinder (see Policies and the decision)	[AVAILABLE]	72	PolicyRouter, PolicyValidator, SignalIntentBinder, CLAIMS.md 2.2/2.3
runtime	Orchestrates policy → decision → execution → trust record; the 3-check VerificationService	[AVAILABLE]	35	packages/runtime/src/services/verification-service.ts
api	The Express HTTP server, the only long-running process	[AVAILABLE]	179 + 29 skipped	packages/api/src/app.ts
receipt	A real ExecutionReceipt/ExecutionPermit model. Disconnected: nothing in runtime or api imports it, the actual wired receipts come from crypto’s ReceiptCrypto directly	[PARTIAL]	0 (no test files exist for this package, confirmed this pass)	@parmana/receipt
replay	ReplayEngine genuinely re-evaluates a recorded policy decision. Disconnected: nothing in runtime or api imports it	[PARTIAL]	9	Semantic verification of every trust artifact remains an explicit Future Claim in CLAIMS.md, this package covers one execution’s decision outcome, verified live, see Replay
storage	Append-only ledger abstraction; memory and supabase providers are real, postgres/sqlite are declared but throw at construction	[AVAILABLE] for memory/supabase	35 + 6 skipped	memory provider verified live this session; skipped tests are Supabase-gated, see @parmana/storage
envelope-verifier	Verifies a SignedExecutionAuthorization: signature, expiry, TTL, nonce	[AVAILABLE]	17	EnvelopeVerifier, CLAIMS.md 2.9/2.10
execution-gateway	Recomputes content hash, compares to businessTransactionHash, releases to a Connector, wired into the default server unconditionally as of commit 651497a	[AVAILABLE]	25	ExecutionGateway.ts:150-165; see The gateway
execution-control	Gateway-authenticated, session-scoped credential isolation for connectors, real and wired into the default server for the one connector it registers	[PARTIAL] for arbitrary connectors	43	ExecutionControlService, InMemorySessionCredentialVault, not yet the finished “AI never holds credentials” claim for connectors you haven’t wired (see Roadmap)
connector-sdk	Connector authoring contracts (capabilities, metadata, versioning, health), reference implementations, and enterprise-named reference mocks, extending execution-control’s registry/vault/policy seams, never modifying them	[AVAILABLE] as a library	86	packages/connector-sdk/src; see Integrations
execution-system	ExecutionSystem interface, plus DefaultExecutionSystem (a no-op placeholder used by many tutorials, not by the default server)	[AVAILABLE]	1	See @parmana/execution-system, which explains the placeholder’s real scope

SDKs and app

Package	Purpose	Status	Evidence
python/	Python SDK	[AVAILABLE]	26 tests, structured HTTP exceptions, generated + drift-guarded models
typescript/	TypeScript SDK	[PARTIAL]	Real client/model code, all 9 test files are empty (0 lines), confirmed this session; HttpTransport.ts returns any HTTP status as a “successful” response, 4xx/5xx are never raised

Not a package: python-old/

A prior Python SDK generation (v0.1.0) was being removed from the repository as of this session (uncommitted deletion in the working tree). Not part of the current architecture.