Execution Integrity

1. executeFromSignals()          → ExecutionAttestation  (governance authorization)
2. Your system performs action   → ExecutedAction         (what actually happened)
3. confirmExecution()            → ExecutionIntegrityProof (proof they match)

import {
  executeFromSignals,
  confirmExecution,
  LocalSigner,
  LocalVerifier,
  MemoryReplayStore,
} from "@parmanasystems/core";

const signer   = new LocalSigner(privateKey);
const verifier = new LocalVerifier(publicKey);
const store    = new MemoryReplayStore();

// Step 1: Get governance authorization
const attestation = await executeFromSignals(
  {
    policyId:      "loan-approval",
    policyVersion: "1.0.0",
    signals:       { credit_score: 720, loan_amount: 15000 },
  },
  signer, verifier, store
);

// Step 2: Perform the real-world action
// ... disburse the loan ...

// Step 3: Confirm the action matches the authorization
const proof = await confirmExecution(
  {
    attestation,
    executedAction: {
      type:       "LOAN_DISBURSED",
      payload:    { amount: 15000, policyId: "loan-approval" },
      executedAt: new Date().toISOString(),
      executedBy: "disbursement-service",
    },
    timeWindowSeconds: 300, // default: 300
  },
  signer,
  verifier,
  store
);

console.log(proof.match);        // true — action matches authorization
console.log(proof.integrityHash); // sha256 linking authorization to action
console.log(proof.verified);      // true — always true when returned without error

interface ExecutedAction {
  type:        string;            // e.g. "LOAN_DISBURSED"
  payload:     Record<string, unknown>;
  executedAt:  string;            // ISO 8601
  executedBy?: string;
}

interface ExecutionIntegrityProof {
  executionId:     string;   // UUID for this proof event
  authorizationId: string;   // executionId from the original attestation
  integrityHash:   string;   // sha256 linking authorization + executedAction
  authorized: {
    action:        string;
    reason:        string;
    policyId:      string;
    policyVersion: string;
  };
  executed:     ExecutedAction;
  match:        boolean;       // true when all three match checks pass
  matchDetails: MatchDetails;
  signature:    string;        // Ed25519 over canonicalized proof payload
  confirmedAt:  string;        // ISO 8601
  verified:     true;          // always true when returned without error
}

interface MatchDetails {
  actionTypeMatch:   boolean; // executedAction.type contains or matches decision.action
  payloadConsistent: boolean; // payload fields don't contradict the authorization
  withinTimeWindow:  boolean; // abs(executedAt - confirmedAt) <= timeWindowSeconds
  timeWindowSeconds: number;  // the configured window
}