CLI Reference

parmana CLI — verify attestations, inspect policies, and manage governance workspaces

Installation

npm install -g @parmanasystems/verifier-cli

Or run without installing:

npx parmana <command>

Usage

parmana <domain> <command> [target] [extra] [--flags]

Global flags

Flag	Description
--json	Machine-readable JSON output. Suitable for CI/CD pipelines and automation.
--strict	Fail-closed mode. Exits with code 1 on any warning, incompatibility, or verification failure.

---

verify

parmana verify artifact <file>

Verify a governance verification artifact produced by npm run proof:verify.

parmana verify artifact ./artifacts/reproducibility/verification.json

Checks performed:

• signature_verified — Ed25519 signature is valid
• runtime_manifest_verified — Runtime manifest matches expected hash
• bundle_manifest_verified — Bundle manifest is intact
• bundle_signature_verified — Bundle signature is valid
• attestation_signature_verified — Attestation signature is valid
• invariants_verified — All invariant checks pass

Exit codes: 0 = pass, 1 = fail (with --strict), 3 = internal error

# JSON output for CI
parmana verify artifact ./verification.json --json

# Strict mode — non-zero exit on any failure
parmana verify artifact ./verification.json --strict

JSON output shape:

{
  "valid": true,
  "checks": {
    "signature_verified":             true,
    "runtime_manifest_verified":      true,
    "bundle_manifest_verified":       true,
    "bundle_signature_verified":      true,
    "attestation_signature_verified": true,
    "invariants_verified":            true
  },
  "artifact": {
    "artifact_hash":  "8f4a2e9c...",
    "runtimeVersion": "1.65.0",
    "runtimeHash":    "7c2d8f1a...",
    "schemaVersion":  "1"
  }
}

---

parmana verify bundle <manifest> <signature>

Verify a governance bundle manifest and its detached signature.

parmana verify bundle bundle.json bundle.sig

---

provenance

parmana provenance verify <manifest> <rebuilt>

Verify release provenance by comparing an original release manifest against a rebuilt manifest.

parmana provenance verify release-manifest.json release-manifest.rebuilt.json

Used in reproducible build verification to confirm that a published package can be independently rebuilt to produce the same manifest.

---

policy

parmana policy build <path>

Build a policy directory into a signed governance bundle.

parmana policy build ./policies/claims-approval/v1

Produces a bundle.manifest.json in the policy directory.

---

parmana policy inspect <path>

Inspect the structure and schema of a policy file.

parmana policy inspect ./policies/claims-approval/v1/policy.json

Outputs:

• Policy ID and version
• Schema version
• Signal declarations and types
• Number of rules
• Rule IDs and outcomes

---

parmana policy graph <path>

Visualize the rule evaluation graph of a policy.

parmana policy graph ./policies/claims-approval/v1/policy.json

Renders the decision tree showing which rules match which signal combinations and their outcomes.

---

parmana policy simulate <policy> <input>

Simulate a batch of decisions against a policy without signing or replay protection.

parmana policy simulate \
  ./policies/claims-approval/v1/policy.json \
  ./test-records.json

The input file must be a GovernedExecutionRequest with a records[] array:

{
  "records": [
    {
      "policyId":      "claims-approval",
      "policyVersion": "v1",
      "signals": {
        "insurance_active": true,
        "risk_score":       42,
        "vip_customer":     false,
        "claim_amount":     8500
      }
    }
  ]
}

Output per record:

• Matched rule ID
• Governance explanation (which signals triggered which conditions)
• Outcome: approved / rejected / escalation required
• Reason string

---

runtime

parmana runtime inspect

Inspect the current runtime version, hash, and supported schema versions.

parmana runtime inspect

Output includes:

• runtimeVersion — current runtime version
• runtimeHash — hash of runtime binary state
• supported_schemaVersions — schema versions this runtime can evaluate

Useful for confirming runtime state before running verification.

---

workspace

parmana workspace init <name>

Scaffold a new Parmana Systems governance workspace from the minimal template.

parmana workspace init my-governance-project
cd my-governance-project
parmana workspace check

Creates a new directory with:

• Example policy structure
• Trust root configuration
• Example signals input file

---

parmana workspace check

Validate the current workspace — checks policy files, trust root, and runtime compatibility.

parmana workspace check

---

parmana workspace explain

Print an explanation of the current workspace structure and governance configuration.

parmana workspace explain

---

Exit codes

Code	Meaning
0	Success
1	Verification failed (with --strict)
2	Usage error (invalid command or missing arguments)
3	Internal error