Module verify 

The one verification decision, and its resolver seam. One verifier. Every surface calls it.

verify_unit is the only place in this line where the question “is this unit what it says it is?” is decided. The harness calls it. newt frame verify calls it. A second implementation of a verification decision is two answers waiting to disagree, and the one that disagrees quietly is the one that ships.

What re-derivation actually means

checkOf .elide = .rederive is a claim with content only if something can be recomputed and compared. Here it is three comparisons, in the order a sceptic would make them:

1. Is this the source it names? Hash the supplied bytes; compare to Derivation::source. A verifier that trusts the caller’s word about which bytes are the source has verified nothing.
2. Does the address resolve? The span must lie within those bytes.
3. Is the elided material what it claims? Hash the addressed range; compare to Derivation::elided. This is the re-derivation — the step the previous revision had no recorded claim to perform.

All three must hold. Any failure names both sides, because “verification failed” that does not say what did not match sends the reader back to a debugger.

One link is the whole obligation

verify_unit checks one derivation and stops. It does not resolve the source’s own provenance, and it does not fail because the source is itself a derived thing — that is the source’s business, not this unit’s.

That is complete verification, not a pragmatic cut, and the reason is Unit.wf. depth <= 1 says nothing is more than one derivation away from source material; a frame with no parents is genesis, the defined bottom. So there is no deeper chain to regress into by construction. The forensic obligation and the depth bound are the same constraint seen from two directions — which is also why refusing concise and generate in v0 is not merely caution: it is what keeps regress impossible.

And it does not resolve the root. verify_unit recomputes the three claims that the source bytes can settle — source, span, elided — and no others. A unit naming a root id nothing ever minted verifies exactly like one naming a real event, because the bytes in hand cannot tell them apart. Verified therefore carries no root field: reporting one would imply this function had established something about it. Root resolution belongs to whoever holds the store, and newt frame reports it as a separate, separately-failable fact.

There is deliberately no walker here. Verified reports the source id that was checked, so a caller who wants the next link calls again with it. The recursion lives in the caller; nothing in this design forbids depth, it simply does not implement an unbounded walk over data we do not control on anybody’s behalf.

Why not NodeStore

content-addressable’s NodeStore is the right seam for units and packets, and its get / get_unverified split is the distinction this module honours. It cannot serve source bytes: it is keyed by [ContentId] (the dag-cbor profile) and a source is an opaque byte string keyed by RawContentId (the raw profile). The two are deliberately different types with no conversion between them. SourceResolver is that second profile’s lookup, not a second copy of the first.

Structs

Mismatch

Both sides of a hash comparison.

Verified

What a successful verification establishes — the facts a report renders.

Enums

VerifyError

Why a unit did not verify.

Traits

SourceResolver

Where source bytes come from.

Functions

verify_unit

The verification decision. Recompute the unit’s claims from the source bytes and compare.

verify_unit_with

verify_unit, fetching the source through a resolver.