Skip to content

docs(parmana-server): fix Parmana link and correct RFC 8785 wording #415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pavancharak wants to merge 3 commits into
base: main
Choose a base branch
from
Open

docs(parmana-server): fix Parmana link and correct RFC 8785 wording #415

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
18225bc
Update README.md
pavancharak Nov 4, 2026
7b6a966
Update README.md
pavancharak Nov 4, 2026
c7626d6
Update README.md
pavancharak Nov 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions integrations/parmana-server/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# Parmana

[Parmana](https://github.com/pavancharak/parmana) decides whether an agent's action may run under a versioned policy,
[Parmana](https://github.com/pavancharak/parmana-core) decides whether an agent's action may run under a versioned policy,
requires a signed human approval where the policy says so, and signs a record of every decision, refusals included.

This integration treats those records as TRACE external evidence. Parmana issues no TRACE Trust Record. An agent
runtime that does points at the Parmana record for its step through `references` (trace-spec §3.1.2):
runtime that points at the Parmana record for its step through `references` (trace-spec §3.1.2):

| Parmana decision | Parmana record | `references` entries |
| ---------------- | -------------------------- | ---------------------------------------------------------------------- |
Expand All @@ -15,8 +15,7 @@ One Parmana record per decision. Each entry's `digest` is `sha256:` over the RFC
object as the resolver retains it. The `approval-outcome` entry points at the signed approval inside the Trust Record
(`#/transaction/signals/approvalArtifact`), because Parmana retains it there, under the Trust Record's own signature.

Parmana signs in its own canonical form, not RFC 8785, and TRACE does not re-sign its records: `parmana_evidence.py`
checks those signatures offline, with Parmana's public key and nothing else.
Parmana's canonical form is JSON with recursively sorted keys. For plain JSON values it matches RFC 8785, and `parmana-core` pins this with conformance tests. Two non-JSON inputs differ: `undefined` values are dropped and `Date` values become ISO strings. TRACE does not re-sign its records: `parmana_evidence.py` checks those signatures offline, with Parmana's public key and nothing else.

## Fixtures

Expand Down
Loading