Parmana Systems: Deterministic Governance Infrastructure for AI Agents

"The AI followed our credit policy"             ← claimed, not proved
"The same inputs give the same decision"        ← claimed, not proved
"The decision cannot be altered retroactively"  ← claimed, not proved
"An auditor can verify the decision"            ← claimed, not proved

Evaluate → Simulate → Execute → ConfirmExecution

1. loadPolicy       — load versioned policy from content-addressed bundle
2. validateSignals  — validate every signal against declared schema
3. evaluatePolicy   — evaluate rules → decision
4. fingerprint      — sha256(canonicalize({ policyId, policyVersion, signals }))
5. reserve          — replay protection phase 1
6. issueToken       — build execution token
7. sign             — Ed25519 signature over canonical attestation
8. confirm          — replay protection phase 2
9. return           — ExecutionAttestation

{
  executionId,           // unique per event — random UUID
  execution_fingerprint, // sha256({ policyId, policyVersion, signals })
  policyId,              // which policy governed this
  policyVersion,         // which version of the policy
  schemaVersion,         // schema used for evaluation
  runtimeVersion,        // runtime that produced this decision
  signalsHash,           // same as execution_fingerprint
  decision,              // { action, requires_override, reason? }
  execution_state,       // pipeline state at signing
  runtimeHash,           // hash of runtime code
  bundleHash,            // hash of policy bundle files
  manifestHash,          // hash of bundle manifest
  manifestSignature,     // bundle's own Ed25519 signature
  trustRootVersion,      // which trust root was used
  signerKeyId,           // which key signed this
  evaluatorHash,         // hash of the evaluation engine
  releaseManifestHash,   // hash of release manifest
}

// FORBIDDEN inside the evaluation scope:
Date.now()     // wall clock — different on every call
Math.random()  // non-deterministic by definition
new Date()     // wall clock contamination

1. Obtain the attestation
2. Obtain the public key
3. Verify the signature
4. Obtain the policy version referenced in the attestation
5. Re-evaluate the policy with the same signals
6. Confirm the decision matches

Phase 1 RESERVE  — before evaluation begins
  executionId reserved in replay store
  If already reserved → InvariantViolation thrown immediately
  Nothing has happened yet — safe to fail

Phase 2 CONFIRM  — after signing completes
  executionId confirmed as executed
  Reservation consumed permanently
  Cannot be replayed by any caller

// Development — in-memory, not persistent
new MemoryReplayStore()

// Production — persistent, atomic, configurable TTL
new RedisReplayStore(process.env.REDIS_URL)

// Custom — implement ReplayStore interface
// must provide: hasExecuted(), markExecuted()

Before provenance:
  unverified signals → governed decision → signed attestation

The decision is proved. The signals are not.

const signals = {
  monthly_income: withProvenance(82000, {
    source: "AccountAggregator",
    sourceType: "financial_api",
    sourceVerified: true,
    verificationMethod: "signature",
    trustLevel: "verified",
    adapterIdentity: "aa-income-adapter@1.2.0",
    evidenceHash: "sha256:abc123...",
    transformationLineage: [
      "rbi-aa-schema-normalization",
      "monthly-average-v2",
    ],
  }),
};

// extractSignalValues() strips provenance
// Policy evaluation sees only values — never metadata
const policySignals = extractSignalValues(governedSignals);
// { monthly_income: 82000, employed: true }

const attestation = await executeFromSignals({
  signals: policySignals,
  ...
});

// RBI Account Aggregator
accountAggregatorProvenance({
  consentId, fiuId, fetchedAt, rawDataHash
})
// → sourceVerified: true, trustLevel: "verified"

// AI document extraction
documentProvenance({
  modelName, modelVersion, extractedAt, rawDocument
})
// → sourceVerified: false, trustLevel: "claimed"

// Voice call transcript
voiceTranscriptProvenance({
  callId, sttModel, language, transcript
})
// → sourceVerified: false, trustLevel: "claimed"

Before provenance:
  anonymous signals → governed decision → signed attestation

After provenance:
  AA consent → evidenceHash → income signal
                                   ↓
                         governed decision
                                   ↓
                         signed attestation
                                   ↓
                         execution integrity proof

Full trace: evidence → signal → decision → execution

Attestation says: approve ₹5 lakh loan to CUST-9823741
System does:      ??? ← unobserved

1. Verify original attestation signature
2. Check not already confirmed
   (replay key: "confirm:" + attestation.executionId)
3. Compute integrityHash:
   sha256(canonicalizeForSigning({
     authorizationId: attestation.executionId,
     execution_fingerprint,
     executedAction,
   }))
4. Check actionTypeMatch
5. Check payloadConsistent
6. Check withinTimeWindow (default 300 seconds)
7. Sign the ExecutionIntegrityProof

✅ Decision followed exactly this policy version
✅ Signals used are exactly what was fingerprinted
✅ Decision cannot be altered without detection
✅ Same policy + signals → same decision always
✅ Execution was not replayed
✅ Runtime that produced this decision is identified
✅ Signal provenance is recorded and hashable
✅ Reported execution is linked to authorization

❌ Signals accurately reflect reality
❌ Reported execution actually occurred
❌ No other execution occurred outside the system
❌ Signing key is controlled by the right party

Phase 1 (shipped)  Signal provenance — trace where signals came from
Phase 2 (next)     Source attestation — verify signals signed by source
Phase 3 (future)   TEE integration — hardware-proved execution
Phase 4 (future)   Governed execution gateway — authorization-bound actions

import {
  executeFromSignals,
  LocalSigner,
  LocalVerifier,
  MemoryReplayStore,
} from "@parmanasystems/core";

const attestation = await executeFromSignals(
  {
    policyId: "personal-loan",
    policyVersion: "1.0.0",
    signals: {
      monthly_income:   82000,
      loan_amount:      500000,
      employed:         true,
      emi_obligations:  12000,
      blacklisted:      false,
    },
  },
  new LocalSigner(privateKey),
  new LocalVerifier(publicKey),
  new MemoryReplayStore()
);

// attestation.decision.action === "approve"
// attestation.signature — Ed25519, independently verifiable
// attestation.execution_fingerprint — SHA-256 binding