Skip to main content
Per-package test counts below are from 2026-07-06 (commit 1f62e24) and not independently re-verified in this pass, the whole-repo total is current: npm test reports 327 passed, 1 skipped, across 82 test files, as of commit 651497a. Running vitest run once from the repo root instead of per-package will produce spurious failures in packages/runtime, several tests resolve fixture paths relative to process.cwd() assuming a per-package invocation, this is a pre-existing test fragility, not a functional bug (see Troubleshooting).
PackagePurposeStatusTestsEvidence
sharedDomain types, config, canonical JSON types[AVAILABLE]6packages/shared/src/domain/*.ts
cryptoSigning, hashing, key providers, canonical serialization[AVAILABLE]29AuthorizationSigner, Ed25519SignatureProvider, Dilithium3SignatureProvider
policyDeterministic, first-match-semantics rule evaluation[AVAILABLE]61PolicyRouter, PolicyValidator, CLAIMS.md 2.2/2.3
runtimeOrchestrates policy → decision → execution → trust record; the 3-check VerificationService[AVAILABLE]31packages/runtime/src/services/verification-service.ts
apiThe Express HTTP server, the only long-running process[AVAILABLE]30 + 1 skippedpackages/api/src/app.ts
receiptA real ExecutionReceipt/ExecutionPermit model. Disconnected: nothing in runtime or api imports it, the actual wired receipts come from crypto’s ReceiptCrypto directly[PARTIAL]not independently re-verified this pass@parmana/receipt
replayReplayEngine genuinely re-evaluates a recorded policy decision. Disconnected: nothing in runtime or api imports it[PARTIAL]9Semantic verification of every trust artifact remains an explicit Future Claim in CLAIMS.md, this package covers one execution’s decision outcome, verified live, see Replay
storageAppend-only ledger abstraction; memory and supabase providers are real, postgres/sqlite are declared but throw at construction[AVAILABLE] for memory/supabase8memory provider verified live this session; see @parmana/storage
envelope-verifierVerifies a SignedExecutionAuthorization: signature, expiry, TTL, nonce[AVAILABLE]15EnvelopeVerifier, CLAIMS.md 2.9/2.10
execution-gatewayRecomputes content hash, compares to businessTransactionHash, releases to a Connector, wired into the default server unconditionally as of commit 651497a[AVAILABLE]25ExecutionGateway.ts:150-165; see The gateway
execution-controlGateway-authenticated, session-scoped credential isolation for connectors, real and wired into the default server for the one connector it registers[PARTIAL] for arbitrary connectors11ExecutionControlService, InMemorySessionCredentialVault, not yet the finished “AI never holds credentials” claim for connectors you haven’t wired (see Roadmap)
connector-sdkConnector authoring contracts (capabilities, metadata, versioning, health), two generic reference implementations, and four enterprise-named reference mocks, extending execution-control’s registry/vault/policy seams, never modifying them[AVAILABLE] as a library45packages/connector-sdk/src; see Integrations
execution-systemExecutionSystem interface, plus DefaultExecutionSystem (a no-op placeholder used by many tutorials, not by the default server)[AVAILABLE]1See @parmana/execution-system, which explains the placeholder’s real scope

​
SDKs and app

PackagePurposeStatusEvidence
python/Python SDK[AVAILABLE]26 tests, structured HTTP exceptions, generated + drift-guarded models
typescript/TypeScript SDK[PARTIAL]Real client/model code, all 9 test files are empty (0 lines), confirmed this session; HttpTransport.ts returns any HTTP status as a “successful” response, 4xx/5xx are never raised

​
Not a package: python-old/

A prior Python SDK generation (v0.1.0) was being removed from the repository as of this session (uncommitted deletion in the working tree). Not part of the current architecture.