@parmanasystems/execution

Deterministic runtime execution, governance tokens, and attestation infrastructure

@parmanasystems/execution is the core runtime package. It implements the deterministic execution pipeline: token issuance, cryptographic signing, policy evaluation, and attestation production.

Most users interact with this package indirectly via @parmanasystems/core. Use it directly only if you need fine-grained control over individual pipeline stages.

Install

npm install @parmanasystems/execution

Key exports

executeDecision(context: ExecutionContext): ExecutionAttestation

The core execution function. Runs the three-stage pipeline: verify → execute → sign.

import { executeDecision } from "@parmanasystems/execution";

const attestation = executeDecision({
  token,
  token_signature,
  execution_fingerprint,
  signer,
  verifier,
  runtime_manifest,
  runtime_requirements,
});

issueToken(input): ExecutionToken

Creates an unsigned governance token binding the decision payload to its execution identity.

getRuntimeManifest(): RuntimeManifest

Returns the current runtime’s version, hash, and supported schema versions. This value is embedded in every attestation.

LocalSigner / LocalVerifier

Ed25519 signer and verifier backed by Node.js crypto. Suitable for development and testing. Use AwsKmsSigner in production.

import { LocalSigner, LocalVerifier } from "@parmanasystems/execution";
import crypto from "crypto";

const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519", {
  privateKeyEncoding: { type: "pkcs8", format: "pem" },
  publicKeyEncoding:  { type: "spki",  format: "pem" },
});

const signer   = new LocalSigner(privateKey);
const verifier = new LocalVerifier(publicKey);

evaluatePolicy(policy, signals): DecisionResult

Evaluates policy rules against signals and returns the matched decision. Does not sign or produce an attestation — used internally by the pipeline.

verifyExecutionToken(token, signature, verifier)

Verifies the Ed25519 signature on a governance token.

Types

type ExecutionAttestation  // final signed record
type ExecutionToken        // intermediate signed token
type ExecutionContext       // full pipeline input
type RuntimeManifest       // runtime version + hash
type Signer                // signing interface
type Verifier              // verification interface
type ReplayStore           // replay protection interface

Invariants

This package enforces invariants through InvariantViolation errors. Any violation throws immediately — there is no partial or silent failure.

See How It Works for the full pipeline documentation.