[Pavan Dev Singh Charak (pavancharak)]

Related Issue

None. The Problem & Solution section below stands in for a linked issue.

Problem & Solution

Problem: AgentMesh workflows have no offline check for Parmana execution trust records. A workflow that acts on a record cannot tell whether a pinned key signed it, unless it re-implements the verifier.
Solution: a community extension, agentmesh-parmana-trust-verify. verify_record(record, trust_document) uses the offline parmana-verifier package. It returns a verdict that denies on any failure: a malformed trust set, a non-object record, or an exception during verification.

Impact on Your Work

Lets an AgentMesh workflow gate its own actions on a signed Parmana record, with no network call and no trust in Parmana's servers.

Timeline

None.

Alternatives Considered

Re-implementing Ed25519 verification inside AgentMesh. Rejected: it would duplicate the verifier's canonicalization, which must match exactly.

Type of Change

• New feature (non-breaking change that adds functionality)

Package(s) Affected

• agentmesh-integrations (framework integrations)

Testing

Unit Testing

7 tests, all passing. They cover a valid record under a pinned key, a tampered transaction, a record signed by an unpinned key, a record without a signature, a malformed trust set, a non-object record, and that the input record is not mutated. The tests build real signed records with the verifier's own canonicalization.

Manual Testing

python examples/basic_usage.py prints allowed: True, then allowed: False after tampering. ruff check and ruff format pass with the pinned 0.12.4.

Checklist

• I have completed "Problem & Solution", "Impact on Your Work", and "Alternatives Considered" (no linked issue)
• My code follows the project style guidelines (ruff check)
• I have added tests that prove the feature works
• All new and existing tests pass
• I have updated documentation as needed (README)
• I have signed the Microsoft CLA (to be done by the PR author)

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Related project: Parmana, pavancharak/parmana-core. The verifier is parmana-verifier on PyPI (Ed25519).

AI Assistance

An AI coding assistant drafted the extension, tests, and README. The PR author reviewed every change and ran the tests and lint checks.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AGT Contributor Check.

[Pavan Dev Singh Charak (pavancharak)]

@microsoft-github-policy-service agree