@parmanasystems/verifier

Independent attestation verification for the parmanasystems governance runtime.

Overview

@parmanasystems/verifier performs portable, independent verification of governance attestations. It has no trust dependency on the runtime that produced the attestation — any party with the signer's public key can verify.

Verification is a four-check process:

1. Signature — the attestation was signed by the trusted governance key
2. Runtime hash — the attestation was produced by the expected runtime version
3. Schema compatibility — the schema version is supported by the runtime
4. Governed — the governed: true field was in the signature scope (INV-008)

Installation

npm install @parmanasystems/verifier

Quick start

import { verifyAttestation } from "@parmanasystems/verifier";
import { getRuntimeManifest, LocalVerifier } from "@parmanasystems/execution";

const verifier = new LocalVerifier(publicKeyPem);
const manifest = getRuntimeManifest();

const result = verifyAttestation(attestation, verifier, manifest);

console.log(result.valid);
// true

console.log(result.checks);
// {
//   signature_verified: true,
//   runtime_verified:   true,
//   schema_compatible:  true,
//   governed:           true,
// }

API

verifyAttestation(attestation, verifier, manifest): VerificationResult

Runs all four checks and returns a structured result. valid is true only when all checks pass.

import { verifyAttestation } from "@parmanasystems/verifier";

const { valid, checks } = verifyAttestation(attestation, verifier, manifest);

verifyBundle(manifestPath, signaturePath): Promise<boolean>

Verifies a signed governance policy bundle — hash integrity and Ed25519 signature.

import { verifyBundle } from "@parmanasystems/verifier";

const ok = await verifyBundle(
  "./policies/claims-approval/v1/bundle.manifest.json",
  "./policies/claims-approval/v1/bundle.sig"
);

verifyRuntime(manifest1, manifest2): boolean

Compares two runtime manifests for equality.

verifyRuntimeCompatibility(manifest, requirements): boolean

Checks whether a runtime manifest satisfies a set of RuntimeRequirements (version + capabilities).

verifyExecutionRequirements(manifest, requirements): boolean

Checks whether a runtime manifest satisfies a set of execution-level requirements.

Types

VerificationResult

interface VerificationResult {
  valid: boolean;
  checks: {
    signature_verified: boolean;
    runtime_verified:   boolean;
    schema_compatible:  boolean;
    governed:           boolean;
  };
}

Independent verification

Verification is designed to run outside the production runtime with no network calls or service dependencies:

// In a separate process, auditor's environment, or third-party system:
import { verifyAttestation } from "@parmanasystems/verifier";

// All you need: the attestation, the public key, and the expected runtime manifest.
const result = verifyAttestation(attestation, verifier, manifest);

The Verifier interface accepts any implementation — LocalVerifier (Ed25519), custom AWS KMS verifiers, or any compatible implementation:

interface Verifier {
  verify(payload: string, signature: string): boolean;
}

License

Apache-2.0