# AIEF (AI Execution Integrity Framework)

URL: https://docs.nexart.io/docs/aief

AIEF v0.2.5 is a framework projection that verifies an AI Execution CER (V1 or V2) and reports a single PASS/FAIL result with a reason.

## Overview

AIEF (AI Execution Integrity Framework) is a projection over an AI Execution CER (either V1 or V2). Instead of exposing the full `VerificationResult` surface, AIEF re-derives and checks a fixed set of integrity properties and reports a single `PASS` or `FAIL` result, together with a machine-readable reason. The current version is AIEF v0.2.5.

## verifyAief

`verifyAief(bundle)` accepts either a V1 or a V2 CER bundle and returns:

verifyAief result shape

```
type AiefResult = {
  result: 'PASS' | 'FAIL';
  reason: string | null;
  checks: {
    schemaSupported: boolean;
    integrityValid: boolean;
    protectedSetValid: boolean;
    chainValid: boolean;
  };
  field?: string;
  expected?: unknown;
  observed?: unknown;
  notes?: string;
};
```

The four checks are:

- schemaSupported. The bundle's `bundleType` (`cer.ai.execution.v1` or `cer.ai.execution.v2`) is one AIEF v0.2.5 recognizes.
- integrityValid. The bundle's `certificateHash` is consistent with the canonical bundle contents.
- protectedSetValid. For V2 bundles, the re-derived `protectedSet` matches the one declared in the bundle.
- chainValid. Any declared step-chain linkage (for example, `prevStepHash`) is intact.

`mapToAiefReason(code)` maps a `CerVerifyCode` (see AI Execution CER) to the human-readable string surfaced as `reason`.

Verify a sealed bundle with AIEF

```
import { verifyAief } from "@nexart/ai-execution";

const aief = await verifyAief(bundle);

if (aief.result === "FAIL") {
  console.error(aief.reason, aief.checks);
} else {
  console.log("AIEF PASS", aief.checks);
}
```

## CLI --aief Projection (Section 9)

The CLI 1.3.0 exposes the same AIEF v0.2.5 Section 9 projection via a flag on the verify command:

Run the AIEF projection from the CLI

```
nexart ai verify --aief bundle.json
# exit code 0 = PASS
# exit code 1 = FAIL
```

`--aief` can be combined with `--json`, `--anchors`, and `--timestamps`. An unsupported `protocolVersion` still resolves to a `SCHEMA_ERROR` / `SCHEMA_VERSION_UNSUPPORTED` outcome with exit code 1, independent of the AIEF projection.

## AiefProfile Is a Different Concept

AiefProfile belongs to validateProfile, not verifyAief
`AiefProfile` is the union `'flexible' | 'AIEF_L2' | 'AIEF_L3' | 'AIEF_L4'`. It is consumed by `validateProfile(target, profile)`, a separate function. There is NO `{ profile: 'AIEF_L4' }` argument to `verifyAief`. Do not pass a profile to `verifyAief`; call `validateProfile` separately when a profile-level check is required.

validateProfile is a separate call from verifyAief

```
import { verifyAief, validateProfile } from "@nexart/ai-execution";

const aief = await verifyAief(bundle);
const profileCheck = validateProfile(bundle, "AIEF_L3");

// aief and profileCheck are independent results; neither call takes the other's input
```

## AIEF Version, Package Version, and Protocol Version Are Independent

AIEF version (currently v0.2.5), NexArt package versions (for example `@nexart/ai-execution` 1.4.0), and the canonicalisation `protocolVersion` (for example 1.3.1) are independent axes. A bump to any one of them does not imply a bump to the others. See Versions for the full breakdown of these axes and the current baseline.

## Next

- Policy SDK: how a sealed policyEvaluation participates in a CER that AIEF later verifies.
- Versions: the four independent version axes.
- Release Notes: what changed in the current baseline.